anchor.diff:  access to dn.subtree="cn=Subschema"
           by * read
   
  -
  
positive.code:   by anonymous auth
  
  
  
  ## DO NOT MODIFY THIS LAST 'CATCH ALL' RULE.  IT COVERS EVERTHING THAT
  ## IS NOT EXPLICITLY COVERED AVOVE.
  
  ## Catch all, explicitly allow anything not covered above.
  access to *
   by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
   by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
   by dn="cn=nss_ldap,ou=users,ou=services,dc=apache,dc=org" read
   by * read
   by anonymous none
  
  # The root DIT should be accessible to all clients
  access to dn.exact=""
  
negative.code: <%
  schemas = hiera(ldapserver::schemas)
  modules = hiera(ldapserver::modules)
  ldap_indexes = hiera(ldapserver::indexes)
  ldap_servers = hiera(ldapserver::slapd_peers)
  -%>
  
  ## This file is managed by puppet, all local changes will be lost
  ## during the next puppet catalog run
  
  