While passwd can change the password for a user stored in a LDAP
repository,  it can't "expire" the password. This would be very handy
for an administrator helping users resetting their passwords.

$ sudo passwd -e readonly
passwd: user 'readonly' does not exist in /etc/passwd

$ sudo ldapsearch -xW -H ldap://ns1 "(uid=readonly)"
dn: uid=readonly, ou=People, dc=example, dc=org
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: readonly user
uidNumber: 10001
gidNumber: 100
homeDirectory: /tmp
uid: readonly
loginShell: /bin/bash
shadowMin: 0
shadowLastChange: 15446
userPassword: bla,bla,bla

$ sudo getent passwd readonly
readonly:x:10001:100:readonly user:/tmp:/bin/bash

severity 668998 wishlist
tags 668998 wontfix
thanks

passwd uses PAM to update a password, but PAM does not have a routine to
expire a password.

Expiring LDAP password in passwd would require to give LDAP knowledge to
passwd, which is not planned.

In case of patch (and if there is a single LDAP schema for storing
passwd/shadow like information), this could be reconsidered.

Until then, the relevant LDAP tools must be used.

Best Regards,