Question:
Why is the Control Hub asking to set up/renew the user's SCH password if SAML is enabled?
Answer:
It is necessary for users with Organization Administrator role to have the Control Hub credentials (and update the password after it expires). When SAML is enabled, there is a "back door" login using these Control Hub credentials (possible to log in through https://cloud.streamsets.com/security/dpmlogin). This "back door" should be currently available only for users with the Organization Administrator role.
This is standard practice in a SAML SP to allow administrators access in case of misconfiguring of SAML or interruption of service.