**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

ldap_value_free_len(vals);
                                vals = nullptr;
                            });
                            for (std::size_t i = 0; vals[i]; i++)
                            {
                                if (vals[i]->bv_val && vals[i]->bv_len > 0)
                                    result.emplace(vals[i]->bv_val, vals[i]->bv_len);
                            }
                        }
                    }
                }
                break;
            }
            case LDAP_RES_SEARCH_REFERENCE:
            {
                char ** referrals = nullptr;
                diag(ldap_parse_reference(handle, msg, &referrals, nullptr, 0));
                if (referrals)
                {
                    SCOPE_EXIT({
                        ber_memvfree(reinterpret_cast<void **>(referrals));
                        referrals = nullptr;
                    });
                    for (std::size_t i = 0; referrals[i]; i++)
                    {
                        LOG_WARNING(&Poco::Logger::get("LDAPClient"), "Received reference during LDAP search but not following it: {}", referrals[i]);
                    }
                }
                break;
            }