cloned from https://bugzilla.redhat.com/show_bug.cgi?id=2109236

Description of problem:

ldap bind occurs when admin user changes password with gracelimit=0

Version-Release number of selected component (if applicable):

ipa-server-4.9.10-4.module+el8.7.0+15926+daa9f08b.x86_64

How reproducible:

Always.

Steps to Reproduce:

1. ipa user-add user1 --first=user1 --last=s
2. ipa passwd user1
3. ipa pwpolicy-mod --gracelimit=0
4. Now run ldap bind.

Actual results:

When password for the ipa user is changed by an administrator the grace period is set to 0.
It allows bind.
[root@server ~]# ldapsearch -LLL -x -D 'uid=user1,cn=users,cn=accounts,dc=rhel87,dc=test' -W -e ppolicy -b uid=user1,cn=users,cn=accounts,dc=rhel87,dc=test dn -v
ldap_initialize( )
Enter LDAP Password:
filter: (objectclass=*)
requesting: dn
dn: uid=user1,cn=users,cn=accounts,dc=rhel87,dc=test

Expected results:

With Grace Period Value=0 All LDAP BIND on expired passwords are denied
Basically -1 and 0 values are behaving the same.