**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

{
    std::scoped_lock lock(mutex);
    return memory_storage.hasSubscription(type);
}
UUID LDAPAccessStorage::loginImpl(const Credentials & credentials, const Poco::Net::IPAddress & address, const ExternalAuthenticators & external_authenticators) const
{
    std::scoped_lock lock(mutex);
    LDAPClient::SearchResultsList external_roles;
    auto id = memory_storage.find<User>(credentials.getUserName());
    if (id)
    {
        auto user = memory_storage.read<User>(*id);
        if (!isAddressAllowedImpl(*user, address))
            throwAddressNotAllowed(address);
        if (!areLDAPCredentialsValidNoLock(*user, credentials, external_authenticators, external_roles))
            throwInvalidCredentials();
        
        updateAssignedRolesNoLock(*id, user->getName(), external_roles);
        return *id;
    }
    else
    {
        
        auto user = std::make_shared<User>();
        user->setName(credentials.getUserName());
        user->authentication = Authentication(Authentication::Type::LDAP);
        user->authentication.setLDAPServerName(ldap_server_name);
        if (!isAddressAllowedImpl(*user, address))