Nick France wrote:

I'm running OpenLDAP 2.3.35 for a simple 'address book'-type directory. There will be anonymous access available to read entries, however, I would like to restrict wildcard searches, and only ever return exact matches. As the entries are unique, there should only ever be one result (sizelimit is set to 1 to ensure this).

I've tried many things with ACLs, trying to filter out the wildcard characters [(!(cn=*\2a*))] but with no success.

Is this possible? Is there a simple flag/directive/compile option to disable wildcard searching?

Don't bother with ACLs. Just set the "unchecked" size limit.