access to *
    by dn.regex="cn=syncrepl-(ldap1|ldap2),dc=example,dc=com" read
    by * break

access to attrs=userPassword
    by dn.regex="cn=admin,dc=example,dc=com" write
    by anonymous auth
    by self write
    by * none

access to attrs=gecos
    by dn.regex="cn=admin,dc=example,dc=com" write
    by anonymous read
    by self write
    by * none

access to *
    by dn.regex="cn=admin,dc=example,dc=com" write
    by * read