[exim] Authentication

OK, I know this has been re-hashed many times, but I'm going cross-eyed
from reading the docs and not getting any closer.

My background:

I've been running sendmail for the last 10 years; typically compiling
from source. As I am starting to maintain more systems remotely, I am
looking for an easier MTA. exim4 comes with debian and works, pretty
much, out of the box.

My policies are as follows:

1. Clients connecting on 25 unauthenticated can send email only to the
local domains.

2. Clients requesting relaying must connect encrypted and authenticate.

3. Clients requesting relaying unencrypted are rejected.

Sounds simple. But I can't for the life of me get 2 to work. exim
always rejects relaying. (That's good, anyway.)

I have TLS working so encryption is there but I can't get the
authentication to go.

I am running exim4-heavy from debian lenny.

Could someone please clue me in? I need the "exim4 relaying for morons"
guide....

Thanks,

--Yan