In general the PKI code doesn't seem to decode the values it receives from the DS. In most cases it's not a problem, but there might be cases where it will produce incorrect results.

For example the UGSubsystem.buildGroup() doesn't decode the value of the UID attribute obtained from the DN in the group's uniqueMember attribute. This is probably fine because a UID usually doesn't contain characters that needs escaping. However, there could be other codes that use attributes that have higher likelihood to contain escaped characters (e.g. cn).

In the UGSubsystem.buildGroup() the code simply gets everything between the first equal sign and comma. For example:

uid=testuser,ou=People,dc=example,dc=com ==> testuser

Ideally all escaped characters (e.g. \2b), quoted values (e.g. "John Smith"), or hex values (e.g #a24f) should be decoded into the proper characters. The current code does not do that.

uid=test\2buser,ou=People,dc=example,dc=com ==> test\2buser