I just ran into this issue, and solved it differently than the foregoing. I am setting up a new LDAP on CentOS 6.4 (for eventual deployment on RHEL 6.4), and it defaults to the "(cn=config)" configuration scheme, so all the (no doubt excellent) instructions above for modifying slapd.conf don't apply.
In the "(cn=config)" way (also called "slapd.d" on some websites), there are lots of steps to getting overlays to work. The default CentOS 6.4 LDAP I was dealing with included the ppolicy schema, but it wasn't activated.
To get it going, there were many steps:
First, the "ppolicy" module is dynamic, you have to make sure it's included in the list of run-time modules. The default CentOS install didn't have any, so I first had to turn on modules, and then add ppolicy to the list. This LDIF does it:
dn: cn=Module{0},cn=config
objectClass: olcModuleList
cn: Module{0}
olcModuleLoad: ppolicy
If you later want to add more modules, just append additional olcModuleLoad entries to this dn.
Second, you have to turn on the overlay for the database(s) to which you want it to apply. Create another dn, thus:
dn: olcOverlay=ppolicy,olcDatabase={2}bdb,cn=config
objectClass: olcPPolicyConfig
olcOverlay: ppolicy
These first two steps get done in the "cn=config" domain, i.e. outside the database, by the root user of the machine. Subsequent steps are in "dc=example,dc=com" scope, and so can be done by the rootDN.
The third step is to create a container for your password policies. This might be optional, I'm not sure -- I created a dn like:
dn: ou=pwpolicies,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: pwpolicies
Fourth, create your actual policy -- people who have run into this error already have this, this is the dn with the "pwdAttribute" thing that's getting the syntax error. With the foregoing overlay and module work done right, you can use pwdAttribute: userPassword" without getting a syntax error. My policy was inside the ou container, of course, and I used an objectClass of "device" in addition to "pwdPolicy", as has been suggested elsewhere.
Finally, you can then actually use the policy, of course.
This whole process was made more confusing for me because so much of the documentation out there is about how to set up slapd.conf. I pieced most of this together from the Zytrax "LDAP for Rocket Scientists" book, which covers the module and overlay stuff very well, but has a wrong or obsolete example (missing a structural object class) in their password policy section.
