From 10aea5d0a39f9a73f85921bebc3060190df068eb Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Wed, 27 May 2015 13:08:26 -0700
Subject: [PATCH 01/21] GUAC-1176: Add password expiration attribute.

---
 .../guacamole/auth/jdbc/user/ModeledUser.java | 19 ++++++++++--
 .../guacamole/auth/jdbc/user/UserModel.java   | 31 +++++++++++++++++++
 .../src/main/resources/translations/en.json   |  1 +
 .../schema/001-create-schema.sql              |  1 +
 .../schema/upgrade/upgrade-pre-0.9.7.sql      |  6 ++++
 .../guacamole/auth/jdbc/user/UserMapper.xml   | 19 ++++++++----
 .../schema/001-create-schema.sql              |  1 +
 .../schema/upgrade/upgrade-pre-0.9.7.sql      |  6 ++++
 .../guacamole/auth/jdbc/user/UserMapper.xml   | 19 ++++++++----
 9 files changed, 88 insertions(+), 15 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java
index 0f234c494..d35b9c07b 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java
@@ -58,12 +58,19 @@ public class ModeledUser extends ModeledDirectoryObject<UserModel> implements Us
      */
     public static final String DISABLED_ATTRIBUTE_NAME = "disabled";
 
+    /**
+     * The name of the attribute which controls whether a user's password is
+     * expired and must be reset upon login.
+     */
+    public static final String EXPIRED_ATTRIBUTE_NAME = "expired";
+
     /**
      * All attributes related to restricting user accounts, within a logical
      * form.
      */
     public static final Form ACCOUNT_RESTRICTIONS = new Form("restrictions", "Account Restrictions", Arrays.asList(
-        new Field(DISABLED_ATTRIBUTE_NAME, "Disabled", "true")
+        new Field(DISABLED_ATTRIBUTE_NAME, "Disabled", "true"),
+        new Field(EXPIRED_ATTRIBUTE_NAME, "Password expired", "true")
     ));
 
     /**
@@ -214,7 +221,10 @@ public class ModeledUser extends ModeledDirectoryObject<UserModel> implements Us
         Map<String, String> attributes = new HashMap<String, String>();
 
         // Set disabled attribute
-        attributes.put("disabled", getModel().isDisabled() ? "true" : null);
+        attributes.put(DISABLED_ATTRIBUTE_NAME, getModel().isDisabled() ? "true" : null);
+
+        // Set password expired attribute
+        attributes.put(EXPIRED_ATTRIBUTE_NAME, getModel().isExpired() ? "true" : null);
 
         return attributes;
     }
@@ -223,7 +233,10 @@ public class ModeledUser extends ModeledDirectoryObject<UserModel> implements Us
     public void setAttributes(Map<String, String> attributes) {
 
         // Translate disabled attribute
-        getModel().setDisabled("true".equals(attributes.get("disabled")));
+        getModel().setDisabled("true".equals(attributes.get(DISABLED_ATTRIBUTE_NAME)));
+
+        // Translate password expired attribute
+        getModel().setExpired("true".equals(attributes.get(EXPIRED_ATTRIBUTE_NAME)));
 
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserModel.java
index 1f84ab566..5057b2f5c 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserModel.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserModel.java
@@ -48,6 +48,13 @@ public class UserModel extends ObjectModel {
      */
     private boolean disabled;
 
+    /**
+     * Whether the user's password is expired. If a user's password is expired,
+     * it must be changed immediately upon login, and the account cannot be
+     * used until this occurs.
+     */
+    private boolean expired;
+
     /**
      * Creates a new, empty user.
      */
@@ -127,4 +134,28 @@ public class UserModel extends ObjectModel {
         this.disabled = disabled;
     }
 
+    /**
+     * Returns whether the user's password has expired. If a user's password is
+     * expired, it must be immediately changed upon login. A user account with
+     * an expired password cannot be used until the password has been changed.
+     *
+     * @return
+     *     true if the user's password has expired, false otherwise.
+     */
+    public boolean isExpired() {
+        return expired;
+    }
+
+    /**
+     * Sets whether the user's password is expired. If a user's password is
+     * expired, it must be immediately changed upon login. A user account with
+     * an expired password cannot be used until the password has been changed.
+     *
+     * @param expired
+     *     true to expire the user's password, false otherwise.
+     */
+    public void setExpired(boolean expired) {
+        this.expired = expired;
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
index 920ded08f..adeadf508 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
@@ -2,6 +2,7 @@
     "USER_ATTRIBUTES" : {
 
         "FIELD_HEADER_DISABLED" : "Login disabled:",
+        "FIELD_HEADER_EXPIRED"  : "Password expired:",
 
         "SECTION_HEADER_RESTRICTIONS" : "Account Restrictions"
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/001-create-schema.sql b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/001-create-schema.sql
index e9545adae..d3cd2ce0d 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/001-create-schema.sql
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/001-create-schema.sql
@@ -77,6 +77,7 @@ CREATE TABLE `guacamole_user` (
   `password_hash` binary(32)   NOT NULL,
   `password_salt` binary(32),
   `disabled`      boolean      NOT NULL DEFAULT 0,
+  `expired`       boolean      NOT NULL DEFAULT 0,
 
   PRIMARY KEY (`user_id`),
   UNIQUE KEY `username` (`username`)
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/upgrade/upgrade-pre-0.9.7.sql b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/upgrade/upgrade-pre-0.9.7.sql
index 8bc41ec26..761d9be41 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/upgrade/upgrade-pre-0.9.7.sql
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/upgrade/upgrade-pre-0.9.7.sql
@@ -26,3 +26,9 @@
 
