This is all done and working. In the end, the changes I needed were:
dn: cn=config
changetype: modify
replace: nsslapd-allow-anonymous-access
nsslapd-allow-anonymous-access: rootdse
dn: dc=example,dc=com
changetype: modify
delete: aci
aci: (targetattr!="userPassword || aci")(version 3.0; acl "Enable
anonymous access"; allow (read, search, compare)
userdn="ldap:///anyone";)
dn: dc=example,dc=com
changetype: modify
add: aci
aci:
(target="ldap:///($dn),dc=example,dc=com")(targetattr!="userPassword
|| aci")(version 3.0;acl "aci";allow (read,search)
userdn="ldap:///cn=*,[$dn],dc=example,dc=com";)
This page was also useful:
https://access.redhat.com/documentation/en-us/red_hat_directory_server/9....
Many thanks to Olivier Judith, Mark Raynolds, and Ludwig Krispenz for
their help!
Glad you got working, and glad Ludwig mentioned macro aci's (these are
often overlooked)!
Best Regards,
Mark