Stupid Basic LDAP Authentication+Authorization

shop.rb

module Shop
  module Config
    LDAP_HOST            = ENV["LDAP_HOST"]
    LDAP_BIND_DN         = ENV["LDAP_BIND_DN"]
    LDAP_BIND_PASS       = ENV["LDAP_BIND_PASS"]
    LDAP_SEARCH_BASE     = ENV["LDAP_SEARCH_BASE"]
    LDAP_SEARCH_PROPERTY = ENV["LDAP_SEARCH_PROPERTY"]
    LDAP_SECURITY_GROUP  = ENV["LDAP_SECURITY_GROUP"]
  end
  
  class LDAP
    def self.find_user(username)
      conn = new_connection
      filter =
        Net::LDAP::Filter.eq(Shop::Config::LDAP_SEARCH_PROPERTY, username)
      result =
        conn.search(base: Shop::Config::LDAP_SEARCH_BASE, filter: filter)
      if result.count > 0
        result[0]
      else
        false
      end
    end
    
    def self.authenticate_user(username, password)
      (Net::LDAP.new host: Shop::Config::LDAP_HOST,
                     port: 636,
                     encryption: :simple_tls,
                     auth: {
                       method: :simple,
                       username: username,
                       password: password
                     }
      ).bind
    end
    
    def self.user_authorized?(user_object)
      begin
        user_object.memberOf.include? Shop::Config::LDAP_SECURITY_GROUP
      rescue
        false
      end
    end
    
    private
    
    def self.new_connection
      Net::LDAP.new host: Shop::Config::LDAP_HOST,
                    port: 636,
                    encryption: :simple_tls,
                    auth: {
                      method: :simple,
                      username: Shop::Config::LDAP_BIND_DN,
                      password: Shop::Config::LDAP_BIND_PASS
                    }
    end
  end
end