title: Websphere Portal 8 login service check existing password correct
body: <p>I have a portlet that is used to change the password of the logged in user. The user has to enter their current password and a new password twice. It calls the LoginService.checkPassword(String userId, char[] password) to determine if the existing password is correct. If this method returns true, then the password is updated by getting the current user via the Puma Profile and setting the updated attribute using the PumaController.setAttributes(User user, Map attributes) call. Then the puma profile is reloaded via the PumaProfile.reload method (I've also tried using the PumaController.reload() method.</p>
  
  <p>The problem I'm facing is that the LoginService.checkPassword(String userId, char[] password) is returning true for the current password and also older passwords rather than just for the current password. Does anyone know why this would be?</p>
  
  <p>In ldap the password field is a single attribute field, as it is also in wimdomain.xml, and if I log out and try to log in, I can only log in with the current password (as you would expect).</p>