changepw

server: OpenLDAP 2.4.43
clients: nss-pam-ldapd 0.9.6

Using 'sudo cmd' on the server side results in messages like this ...
sudo /etc/init.d/nslcd status
Password;
sudo: Account or passwd is expired, reset your password and try again
sudo: unable to change expired password: Authentication token manipulation error

My user account expiry information is set as:
$ chage -l james
Last password change                              : Jan 09, 2016
Password expires                                  : never
Password inactive                                 : never
Account expires                                   : never
Minimum number of days between password change    : 0
Maximum number of days between password change    : 99999
Number of days of warning before password expires : 7

If I try to set my passwd, I get this ...
$ passwd
Changing password for james.
(current) UNIX password:
New password:
Retype new password:
password change failed: Invalid credentials
passwd: password updates successfully

/etc/pam.d/system-auth on client/server
---
auth            required        pam_env.so
auth            required        pam_unix.so try_first_pass likeauth nullok
auth            optional        pam_permit.so
auth            sufficient      pam_ldap.so use_first_pass
account         required        pam_unix.so
account         optional        pam_permit.so
account         sufficient      pam_ldap.so
password        required        pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password        required        pam_unix.so try_first_pass use_authtok nullok sha512 shadow
password        optional        pam_permit.so
password        sufficient      pam_ldap.so use_authtok use_first_pass
session         required        pam_limits.so
session         required        pam_env.so
session         required        pam_unix.so
session         optional        pam_permit.so
session         optional        pam_ldap.so

/etc/nslcd.conf on client/server
---
uid nslcd
gid nslcd
uri ldap://10.10.10.100/
base dc=my,dc=example,dc=com

/etc/nsswitch.conf on client
---
passwd:      files ldap
shadow:      files ldap
group:       files ldap

hosts:       files dns
networks:    files dns

services:    db files
protocols:   db files
rpc:         db files
ethers:      db files
netmasks:    files
netgroup:    files
bootparams:  files

automount:   files
aliases:     files


/etc/openldap/ldap.conf on server/client
---
host 10.10.10.100
base dc=my,dc=example,dc=com
uri ldap://10.10.10.100/
ldap_version 3
pam_password exop
pam_filter objectclass=posixAccount
nss_reconnect_tries 4
nss_reconnect_sleeptime 1
nss_reconnect_maxsleeptime 16
nss_reconnect_maxconntries 2
nss_initgroups_ignoreusers ldap,openldap,mysql,syslog,root,postgres