Possible LDAP injection in check_credentials method

[akudiurov]

Problem:
During security code audit it was found that username, used for LDAP auth is inserted in the query by plain string formatting. Such an approach is insecure because it's possible to insert arbitrary commands in the query.

Possible impact:
It is possible to bypass auth with invalid credentials and modify content inside the LDAP tree.

Solution:
One of the ways to prevent LDAP injection in ldap3 is to use the Abstraction Layer.
The Abstraction Layer relies on a simple ORM (Object Relational Mapping) that links Entries object to entries stored in the LDAP.

Entry in the source code:
Ldap.py -> check_credentials()

Usage in the source code:
basic_credential.py -> Ldap -> verify_credentials()