Configuration

Configuration

Configure delegated password reset when a trusted actor is authorized to reset a specific other account. The IdP selects and authorizes the target; the pipe applies the reset logic for that target.

Required session data

For SAML authentication, map these assertion attributes into the server-side session:

Attribute	Meaning
on_behalf_of_user_name	Target account identifier used by the delegated pipe.
on_behalf_of_display_name	Target display name, shown verbatim by the UI.
on_behalf_of_email	Optional target email, available to notification logic.

Both the target username and display name must be present for the module to expose delegated data. A name such as Example User (Student) is one display-name value; no separate role attribute is required.

Configure the delegated pipe

Use the configured pipe_id as the entry point. Its routing logic should select a dedicated delegated flow when the trusted request contains on_behalf_of_user_name; otherwise it should use the self-service flow. In the delegated branch, look up and reset the target account, not request.user_name, which identifies the actor.

Restrict target selection to accounts the actor is permitted to manage and apply the relevant scope check before the reset. Assertion attributes and a visible name are not, by themselves, a directory permission model. See Delegated reset and Security configuration.

Verify the UI and target

After authentication, verify that the name above the password field is the selected target's exact display name. Complete a reset with a synthetic target and verify sign-in as that target. Confirm that the actor's own password was not changed. Also test a target outside the permitted scope and confirm that it is rejected.

The UI's Change user action ends the current local selection/session and returns to authentication; it does not grant permission to choose an arbitrary account. For own-account resets, the delegated name panel is hidden.