目前想要在OpenLdap 設定特定帳號可以readonly userPassword屬性

找了一下資訊照著設定

dn: olcDatabase={0}config,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * break
olcAccess: {1}to * by self write by * none
olcAccess: {2}to attrs=userPassword by dn="cn=admin,dc=example,dc=com" write by dn="cn=user1,dc=example,dc=com" read by anonymous auth by self write by * none

然後執行上述內容的setting.ldif檔
ldapmodify -Y EXTERNAL -H ldapi:/// -f setting.ldif
得到以下訊息

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"

然後有試著去查看slapd.d/cn=config 下的 olcDatabase{0}config.ldif
也有看寫入了

但再下 ldapsearch -x -D "cn=user1,dc=example,dc=com" -w xxxxxx -b "dc=example,dc=com" "uid=xxxxxxx"

找出來就是沒有userPassword 屬性值，如改用最大權限帳號就是可以看到userPassword

請問各位大大，小弟少做了什麼 還是這樣設定還是無法查看userPassword

謝謝