Description of problem:

I don't know if this has been on purpose as a feature or if it could be
considered as a bug. Customers are confused about this.

For them, adding a user to the group "cn=admins" is enough to make a user have
the same rights of "admin" user.

But there's at least a Permission missing, that is to be able to do this:

aci: (targetattr = "krblastpwdchange || krbpasswordexpiration || krbprincipalk
 ey || userpassword")(target = "ldap:///uid=*,cn=deleted users,cn=accounts,cn=
 provisioning,dc=cgparente,dc=local")(targetfilter = "(objectclass=posixaccoun
 t)")(version 3.0;acl "permission:System: Reset Preserved User password";allow
  (read,search,write) groupdn = "ldap:///cn=System: Reset Preserved User passw
 ord,cn=permissions,cn=pbac,dc=cgparente,dc=local";)

Example:

user "example" is member of admin groups:

ipa group-show admins
  Group name: admins
  Description: Account administrators group
  GID: 142600000
  Member users: admin, example
  Member of groups: ad_users


kinit example
Password for example@CGPARENTE.LOCAL:

ipa user-del test --preserve
ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the
'krbLastPwdChange' attribute of entry 'uid=test,cn=deleted
users,cn=accounts,cn=provisioning,dc=cgparente,dc=local'

ipa role-add-member "User Administrator" --user=example

kinit example
ipa user-del test --preserve

Works.