Our content manager (2011 SP1) uses LDAP directory service for authentication. There are tridion editors who would use ONLY Tridion and nothing else. New users of this kind will not be able to login to the Tridion CME since the AD will be set to "Change password on first login" and Tridion would still show the basic authentication grey box rather than a prompt for a new password. Can we extend Tridion.Security and built a authentication mechanism for change and reset password? If Tridion just leverages the IIS Basic Authentication, then a custom .NET forms authentication should be built to meet the requirements. If that is the case, I will post the question in a Microsoft forum.
Tridion will make sure the person is authenticated from the AD, but that's it. Tridion as an organization has a best-of-breed approach and tries not to do things that others have done well, including authorization solutions. They sit on top and integrate with other well defined and correct solutions.
I would suggest to place a page on your extranet login success page that allows new users (ie. Tridion editors) to update their password. Making it a 'Tridion problem' is only making the solution more complex and opaque.