We should disallow requests to Change Password API authenticated with a bearer token from our Token Service. The reasoning for this is that it is best practice from a security perspective to mandate the proof of knowledge of the current password at the time the password is changed.

Kibana ( ping @azasypkin ) needs to adjust for this change too when the Token authentication provider is in use. The two available options that we originally discussed :

• Kibana makes the request to the change password API on behalf of the user using the current password and a basic auth header ( preferable from our perspective )
• Kibana makes the request to the change password API , passing the current password as a parameter in the call. This would require changing the API to support the extra parameter and investigation to see if/how it is possible to use the principal from the bearer token and the password from the API request to authenticate the request.