A group in my company is implementing a single-sign-on REST API for our applications. This authentication service has a password reset function. The application sends the user
Are there any significant security reasons to prefer one method over the other?
Yes. If you go the temporary password route then anyone can annoy the crap out of a user by constantly hitting the reset link and putting in that user's email address. If you use password reset links the user can just ignore them and delete the emails.