allow bind_anon_dn
access to attrs=userPassword,sambaNTPassword,sambaLMPassword
by self write
by anonymous auth
by * none
access to dn.regex="^uid=([^,]+)ou=People,dc=azapple,dc=com$$"
by self read
by anonymous auth
by * none
# a bottom catchall rule...
access to *
by anonymous read
by * read
access to dn.base="cn=Subschema" by * read