diff --git a/app/controllers/devise_overrides/passwords_controller.rb b/app/controllers/devise_overrides/passwords_controller.rb
index 17dd32086..a17ca1d98 100644
--- a/app/controllers/devise_overrides/passwords_controller.rb
+++ b/app/controllers/devise_overrides/passwords_controller.rb
@@ -3,6 +3,7 @@ class DeviseOverrides::PasswordsController < Devise::PasswordsController
 
   skip_before_action :require_no_authentication, raise: false
   skip_before_action :authenticate_user!, raise: false
+  before_action :check_saml_user, only: [:create]
 
   def create
     @user = User.from_email(params[:email])
@@ -43,4 +44,13 @@ class DeviseOverrides::PasswordsController < Devise::PasswordsController
       message: message
     }, status: status
   end
+
+  def check_saml_user
+    return if params[:email].blank?
+
+    user = User.from_email(params[:email])
+    return unless user&.saml_user?
+
+    build_response(I18n.t('messages.reset_password_saml_user'), 403)
+  end
 end