Change ACL for non-privileged users to not work on reset model, instead allow registrars to change unprivileged passwords directly
puppet/modules/openldap/templates/mandriva-dit-access.conf