force use of start_tls: how?

[Andreas Hasenack <ahasenack@terra.com.br>]

I'm trying to avoid mistakes and configure a server and/or client to
force the use of start tls. So, if someone binds to the server and
accidentally forgets to configure start_tls on the client, the
connection is rejected.

The problem is that the rejection happens too late: the client password
was already sent to the server in clear test.

So far I have tested using acls (ssf=56) and the global "security"
setting with ssf, simple_bind and transport. In all cases, the
unencrypted access is rejected, but too late: the password was sent.

I guess what I need is a setting in /etc/openldap/ldap.conf similar to
the sasl minssf property, but for non-sasl binds. Is there such a thing?
Something that would behave as if -ZZ was always added to the openldap
command-line tools.