The "-D <dn>" option is irrelevant on a SASL bind. SASL uses usernames, not DNs. For your example, use "-U admin" instead.
And how does slapd know which DN to bind when -U admin is given? Or the other way around: How is "-U admin" authorized to be "cn=admin,ou=users,dc=example,dc=org" ?
Thomy