Password expiration value is calculated wrong when ldap_expirationtime2unix() returns 0. This 0 value means 'password doesn't expire' in Active Directory for example (see MDL-4687 for a patch that adds password expiration support for Active Directory), but the current code substracts $now from 0 and gets a negative value instead.

The attached patches (for 1.8 and 1.9) fix this issue.

Saludos. Iñaki.