There were two issues. First, I had to use distinguishedname= rather than dn=a. Apparently Active Directory is picky about the filter though oddly you can use dn when specifying get_value. Secondly, the sample distinguishednames I tested had parens in them which must be escaped. Net::LDAP doesn't handle that for you.

I added this bit:

sub cleanLDAPString
{
    my $tempstr = shift;

    $tempstr =~ s/\\/\\5c/;
    $tempstr =~ s/\(/\\28/;
    $tempstr =~ s/\)/\\29/;
    $tempstr =~ s/&/\\26/;
    $tempstr =~ s/\|/\\7c/;
    $tempstr =~ s/>/\\3e/;
    $tempstr =~ s/</\\3c/;
    $tempstr =~ s/\~/\\7e/;
    $tempstr =~ s/\*/\\2a/;

    return $tempstr;
}
[download]

and called it before I constructed the filter. Worked just fine. Thank you very much for the feedback. It helped lead me to the solution.

:)

And nuts to those that think minimalist responses and snide comments are in any way helpful to the people who come here. If you don't have anything helpful to contribute then don't post. And for the record, posting greps to the doc that I already specified I'd read and that didn't have any relevant examples is just effing arrogant and lazy.