Thats one benefit of having a SSO solution which you do not have?
Maybe a reason to install such a thing now. Like keycloak or Authentik.
Otherwise you either send the user the generated first password, or you have them click on “forgot password”.
Its a one time thing of 3 minutes, so users should not complain.