acl usage

[Harry Hoffman <h.hoffman@auckland.ac.nz>]

Hi All,
    I'm trying to setup ACL's for our openldap-2 server. The acl's look like 
this:
access to attr=userPassword
        by self write
        by anonymous auth
        by * auth
access to dn=".*,ou=People,o=The University of Auckland,c=NZ"
       by anonymous auth
       by * auth
access to *
        by self write
        by users read
        by * read

I'm trying to set the acl's so that an anonymous user can authenticate to:
"uid=user,ou=People,o=The University of Auckland,c=NZ"
but not actually read any other attributes from there.
Can anyone tell me what I'm doing wrong?

Thanks,
Harry