IdentityServer4 and Update password using API

Question

I have an API project and a separate project running IdentityServer4. A 3rd party app logins to IdentityServer4 and receives Access Token. Using the token 3rd party app makes calls to API project. Now 3rd party app wants an API resource (api/users/change_password) to have the ability to change password of a user by providing username, current password and new password. How can I update/change user's password from API project?

Answer 1

I would say that something is wrong with the requirement. To get an access token you redirect user to IDP UI . But to change a password you don't want to do it. Why? Setting password through API isn't secure. It means that 3rd party application can change user password by its own wish. It's very risky.