I guess you're using OpenLDAP backend, right?
Reference: http://iredmail.org/wiki/index.php?titl … be_Webmail

// SQL Driver options
// ------------------
// PEAR database DSN for performing the query. By default
// Roundcube DB settings are used.
//$rcmail_config['password_db_dsn'] = '';
$rcmail_config['password_db_dsn'] = 'mysqli://roundcube:xxx@localhost/vmail';

// The SQL query used to change the password.
// The query can contain the following macros that will be expanded as follows:
//      %p is replaced with the plaintext new password
//      %c is replaced with the crypt version of the new password, MD5 if available
//         otherwise DES.
//      %o is replaced with the password before the change
//      %n is replaced with the hashed version of the new password
//      %q is replaced with the hashed password before the change
//      %h is replaced with the imap host (from the session info)
//      %u is replaced with the username (from the session info)
//      %l is replaced with the local part of the username
//         (in case the username is an email address)
//      %d is replaced with the domain part of the username
//         (in case the username is an email address)
// Escaping of macros is handled by this module.
// Default: "SELECT update_passwd(%c, %u)"
//$rcmail_config['password_query'] = 'SELECT update_passwd(%c, %u)';
$rcmail_config['password_query'] = 'UPDATE mailbox SET password=%c,modified=NOW() WHERE username=%u LIMIT 1';

$rcmail_config['plugins'] = array('additional_message_headers', 'archive');

I added 'LIMIT 1' in iRedMail moment ago, thanks for your remind.
And we use this in plugin:

$rcmail_config['password_query'] = 'UPDATE vmail.mailbox SET password=%c,modified=NOW() WHERE username=%u LIMIT 1';

UPDATE vmail.mailbox SET password=%c,modified=NOW() WHERE username=%u LIMIT 1';