**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

if (cit != ldap_caches.end())
            {
                auto & cache = cit->second;
                const auto eit = cache.find(credentials.getUserName());
                if (eit != cache.end())
                {
                    const auto & entry = eit->second;
                    const auto last_check_period = std::chrono::steady_clock::now() - entry.last_successful_authentication_timestamp;
                    if (
                        
                        entry.last_successful_params_hash != 0 &&
                        entry.last_successful_authentication_timestamp != std::chrono::steady_clock::time_point{} &&
                        
                        entry.last_successful_params_hash == params_hash &&
                        last_check_period >= std::chrono::seconds{0} &&
                        last_check_period <= params->verification_cooldown &&
                        
                        (
                            search_params == nullptr ?
                            entry.last_successful_search_results.empty() :
                            search_params->size() == entry.last_successful_search_results.size()
                        )
                    )
                    {
                        if (search_results)
                            *search_results = entry.last_successful_search_results;
                        return true;
                    }
                    
                    if (last_check_period > params->verification_cooldown)