It is caused by
Users password reset does not work when LDAP export is enabled. When the process tries to log in the user with the new password, it is not found in LDAP (the password has not been updated) and an error 400 occurs.
1. Build up a Liferay LDAP environment and set LDAP authentication to required
2. Log in with an imported user
3. Update the password of this user in Liferay
New password is not updated and exported and user cannot log in. Error 400 occurs.
User can log in with the new password and its updated in Liferay and LDAP.