Created User requires logging in first before we can make API calls

[BillyMai]

When I create a user through the UI, I'm not able to make any API calls using this user's profile. It requires me to login first from the UI and reset the initial password. Since I have SSO enabled I can't log in via the UI to reset it. Trying to reset it from Admin Functions doesn't help either. Is there a way to bypass this requirement of logging in from the UI?

[dgandhi]

Yes, please check below document , it has all the details.

https://forums.saviynt.com/t5/identity-governance/getting-html-response-when-calling-saviynt-api-in-...

Hope this helps!!

[pmahalle]

Hi @BillyMai ,

Can you try by uncheck the Set Security Question on Login option under Global Configurations --> Preferences

[BillyMai]

It already is unchecked, It was never checked.

[pmahalle]

How you are getting the initial password once user created through UI?

[BillyMai]

Admin functions

[pmahalle]

That’s the reason, you need to reset the password on first logon. 

Since admin is resetting the password through Admin Function, user needs to reset password on first login otherwise it will be a security issue since admin also know the password.

[BillyMai]

Since SSO is enabled and local authentication is turned off, how will the user login to reset the password?

[rushikeshvartak]

update users set passwordexpired=0, localauthenabled=1 where username='SAVIyntXXXXX'

[BillyMai · Accepted solution]

I found that you have to do it in this order:
1. create the user via the API

2. set localauthenabled = 1

3. reset password via admin functions

4. set passwordexpired = 0

5. use the updated password to make api call