[Samba] changing samba user password

[Sonic]

Looking for a good, and secure, way to have users in a Samba AD environment
be able to change their passwords without using a Windows domain member
client or having local user or shell access to the AD system.
Web based would probably be ideal, but I don't want some huge set of
modules that do everything under the sun, just this one task.
Possible? With what?

Thanks!

Chris