Problem with ACLs

[Bill Bradford <mrbill@mrbill.net>]

Trying to give a single user "read only" access to everything in
the database including userPassword info.

Here's the LDIF file I'm using w/ldapmodify:

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange
 by dn="cn=Manager,dc=domain,dc=com" write
 by dn.exact="uid=romanager,ou=Users,dc=domain,dc=com" read
 by anonymous auth
 by self write
 by * none
olcAccess: {1}to dn.base=""
 by * read
olcAccess: {2}to *
 by dn="cn=Manager,dc=domain,dc=com" write
 by * read

However, authenticating as uid=romanager,ou=Users,dc=domain,dc=com
lets that user read his own password hash, but nobody else's.  In
other words it's authenticating just like any other user, and it's
as if the 

by dn.exact="uid=romanager,ou=Users,dc=domain,dc=com" read

line is being ignored.  The change is being applied as I've looked
at the database files for the config.  I've tried restarting slapd, etc.

Any suggestions?

@(#) $OpenLDAP: slapd 2.4.44 (Aug  4 2017 14:23:27) $

Bill

--
Bill Bradford
Houston, Texas USA