If you're using the PingOne for Enterprise Directory Password Credential Validator for PingFederate, you can allow your users to change or reset their passwords.
Ensure your PingFederate adapter is set to allow password changes, then have your users choose to change their passwords when they sign on.