I'm wondering about LDAP, which I don't know very well.
To mitigate large compromisson in case of hack, I would like to use two different passwords for an LDAP account: a password for connecting to the web backoffice and a password for the VPN, with the same username. This way, if someone compromises a web server and store logins and passwords used for connexion, they won't be able to enter the network because the VPN password will be different. Does LDAP allow this to be done?
(PS: I will of course use a yubikey and OTP token on the backoffice and VPN but nevertheless I would like to differentiate passwords).
Thank you community !