Updating a local user password
Note
This feature is at the Preview stage.
Resetting a password
To reset a local user password, do the following:
-
Log in to Yandex Identity Hub using an administrator or organization owner account.
-
In the left-hand panel, select Users and find the local user.
Optionally, use the search bar or filter at the top of the page.
-
In the row with the user, click and select Reset password.
-
In the window that opens, confirm resetting the password.
Save the generated password and communicate it to the user. After closing the window, you will not be able to view the new password.
If you do not have the Yandex Cloud CLI installed yet, install and initialize it.
By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.
-
See the description of the CLI command for resetting a user password in a pool:
yc organization-manager idp user reset-password --help -
To get a list of pools in an organization, provide its ID in this command:
yc organization-manager idp userpool list \ --organization-id <organization_ID>Result:
+----------------------+--------------+-------------+----------------------+---------------------+ | ID | NAME | DESCRIPTION | ORGANIZATION ID | CREATED AT | +----------------------+--------------+-------------+----------------------+---------------------+ | ek0o6g0irskn******** | sample-pool1 | | bpf2c65rqcl8******** | 2025-05-17 10:01:04 | | ek03mf01jr4z******** | sample-pool2 | | bpf2c65rqcl8******** | 2025-06-28 16:30:23 | +----------------------+--------------+-------------+----------------------+---------------------+ -
To get the IDs and other information about pool users, provide the pool ID in the following command:
yc organization-manager idp user list \ --userpool-id <user_pool_ID>Result:
+----------------------+----------------------------------------+-----------+----------------------+-----------+---------------------+ | ID | USERNAME | FULL NAME | USERPOOL ID | IS ACTIVE | CREATED AT | +----------------------+----------------------------------------+-----------+----------------------+-----------+---------------------+ | aje3i1gq49n3******** | test-user1@test.ru.idp.yandexcloud.net | User 1 | ek0o6g0irskn******** | true | 2025-10-07 10:41:54 | | aje0j5mts02t******** | test-user2@test.ru.idp.yandexcloud.net | User 2 | ek0o6g0irskn******** | false | 2025-07-16 11:18:57 | +----------------------+----------------------------------------+-----------+----------------------+-----------+---------------------+ -
Run the command, specifying the user ID:
yc organization-manager idp user reset-password <user_ID>Result:
generated password for user 'ek0gkfu0jc7v********' is 'rhls-mpvg-****-****'Save the generated password and communicate it to the user. After closing the shell, you will not be able to view the new password.
Use the User.GeneratePassword REST API method for the User resource or the UserService/GeneratePassword gRPC API call.
The user must change this password on their first login to Yandex Cloud.
Setting a password
You cannot generate a random password for a local user via the Cloud Center interface. To change the password to a generated one, follow this guide.
If you do not have the Yandex Cloud CLI installed yet, install and initialize it.
By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.
-
View the description of the CLI command for changing a user password in a pool:
yc organization-manager idp user set-password --help -
To get a list of pools in an organization, provide its ID in this command:
yc organization-manager idp userpool list \ --organization-id <organization_ID>Result:
+----------------------+--------------+-------------+----------------------+---------------------+ | ID | NAME | DESCRIPTION | ORGANIZATION ID | CREATED AT | +----------------------+--------------+-------------+----------------------+---------------------+ | ek0o6g0irskn******** | sample-pool1 | | bpf2c65rqcl8******** | 2025-05-17 10:01:04 | | ek03mf01jr4z******** | sample-pool2 | | bpf2c65rqcl8******** | 2025-06-28 16:30:23 | +----------------------+--------------+-------------+----------------------+---------------------+ -
To get the IDs and other information about pool users, provide the pool ID in the following command:
yc organization-manager idp user list \ --userpool-id <user_pool_ID>Result:
+----------------------+----------------------------------------+-----------+----------------------+-----------+---------------------+ | ID | USERNAME | FULL NAME | USERPOOL ID | IS ACTIVE | CREATED AT | +----------------------+----------------------------------------+-----------+----------------------+-----------+---------------------+ | aje3i1gq49n3******** | test-user1@test.ru.idp.yandexcloud.net | User 1 | ek0o6g0irskn******** | true | 2025-10-07 10:41:54 | | aje0j5mts02t******** | test-user2@test.ru.idp.yandexcloud.net | User 2 | ek0o6g0irskn******** | false | 2025-07-16 11:18:57 | +----------------------+----------------------------------------+-----------+----------------------+-----------+---------------------+ -
Run this command, specifying the user ID and their new password in the
--passwordparameter:yc organization-manager idp user set-password <user_ID> \ --password <new_password>Note
The user password may include Latin letters, numbers, and special characters.
It must be at least seven characters long and must contain at least one uppercase Latin letter, one lowercase Latin letter, one number, and one special character.
Use the User.SetOwnPassword REST API method for the User resource or the UserService/SetOwnPassword gRPC API call.