LabManager is just a read-only consumer of an LDAP resource. You mentioned AD, so probably the best way is to have some domain member machine (or VM!) available for remote desktop connections for people to RDC into in order to do password changes. Or, likewise with an openldap server, a linux machine to serve a similar role. I believe there are also some third party web based apps that can serve in a browse-to-and-change capacity; but again, LM is a read-only consumer of whatever LDAP wants to tell it.