Many thanks for this. It turned out that my problem was indeed to do
with Kerberos auth. The authz-regexp stuff was fine; the problem was
that I was trying to use slurpd_adm as the replicator DN/ticket, but
ldapadm as the usual admin DN/ticket. Thus during my test runs, I would
kinit as ldapadm; which meant that slurpd was using this available
ticket, but on the slave server ldapadm was not set up as the replication
DN so replication failed.
On altering my setup so that ldapadm was used for all (i.e. was in the
'replica' config on the master, although as above that's not necessary;
had a kerberos ticket on the master; was the updatedn value on the slave;
and had appropriate access on the slave), it worked fine.
Unfortunately, it seems that it's not possible to have 2 Kerberos tickets
active at the same time: i.e. it's not possible for me to set up
slurpd_adm as the replication user, & have k5start managing that ticket,
and then to kinit as ldapadm (the admin user) on the master server - if I
do so, replication stops working. I.e. the replication user & the admin
user need to be the same if one wishes to be able to run admin tasks
whilst logged on to the master server.