{"record":{"id":"26bbe82e249c349b","repo":"hashicorp/vault","slug":"password-reset-is-not-available-for-the-current-us","errorCode":null,"errorMessage":"Password reset is not available for the current user.","messagePattern":"Password reset is not available for the current user\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ui/app/routes/vault/cluster/access/reset-password.ts","lineNumber":24,"sourceCode":"import Route from '@ember/routing/route';\nimport { service } from '@ember/service';\n\nimport type AuthService from 'vault/vault/services/auth';\nimport type CapabilitiesService from 'vault/services/capabilities';\n\nconst ERROR_UNAVAILABLE = 'Password reset is not available for the current user.';\nconst ERROR_NO_ACCESS =\n  'You do not have permissions to update your password. If you think this is a mistake ask your administrator to update your policy.';\n\nexport default class VaultClusterAccessResetPasswordRoute extends Route {\n  @service declare readonly auth: AuthService;\n  @service declare readonly capabilities: CapabilitiesService;\n\n  async model() {\n    const { authMethodType, authMountPath, displayName } = this.auth.authData;\n    // Password reset is only available on userpass type auth mounts\n    if (authMethodType !== 'userpass') {\n      throw new Error(ERROR_UNAVAILABLE);\n    }\n\n    // Both of these are necessary to build the reset password URL\n    if (!authMountPath || !displayName) {\n      throw new Error(ERROR_UNAVAILABLE);\n    }\n\n    const capabilities = await this.capabilities.fetchPathCapabilities(\n      `auth/${authMountPath}/users/${displayName}/password`\n    );\n\n    // Throw an error if we know for certain the user doesn't have permission\n    if (!capabilities.canUpdate) {\n      throw new Error(ERROR_NO_ACCESS);\n    }\n    return {\n      backend: authMountPath,\n      username: displayName,","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/hashicorp/vault/blob/744b611b5700b3b7f82d76b4d6938a91b9989367/ui/app/routes/vault/cluster/access/reset-password.ts#L6-L42","documentation":"Thrown by the reset-password route model (ui/app/routes/vault/cluster/access/reset-password.ts:24). Self-service password reset only exists for userpass auth mounts; the model reads authData from the auth service and immediately throws ERROR_UNAVAILABLE when the current auth method type is anything other than userpass.","triggerScenarios":"Navigating to /ui/vault/access/reset-password while authenticated via a non-userpass method: ldap, okta, oidc, radius, token, github, etc.","commonSituations":"A bookmarked or deep-linked reset-password URL hit while logged in through SSO/OIDC or LDAP; a session restored after the mount configuration changed.","solutions":["Change your password in the system that actually manages it (LDAP directory, identity provider)","Log in with your userpass credentials if you have them — then this page becomes available","Administrators can reset a userpass password via CLI: vault write auth/userpass/users/<name>/password password=<new>"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before linking/transitioning to the reset-password route\nif (this.auth.authData?.authMethodType !== 'userpass') {\n  hideResetPasswordLink(); // or: this.router.transitionTo('vault.cluster.access');\n}","typeGuard":"const PASSWORD_RESET_METHOD = 'userpass' as const;\nfunction supportsSelfPasswordReset(methodType: string | undefined): methodType is 'userpass' {\n  return methodType === PASSWORD_RESET_METHOD;\n}","tryCatchPattern":"try {\n  await this.router.transitionTo('vault.cluster.access.reset-password');\n} catch (e) {\n  if (e.message === 'Password reset is not available for the current user.') {\n    notifyUser('Self-service password reset requires a userpass login');\n    this.router.transitionTo('vault.cluster.access');\n  } else {\n    throw e;\n  }\n}","preventionTips":["Only surface the reset-password link when the auth method is userpass","For LDAP/OIDC/Okta users, direct password changes to the upstream identity system"],"tags":["auth","userpass","password","routing"],"backgroundTag":null,"analyzedSha":"744b611b5700b3b7f82d76b4d6938a91b9989367","analyzedAt":"2026-08-15T14:40:29.333Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}