This way is not safe. Please, use python libs for any OS task.
os.environ["LDAPTLS_CACERTDIR"] = m1.get_ssca_dir()

Why not to use UserAccounts DSLdapObject here?

UserAccounts can be used here.
And, btw, you change it with "topo.standalone.simple_bind_s(DN_DM, PASSWORD)" but the comment states - "Testuser attempts"

One line should be enough here :)

Once again, I think, you can use UserAccounts object here. It will be more efficient and more readable.

We should use more meaningful test function names. The test suite already states 'pwdmodify'. Please, rename all test_pwd_modify, test_pwd_modify_1, test_pwd_modify_with_setup (what is the setup?)

As long as we add a new tests we better use DSLdapObject API for this instead of old Entry API.
We have OrganizationalUnit(DSLdapObject) in idm directory
How to use PwPolicyContainer(DSLdapObject) you can find in CLI code.
And for adding users - you know :)

@spichugi Hey mate please check the code, it's rebased to the latest commit.

LGTM, ack!

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3024

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.