No, LDAP ACLs work, group was wrong..

ansible-inventory.yml

@@ -35,30 +35,30 @@ all:
       acls:
       - >-
         {0}to attrs=userPassword
-        by dn="cn=uffd,ou=system,dc=example,dc=com" write
-        by group="cn=uffd_admin,ou=groups,dc=example,dc=com" write
-        by self write
+        by dn="cn=uffd,ou=system,dc=example,dc=com" =xw
+        by group/groupOfUniqueNames/uniqueMember.exact="cn=uffd_admin,ou=groups,dc=example,dc=com" =xw
+        by self =xw
         by anonymous auth
       - >-
         {1}to attrs=shadowLastChange
         by dn="cn=uffd,ou=system,dc=example,dc=com" write
-        by group="cn=uffd_admin,ou=groups,dc=example,dc=com" write
+        by group/groupOfUniqueNames/uniqueMember.exact="cn=uffd_admin,ou=groups,dc=example,dc=com" write
         by self write
       - >-
         {2}to dn.subtree="ou=users,dc=example,dc=com"
         by dn="cn=uffd,ou=system,dc=example,dc=com" write
-        by group="cn=uffd_admin,ou=groups,dc=example,dc=com" write
+        by group/groupOfUniqueNames/uniqueMember.exact="cn=uffd_admin,ou=groups,dc=example,dc=com" write
         by self write
         by * read
       - >-
         {3}to dn.subtree="ou=groups,dc=example,dc=com"
         by dn="cn=uffd,ou=system,dc=example,dc=com" write
-        by group="cn=uffd_admin,ou=groups,dc=example,dc=com" write
+        by group/groupOfUniqueNames/uniqueMember.exact="cn=uffd_admin,ou=groups,dc=example,dc=com" write
         by * read
       - >-
         {4}to dn.subtree="ou=postfix,dc=example,dc=com"
         by dn="cn=uffd,ou=system,dc=example,dc=com" write
-        by group="cn=uffd_admin,ou=groups,dc=example,dc=com" write
+        by group/groupOfUniqueNames/uniqueMember.exact="cn=uffd_admin,ou=groups,dc=example,dc=com" write
         by * read
 #      - >-
 #        {5}to *