Index: branches/ClientUserManagement/HeuristicLab.Services.Access/3.3/AccessService.cs
===================================================================
--- branches/ClientUserManagement/HeuristicLab.Services.Access/3.3/AccessService.cs	(revision 7611)
+++ branches/ClientUserManagement/HeuristicLab.Services.Access/3.3/AccessService.cs	(revision 7612)
@@ -36,5 +36,5 @@
     private IUserManager UserManager {
       get {
-        if (userManager == null) userManager = new UserManager();
+        if (userManager == null) userManager = AccessServiceLocator.Instance.UserManager;
         return userManager;
       }
@@ -44,5 +44,5 @@
     private IRoleVerifier RoleVerifier {
       get {
-        if (roleVerifier == null) roleVerifier = new RoleVerifier();
+        if (roleVerifier == null) roleVerifier = AccessServiceLocator.Instance.RoleVerifier;
         return roleVerifier;
       }
@@ -143,4 +143,6 @@
 
     public void DeleteClient(DT.Client client) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       using (DA.ClientManagementDataContext context = new DA.ClientManagementDataContext()) {
         //load client because we could get a detached object
@@ -198,4 +200,6 @@
 
     public void DeleteClientGroup(DT.ClientGroup clientGroup) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       using (DA.ClientManagementDataContext context = new DA.ClientManagementDataContext()) {
         //load clientGroup because we could get a detached object
@@ -289,4 +293,6 @@
 
     public void DeleteClientLog(DT.ClientLog log) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       using (DA.ClientManagementDataContext context = new DA.ClientManagementDataContext()) {
         context.ClientLogs.DeleteOnSubmit(Convert.ToEntity(log));
@@ -484,4 +490,6 @@
 
     public DT.User AddUser(DT.User user) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       DA.User accessUser;
       DA.aspnet_User aspUser;
@@ -529,4 +537,6 @@
 
     public void DeleteUser(DT.User user) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       if (user.Id != null && user.Id != Guid.Empty) {
         //delete asp.net user
@@ -551,8 +561,12 @@
 
     public void UpdateUser(DT.User user) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       AddUser(user);
     }
 
     public void AddUserToRole(DT.Role role, DT.User user) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       //TODO: usernames and rolenames have to be unique!
       MembershipUser msUser = Membership.GetUser((object)user.Id);
@@ -563,4 +577,6 @@
 
     public void RemoveUserFromRole(DT.Role role, DT.User user) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       MembershipUser msUser = Membership.GetUser((object)user.Id);
       if (msUser != null) {
@@ -569,5 +585,5 @@
     }
 
-    public bool ResetPassword(Guid userId, string oldPassword, string newPassword) {
+    public bool ChangePassword(Guid userId, string oldPassword, string newPassword) {
       MembershipUser msUser = Membership.GetUser(userId);
       if (msUser != null) {
@@ -575,4 +591,15 @@
       }
       return false;
+    }
+
+    public string ResetPassword(Guid userId) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
+      MembershipUser msUser = Membership.GetUser(userId);
+      if (msUser != null) {
+        return msUser.ResetPassword();
+      } else {
+        throw new Exception("Password reset failed.");
+      }
     }
     #endregion
@@ -626,4 +653,6 @@
 
     public void DeleteUserGroup(DT.UserGroup group) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       using (DA.ClientManagementDataContext context = new DA.ClientManagementDataContext()) {
         context.UserGroupBases.DeleteOnSubmit(Convert.ToEntity(group));
@@ -733,4 +762,6 @@
 
     public DT.Role AddRole(DT.Role role) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       Roles.CreateRole(role.Name);
       return role;
@@ -738,4 +769,6 @@
 
     public void DeleteRole(DT.Role role) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       Roles.DeleteRole(role.Name);
     }
@@ -767,4 +800,6 @@
 
     public void RemoveRoleFromGroup(DT.UserGroup userGroup, DT.Role role) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       Guid[] userIds;
       string[] aspUsers;
@@ -795,4 +830,6 @@
 
     public IEnumerable<DT.ClientError> GetClientErrors() {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       using (DA.ClientManagementDataContext context = new DA.ClientManagementDataContext()) {
         var query = from c in context.ClientErrors
@@ -803,4 +840,6 @@
 
     public IEnumerable<DT.ClientError> GetLastClientErrors(DateTime startDate) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       using (DA.ClientManagementDataContext context = new DA.ClientManagementDataContext()) {
         var query = from c in context.ClientErrors
@@ -812,4 +851,6 @@
 
     public void DeleteError(DT.ClientError error) {
+      roleVerifier.AuthenticateForAllRoles(AccessServiceRoles.Administrator);
+
       using (DA.ClientManagementDataContext context = new DA.ClientManagementDataContext()) {
         var query = context.ClientErrors.Where(x => x.Id == error.Id);
Index: branches/ClientUserManagement/HeuristicLab.Services.Access/3.3/IAccessService.cs
===================================================================
--- branches/ClientUserManagement/HeuristicLab.Services.Access/3.3/IAccessService.cs	(revision 7611)
+++ branches/ClientUserManagement/HeuristicLab.Services.Access/3.3/IAccessService.cs	(revision 7612)
@@ -104,5 +104,4 @@
 
     #region User
-    //TODO: i don't think this method is needed
     [OperationContract]
     LightweightUser Login();
@@ -142,5 +141,8 @@
 
     [OperationContract]
-    bool ResetPassword(Guid userId, string oldPassword, string newPassword);
+    bool ChangePassword(Guid userId, string oldPassword, string newPassword);
+
+    [OperationContract]
+    string ResetPassword(Guid userId);
     #endregion
 
