Finally, I've got a solution.

I managed to get the pwm (Password Management) solution off of the
forge. (http://forge.novell.com/modules/xfmod/project/?pwm)

This is a really clean solution and integrates nicely with AM. It does
require Java JDK 5 and tomcat 4 or 5. It won't run on Netware because
JDK 5 isn't available for Netware.

I built a SLES 10 box with JDK 5 and tomcat5 to run it on -- an
adventure in its own right -- and it works perfectly.

My last little glitch is getting tomcat 5 to start as a daemon at
boot. Put the working script into init.d, pointed to it from rc3.d,
but it doesn't start.

Oh, well.

Thanks all,

Don