**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

raw_message = nullptr;
                }
            });
            ldap_get_option(handle, LDAP_OPT_DIAGNOSTIC_MESSAGE, &raw_message);
            if (raw_message && *raw_message != '\0')
            {
                if (!text.empty())
                    text += ": ";
                text += raw_message;
            }
        }
        throw Exception(text, ErrorCodes::LDAP_ERROR);
    }
}
void LDAPClient::openConnection()
{
    std::scoped_lock lock(ldap_global_mutex);
    closeConnection();
    {
        LDAPURLDesc url;
        std::memset(&url, 0, sizeof(url));
        url.lud_scheme = const_cast<char *>(params.enable_tls == LDAPClient::Params::TLSEnable::YES ? "ldaps" : "ldap");
        url.lud_host = const_cast<char *>(params.host.c_str());
        url.lud_port = params.port;
        url.lud_scope = LDAP_SCOPE_DEFAULT;
        auto * uri = ldap_url_desc2str(&url);
        if (!uri)
            throw Exception("ldap_url_desc2str() failed", ErrorCodes::LDAP_ERROR);
        SCOPE_EXIT({ ldap_memfree(uri); });
        diag(ldap_initialize(&handle, uri));