Howard Chu writes:
You could write an overlay that intercepts Bind operations and compares against those attributes if you wish. The stock code only compares against userPassword.
...and combine it with contrib/slapd-modules/smbk5pwd/, so the Password Modify operation will work right.