/usr/bin/passwd offers a "safe way" for root to edit /etc/passwd (or shadow). If setuid it allows regular users to change passwd without asking root to do changes for them.
(note: does have learning curve on args to choose)
gnupasswd - gnu change user password
gnugpasswd - gnu change group password
gnupasswd(1) has a goal to work with older login.c/linux and some newer too, also "getpwent" (any glibc). or help convert.
gnupassd does pass only: leaves all else alone (compat). ...
Event Manager for OpenLDAP is an internal LDAP event handler that can execute operations to automate tasks. It can be used as base for remote automation, Identity Management, and so on.