I wrote a post on my personal blog with some password policy recommendations for the Ping Identity Directory Server. Note that while the post is specific to the Ping Identity Directory Server, particularly with regard to some of the features and a lot of the configuration properties, much of the advice is general enough that it could be applied to other servers as well.