**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

{
    std::scoped_lock lock(mutex);
    if (!kerberos_params.has_value())
        throw Exception("Kerberos is not enabled", ErrorCodes::BAD_ARGUMENTS);
    if (!credentials.isReady())
        return false;
    if (credentials.isFailed())
        return false;
    if (!realm.empty() && realm != credentials.getRealm())
        return false;
    return true;
}
GSSAcceptorContext::Params ExternalAuthenticators::getKerberosParams() const
{
    std::scoped_lock lock(mutex);
    if (!kerberos_params.has_value())
        throw Exception("Kerberos is not enabled", ErrorCodes::BAD_ARGUMENTS);
    return kerberos_params.value();
}
}