 ALTER TABLE guacamole_user ADD COLUMN disabled BOOLEAN NOT NULL DEFAULT 0;
 
+--
+-- Add per-user password expiration flag
+--
+
+ALTER TABLE guacamole_user ADD COLUMN expired BOOLEAN NOT NULL DEFAULT 0;
+
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/user/UserMapper.xml b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/user/UserMapper.xml
index de4b311cd..31a8fe407 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/user/UserMapper.xml
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/user/UserMapper.xml
@@ -33,6 +33,7 @@
         <result column="password_hash" property="passwordHash" jdbcType="BINARY"/>
         <result column="password_salt" property="passwordSalt" jdbcType="BINARY"/>
         <result column="disabled"      property="disabled"     jdbcType="BOOLEAN"/>
+        <result column="expired"       property="expired"      jdbcType="BOOLEAN"/>
     </resultMap>
 
     <!-- Select all usernames -->
@@ -59,7 +60,8 @@
             username,
             password_hash,
             password_salt,
-            disabled
+            disabled,
+            expired
         FROM guacamole_user
         WHERE username IN
             <foreach collection="identifiers" item="identifier"
@@ -77,7 +79,8 @@
             username,
             password_hash,
             password_salt,
-            disabled
+            disabled,
+            expired
         FROM guacamole_user
         JOIN guacamole_user_permission ON affected_user_id = guacamole_user.user_id
         WHERE username IN
@@ -98,7 +101,8 @@
             username,
             password_hash,
             password_salt,
-            disabled
+            disabled,
+            expired
         FROM guacamole_user
         WHERE
             username = #{username,jdbcType=VARCHAR}
@@ -119,13 +123,15 @@
             username,
             password_hash,
             password_salt,
-            disabled
+            disabled,
+            expired
         )
         VALUES (
             #{object.identifier,jdbcType=VARCHAR},
             #{object.passwordHash,jdbcType=BINARY},
             #{object.passwordSalt,jdbcType=BINARY},
-            #{object.disabled,jdbcType=BOOLEAN}
+            #{object.disabled,jdbcType=BOOLEAN},
+            #{object.expired,jdbcType=BOOLEAN}
         )
 
     </insert>
@@ -135,7 +141,8 @@
         UPDATE guacamole_user
         SET password_hash = #{object.passwordHash,jdbcType=BINARY},
             password_salt = #{object.passwordSalt,jdbcType=BINARY},
-            disabled = #{object.disabled,jdbcType=BOOLEAN}
+            disabled = #{object.disabled,jdbcType=BOOLEAN},
+            expired = #{object.expired,jdbcType=BOOLEAN}
         WHERE user_id = #{object.objectID,jdbcType=VARCHAR}
     </update>
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/001-create-schema.sql b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/001-create-schema.sql
index d228b5844..7f14986be 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/001-create-schema.sql
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/001-create-schema.sql
@@ -118,6 +118,7 @@ CREATE TABLE guacamole_user (
   password_hash bytea        NOT NULL,
   password_salt bytea,
   disabled      boolean      NOT NULL DEFAULT FALSE,
+  expired       boolean      NOT NULL DEFAULT FALSE,
 
   PRIMARY KEY (user_id),
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/upgrade/upgrade-pre-0.9.7.sql b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/upgrade/upgrade-pre-0.9.7.sql
index ba8649629..0853e90c8 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/upgrade/upgrade-pre-0.9.7.sql
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/upgrade/upgrade-pre-0.9.7.sql
@@ -26,3 +26,9 @@
 
 ALTER TABLE guacamole_user ADD COLUMN disabled boolean NOT NULL DEFAULT FALSE;
 
+--
+-- Add per-user password expiration flag
+--
+
+ALTER TABLE guacamole_user ADD COLUMN expired boolean NOT NULL DEFAULT FALSE;
+
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/user/UserMapper.xml b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/user/UserMapper.xml
index 6b2438229..d78b30abb 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/user/UserMapper.xml
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/user/UserMapper.xml
@@ -33,6 +33,7 @@
         <result column="password_hash" property="passwordHash" jdbcType="BINARY"/>
         <result column="password_salt" property="passwordSalt" jdbcType="BINARY"/>
         <result column="disabled"      property="disabled"     jdbcType="BOOLEAN"/>
+        <result column="expired"       property="expired"      jdbcType="BOOLEAN"/>
     </resultMap>
 
     <!-- Select all usernames -->
@@ -59,7 +60,8 @@
             username,
             password_hash,
             password_salt,
-            disabled
+            disabled,
+            expired
         FROM guacamole_user
         WHERE username IN
             <foreach collection="identifiers" item="identifier"
@@ -77,7 +79,8 @@
             username,
             password_hash,
             password_salt,
-            disabled
+            disabled,
+            expired
         FROM guacamole_user
         JOIN guacamole_user_permission ON affected_user_id = guacamole_user.user_id
         WHERE username IN
@@ -98,7 +101,8 @@
             username,
             password_hash,
             password_salt,
-            disabled
+            disabled,
+            expired
         FROM guacamole_user
         WHERE
             username = #{username,jdbcType=VARCHAR}
@@ -119,13 +123,15 @@
             username,
             password_hash,
             password_salt,
-            disabled
+            disabled,
+            expired
         )
         VALUES (
             #{object.identifier,jdbcType=VARCHAR},
             #{object.passwordHash,jdbcType=BINARY},
             #{object.passwordSalt,jdbcType=BINARY},
-            #{object.disabled,jdbcType=BOOLEAN}
+            #{object.disabled,jdbcType=BOOLEAN},
+            #{object.expired,jdbcType=BOOLEAN}
         )
 
