You can get the encrypted password out of ldap by running:
ldapsearch -x -W -D "uid=zimbra,cn=admins,cn=zimbra" -b 'dc=domain,dc=com' -h zimbraldaphost.domain.com '(uid=username)' userPassword
You then have to enter the ldap zimbra/admin password. If you don't know the password you can get it by running:
zmlocalconfig -s ldap_root_password |