diff --git a/service/src/main/java/io/mifos/identity/internal/command/handler/UserCommandHandler.java b/service/src/main/java/io/mifos/identity/internal/command/handler/UserCommandHandler.java
index 0a54236..80955c0 100644
--- a/service/src/main/java/io/mifos/identity/internal/command/handler/UserCommandHandler.java
+++ b/service/src/main/java/io/mifos/identity/internal/command/handler/UserCommandHandler.java
@@ -78,7 +78,7 @@
 
     final UserEntity userWithNewPassword = userEntityCreator.build(
             user.getIdentifier(), user.getRole(), command.getPassword(),
-            !SecurityContextHolder.getContext().getAuthentication().getPrincipal().equals(command.getIdentifier()));
+            !SecurityContextHolder.getContext().getAuthentication().getName().equals(command.getIdentifier()));
     usersRepository.add(userWithNewPassword);
     logger.info("Changed password for user {}, expiration date is now {}", user.getIdentifier(), userWithNewPassword.getPasswordExpiresOn());
 
diff --git a/service/src/main/java/io/mifos/identity/rest/ApplicationPermissionUserRestController.java b/service/src/main/java/io/mifos/identity/rest/ApplicationPermissionUserRestController.java
index 4ef93e3..a2238fd 100644
--- a/service/src/main/java/io/mifos/identity/rest/ApplicationPermissionUserRestController.java
+++ b/service/src/main/java/io/mifos/identity/rest/ApplicationPermissionUserRestController.java
@@ -15,8 +15,11 @@
  */
 package io.mifos.identity.rest;
 
+import io.mifos.anubis.annotation.AcceptedTokenType;
+import io.mifos.anubis.annotation.Permittable;
 import io.mifos.core.command.gateway.CommandGateway;
 import io.mifos.core.lang.ServiceException;
+import io.mifos.identity.api.v1.PermittableGroupIds;
 import io.mifos.identity.internal.command.SetApplicationPermissionUserEnabledCommand;
 import io.mifos.identity.internal.service.ApplicationService;
 import io.mifos.identity.internal.service.UserService;
@@ -48,6 +51,7 @@
     this.commandGateway = commandGateway;
   }
 
+  @Permittable(value = AcceptedTokenType.TENANT, groupId = PermittableGroupIds.SELF_MANAGEMENT)
   @RequestMapping(value = "/enabled", method = RequestMethod.PUT,
           consumes = {MediaType.ALL_VALUE},
           produces = {MediaType.APPLICATION_JSON_VALUE})
@@ -64,6 +68,7 @@
     return ResponseEntity.accepted().build();
   }
 
+  @Permittable(value = AcceptedTokenType.TENANT, groupId = PermittableGroupIds.SELF_MANAGEMENT)
   @RequestMapping(value = "/enabled", method = RequestMethod.GET,
           consumes = {MediaType.APPLICATION_JSON_VALUE},
           produces = {MediaType.APPLICATION_JSON_VALUE})
diff --git a/service/src/main/java/io/mifos/identity/rest/UserRestController.java b/service/src/main/java/io/mifos/identity/rest/UserRestController.java
index b20a38e..bcaf57c 100644
--- a/service/src/main/java/io/mifos/identity/rest/UserRestController.java
+++ b/service/src/main/java/io/mifos/identity/rest/UserRestController.java
@@ -61,7 +61,7 @@
   @RequestMapping(method = RequestMethod.GET,
       consumes = {MediaType.ALL_VALUE},
       produces = {MediaType.APPLICATION_JSON_VALUE})
-  @Permittable(AcceptedTokenType.TENANT)
+  @Permittable(value = AcceptedTokenType.TENANT, groupId = PermittableGroupIds.IDENTITY_MANAGEMENT)
   public @ResponseBody List<User> findAll() {
     return this.service.findAll();
   }
@@ -95,7 +95,7 @@
   @RequestMapping(value = PathConstants.IDENTIFIER_RESOURCE_STRING + "/roleIdentifier", method = RequestMethod.PUT,
       consumes = {MediaType.APPLICATION_JSON_VALUE},
       produces = {MediaType.APPLICATION_JSON_VALUE})
-  @Permittable(AcceptedTokenType.TENANT)
+  @Permittable(value = AcceptedTokenType.TENANT, groupId = PermittableGroupIds.IDENTITY_MANAGEMENT)
   public @ResponseBody ResponseEntity<Void> changeUserRole(
       @PathVariable(IDENTIFIER_PATH_VARIABLE) final String userIdentifier,
       @RequestBody @Valid final RoleIdentifier roleIdentifier)