> access to dn=".*,dc=example,dc=com" attr=userPassword dn.subtree="dc=example,dc=com" would likely work better than a regex. If you still want to use a regex, dn.regex would be in order.