I just ran into this problem and solved it differently from the previous one. I install the new LDAP on CentOS 6.4 (for possible deployment on RHEL 6.4), and by default it uses the "(cn = config)" configuration scheme, so all (no doubt excellent) instructions for changing slapd.conf don't apply.
The "(cn = config)" method (also called "slapd.d" on some websites) has many steps for getting overlays to work with. In the standard CentOS 6.4 LDAP client I was dealing with, the ppolicy scheme was enabled, but it was not activated.
For this to happen, there were many steps:
Firstly, the "ppolicy" module is dynamic, you have to make sure that it is included in the list of runtime modules. The CentOS installation did not have a default, so I had to turn on the modules first and then add ppolicy to the list. This LDIF does this:
dn: cn=Module{0},cn=config objectClass: olcModuleList cn: Module{0} olcModuleLoad: ppolicy
If you later want to add additional modules, just add additional olcModuleLoad entries to this dn.
Secondly, you must include an overlay for the base (s) to which you want to apply. Create another dn like this:
dn: olcOverlay=ppolicy,olcDatabase={2}bdb,cn=config objectClass: olcPPolicyConfig olcOverlay: ppolicy
These first two steps are performed in the cn = config domain, that is, outside the database, by the root user of the machine. The next steps are in the scope of "dc = example, dc = com", and therefore this can be done using rootDN.
The third step is to create a container for your password policies. This may be optional, I'm not sure - I created dn like:
dn: ou=pwpolicies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: pwpolicies
Fourth, create your actual policy - people who have encountered this error already have this, this is dn with the thing "pwdAttribute", which receives a syntax error. Of course, my work was inside the ou container, and I used objectClass for the “device” in addition to “pwdPolicy”, as suggested elsewhere.
Finally, you can actually use this policy, of course.
This whole process has become more confusing for me, because most of the documentation on how to configure slapd.conf. I have collected most of this information from Zytrax's book “LDAP for Rocket Scientists,” which covers module and overlays very well, but has an incorrect or outdated example (missing a structural object class) in the password policy section.