**Use case**
In some organisations are using AD with hierarchical structure (nested organisation unit) and DN follow this structure. As result we can not  use permanent build_dn for users with different OU.

**Describe the solution you'd like**
Solution can be look like:
1) bind as service account
2) set dn for user_name by some filter string to user_dn
3) bind as user_dn with password
3) use user_dn with filter for group/roles fetching

This approach is implemented in Metabase.

{
    GSSAcceptorContext::Params params;
    Poco::Util::AbstractConfiguration::Keys keys;
    config.keys("kerberos", keys);
    std::size_t reealm_key_count = 0;
    std::size_t principal_keys_count = 0;
    for (auto key : keys)
    {
        const auto bracket_pos = key.find('[');
        if (bracket_pos != std::string::npos)
            key.resize(bracket_pos);
        boost::algorithm::to_lower(key);
        reealm_key_count += (key == "realm");
        principal_keys_count += (key == "principal");
    }
    if (reealm_key_count > 0 && principal_keys_count > 0)
        throw Exception("Realm and principal name cannot be specified simultaneously", ErrorCodes::BAD_ARGUMENTS);
    if (reealm_key_count > 1)
        throw Exception("Multiple realm sections are not allowed", ErrorCodes::BAD_ARGUMENTS);
    if (principal_keys_count > 1)
        throw Exception("Multiple principal sections are not allowed", ErrorCodes::BAD_ARGUMENTS);
    params.realm = config.getString("kerberos.realm", "");
    params.principal = config.getString("kerberos.principal", "");
    return params;
}
}
void ExternalAuthenticators::reset()