Change "nsslapd-allow-anonymous-access" to "rootdse" in
"cn=config" on all IPA Servers:
$ ldapmodify -x -D "cn=Directory Manager" -W -h
server.example.com -p 389 -ZZ
dn: cn=config
changetype: modify
replace: nsslapd-allow-anonymous-access
nsslapd-allow-anonymous-access: rootdse