Note that with slapd-ldap, the special character "*" actually allows anonymous rather than denies, as is the case with authz-policy