**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

diag(ldap_set_option(handle, LDAP_OPT_X_TLS_NEWCTX, &i_am_a_server));
    }
#endif
    if (params.enable_tls == LDAPClient::Params::TLSEnable::YES_STARTTLS)
        diag(ldap_start_tls_s(handle, nullptr, nullptr));
    switch (params.sasl_mechanism)
    {
        case LDAPClient::Params::SASLMechanism::SIMPLE:
        {
            const auto escaped_user_name = escapeForLDAP(params.user);
            const auto bind_dn = replacePlaceholders(params.bind_dn, { {"{user_name}", escaped_user_name} });
            ::berval cred;
            cred.bv_val = const_cast<char *>(params.password.c_str());
            cred.bv_len = params.password.size();
            diag(ldap_sasl_bind_s(handle, bind_dn.c_str(), LDAP_SASL_SIMPLE, &cred, nullptr, nullptr, nullptr));
            break;
        }
        default:
            throw Exception("Unknown SASL mechanism", ErrorCodes::LDAP_ERROR);
    }
}
void LDAPClient::closeConnection() noexcept
{
    std::scoped_lock lock(ldap_global_mutex);
    if (!handle)
        return;
    ldap_unbind_ext_s(handle, nullptr, nullptr);
    handle = nullptr;
}
LDAPClient::SearchResults LDAPClient::search(const SearchParams & search_params)