Is there any way to force clients to use start_tls without sending any credentials over the wire
No, unfortunately that was not taken into consideration when the LDAP v3 spec was written.
--Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration A division of Synacor, Inc