I have seen a response from gluu staff here on the support pages, where they say that gluu does not save the password in it's own ldap, so the second question is answered.
However, it also seems that gluu does not enable an end-user to change his/her ldap password. In MSAD this should be possible, without requiring special permissions. (the first method on https://support.microsoft.com/en-us/help/269190/how-to-change-a-windows-active-directory-and-lds-user-password-through)