Grouper Local Auth ( and the GrouperClient )

It would be useful if:

A)  User could use the UI and establish a personal WS password/certificate.
           ( Single factor, and LOCAL to grouper.)
B)   Uses WS password/certificate with grouperClient.

 
C) There was a Webservice password to change  method to
          Allow the current user to change their own password
          Allow an authorized "WebService password admin" to change "select other" users the passwords

D) A way to configure an auto expire ( time limit/bound ) the password/certificate.

E) Still require the user to be authorized to use WebServices. (AKA: grouper-ws.properties:ws.client.user.group.name )

Similar/Related to 
https://todos.internet2.edu/browse/GRP-2396