anchor.diff:  
   ## Allow 'self' to edit subset of own attrs, even in the sandbox.
   access to dn.subtree="ou=sandbox,dc=apache,dc=org"
  -attrs=mail,sn,givenName,userPassword
  +  attrs=mail,sn,givenName,userPassword
     by self write
     by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
     by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
  
positive.code: # Replication Directives:
  
  <%-
  ldap_servers = slapd_peers.select { |x| x != Facter.value(:hostname) }
  ldap_servers.each do |server|
  -%>
  syncrepl rid=<%= server.split('-')[0].gsub('ldap', '') %>
  
negative.code: 
  ## Catch all, explicitly allow anything not covered above.
  access to *
    by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
    by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=nss_ldap,ou=users,ou=services,dc=apache,dc=org" read
    by * read
    by anonymous none
  
  # The root DIT should be accessible to all clients
  access to dn.exact=""
    by * read
  
  # So should the schema
  access to dn.subtree="cn=Subschema"
    by * read
  
  