code: def _connect(self):
          
          ldap_client = ldap.initialize(self.uri)
          ldap.set_option(ldap.OPT_REFERRALS, 0)
          ldap.set_option(ldap.OPT_TIMEOUT, self.timeout)
          if self.starttls == 'on':
              ldap.set_option(ldap.OPT_X_TLS_DEMAND, True)
          else:
              ldap.set_option(ldap.OPT_X_TLS_DEMAND, False)
          # set the CA file if declared and if necessary
          if self.ca and self.checkcert == 'on':
              # check if the CA file actually exists
              if os.path.isfile(self.ca):
                  ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, self.ca)
              else:
                  raise CaFileDontExist(self.ca)
          if self.checkcert == 'off':
              # this is dark magic
              # remove any of these two lines and it doesn't work
              ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
              ldap_client.set_option(
                  ldap.OPT_X_TLS_REQUIRE_CERT,
                  ldap.OPT_X_TLS_NEVER
                  )
          else:
              # this is even darker magic
              ldap_client.set_option(
                  ldap.OPT_X_TLS_REQUIRE_CERT,
                  ldap.OPT_X_TLS_DEMAND
                  )
              # it doesn't make sense to set it to never
              # (== don't check certifate)
              # but it only works with this option...
              # ... and it checks the certificat
              # (I've lost my sanity over this)
              ldap.set_option(
                  ldap.OPT_X_TLS_REQUIRE_CERT,
                  ldap.OPT_X_TLS_NEVER
                  )
          if self.starttls == 'on':
              try:
                  ldap_client.start_tls_s()
              except Exception as e:
                  self._exception_handler(e)
          return ldap_client
docs: Initialize an ldap client