SUBTREE search scope is required.

Avoid building filter with string concatenation to avoid an LDAP injection
vector. The parameterization baked into SearchFilter performs escaping to
guard against injection attacks.