ampassword -a (admin) doesn't work

Unless my expectations of the purpose of this command are wrong, this doesn't seem to work at all. Aside from the simple JAVA_HOME problem. I have done the following on 10.1.0, 11.0.0 and 11.0.1:

1) Install and configure in simplest/default configuration
2) Install appropriate admintools, fix JAVA_HOME.
3) Try ./ampassword -a -o <filewithpasswordin> -n <filewithnewpasswordin>

In both scenarios it successfully binds to the config store and runs a number of relevant searches, before coming back with:

11.0.x:

$ ./ampassword -a -o oldpass -n newpass
Passwords do not match in directory server

10.1.0:

Exception in thread "main" java.lang.NoClassDefFoundError: com/sun/identity/entitlement/EntitlementException
	at com.sun.identity.idm.server.IdServicesImpl.checkPermission(IdServicesImpl.java:2749)
	at com.sun.identity.idm.server.IdServicesImpl.setAttributes(IdServicesImpl.java:1662)
	at com.sun.identity.idm.server.IdCachedServicesImpl.setAttributes(IdCachedServicesImpl.java:528)
	at com.sun.identity.idm.AMIdentity.store(AMIdentity.java:589)
	at com.iplanet.services.ldap.ServerConfigMgr.changePassword(ServerConfigMgr.java:405)
	at com.iplanet.services.ldap.ServerConfigMgr.main(ServerConfigMgr.java:468)

I have tried various combinations including specifying the passwords inline (not in file), swapping old and new pass, using the UrlPolicyAgent password rather than the admin password(s)

Specifying old and new passwords the same does give an appropriate error, which leads me to believe this probably isn't a command line argument or file reading issue.