[389-users] More meaningful failure messages when changing passwords

[Mitch Patenaude]

Our organization’s security policies impose several constraints on password changes. 
There is a complexity requirement, and a ban on reuse of old passwords.  I’ve gotten all
of these requirements worked into the 389 server, but when the constraints aren’t met, the
error message is very misleading and opaque:

Password change failed. Server message: Failed to update password

passwd: Authentication token is no longer valid; new one required

This results in a lot of support requests about the inability to change passwords.  Is
there any way to make the error messages a little more descriptive?  We’re using pam_sss
and sssd on Centos 7.x.

Thanks,
    -- Mitch