RFC 4515 search filters as :eldap terms, built with the username as data. Ported from exio's parser, with one change in how the username gets in.

:eldap takes a filter as a term, not a string, so the configured search.filter ((&(objectClass=person)(uid={username}))) is parsed here. exio and macaw escaped the username into the filter's text and then parsed the result, so the escaping was all that stood between a username and the filter's structure. Here the template is parsed with {username} as a placeholder and the username's bytes go straight into the assertion value of the term: a *, ( or \ in a username is a byte of the value, never syntax, whatever the escaping would have done.

\hh escapes in the template decode to their bytes, so an escaped * is a literal asterisk, never a wildcard. Supported: &, |, !, equality, presence (attr=*), substrings, >=, <= and ~=. Extensible matches are not.