{"record":{"id":"f17e954924c9cafa","repo":"n8n-io/n8n","slug":"login-is-handled-by-currentauthenticationmethod","errorCode":null,"errorMessage":"Login is handled by ${currentAuthenticationMethod}. Please contact your Identity Provider to reset your password.","messagePattern":"Login is handled by (.+?)\\. Please contact your Identity Provider to reset your password\\.","errorType":"exception","errorClass":"ForbiddenError","httpStatus":403,"severity":"error","filePath":"packages/cli/src/controllers/password-reset.controller.ts","lineNumber":109,"sourceCode":"\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (user.role.slug !== GLOBAL_OWNER_ROLE.slug && !this.license.isWithinUsersLimit()) {\n\t\t\t\tthis.logger.debug(\n\t\t\t\t\t'Request to send password reset email failed because the user limit was reached',\n\t\t\t\t);\n\t\t\t\tthrow new ForbiddenError(RESPONSE_ERROR_MESSAGES.USERS_QUOTA_REACHED);\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\t(isSamlCurrentAuthenticationMethod() || isOidcCurrentAuthenticationMethod()) &&\n\t\t\t\t!(hasGlobalScope(user, 'user:resetPassword') || user.settings?.allowSSOManualLogin === true)\n\t\t\t) {\n\t\t\t\tconst currentAuthenticationMethod = isSamlCurrentAuthenticationMethod() ? 'SAML' : 'OIDC';\n\t\t\t\tthis.logger.debug(\n\t\t\t\t\t`Request to send password reset email failed because login is handled by ${currentAuthenticationMethod}`,\n\t\t\t\t);\n\t\t\t\tthrow new ForbiddenError(\n\t\t\t\t\t`Login is handled by ${currentAuthenticationMethod}. Please contact your Identity Provider to reset your password.`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst ldapIdentity = user.authIdentities?.find((i) => i.providerType === 'ldap');\n\t\t\tif (!user.password || (ldapIdentity && user.disabled)) {\n\t\t\t\tthis.logger.debug(\n\t\t\t\t\t'Request to send password reset email failed because no user was found for the provided email',\n\t\t\t\t\t{ invalidEmail: email },\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (this.license.isLdapEnabled() && ldapIdentity) {\n\t\t\t\tthrow new UnprocessableRequestError('forgotPassword.ldapUserPasswordResetUnavailable');\n\t\t\t}\n\n\t\t\tconst url = this.authService.generatePasswordResetUrl(user);","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/password-reset.controller.ts#L91-L127","documentation":"POST /rest/forgot-password is refused when SAML or OIDC is the current authentication method AND the user lacks the `user:resetPassword` global scope AND has not opted into `settings.allowSSOManualLogin`. Password resets are delegated to the identity provider in SSO mode; n8n will not issue a local reset token.","triggerScenarios":"forgotPassword when `isSamlCurrentAuthenticationMethod()` or `isOidcCurrentAuthenticationMethod()` is true, the user has no `user:resetPassword` scope, and `user.settings.allowSSOManualLogin !== true`.","commonSituations":"SSO migration where users still try the local forgot-password link; an SSO-only user without manual-login allowance; admin hasn't granted the reset scope.","solutions":["Direct the user to the identity provider's self-service password reset.","If local reset must stay available, grant the user the `user:resetPassword` global scope or set `allowSSOManualLogin: true` in their settings.","Confirm the intended auth method — if SSO was enabled by mistake, switch back via config."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// If SSO is the auth method, route to the IdP unless the user has reset scope or manual login.\nconst ssoActive = settings.authMethod === 'saml' || settings.authMethod === 'oidc';\nif (ssoActive && !me.canResetPassword && !me.allowSSOManualLogin) {\n  redirectToIdpReset();\n  return;\n}\nawait restApi.post('/forgot-password', { email });","typeGuard":null,"tryCatchPattern":"try {\n  await restApi.post('/forgot-password', { email });\n} catch (e) {\n  if (e.response?.status === 403 && /login is handled by/i.test(e.response.data.message)) {\n    showIdpRedirectNotice(e.response.data.message);\n  } else throw e;\n}","preventionTips":["Detect SSO mode from settings and hide the local forgot-password link for SSO-only users.","Grant `user:resetPassword` scope (or set allowSSOManualLogin) for users who need a local reset fallback.","Document the IdP self-service reset URL for SSO users."],"tags":["sso","saml","oidc","auth","password-reset"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}