try
{
//manager.setPassword(userName, currPassword, newPassword);
// Changes for new Security API's
User user = manager.getUser(userName);
PasswordCredential credential = manager.getPasswordCredential(user);
credential.setPassword(currPassword, newPassword);
manager.storePasswordCredential(credential);
audit.logUserActivity(userName, getIPAddress(actionRequest), AuditActivity.PASSWORD_CHANGE_SUCCESS, USER_ADMINISTRATION);
// update Subject in session to reflect the changed PasswordCredential
RequestContext requestContext = (RequestContext)actionRequest.getAttribute(PortalReservedParameters.REQUEST_CONTEXT_ATTRIBUTE);