The Ping Identity Directory Server offers a get password policy state issues control that can give an authorized client more information about the reason for an authentication failure and potential issues with a user’s password policy state. I wrote about it on my personal blog at https://nawilson.com/2019/02/11/the-get-password-policy-state-issues-control-in-the-ping-identity-directory-server/