Root issue: Users are created in an LDAP server (in my case, via a Samba 4 PDC), and a temporary password is given to them, to access Phabricator. They cannot change their LDAP password from within Phabricator.
I'm assuming this is not currently a feature?