The error seems to be from a backend system and not IdM and that means that the IdM policy is not the source of the issue. Perhaps you have a problem with different KEYS.INI files between the runtime system and the GUI system and because of that the runtime is unable to decode the password and sap_GetPassword returns an empty string. You can modify the sap_GetPassword to log the length of the input Par and the result after decoding to verify this.
Br,
Chris