anchor.diff:    by anonymous auth
   
   
  -
   ## DO NOT MODIFY THIS LAST 'CATCH ALL' RULE.  IT COVERS EVERTHING THAT
   ## IS NOT EXPLICITLY COVERED AVOVE.
   
   ## Catch all, explicitly allow anything not covered above.
   access to *
  - by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
  - by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
  - by dn="cn=nss_ldap,ou=users,ou=services,dc=apache,dc=org" read
  - by * read
  - by anonymous none
  +by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
  +by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
  +by dn="cn=nss_ldap,ou=users,ou=services,dc=apache,dc=org" read
  +by * read
  +by anonymous none
   
   # The root DIT should be accessible to all clients
   access to dn.exact=""
  
positive.code: access to dn.subtree="cn=Subschema"
          by * read
  
  
  
negative.code: ## Allow users, and selfserve to modify a users password.
  access to dn.subtree="ou=people,dc=apache,dc=org"
    attrs=userPassword
    by self write
    by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
    by dn="cn=idao-rw,ou=users,ou=services,dc=apache,dc=org" write
    by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=httpduser,ou=users,ou=services,dc=apache,dc=org" read
    by * auth
    by anonymous auth
  
  ## Allow self & secretary@ to edit email addresses
  access to dn.subtree="ou=people,dc=apache,dc=org"
    attrs=mail
    by self write
    by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
    by group.exact="cn=asf-secretary,ou=groups,ou=services,dc=apache,dc=org" write
    by dn="cn=idao-ro,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=nss_ldap,ou=users,ou=services,dc=apache,dc=org" read
    by * read
    by anonymous auth
  
  ## Allow users to edit a subset of their own personal attributes.
  ## NOTE that mail,userPassword have been moved out to allow further access by others
  access to dn.subtree="ou=people,dc=apache,dc=org"
    attrs=sn,givenName,loginShell,asf-sascore,asf-pgpKeyFingerprint,sshPublicKey,asf-member-activeprojects,asf-member-affiliationurl,asf-member-affiliation,asf-member-personalurl,asf-member-status,asf-altEmail,asf-personalURL
    by self write
    by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
    by dn="cn=idao-ro,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=nss_ldap,ou=users,ou=services,dc=apache,dc=org" read
    by * read
    by anonymous auth
  
  
  ## Allow users to read thier ICLA data, but only allow secretary@
  ## to edit it.
  access to dn.subtree="ou=people,dc=apache,dc=org"
    attrs=asf-icla-legalname,asf-icla-email,asf-icla-file
    by self read
    by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
    by group.exact="cn=asf-secretary,ou=groups,ou=services,dc=apache,dc=org" write
    by dn="cn=idao-ro,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=nss_ldap,ou=users,ou=services,dc=apache,dc=org" read
    by * read
    by anonymous auth
  
  
  ## Make a user icla-publicname writable by 'self' and readable by
  ## any authenticated user.
  access to dn.subtree="ou=people,dc=apache,dc=org"
    attrs=asf-icla-publicname
    by self write
    by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
    by group.exact="cn=asf-secretary,ou=groups,ou=services,dc=apache,dc=org" write
    by dn="cn=idao-ro,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=nss_ldap,ou=users,ou=services,dc=apache,dc=org" read
    by * read
    by anonymous auth
  
  
  ## Allow PMC chairs, and Hudson admins to grant job admin privs
  access to dn.subtree="ou=hudson,ou=apps,ou=groups,dc=apache,dc=org"
    attrs=memberUid,member
    by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
    by group.exact="cn=pmc-chairs,ou=groups,ou=services,dc=apache,dc=org" write
    by group.exact="cn=hudson-admin,ou=groups,ou=services,dc=apache,dc=org" write
    by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=nss_ldap,ou=users,ou=services,dc=apache,dc=org" read
    by * read
    by anonymous auth
  ## Allow the PMC chairs to edit group memberships.
  access to dn.subtree="ou=groups,dc=apache,dc=org"
    attrs=memberUid,member
    by group.exact="cn=apldap,ou=groups,ou=services,dc=apache,dc=org" write
    by group.exact="cn=asf-secretary,ou=groups,ou=services,dc=apache,dc=org" write
    by group.exact="cn=pmc-chairs,ou=groups,ou=services,dc=apache,dc=org" write
    by dn="cn=ldaprepl,ou=users,ou=services,dc=apache,dc=org" read
    by dn="cn=nss_ldap,ou=users,ou=services,dc=apache,dc=org" read
    by * read
    by anonymous auth
  
  
  ## Explictly make the pmc-chairs group writable only to apldap (root@ equiv) and the ASF Secretary Group
  