"passwd" by root for user fails with sssd,pam, ldap

[Augustin Wolf]

Hi list,
I have a user management in LDAP, as it works fine for user (can
login, do `passwd` to change his password, etc.)
But, root cannot change users password otherwise as via ldapmodify. Is
it normal behavior, or do I have some configuration errors?
For now, LDAP ACL was "turned off" - every user has manage permission,
I will change this as soon as root can change user password.
SELlinux was also turned off to eliminate it's potential interference.
Iptables was "turned off", as well.

Configs, logs, etc are in here: http://fpaste.org/26708/
Thanks in advance,
Augustyn