     </insert>
@@ -135,7 +141,8 @@
         UPDATE guacamole_user
         SET password_hash = #{object.passwordHash,jdbcType=BINARY},
             password_salt = #{object.passwordSalt,jdbcType=BINARY},
-            disabled = #{object.disabled,jdbcType=BOOLEAN}
+            disabled = #{object.disabled,jdbcType=BOOLEAN},
+            expired = #{object.expired,jdbcType=BOOLEAN}
         WHERE user_id = #{object.objectID,jdbcType=VARCHAR}
     </update>
 

From e51363f9c510a255fe089a0254cee43736b6b74d Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Wed, 27 May 2015 13:22:39 -0700
Subject: [PATCH 02/21] GUAC-1176: Define USERNAME and PASSWORD fields
 publicly. They aren't very helpful isolated within the USERNAME_PASSWORD
 object.

---
 .../net/auth/credentials/CredentialsInfo.java    | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java
index b68e06d5d..b3c7c1175 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java
@@ -67,13 +67,25 @@ public class CredentialsInfo {
      */
     public static final CredentialsInfo EMPTY = new CredentialsInfo(Collections.<Field>emptyList());
 
+    /**
+     * A field describing the username HTTP parameter expected by Guacamole
+     * during login, if usernames are being used.
+     */
+    public static final Field USERNAME = new Field("username", "username", Field.Type.USERNAME);
+
+    /**
+     * A field describing the password HTTP parameter expected by Guacamole
+     * during login, if passwords are being used.
+     */
+    public static final Field PASSWORD = new Field("password", "password", Field.Type.PASSWORD);
+
     /**
      * CredentialsInfo object which describes standard username/password
      * credentials.
      */
     public static final CredentialsInfo USERNAME_PASSWORD = new CredentialsInfo(Arrays.asList(
-        new Field("username", "username", Field.Type.USERNAME),
-        new Field("password", "password", Field.Type.PASSWORD)
+        USERNAME,
+        PASSWORD
     ));
     
 }

From 542c87d63169106dbb60081336011f1ce8faf57e Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Wed, 27 May 2015 15:15:22 -0700
Subject: [PATCH 03/21] GUAC-1176: Stub password reset logic.

---
 .../auth/jdbc/user/UserContextService.java    | 65 +++++++++++++++++--
 1 file changed, 61 insertions(+), 4 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
index 589edd149..98bdc0fd1 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
@@ -24,8 +24,16 @@ package org.glyptodon.guacamole.auth.jdbc.user;
 
 import com.google.inject.Inject;
 import com.google.inject.Provider;
+import java.util.Arrays;
+import javax.servlet.http.HttpServletRequest;
 import org.glyptodon.guacamole.GuacamoleException;
+import org.glyptodon.guacamole.form.Field;
 import org.glyptodon.guacamole.net.auth.Credentials;
+import org.glyptodon.guacamole.net.auth.credentials.CredentialsInfo;
+import org.glyptodon.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
+import org.glyptodon.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * Service which creates new UserContext instances for valid users based on
@@ -35,6 +43,11 @@ import org.glyptodon.guacamole.net.auth.Credentials;
  */
 public class UserContextService  {
 
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(UserService.class);
+
     /**
      * Service for accessing users.
      */
@@ -47,19 +60,45 @@ public class UserContextService  {
     @Inject
     private Provider<UserContext> userContextProvider;
 
+    /**
+     * The name of the HTTP parameter to expect if the user is changing their
+     * expired password upon login.
+     */
+    private static final String NEW_PASSWORD_PARAMETER = "new-password";
+
+    /**
+     * The field to provide the user when their password is expired and must
+     * be changed.
+     */
+    private static final Field NEW_PASSWORD = new Field(NEW_PASSWORD_PARAMETER, "New password", Field.Type.PASSWORD);
+
+    /**
+     * Information describing the expected credentials if a user's password is
+     * expired. If a user's password is expired, it must be changed during the
+     * login process.
+     */
+    private static final CredentialsInfo EXPIRED_PASSWORD = new CredentialsInfo(Arrays.asList(
+        CredentialsInfo.USERNAME,
+        CredentialsInfo.PASSWORD,
+        NEW_PASSWORD
+    ));
+
     /**
      * Authenticates the user having the given credentials, returning a new
-     * UserContext instance if the credentials are valid.
+     * UserContext instance only if the credentials are valid. If the
+     * credentials are invalid or expired, an appropriate GuacamoleException
+     * will be thrown.
      *
      * @param credentials
      *     The credentials to use to produce the UserContext.
      *
      * @return
      *     A new UserContext instance for the user identified by the given
-     *     credentials, or null if the credentials are not valid.
+     *     credentials.
      *
      * @throws GuacamoleException
-     *     If an error occurs during authentication.
+     *     If an error occurs during authentication, or if the given
+     *     credentials are invalid or expired.
      */
     public org.glyptodon.guacamole.net.auth.UserContext
         getUserContext(Credentials credentials)
@@ -69,6 +108,24 @@ public class UserContextService  {
         ModeledUser user = userService.retrieveUser(credentials);
         if (user != null && !user.getModel().isDisabled()) {
 
