diff --git a/jsonapi.services.yml b/jsonapi.services.yml
index 970157e..8d367ee 100644
--- a/jsonapi.services.yml
+++ b/jsonapi.services.yml
@@ -51,6 +51,11 @@ services:
     arguments: ['@jsonapi.link_manager', '@jsonapi.current_context', '@entity_type.manager', '@jsonapi.resource_type.repository']
     tags:
       - { name: normalizer, priority: 22 }
+  serializer.normalizer.user_entity.jsonapi:
+    class: Drupal\jsonapi\Normalizer\UserEntityNormalizer
+    arguments: ['@jsonapi.link_manager', '@jsonapi.resource_type.repository', '@entity_type.manager', '@current_user', '@config.factory']
+    tags:
+      - { name: normalizer, priority: 22 }
   serializer.normalizer.entity_reference_field.jsonapi:
     class: Drupal\jsonapi\Normalizer\EntityReferenceFieldNormalizer
     arguments: ['@jsonapi.link_manager', '@entity_field.manager', '@plugin.manager.field.field_type', '@jsonapi.resource_type.repository', '@entity.repository']
diff --git a/src/Controller/EntityResource.php b/src/Controller/EntityResource.php
index 6fbb175..addeffc 100644
--- a/src/Controller/EntityResource.php
+++ b/src/Controller/EntityResource.php
@@ -232,6 +232,10 @@ class EntityResource {
     }
     $body = Json::decode($request->getContent());
     $data = $body['data'];
+    if ($entity->getEntityTypeId() == 'user' && isset($data['attributes']['current_pass'])) {
+      $current_pass = $data['attributes']['current_pass'];
+      unset($data['attributes']['current_pass']);
+    }
     if ($data['id'] != $entity->uuid()) {
       throw new BadRequestHttpException(sprintf(
         'The selected entity (%s) does not match the ID in the payload (%s).',
@@ -246,6 +250,10 @@ class EntityResource {
       return $destination;
     }, $entity);
 
+    if ($entity->getEntityTypeId() == 'user' && isset($current_pass)) {
+      $entity->setExistingPassword($current_pass);
+    }
+
     $this->validate($entity);
     $entity->save();
     return $this->getIndividual($entity, $request);
diff --git a/src/Normalizer/UserEntityNormalizer.php b/src/Normalizer/UserEntityNormalizer.php
new file mode 100644
index 0000000..294606c
--- /dev/null
+++ b/src/Normalizer/UserEntityNormalizer.php
@@ -0,0 +1,77 @@
+<?php
+
+namespace Drupal\jsonapi\Normalizer;
+
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\user\UserInterface;
+use Drupal\jsonapi\LinkManager\LinkManager;
+use Drupal\jsonapi\Normalizer\EntityNormalizer;
+use Drupal\jsonapi\ResourceType\ResourceTypeRepository;
+
+/**
+ * Provides support for files upload.
+ */
+class UserEntityNormalizer extends EntityNormalizer {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $supportedInterfaceOrClass = UserInterface::class;
+
+  /**
+   * The current user service.
+   *
+   * @var \Drupal\Core\Session\AccountInterface
+   */
+  protected $currentUser;
+
+  /**
+   * The config factory object.
+   *
+   * @var \Drupal\Core\Config\ConfigFactoryInterface
+   */
+  protected $configFactory;
+
+  /**
+   * UserEntityNormalizer constructor.
+   *
+   * @param \Drupal\jsonapi\LinkManager\LinkManager $link_manager
+   *   The link manager.
+   * @param \Drupal\jsonapi\ResourceType\ResourceTypeRepository $resource_type_repository
+   *   The JSON API resource type repository.
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   The entity type manager.
+
+   * @param \Drupal\Core\Session\AccountInterface $current_user
+   *   Current user service object.
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   Site configs service.
+   */
+  public function __construct(LinkManager $link_manager, ResourceTypeRepository $resource_type_repository, EntityTypeManagerInterface $entity_type_manager, AccountInterface $current_user, ConfigFactoryInterface $config_factory) {
+    parent::__construct($link_manager, $resource_type_repository, $entity_type_manager);
+    $this->currentUser = $current_user;
+    $this->configFactory = $config_factory;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function denormalize($data, $class, $format = NULL, array $context = []) {
+
+    $current_pass = '';
+    if (isset($data['current_pass'])) {
+      $current_pass = $data['current_pass'];
+      unset($data['current_pass']);
+    }
+
+    /* @var \Drupal\user\UserInterface $user */
+    $user = parent::denormalize($data, $class, $format, $context);
+
+    if (!empty($current_pass)) $user->setExistingPassword($current_pass);
+
+    return $user;
+  }
+
+}