Would it be feasible to make an access type of fdServerPassword - in the Systems schema, and make the passwords to systems such as Dovecot be of that type, then add LDAP access rules to make attribute fsServerPassword unreadable, except by whatever LDAP account FreedomDirectory uses ?
Best John