+            // Update password if password is expired
+            if (user.getModel().isExpired()) {
+
+                // Pull new password from HTTP request
+                HttpServletRequest request = credentials.getRequest();
+                String newPassword = request.getParameter(NEW_PASSWORD_PARAMETER);
+
+                // Require new password if account is expired
+                if (newPassword == null) {
+                    logger.info("The password of user \"{}\" has expired and must be reset.", user.getIdentifier());
+                    throw new GuacamoleInsufficientCredentialsException("Password expired", EXPIRED_PASSWORD);
+                }
+
+                // STUB: Change password if new password given
+                logger.info("Resetting expired password of user \"{}\".", user.getIdentifier());
+
+            }
+
             // Upon successful authentication, return new user context
             UserContext context = userContextProvider.get();
             context.init(user.getCurrentUser());
@@ -77,7 +134,7 @@ public class UserContextService  {
         }
 
         // Otherwise, unauthorized
-        return null;
+        throw new GuacamoleInvalidCredentialsException("Invalid login", CredentialsInfo.USERNAME_PASSWORD);
 
     }
 

From 7a3503a40e64fe8a5d5c45335d9f2320770c64fe Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Wed, 3 Jun 2015 00:29:36 -0700
Subject: [PATCH 04/21] GUAC-1176: Handle insufficient credentials distinctly
 from invalid credentials.

---
 .../app/auth/service/authenticationService.js |  2 +-
 .../app/index/controllers/indexController.js  | 16 ++++-
 .../main/webapp/app/login/directives/login.js | 68 ++++++++++++++++---
 .../webapp/app/login/templates/login.html     |  2 +-
 guacamole/src/main/webapp/index.html          |  3 +-
 5 files changed, 78 insertions(+), 13 deletions(-)

diff --git a/guacamole/src/main/webapp/app/auth/service/authenticationService.js b/guacamole/src/main/webapp/app/auth/service/authenticationService.js
index 6671052ed..2c0bd6bc0 100644
--- a/guacamole/src/main/webapp/app/auth/service/authenticationService.js
+++ b/guacamole/src/main/webapp/app/auth/service/authenticationService.js
@@ -160,7 +160,7 @@ angular.module('auth').factory('authenticationService', ['$injector',
             else if (error.type === Error.Type.INSUFFICIENT_CREDENTIALS)
                 $rootScope.$broadcast('guacInsufficientCredentials', parameters, error.expected);
 
-            authenticationProcess.reject();
+            authenticationProcess.reject(error);
         });
 
         return authenticationProcess.promise;
diff --git a/guacamole/src/main/webapp/app/index/controllers/indexController.js b/guacamole/src/main/webapp/app/index/controllers/indexController.js
index cd0897b2f..283e4a0cf 100644
--- a/guacamole/src/main/webapp/app/index/controllers/indexController.js
+++ b/guacamole/src/main/webapp/app/index/controllers/indexController.js
@@ -36,11 +36,22 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
      */
     $scope.guacNotification = guacNotification;
 
+    /**
+     * The credentials that the authentication service is has already accepted,
+     * pending additional credentials, if any. If the user is logged in, or no
+     * credentials have been accepted, this will be null. If credentials have
+     * been accepted, this will be a map of name/value pairs corresponding to
+     * the parameters submitted in a previous authentication attempt.
+     *
+     * @type Object.<String, String>
+     */
+    $scope.acceptedCredentials = null;
+
     /**
      * The credentials that the authentication service is currently expecting,
      * if any. If the user is logged in, this will be null.
      *
-     * @type Form[]|Form|Field[]|Field
+     * @type Field[]
      */
     $scope.expectedCredentials = null;
 
@@ -112,6 +123,7 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
     $scope.$on('guacInvalidCredentials', function loginInvalid(event, parameters, expected) {
         $scope.page.title = 'APP.NAME';
         $scope.page.bodyClassName = '';
+        $scope.acceptedCredentials = {};
         $scope.expectedCredentials = expected;
     });
 
@@ -119,11 +131,13 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
     $scope.$on('guacInsufficientCredentials', function loginInsufficient(event, parameters, expected) {
         $scope.page.title = 'APP.NAME';
         $scope.page.bodyClassName = '';
+        $scope.acceptedCredentials = parameters;
         $scope.expectedCredentials = expected;
     });
 
     // Clear login screen if login was successful
     $scope.$on('guacLogin', function loginSuccessful() {
+        $scope.acceptedCredentials = null;
         $scope.expectedCredentials = null;
     });
 
diff --git a/guacamole/src/main/webapp/app/login/directives/login.js b/guacamole/src/main/webapp/app/login/directives/login.js
index 1b8b407ca..fd05d4be3 100644
--- a/guacamole/src/main/webapp/app/login/directives/login.js
+++ b/guacamole/src/main/webapp/app/login/directives/login.js
@@ -39,9 +39,16 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
          * The login form or set of fields. This will be displayed to the user
          * to capture their credentials.
          *
-         * @type Form[]|Form|Field[]|Field 
+         * @type Field[]
          */
-        form : '='
+        form : '=',
+
+        /**
+         * A map of all field name/value pairs that have already been provided.
+         * If not null, the user will be prompted to continue their login
+         * attempt using only the fields which remain.
+         */
+        values : '='
 
     };
 
