Translate most of an LDAP authorization function (based on Shiro's official ActiveDirectory authz) that I found on Stack Overflow. Missing the 'map LDAP group -> role' functionality. Not tested beyond 'it compiles'