Answer
This is commonly a missing-permission issue rather than something needing a system-wide parameter change — grant the specific Presentation Object(s) and Database Object(s) that support the self-service change-password functionality to the affected users' Permission Sets (the same underlying grants referenced for this exact capability), rather than assuming Change Password is only usable by the application-owner account. Once those specific grants are added to a user's permission set, self-service password changes work the same way for that user as they do for IFSAPP.