@@ -49,6 +56,10 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
     directive.controller = ['$scope', '$injector',
         function loginController($scope, $injector) {
         
+        // Required types
+        var Error = $injector.get('Error');
+        var Field = $injector.get('Field');
+
         // Required services
         var $route                = $injector.get('$route');
         var authenticationService = $injector.get('authenticationService');
@@ -61,9 +72,37 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
         $scope.loginError = false;
 
         /**
-         * All form values entered by the user.
+         * All form values entered by the user, as parameter name/value pairs.
+         *
+         * @type Object.<String, String>
          */
-        $scope.values = {};
+        $scope.enteredValues = {};
+
+        /**
+         * All form fields which have not yet been filled by the user.
+         *
+         * @type Field[]
+         */
+        $scope.remainingFields = [];
+
+        $scope.$watch('values', function resetEnteredValues(values) {
+            angular.extend($scope.enteredValues, values || {});
+        });
+
+        $scope.$watch('form', function resetRemainingFields(fields) {
+
+            // If no fields are provided, then no fields remain
+            if (!fields) {
+                $scope.remainingFields = [];
+                return;
+            }
+
+            // Filter provided fields against provided values
+            $scope.remainingFields = fields.filter(function isRemaining(field) {
+                return !(field.name in $scope.values);
+            });
+
+        });
 
         /**
          * Submits the currently-specified username and password to the
@@ -72,19 +111,30 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
         $scope.login = function login() {
 
             // Attempt login once existing session is destroyed
-            authenticationService.authenticate($scope.values)
+            authenticationService.authenticate($scope.enteredValues)
 
             // Clear and reload upon success
             .then(function loginSuccessful() {
                 $scope.loginError = false;
-                $scope.values = {};
+                $scope.enteredValues = {};
                 $route.reload();
             })
 
             // Reset upon failure
-            ['catch'](function loginFailed() {
-                $scope.loginError = true;
-                $scope.values.password = '';
+            ['catch'](function loginFailed(error) {
+
+                // Clear out passwords and flag error if credentials are invalid
+                if (error.type === Error.Type.INVALID_CREDENTIALS) {
+                    $scope.loginError = true;
+                    angular.forEach($scope.form, function clearEnteredValueIfPassword(field) {
+
+                        // Remove entered value only if field is a password field
+                        if (field.type === Field.Type.PASSWORD)
+                            delete $scope.enteredValues[field.name];
+
+                    });
+                }
+
             });
 
         };
diff --git a/guacamole/src/main/webapp/app/login/templates/login.html b/guacamole/src/main/webapp/app/login/templates/login.html
index ac6879a14..db020c86b 100644
--- a/guacamole/src/main/webapp/app/login/templates/login.html
+++ b/guacamole/src/main/webapp/app/login/templates/login.html
@@ -36,7 +36,7 @@
 
                 <!-- Login fields -->
                 <div class="login-fields">
-                    <guac-form namespace="'LOGIN'" content="form" model="values"></guac-form>
+                    <guac-form namespace="'LOGIN'" content="remainingFields" model="enteredValues"></guac-form>
                 </div>
 
                 <!-- Submit button -->
diff --git a/guacamole/src/main/webapp/index.html b/guacamole/src/main/webapp/index.html
index 3303ec1a8..046876f10 100644
--- a/guacamole/src/main/webapp/index.html
+++ b/guacamole/src/main/webapp/index.html
@@ -50,7 +50,8 @@
         </div>
 
         <!-- Login screen for logged-out users -->
-        <guac-login ng-show="expectedCredentials" form="expectedCredentials"></guac-login>
+        <guac-login ng-show="expectedCredentials" form="expectedCredentials"
+                    values="acceptedCredentials"></guac-login>
         
         <script type="text/javascript" src="app.js"></script>
     </body>

From 85dae9e52a80d169584f3341e62fddf855d6942f Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Wed, 3 Jun 2015 00:35:10 -0700
Subject: [PATCH 05/21] GUAC-1176: Clear passwords if credentials are rejected
 for any reason (even client error). Flag generic login error only for
 specifically invalid credentials.

---
 guacamole/src/main/webapp/app/login/directives/login.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/guacamole/src/main/webapp/app/login/directives/login.js b/guacamole/src/main/webapp/app/login/directives/login.js
index fd05d4be3..26316830c 100644
--- a/guacamole/src/main/webapp/app/login/directives/login.js
+++ b/guacamole/src/main/webapp/app/login/directives/login.js
@@ -123,9 +123,12 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
             // Reset upon failure
             ['catch'](function loginFailed(error) {
 
-                // Clear out passwords and flag error if credentials are invalid
-                if (error.type === Error.Type.INVALID_CREDENTIALS) {
+                // Flag generic error for invalid login
+                if (error.type === Error.Type.INVALID_CREDENTIALS)
                     $scope.loginError = true;
+
+                // Clear out passwords if the credentials were rejected for any reason
+                if (error.type !== Error.Type.INSUFFICIENT_CREDENTIALS) {
                     angular.forEach($scope.form, function clearEnteredValueIfPassword(field) {
 
                         // Remove entered value only if field is a password field

From 304e150a1e3ad0e67a8a55422a2bb85847486948 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Wed, 3 Jun 2015 16:04:44 -0700
Subject: [PATCH 06/21] GUAC-1176: Validate new password set due to expiration.
 Allow errors dialogs during login process.

