**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

}
        
        if (params_hash != new_params_hash)
            return false;
        auto & entry = ldap_caches[server][credentials.getUserName()];
        if (entry.last_successful_authentication_timestamp < current_check_timestamp)
        {
            entry.last_successful_params_hash = params_hash;
            entry.last_successful_authentication_timestamp = current_check_timestamp;
            if (search_results)
                entry.last_successful_search_results = *search_results;
            else
                entry.last_successful_search_results.clear();
        }
        else if (
            entry.last_successful_params_hash != params_hash ||
            (
                search_params == nullptr ?
                !entry.last_successful_search_results.empty() :
                search_params->size() != entry.last_successful_search_results.size()
            )
        )
        {
            
            return false;
        }
    }
    return result;
}
bool ExternalAuthenticators::checkKerberosCredentials(const String & realm, const GSSAcceptorContext & credentials) const