I did some testing of pam_sss and the LDAP backend's password policy
features and ran into some issue. One of the being the getuid() == 0
checks in pam_sss when checking whether the user needs to be prompted for
the old password before changing the password.

I guess the idention of those checks is that "root" should be able to
change a users password without being prompted for the old password.
There are however some issues with that:

• Most PAM clients run with a real uid of root(0), so that check will not
  work correctly in many cases. A notable exception being the passwd
  command. But with password policies in place password changes can be
  triggered from almost every PAM client.

• When using the LDAP backend even root would need to somehow
  authenticate against the LDAP Server to be able to change a users
  password.

I already send a proposed patch/workaround to the list:
https://fedorahosted.org/pipermail/sssd-devel/2010-March/002842.html