I still have no clue if any of this works; I'm just using a code snippet to get started on this. Still need to LDAP escape the user string (don't want them sending in *!) and test the whole thing.