Ruby/LDAP is an extension library for Ruby. It provides the interface to some LDAP libraries (e.g. OpenLDAP, Netscape SDK and Active Directory). The common API for application development is described in RFC1823 and is supported by Ruby/LDAP.
A little command-line tool and a little php module to change kerberos passwords, even on a Active Directory server, even already expired ones. It runs on Linux, no additional configuration (or access) to the kerberos server is needed.