hashicorp/vault · error · Error

Password reset is not available for the current user.

Error message

Password reset is not available for the current user.

What it means

Thrown by the reset-password route model (ui/app/routes/vault/cluster/access/reset-password.ts:24). Self-service password reset only exists for userpass auth mounts; the model reads authData from the auth service and immediately throws ERROR_UNAVAILABLE when the current auth method type is anything other than userpass.

Source

Thrown at ui/app/routes/vault/cluster/access/reset-password.ts:24

import Route from '@ember/routing/route';
import { service } from '@ember/service';

import type AuthService from 'vault/vault/services/auth';
import type CapabilitiesService from 'vault/services/capabilities';

const ERROR_UNAVAILABLE = 'Password reset is not available for the current user.';
const ERROR_NO_ACCESS =
  'You do not have permissions to update your password. If you think this is a mistake ask your administrator to update your policy.';

export default class VaultClusterAccessResetPasswordRoute extends Route {
  @service declare readonly auth: AuthService;
  @service declare readonly capabilities: CapabilitiesService;

  async model() {
    const { authMethodType, authMountPath, displayName } = this.auth.authData;
    // Password reset is only available on userpass type auth mounts
    if (authMethodType !== 'userpass') {
      throw new Error(ERROR_UNAVAILABLE);
    }

    // Both of these are necessary to build the reset password URL
    if (!authMountPath || !displayName) {
      throw new Error(ERROR_UNAVAILABLE);
    }

    const capabilities = await this.capabilities.fetchPathCapabilities(
      `auth/${authMountPath}/users/${displayName}/password`
    );

    // Throw an error if we know for certain the user doesn't have permission
    if (!capabilities.canUpdate) {
      throw new Error(ERROR_NO_ACCESS);
    }
    return {
      backend: authMountPath,
      username: displayName,

View on GitHub (pinned to 744b611b57)

Solutions

1. Change your password in the system that actually manages it (LDAP directory, identity provider)
2. Log in with your userpass credentials if you have them — then this page becomes available
3. Administrators can reset a userpass password via CLI: vault write auth/userpass/users/<name>/password password=<new>

// Before linking/transitioning to the reset-password route
if (this.auth.authData?.authMethodType !== 'userpass') {
  hideResetPasswordLink(); // or: this.router.transitionTo('vault.cluster.access');
}

const PASSWORD_RESET_METHOD = 'userpass' as const;
function supportsSelfPasswordReset(methodType: string | undefined): methodType is 'userpass' {
  return methodType === PASSWORD_RESET_METHOD;
}

try {
  await this.router.transitionTo('vault.cluster.access.reset-password');
} catch (e) {
  if (e.message === 'Password reset is not available for the current user.') {
    notifyUser('Self-service password reset requires a userpass login');
    this.router.transitionTo('vault.cluster.access');
  } else {
    throw e;
  }
}

When it happens

Trigger: Navigating to /ui/vault/access/reset-password while authenticated via a non-userpass method: ldap, okta, oidc, radius, token, github, etc.

Common situations: A bookmarked or deep-linked reset-password URL hit while logged in through SSO/OIDC or LDAP; a session restored after the mount configuration changed.

Related errors

• You do not have permissions to update your password. If you
• Invalid URL
• Given param is not a supported tool action

AI-assisted analysis of hashicorp/vault@744b611b57 (2026-08-15). Data as JSON: /api/errors/26bbe82e249c349b. Report an issue: GitHub.