**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

{
public:
    void reset();
    void setConfiguration(const Poco::Util::AbstractConfiguration & config, Poco::Logger * log);
    
    bool checkLDAPCredentials(const String & server, const BasicCredentials & credentials,
        const LDAPClient::SearchParamsList * search_params = nullptr, LDAPClient::SearchResultsList * search_results = nullptr) const;
    bool checkKerberosCredentials(const String & realm, const GSSAcceptorContext & credentials) const;
    GSSAcceptorContext::Params getKerberosParams() const;
private:
    struct LDAPCacheEntry
    {
        std::size_t last_successful_params_hash = 0;
        std::chrono::steady_clock::time_point last_successful_authentication_timestamp;
        LDAPClient::SearchResultsList last_successful_search_results;
    };
    using LDAPCache = std::unordered_map<String, LDAPCacheEntry>; 
    using LDAPCaches = std::map<String, LDAPCache>;               
    using LDAPParams = std::map<String, LDAPClient::Params>;      
private:
    mutable std::recursive_mutex mutex;
    LDAPParams ldap_client_params_blueprint;
    mutable LDAPCaches ldap_caches;
    std::optional<GSSAcceptorContext::Params> kerberos_params;
};
}