Authenticated users can change their passwords through the OpenAM console.