This may be a very minor problem, but the ldap.dn.escape_dn_chars function does not handle strings containing only one space character properly. As both the first and the last characters is a space in such a string.

>>> ldap.dn.escape_dn_chars(' ');
'\\\\ '

I believe the quickest fix would be if the s[-1] check were done before the s[0],