When configuring LDAP/SDBM remove the need for a static 'admin' ID with password and ROAUDIT access

An ideal situation would be if the initial LDAP bind and subsequent query to determine group membership could be conducted under each individual user's specific DN. Under LDAP/SDBM the following bind and search returns multiple LDAP attributes for a given user, some of them 'multi-valued' such as the 'racfconnectgroupname' below (using the commonly available 'ldapsearch' command line utility for illustration purposes, based on the example here: 

Using LDAP client utilities with SDBM - IBM Documentation  (doesn't require any special privileges e.g. ROAUDIT) ):

We have a java based web application server from another vendor that allows the specification of a 'user DN' when binding to LDAP and permits the specification of an LDAP attribute which denotes group membership, 'racfconnectgroupname' in this case. This appears to work very well and removes the need to specify a static 'admin' ID with password at the application web server end. It would be great if SMU could operate in a similar fashion: do an LDAP bind with the DN of the user logging on (using the user password specified) and conduct a search using the same DN as the 'base' with a filter of 'objectclass=*' (I believe SDBM restricts what the filter can be here). The groups that a given user is a member of can then be established by evaluating the value(s) of the 'racfconnectgroupname' attribute.