**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

{
        grant_role(role_name, true );
    }
    
    
    for (const auto & role_name : local_role_names)
    {
        grant_role(role_name, false );
        users_per_roles[role_name].insert(user_name);
    }
    
    for (const auto & old_role_name : old_role_names)
    {
        if (local_role_names.count(old_role_name))
            continue;
        const auto rit = users_per_roles.find(old_role_name);
        if (rit == users_per_roles.end())
            continue;
        auto & user_names = rit->second;
        user_names.erase(user_name);
        if (!user_names.empty())
            continue;
        users_per_roles.erase(rit);
        if (common_role_names.count(old_role_name))
            continue;
        const auto iit = granted_role_ids.find(old_role_name);
        if (iit == granted_role_ids.end())
            continue;
        const auto old_role_id = iit->second;
        granted_role_names.erase(old_role_id);