note on password changes

When passwords are changed by someone other than the user, the new passwords expire immediately.

For users that do changes for the user, typically a web app, they can be exempted, e.g.

ldapmodify -Y GSSAPI <foo where></foo where>server.