SunOneDS-5.2 bind authmethod=ssl doesn't appear to work

Question

Having set up DS-5.2 with SSL + allow user authentication + user entry with (binary) certificate + certmap.conf setup for user cert CA cert + ACI entry with bind rule set to
allow (all) (userdn = ....) and (authmethod="ssl")
client connections ARE authenticated by client certificate when passed.
However, if the client binds with bindDN=userdn in ACI, but NOT using either a certificate nor SSL connection, the associated search request is still allowed. In other words, it appears that the "authmethod=ssl" bind rule HAS NO AFFECT!? Other ACI's on the entry deny anonymous access and allow other groups without SSL.
The SunOneDS-5.2 Administration Guide states for authmethod="ssl",
SSL - The client must bind to the directory over a Secure Sockets
Layer (SSL) or Transport Layer Security (TLS) connection
but this doesn't appear to be working in forcing an SSL bind/connection.
It is also interesting to note that the client certificate is offered at the LDAP connection step and not at the LDAP bind step and that a subsequent bind appears to be necessary to properly affect a subsequent search. That is, with the above ACI bind rule, connect with certificate over SSL but bind as annonymous and the search fails. ANY connection with proper bindDN and bindPW satisfies the ACI and the search succeeds.
The intention is to FORCE SSL connections for certain subtrees where the LDAP server ALSO allows NON-SSL connections for OTHER subtrees. A secondary desire is to allow SSL + certificate authentication to provide the forced SSL connection and user binding without requiring a subsequent bindDN and bindPW.
An example of SSL + certificate connection + full user binding is:
conn=30 op=-1 msgId=-1 - SSL 128-bit RC4; client 0.9.2342.19200300.100.1.4=Personal/User SSL Certificate, CN=......., OU=......, O=...., L=...., ST=...., C=..; issuer 0.9.2342.19200300.100.1.4=localnet10 SSL only CA Certificate, CN=SSLonlyCA, OU=......., O=..., L=...., ST=..., C=..
conn=30 op=-1 msgId=-1 - SSL client bound as uid=NEngineer1,ou=People,o=..,c=..
conn=30 op=0 msgId=1 - BIND dn="uid=NEngineer1,ou=People,o=..,c=.." method=128 version=3
conn=30 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=nengineer1,ou=people,o=..,c=.."
conn=30 op=1 msgId=2 - SRCH base="o=..,c=.." scope=2 filter="(dc=.............)" attrs="dn ........."
conn=30 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=

Answer 1

Corrected - what was needed was a bind rule, boolean change from "and" to "or":
(targetattr = "*") (version 3.0;acl "DENY all but Network Administrators access";deny (all)(groupdn != "ldap:///cn=Network Administrators,ou=Groups,o=xx,c=xx")or(authmethod!="ssl");)