OpenLdap how to create an attribute-analogue of userPassword?

Question

OpenLDAP

Set up Postfix+Dovecot+OpenLDAP mail system. Dovecot works as a local delivery agent. It takes 3 parameters from the database: user, password and mail_crypt_private_password. Users' keys are encrypted last to encrypt all mail in their mailboxes. Each user has their own key.

I ran into a problem related to insufficient knowledge of Ldap: at the moment, Dovkot's mail_crypt_private_password parameter is taken from the Ldap "description" attribute. I understand that this is wrong, this is not the attribute for storing passwords and it is stored in clear text (unlike userPassword). I did not find an attribute similar to userPassword in the available schemes. Here I see a solution of 2 options:
1. Manually create an attribute similar to userPassword. Made an additional schema "dovecot-options.schema" with one mailcryptPassword attribute and its corresponding objectClass. The attribute has been added, but with the properties of plain text. And it should be with userPassword properties.
2. For each mail user in the database, create a children record containing the userPassword attribute. But then it is not clear how Dovecot will distinguish the user password userPassword=password from the encryption password userPassword=mail_crypt_private_password, 100% that there will be errors and problems.

I think it's more correct to create a separate mailcryptPassword attribute, but how to create it so that its properties are the same as those of userPassword? It - like the user's password - will be stored in the database as an SSHA hash.
I ask those who are well versed in OpenLDAP to respond

Answer 1

Look here
https://github.com/ValV/postfix-dovecot-ldap-schema

Answer 2

Thank you, I tried to add this scheme. Unfortunately, the included mailPassword attribute is again saved as plain text. That is, theoretically, the hoster and any interested authorities can easily spy on it.
I tried to make it a descendant of userPassword so that it gets all the properties of the parent - it didn’t work, it is stubbornly saved in plaintext. It looks like userPassword is the only one of its kind. I'll try to write to the OpenLDAP developers