**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

const auto role = typeid_cast<std::shared_ptr<const Role>>(entity);
    const auto it = granted_role_names.find(id);
    if (role) 
    {
        const auto & new_role_name = role->getName();
        if (it != granted_role_names.end()) 
        {
            const auto & old_role_name = it->second;
            if (new_role_name != old_role_name)
            {
                
                applyRoleChangeNoLock(false , id, old_role_name);
                applyRoleChangeNoLock(true , id, new_role_name);
            }
        }
        else 
        {
            applyRoleChangeNoLock(true , id, new_role_name);
        }
    }
    else 
    {
        if (it != granted_role_names.end()) 
        {
            const auto & old_role_name = it->second;
            applyRoleChangeNoLock(false , id, old_role_name);
        }
    }
}
void LDAPAccessStorage::applyRoleChangeNoLock(bool grant, const UUID & role_id, const String & role_name)