**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

throw Exception("Failed to process LDAP search message", ErrorCodes::LDAP_ERROR);
        }
    }
    return result;
}
bool LDAPSimpleAuthClient::authenticate(const SearchParamsList * search_params, SearchResultsList * search_results)
{
    if (params.user.empty())
        throw Exception("LDAP authentication of a user with empty name is not allowed", ErrorCodes::BAD_ARGUMENTS);
    if (!search_params != !search_results)
        throw Exception("Cannot return LDAP search results", ErrorCodes::BAD_ARGUMENTS);
    
    if (params.password.empty())
        return false;
    SCOPE_EXIT({ closeConnection(); });
    
    openConnection();
    
    if (search_params)
    {
        search_results->clear();
        search_results->reserve(search_params->size());
        try
        {
            for (const auto & single_search_params : *search_params)
            {
                search_results->emplace_back(search(single_search_params));
            }
        }
        catch (...)