**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

}
}
namespace DB
{
class AccessControlManager;
class LDAPAccessStorage : public IAccessStorage
{
public:
    static constexpr char STORAGE_TYPE[] = "ldap";
    explicit LDAPAccessStorage(const String & storage_name_, AccessControlManager * access_control_manager_, const Poco::Util::AbstractConfiguration & config, const String & prefix);
    virtual ~LDAPAccessStorage() override = default;
    String getLDAPServerName() const;
public: 
    virtual const char * getStorageType() const override;
    virtual String getStorageParamsJSON() const override;
private: 
    virtual std::optional<UUID> findImpl(EntityType type, const String & name) const override;
    virtual std::vector<UUID> findAllImpl(EntityType type) const override;
    virtual bool existsImpl(const UUID & id) const override;
    virtual AccessEntityPtr readImpl(const UUID & id) const override;
    virtual String readNameImpl(const UUID & id) const override;
    virtual bool canInsertImpl(const AccessEntityPtr &) const override;
    virtual UUID insertImpl(const AccessEntityPtr & entity, bool replace_if_exists) override;
    virtual void removeImpl(const UUID & id) override;
    virtual void updateImpl(const UUID & id, const UpdateFunc & update_func) override;
    virtual ext::scope_guard subscribeForChangesImpl(const UUID & id, const OnChangedHandler & handler) const override;