---
 .../auth/jdbc/user/UserContextService.java    |  9 ++++
 .../main/webapp/app/login/directives/login.js | 46 ++++++++++++++++---
 .../webapp/app/login/templates/login.html     |  8 ++++
 .../src/main/webapp/translations/en.json      | 19 ++++----
 .../src/main/webapp/translations/ru.json      | 21 +++++----
 5 files changed, 80 insertions(+), 23 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
index 98bdc0fd1..4af1d5cee 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
@@ -26,6 +26,7 @@ import com.google.inject.Inject;
 import com.google.inject.Provider;
 import java.util.Arrays;
 import javax.servlet.http.HttpServletRequest;
+import org.glyptodon.guacamole.GuacamoleClientException;
 import org.glyptodon.guacamole.GuacamoleException;
 import org.glyptodon.guacamole.form.Field;
 import org.glyptodon.guacamole.net.auth.Credentials;
@@ -121,6 +122,14 @@ public class UserContextService  {
                     throw new GuacamoleInsufficientCredentialsException("Password expired", EXPIRED_PASSWORD);
                 }
 
+                // New password must be different from old password
+                if (newPassword.equals(credentials.getPassword()))
+                    throw new GuacamoleClientException("The new password must be different from the expired password.");
+
+                // New password must not be blank
+                if (newPassword.isEmpty())
+                    throw new GuacamoleClientException("The new password may not be blank.");
+
                 // STUB: Change password if new password given
                 logger.info("Resetting expired password of user \"{}\".", user.getIdentifier());
 
diff --git a/guacamole/src/main/webapp/app/login/directives/login.js b/guacamole/src/main/webapp/app/login/directives/login.js
index 26316830c..b54ab24cd 100644
--- a/guacamole/src/main/webapp/app/login/directives/login.js
+++ b/guacamole/src/main/webapp/app/login/directives/login.js
@@ -64,6 +64,26 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
         var $route                = $injector.get('$route');
         var authenticationService = $injector.get('authenticationService');
 
+        /**
+         * An action to be provided along with the object assigned to
+         * $scope.loginStatus which closes the currently-shown status dialog.
+         */
+        var ACKNOWLEDGE_ACTION = {
+            name        : "LOGIN.ACTION_ACKNOWLEDGE",
+            // Handle action
+            callback    : function acknowledgeCallback() {
+                $scope.loginStatus = false;
+            }
+        };
+
+        /**
+         * The currently-visible notification describing login status, or false
+         * if no notification should be shown.
+         *
+         * @type Notification|Boolean|Object
+         */
+        $scope.loginStatus = false;
+
         /**
          * Whether an error occurred during login.
          * 
@@ -110,12 +130,15 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
          */
         $scope.login = function login() {
 
+            // Start with cleared status
+            $scope.loginError  = false;
+            $scope.loginStatus = false;
+
             // Attempt login once existing session is destroyed
             authenticationService.authenticate($scope.enteredValues)
 
             // Clear and reload upon success
             .then(function loginSuccessful() {
-                $scope.loginError = false;
                 $scope.enteredValues = {};
                 $route.reload();
             })
@@ -123,13 +146,24 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
             // Reset upon failure
             ['catch'](function loginFailed(error) {
 
-                // Flag generic error for invalid login
-                if (error.type === Error.Type.INVALID_CREDENTIALS)
-                    $scope.loginError = true;
-
                 // Clear out passwords if the credentials were rejected for any reason
                 if (error.type !== Error.Type.INSUFFICIENT_CREDENTIALS) {
-                    angular.forEach($scope.form, function clearEnteredValueIfPassword(field) {
+
+                    // Flag generic error for invalid login
+                    if (error.type === Error.Type.INVALID_CREDENTIALS)
+                        $scope.loginError = true;
+
+                    // Display error if anything else goes wrong
+                    else
+                        $scope.loginStatus = {
+                            'className' : 'error',
+                            'title'     : 'LOGIN.DIALOG_HEADER_ERROR',
+                            'text'      : error.message,
+                            'actions'   : [ ACKNOWLEDGE_ACTION ]
+                        };
+
+                    // Clear all visible password fields
+                    angular.forEach($scope.remainingFields, function clearEnteredValueIfPassword(field) {
 
                         // Remove entered value only if field is a password field
                         if (field.type === Field.Type.PASSWORD)
diff --git a/guacamole/src/main/webapp/app/login/templates/login.html b/guacamole/src/main/webapp/app/login/templates/login.html
index db020c86b..bcb8ed48e 100644
--- a/guacamole/src/main/webapp/app/login/templates/login.html
+++ b/guacamole/src/main/webapp/app/login/templates/login.html
@@ -49,4 +49,12 @@
         </div>
 
     </div>
+
+    <!-- Login-specific status/error dialog -->
+    <div ng-class="{shown: loginStatus}" class="status-outer">
+        <div class="status-middle">
+            <guac-notification notification="loginStatus"></guac-notification>
+        </div>
+    </div>
+
 </div>
diff --git a/guacamole/src/main/webapp/translations/en.json b/guacamole/src/main/webapp/translations/en.json
index 08d050a10..1027a45fb 100644
--- a/guacamole/src/main/webapp/translations/en.json
+++ b/guacamole/src/main/webapp/translations/en.json
@@ -143,7 +143,10 @@
 
     "LOGIN": {
 
-        "ACTION_LOGIN" : "@:APP.ACTION_LOGIN",
+        "ACTION_ACKNOWLEDGE" : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_LOGIN"       : "@:APP.ACTION_LOGIN",
+
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
         "ERROR_INVALID_LOGIN" : "Invalid Login",
 
