Explanation
Once the user is redirected to Okta they'll need to enter their Okta credentials, unless they had already authenticated into Okta in a previous session within the same browser. In either case, a successful authentication request will redirect the user back to the SP's Assertion Consumer Service (ACS) URL with an embedded SAML response from Okta. At a minimum, the response will:
* Indicate that it is indeed from Okta and hasn't been altered, and contain a digital signature proving such. This signature will be verified by the SP using a public key from Okta that was previously uploaded to the SP as a certificate.
* Indicate that the user has authenticated successfully into Okta
* Indicate who the user is via the NameID, a standard attribute used in SAML assertions.
https://support.okta.com/help/s/article/Beginner-s-Guide-to-SAML?language=en_US

Explanation
1. Click on the password reset linkInclude a Click here to reset your password link on the Okta Sign-On page so that users can intuitively initiate the password reset ow. By combining self-service password resets with SSO, not only can organizations reduce the number of required passwords (a security benet, as well as end-user convenience) but users are able to access all their applications through a single password reset.
2. Receive either an email or an SMS messageThe user has the option to receive either an email or an SMS message containing a password reset code. With both options, the user still has to answer a security question to verify identity before they are allowed to reset their password. This security question and answer is created when users enroll in Okta MFA.
3. Enter a new passwordThe newly created password can still impose the same password policies such as character length, number of special characters required, etc., ensuring a consistent password policy throughout the organization.
https://www.okta.com/resources/whitepaper/enable-self-service-password-resets/