If you have multiple sites for the same user base then I must highly suggest some form of single sign on(like Shibboleth). When users have different passwords for multiples sites they tend to have trouble remembering them all. One or two passwords are easily remembers by most people, three the user may write them down in a secret location. If more then four the user very well may just write them all out on a post it note and apply it to desk or monitor.
Passwords need not be overly complex, though they need to be complex enough to prevent first or second attempt's. As long as your system/sites have some sort of security measure which limits the number of log in attempts then the passwords don't need to be over complex.
As an example, if your systems have a limit of 3 logon attempts per hour, then a basic password such as "Cindy65" is more then complex enough. While the hacker may know that the users real name is Cindy, he really would never know that she was born in 1965. His attempts would naturally be "cindy", "lastname", "Cindy", Lastname", though by this time he is blocked out.
While this may be a simplistic case and a simple password, it is all that is really needed if you the admin have set up everything correct server side. We can also ask for slightly more complex passwords that is easy to remember, such as a random combination of keys. Symbols and capital letters also help greatly.
We just need to remember, the harder we make it on the user, the more likely it is that they will write it down in public.
One thing I always like to ask my users to do is write their name concatenated with the name of a medication they are on, favorite food, best friends name, etc. These combination of dictionary words while simplistic are nearly impossible to crack.
Examples:
CindyProzac,
WilliamCodene,
JoePetertherabbit
Good Luck.