SASL and mail attribute help - SOLVED mostly

["Al Pacifico" <pacifico@drizzle.com>]

So, I discovered my problem is with my ACL's. If I comment them all out, it
works. Boy do I feel foolish. Thanks for your patience.

So, I tried:
access to * by *

It works, but is obviously undesirable.

Then:
access to attrs=userpassword,mail
	by *

This fails also, same message, as does:
access to attrs=userpassword,mail
	by * auth
and:
access to attrs=userpassword,mail
	by * search

The following works:
access to *
	by * auth

This may be a safe policy, but I'm curious: which resources must be
available to complete this operation? (in case I blunder editing slapd.conf
in the future, I'd like this to be as restrictive as possible).
-al