@Unauthenticated
    @Override
    public ChangePasswordResponse changePassword(final ChangePasswordRequest changePasswordRequest) {
        final HttpServletRequest request = httpServletRequestHolderProvider.get().get();
        final AuthenticationServiceImpl service = serviceProvider.get();
        final String userId = service.getUserIdFromRequest(request);
        final AuthenticateEventAction.Builder<Void> eventBuilder = event.logging.AuthenticateEventAction.builder()
                .withUser(event.logging.User.builder().withId(userId).build())
                .withAuthenticationEntity(event.logging.User.builder()
                        .withId(changePasswordRequest.getUserId())
                        .build())
                .withAction(AuthenticateAction.CHANGE_PASSWORD);

        try {
            final ChangePasswordResponse response =
                    service.changePassword(request, changePasswordRequest);

            if (!response.isChangeSucceeded()) {
                eventBuilder.withOutcome(AuthenticateOutcome.builder()
                        .withSuccess(false)
                        .withReason(AuthenticateOutcomeReason.INCORRECT_USERNAME_OR_PASSWORD)
                        .withDescription(response.getMessage())
                        .build());
            }
            return response;

        } catch (Throwable e) {
            eventBuilder.withOutcome(AuthenticateOutcome.builder()
                    .withSuccess(false)
                    .withReason(AuthenticateOutcomeReason.OTHER)
                    .withDescription(e.getMessage())
                    .withData(Data.builder()
                            .withName("Error")
                            .withValue(e.getMessage())
                            .build())
                    .build());
            throw e;
        } finally {
            final String description;
            if (userId == null) {
                description = "An unauthenticated user is changing a user's password";
            } else if (userId.equals(changePasswordRequest.getUserId())) {
                description = "User is changing their own password";
            } else {
                description = "User is changing another user's password";
            }
            //Need to set the user id explictly as this method runs as INTERNAL_PROCESSING_USER
            final Event event = stroomEventLoggingServiceProvider.get().createEvent(
                    "AuthenticationResourceImpl.ChangePassword",
                    description,
                    eventBuilder.build());

            stroomEventLoggingServiceProvider.get().log(
                    userId == null
                            ? event
                            //Unauthenticated case
                            : Event.builder().copyOf(event)
                                    .withEventSource(EventSource.builder().copyOf(event.getEventSource())
                                            .withUser(User.builder().withId(userId).build())
                                            .build())
                                    .build()
            );
        }
    }
Called as part of logout flow when using internal identity provider.
stroom-security/stroom-security-identity/src/main/java/stroom/security/identity/authenticate/AuthenticationResourceImpl.java