When specifying a search user for an LDAP authentication realm, what administrative permissions are required on the search user account? (Select all that apply)