LDAP auth and password change over VPN

Hello! Who can make sense of these two pieces of information?

FortiOS Handbook: Authentication for FortiOS 5.2, PDF file, page 28:

password-expiry-warning and password-renewal In SSLVPN, when an LDAP user is connecting to the LDAP server it is possible for them to receive any pending password expiry or renewal warnings. When the password renewal or expiry warning exists, SSLVPN users will see a prompt allowing them to change their password. password-expiry-warning allows FortiOS to detect from the LDAP server when a password is expiring or has expired using server controls or error codes. password-renewal allows FortiOS to perform the online LDAP password renewal operations the LDAP server expects.

Fortigate-cli-5.2.pdf, page 720:

FortiGate LDAP support does not extend to proprietary functionality, such as notification of password expiration, that is available from some LDAP servers. FortiGate LDAP support does not supply information to the user about why authentication failed.

And below this, there are options:

config user ldap

edit <server_name>

set password-expiry-warning {disable | enable}

set password-renewal {disable | enable}

...

end

Now why I am asking this is that I enabled these two options and set my own account in a state where I should change my password in next logon which I did with VPN (with Windows AD). FortiClient really tells me that I have to change my password but when I do this by entering new password twice, I just get Permission denied (-455) or something like that and that's it. What is wrong here? I even added the internal user that authenticates LDAP to Domain Admins group but that didn't help to really password successfully and log in. When I checked from AD server which password actually works, old or the entered new one, it turned out that the password wasn't actually changed.

Any hints or experience with this?

Thank you.