code: func (s *AuthServer) ChangePassword(req services.ChangePasswordReq) error {
  	// validate new password
  	err := services.VerifyPassword(req.NewPassword)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	authPreference, err := s.GetAuthPreference()
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	userID := req.User
  	fn := func() error {
  		secondFactor := authPreference.GetSecondFactor()
  		switch secondFactor {
  		case teleport.OFF:
  			return s.CheckPasswordWOToken(userID, req.OldPassword)
  		case teleport.OTP:
  			return s.CheckPassword(userID, req.OldPassword, req.SecondFactorToken)
  		case teleport.U2F:
  			if req.U2FSignResponse == nil {
  				return trace.BadParameter("missing U2F sign response")
  			}
  
  			return s.CheckU2FSignResponse(userID, req.U2FSignResponse)
  		}
  
  		return trace.BadParameter("unsupported second factor method: %q", secondFactor)
  	}
  
  	err = s.WithUserLock(userID, fn)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	return trace.Wrap(s.UpsertPassword(userID, req.NewPassword))
  }
docs: // ChangePassword changes user passsword