hadmut@danisch.de wrote:

But this opens other questions:

Does slapd support multiple password entries?

Of course. The schema definition for userPassword says that it is a multivalued attribute. (Note: "values" not "entries". Seems you need to do some more reading on LDAP basics.)

What does slap (and slappasswd) do if there are multiple entries for userPassword? Does slapd check them all until one of them matches?

slappasswd doesn't know anything about that. slapd checks until it finds a match.