Is there an example of setting an Active Directory attribute from F5 iRule or Access Policy?

This one went quiet, but now we want a solution. Move to 11.6.

May be there are other routes to a solution, but I think it makes sense to try and do this in the style of Arnaud's first answer - e.g. using a regular APM component, since the password change will fail sometimes, and we would want to handle those errors in the same style as when conducting a normal login.