@@ -161,7 +164,7 @@
         "ACTION_SAVE"                 : "@:APP.ACTION_SAVE",
 
         "DIALOG_HEADER_CONFIRM_DELETE" : "Delete Connection",
-        "DIALOG_HEADER_ERROR"          : "Error",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
 
         "FIELD_HEADER_LOCATION" : "Location:",
         "FIELD_HEADER_NAME"     : "Name:",
@@ -194,7 +197,7 @@
         "ACTION_SAVE"          : "@:APP.ACTION_SAVE",
 
         "DIALOG_HEADER_CONFIRM_DELETE" : "Delete Connection Group",
-        "DIALOG_HEADER_ERROR"          : "Error",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
 
         "FIELD_HEADER_LOCATION" : "Location:",
         "FIELD_HEADER_NAME"     : "Name:",
@@ -216,8 +219,8 @@
         "ACTION_DELETE"        : "@:APP.ACTION_DELETE",
         "ACTION_SAVE"          : "@:APP.ACTION_SAVE",
 
-        "DIALOG_HEADER_CONFIRM_DELETE"  : "Delete User",
-        "DIALOG_HEADER_ERROR"           : "Error",
+        "DIALOG_HEADER_CONFIRM_DELETE" : "Delete User",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
 
         "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
 
@@ -414,7 +417,7 @@
         "ACTION_NEW_CONNECTION"       : "New Connection",
         "ACTION_NEW_CONNECTION_GROUP" : "New Group",
 
-        "DIALOG_HEADER_ERROR"          : "Error",
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
         "HELP_CONNECTIONS"   : "Click or tap on a connection below to manage that connection. Depending on your access level, connections can be added and deleted, and their properties (protocol, hostname, port, etc.) can be changed.",
         
@@ -469,7 +472,7 @@
         "ACTION_ACKNOWLEDGE"   : "@:APP.ACTION_ACKNOWLEDGE",
         "ACTION_NEW_USER"      : "New User",
 
-        "DIALOG_HEADER_ERROR"           : "Error",
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
         "HELP_USERS" : "Click or tap on a user below to manage that user. Depending on your access level, users can be added and deleted, and their passwords can be changed.",
 
@@ -484,7 +487,7 @@
         "ACTION_DELETE"      : "Kill Sessions",
         
         "DIALOG_HEADER_CONFIRM_DELETE" : "Kill Sessions",
-        "DIALOG_HEADER_ERROR"          : "Error",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
         
         "FIELD_PLACEHOLDER_FILTER" : "Filter",
         
diff --git a/guacamole/src/main/webapp/translations/ru.json b/guacamole/src/main/webapp/translations/ru.json
index ba7e6d78a..05096ba5a 100644
--- a/guacamole/src/main/webapp/translations/ru.json
+++ b/guacamole/src/main/webapp/translations/ru.json
@@ -143,7 +143,10 @@
 
     "LOGIN": {
 
-        "ACTION_LOGIN" : "@:APP.ACTION_LOGIN",
+        "ACTION_ACKNOWLEDGE" : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_LOGIN"       : "@:APP.ACTION_LOGIN",
+
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
         "ERROR_INVALID_LOGIN" : "Неверные данные для входа",
 
@@ -161,7 +164,7 @@
         "ACTION_SAVE"                 : "@:APP.ACTION_SAVE",
 
         "DIALOG_HEADER_CONFIRM_DELETE" : "Удалить подключение",
-        "DIALOG_HEADER_ERROR"          : "Ошибка",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
 
         "FIELD_HEADER_LOCATION" : "Размещение:",
         "FIELD_HEADER_NAME"     : "Название:",
@@ -194,7 +197,7 @@
         "ACTION_SAVE"          : "@:APP.ACTION_SAVE",
 
         "DIALOG_HEADER_CONFIRM_DELETE" : "Удалить группу подключений",
-        "DIALOG_HEADER_ERROR"          : "Ошибка",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
 
         "FIELD_HEADER_LOCATION" : "Размещение:",
         "FIELD_HEADER_NAME"     : "Название:",
@@ -216,8 +219,8 @@
         "ACTION_DELETE"        : "@:APP.ACTION_DELETE",
         "ACTION_SAVE"          : "@:APP.ACTION_SAVE",
 
-        "DIALOG_HEADER_CONFIRM_DELETE"  : "Удалить пользователя",
-        "DIALOG_HEADER_ERROR"           : "Ошибка",
+        "DIALOG_HEADER_CONFIRM_DELETE" : "Удалить пользователя",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
 
         "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
 
@@ -393,7 +396,7 @@
         "ACTION_NEW_CONNECTION"       : "Новое подключение",
         "ACTION_NEW_CONNECTION_GROUP" : "Новая группа",
 
-        "DIALOG_HEADER_ERROR"          : "Ошибка",
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
         "HELP_CONNECTIONS"   : "Нажмите на подключение, чтобы управлять им. В зависимости от прав доступа возможно добавление и удаление подключений, а также изменение их свойств (протокол, название сервера, порт и пр.).",
 
@@ -409,7 +412,7 @@
         "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
         "ACTION_UPDATE_PASSWORD"    : "@:APP.ACTION_UPDATE_PASSWORD",
 
