This is a great hint. Thanks for posting it. I have been testing it out and it works fine on our 10.4.8 server, but returns a 1021 days left on our 10.3.9 server. Would there be anything different about the AD plugins?

I can see a few uses for this.

1) Our AD authenticated realm can now being to remind people when their passwords are about to expire. We can grab the user name from their login and send it to the script, have it show up in bright red of something on the landing page.
2) AD login users. OS 10.4 now reminds us our password is expiring, but that does not mean people will change it in time. We could now use this script to check the expiration date, if it is less than three days or so, take them to the online password change page. Could even run a cron job to get around those who leave their computers on at night.

Again, great hint, thanks for posting it!