How embarassing, I've been stressing over what I thought was ACLs with LDAP for a few days - only to realise that the issue was with indexes.

Hot tip guys - slapd returns an empty search set if you haven't indexed the data already... just in case you'd forgotten like me.

How embarassing.