https://bugs.openldap.org/show_bug.cgi?id=7981
--- Comment #3 from Ondřej Kuzník ondra@mistotebe.net --- Rather than extending the pwdPolicy objectclass, maybe the new mechanism added in ITS#9343 could be used to override the default scheme if desided?