public void changeUserPassword(String userId, String password) {
SysParm parmPwdExpiredDay = commonDao.findById(SysParm.class,
PwdPloicyKeys.PWD_EXPIRED_DAY.toString().toLowerCase());
int expiredDay = Integer.parseInt(parmPwdExpiredDay.getParmValue());
Date now = Calendar.getInstance().getTime();
User user = userDao.findByCode(userId);
String pwdHash = encodePassword(user.getCode(), password);
user.setPwdExpiredTime(new Timestamp(CapDate.shiftDays(now, expiredDay)
.getTime()));
user.setPassword(pwdHash);
user.setStatus("0");
userDao.save(user);
// insert pwd history
PwdLog uph = new PwdLog();
uph.setUserCode(user.getCode());
uph.setPassword(pwdHash);
uph.setUpdateTime(new Timestamp(now.getTime()));
userPwdHistoryDao.save(uph);
}