We use ipa-server-4.6.4-10.el7.centos.6.x86_64

and update expiration check script:

#  userpw_expiry_datetime=$(/usr/bin/ipa user-show ${user} --all | grep krbpasswordexpiration | awk '{print $2}' | cut -c 1-14)
   userpw_expiry_datetime=$(/usr/bin/ipa user-show ${user} --all | grep -i "password expiration:" | awk '{print $4}' | cut -c 1-14)

This is work for me.

Regards. Igor S.