access to attr=*
       by group.exact="cn=phone,ou=groups,dc=example,dc=com"
       by user       read
       by *          none