--- slapd.conf ---
access to *
  by anonymous auth

access to *
  by self write

access to *
  by users read 
--- slapd.conf ---

You may think this will allow any user to login, to read everything and change his own data if he is logged in. But in this example only the login works and an ldapsearch returns no data. The Problem is that SLAPD goes throgh its access config line by line and stops as soon as it finds a match in the part of the access rule.(here: "to *")

To get what we wanted the file has to read:

--- slapd.conf ---
access to *
  by anonymous auth
  by self write
  by users read 
--- slapd.conf ---

The general rule is: "special access rules first, generic access rules last"