3023735 - External Onboarding Users Redirected to SSO Login When Using Reset Password Link

• External onboarding candidates are redirected to the SSO login page when clicking the initial Reset Password or Welcome Email link, instead of being prompted to set a password.
• When I click the Reset Password or Welcome Email link, I’m redirected to our SSO/company/Microsoft login instead of the password setup page (IAS), so I can’t set or reset my password.
• The links are unreliable—sometimes expired, invalid, or pointing to the wrong environment/URL (e.g., prod vs. dev), causing 403 errors, loops, or an unclickable experience.
• Even after using the link, I’m sent back to a generic login/SSO page and can’t access the onboarding portal or complete my tasks.
• The process is confusing: I receive password reset emails even though SSO is enabled, I’m prompted for unexpected username/email inputs, or the second use of a link stops working.
• Specific cases fail too—rehire/restart emails and welcome/activation links route me to the wrong page (e.g., email overview or company login) instead of a proper password setup prompt.

SAP SuccessFactors Onboarding

1. Go to Email Services
2. Filter "(ONB) External User Welcome Message Template" Templates
   • Customer might be using a custom welcome email template as well
3. Click on the hyperlink which is redirecting the external candidate to reset password page ([[PasswordResetUrl]] - Token)
   • Even tried copying the link address manually and opening in an incognito browser
4. You will be redirected to the SSO or Login Page

Cause 1: The candidate is unable to reset the password because of the Password Reset Link Expiry setting.

Cause 2: Using the same link from the Welcome Message will not work if candidate have previously reset their password.

Cause 3: Unsynchronized or wrong code for link from the email template itself to the manage data (EmailTemplate)

Cause 4: 

• Full SSO enabled in Production - External onboarding users are incorrectly routed to SSO authentication.
• SSO configuration mismatch between environments - Preview uses Partial Organization SSO, while Production uses Full SSO.
• Incorrect Partial SSO setting relative to IAS usage - Partial SSO must not be enabled when IAS is active. 

Resolution 1:

To increase the Reset Password Link Expiration days. Kindly follow the below mentioned steps:

1. Go to Admin Centre > Password & Login Policy Settings
2. Find “Set Welcome Password and Reset Password link expiration (in days)” and increase the number of days in the dialog box
3. Click on Set Password and Login Policy

Resolution 2:

• Candidate may instead click on the hyperlink (e.g. Click here to log on to the Onboarding Home page) from the Welcome Message, similar to https://performancemanager4.successfactors.com/login?company=abcd&username=abc%40abcmail.com&pm_product_name=ONB
• Follow the below link on how to reset the password from the login page: Logging into the Application as New Hire

PLEASE NOTE: The Login URL sent from Onboarding Welcome Email is uniquely created for each candidate. There are times that the browser will still find the normal login URL, and this is because of the Web Browsers (Edge,Chrome,Mozilla,etc..) caching/history.

If the candidate is unable to login using the onboarding url, one should make sure that the below steps are maintained or followed:

1. Make sure that the onboardees login url has "ONB" in it (see Resolution 2: no.1)
2. Do a clear cache/history
3. Use Incognito/Safety mode
4. Could also use the Nudge email sent to complete pending task as it also uses the same unique URL created for the candidate.

Resolution 3

1. Go to Manage Data > EmailTemplate > and look for the affected email template
2. Observe the html code for the [[PasswordResetUrl]] (See image below)
3. Ensure to follow the standard link code as seen in the "Correct" picture below
   

Resolution 4: 

• Validate SSO configuration:
  • If IAS is NOT enabled - Enable Partial Organization SSO
  • If IAS IS enabled - Do not enable Partial SSO
• Ensure environment consistency:
  • Preview and Production must use the same SSO model

• 3135832 - HomePage URL redirected to SSO login for External Users - Onboarding
• 3378476 - Rehire User Welcome Message is redirecting to the SSO login page (Rehire with Old Employment) - Onboarding
• 3061311 - Password Reset Link from Welcome Message is Redirecting to SSO or Login Page - Onboarding

obx, Password, Reset, password reset, password reset link Link, SSO, redirect, link Expired, Onboarding, welcome email, onboarding, login url, sso login, welcome email, SSO, partial SSO, IAS.  , KBA , LOD-SF-OBX-EML , Notifications , Problem