https://bugs.openldap.org/show_bug.cgi?id=9817
--- Comment #8 from Ondřej Kuzník ondra@mistotebe.net --- Maybe we could introduce a new rewrite map 'dn2filter' or somesuch, which unescapes DN-special characters (e.g. '=', ',', '+', ...) and escapes filter-special characters (parentheses, '*', ...) correctly. Then you could add that between lines 4 and 5 in your example. Or pairs of 'escapeDN'+'unescapeDN' and 'escapeFilter'+'unescapeFilter' for more free-form work (and call 'unescapeDN' then 'escapeFilter').
librewrite already calls into libldap so if there are helpers there that might be of use, we'd be free to call them.