Prevent locally managed user from changing their own password

For some use-cases, an administrator might want to prevent a user from changing their own password.  Only allowing admins to change the passwords.   Today the only way to do this is to use external authentication like LDAP and configure it there.