access to dn.regex="^uid=[^,]+,dc=([^,]+),(uid=[^,]+,ou=kunden,dc=example,dc=com)$$"
        attrs=pfAccountStatus,pfMail,pfClearPassword,pfMailHost,pfMailMessageStore,pfMailForwardingAddress,PFClientAccount,PFDomain,PFMailAccount
        by self read
        by dn.exact="cn=mailsystem,dc=example,dc=com" read