**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

{
    std::set<String> role_names;
    if (external_roles.size() != role_search_params.size())
        throw Exception("Unable to map external roles", ErrorCodes::BAD_ARGUMENTS);
    for (std::size_t i = 0; i < external_roles.size(); ++i)
    {
        const auto & external_role_set = external_roles[i];
        const auto & prefix = role_search_params[i].prefix;
        for (const auto & external_role : external_role_set)
        {
            if (
                prefix.size() < external_role.size() &&
                external_role.compare(0, prefix.size(), prefix) == 0
            )
            {
                role_names.emplace(external_role, prefix.size());
            }
        }
    }
    return role_names;
}
bool LDAPAccessStorage::areLDAPCredentialsValidNoLock(const User & user, const Credentials & credentials,