code: def bind_search(self, username, password):
          
  
          log.debug("Performing bind/search")
  
          ctx = {'username':username, 'password':password}
  
          user = self.config['BIND_DN'] % ctx
  
          bind_auth = self.config['BIND_AUTH']
          try:
              log.debug("Binding with the BIND_DN %s" % user)
              self.conn.simple_bind_s(user, bind_auth)
          except ldap.INVALID_CREDENTIALS:
              msg = "Could not connect bind with the BIND_DN=%s" % user
              log.debug(msg)
              if self._raise_errors:
                  raise ldap.INVALID_CREDENTIALS(msg)
              return None
  
          user_search = self.config.get('USER_SEARCH')
  
          results = None
          found_user = False
          for search in user_search:
              base = search['base']
              filt = search['filter'] % ctx
              scope = search.get('scope', ldap.SCOPE_SUBTREE)
              log.debug("Search for base=%s filter=%s" % (base, filt))
              results = self.conn.search_s(base, scope, filt, attrlist=self.attrlist)
              if results:
                  found_user = True
                  log.debug("User with DN=%s found" % results[0][0])
                  try:
                      self.conn.simple_bind_s(results[0][0], password)
                  except ldap.INVALID_CREDENTIALS:
                      self.conn.simple_bind_s(user, bind_auth)
                      log.debug("Username/password mismatch, continue search...")
                      results = None
                      continue
                  else:
                      log.debug("Username/password OK")
                      break
          if not results and self._raise_errors:
              msg = "No users found matching search criteria: {}".format(user_search)
              if found_user:
                  msg = "Username/password mismatch"
              raise ldap.INVALID_CREDENTIALS(msg)
  
          log.debug("Unbind")
          self.conn.unbind_s()
  
          return self.format_results(results)
docs: Bind to BIND_DN/BIND_AUTH then search for user to perform lookup.