-        "DIALOG_HEADER_ERROR"    : "@:APP.DIALOG_HEADER_ERROR",
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
         "ERROR_PASSWORD_BLANK"    : "Пароль не может быть пустым.",
         "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
@@ -448,7 +451,7 @@
         "ACTION_ACKNOWLEDGE"   : "@:APP.ACTION_ACKNOWLEDGE",
         "ACTION_NEW_USER"      : "Новый пользователь",
 
-        "DIALOG_HEADER_ERROR"           : "Ошибка",
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
         "HELP_USERS" : "Нажмите на пользователя, чтобы управлять им. В зависимости от прав доступа возможно добавление и удаление пользователей, а также изменение паролей.",
 
@@ -463,7 +466,7 @@
         "ACTION_DELETE"      : "Завершить сессии",
 
         "DIALOG_HEADER_CONFIRM_DELETE" : "Завершение сессий",
-        "DIALOG_HEADER_ERROR"          : "Ошибка",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
 
         "FIELD_PLACEHOLDER_FILTER" : "Фильтр",
 

From 904e54090f8a5b85e391f8c6e6395927741c30dc Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Wed, 3 Jun 2015 16:28:47 -0700
Subject: [PATCH 07/21] GUAC-1176: Use translation strings for client error
 messages.

---
 .../guacamole/auth/jdbc/user/UserContextService.java       | 4 ++--
 .../src/main/resources/translations/en.json                | 7 +++++++
 .../src/main/resources/translations/ru_RU.json             | 7 +++++++
 guacamole/src/main/webapp/translations/en.json             | 3 ++-
 guacamole/src/main/webapp/translations/ru.json             | 3 ++-
 5 files changed, 20 insertions(+), 4 deletions(-)
 create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru_RU.json

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
index 4af1d5cee..131cd19ce 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
@@ -124,11 +124,11 @@ public class UserContextService  {
 
                 // New password must be different from old password
                 if (newPassword.equals(credentials.getPassword()))
-                    throw new GuacamoleClientException("The new password must be different from the expired password.");
+                    throw new GuacamoleClientException("LOGIN.ERROR_PASSWORD_SAME");
 
                 // New password must not be blank
                 if (newPassword.isEmpty())
-                    throw new GuacamoleClientException("The new password may not be blank.");
+                    throw new GuacamoleClientException("LOGIN.ERROR_PASSWORD_BLANK");
 
                 // STUB: Change password if new password given
                 logger.info("Resetting expired password of user \"{}\".", user.getIdentifier());
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
index adeadf508..2a4098d9a 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
@@ -1,4 +1,10 @@
 {
+
+    "LOGIN" : {
+        "ERROR_PASSWORD_BLANK" : "@:APP.ERROR_PASSWORD_BLANK",
+        "ERROR_PASSWORD_SAME"  : "The new password must be different from the expired password."
+    },
+
     "USER_ATTRIBUTES" : {
 
         "FIELD_HEADER_DISABLED" : "Login disabled:",
@@ -7,4 +13,5 @@
         "SECTION_HEADER_RESTRICTIONS" : "Account Restrictions"
 
     }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru_RU.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru_RU.json
new file mode 100644
index 000000000..30a0c2ad6
--- /dev/null
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru_RU.json
@@ -0,0 +1,7 @@
+{
+
+    "LOGIN" : {
+        "ERROR_PASSWORD_BLANK" : "@:APP.ERROR_PASSWORD_BLANK"
+    }
+
+}
diff --git a/guacamole/src/main/webapp/translations/en.json b/guacamole/src/main/webapp/translations/en.json
index 1027a45fb..5a761501f 100644
--- a/guacamole/src/main/webapp/translations/en.json
+++ b/guacamole/src/main/webapp/translations/en.json
@@ -23,6 +23,7 @@
 
         "DIALOG_HEADER_ERROR" : "Error",
 
+        "ERROR_PASSWORD_BLANK"    : "Your password cannot be blank.",
         "ERROR_PASSWORD_MISMATCH" : "The provided passwords do not match.",
         
         "FIELD_HEADER_PASSWORD"       : "Password:",
@@ -435,7 +436,7 @@
 
         "DIALOG_HEADER_ERROR"    : "@:APP.DIALOG_HEADER_ERROR",
 
-        "ERROR_PASSWORD_BLANK"    : "Your password cannot be blank.",
+        "ERROR_PASSWORD_BLANK"    : "@:APP.ERROR_PASSWORD_BLANK",
         "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
 
         "FIELD_HEADER_LANGUAGE"           : "Display language:",
diff --git a/guacamole/src/main/webapp/translations/ru.json b/guacamole/src/main/webapp/translations/ru.json
index 05096ba5a..dd3947b83 100644
--- a/guacamole/src/main/webapp/translations/ru.json
+++ b/guacamole/src/main/webapp/translations/ru.json
@@ -23,6 +23,7 @@
 
         "DIALOG_HEADER_ERROR" : "Ошибка",
 
+        "ERROR_PASSWORD_BLANK"    : "Пароль не может быть пустым.",
         "ERROR_PASSWORD_MISMATCH" : "Указанные пароли не совпадают.",
 
         "FIELD_HEADER_PASSWORD"       : "Пароль:",
@@ -414,7 +415,7 @@
 
         "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
-        "ERROR_PASSWORD_BLANK"    : "Пароль не может быть пустым.",
+        "ERROR_PASSWORD_BLANK"    : "@:APP.ERROR_PASSWORD_BLANK",
         "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
 
         "FIELD_HEADER_LANGUAGE"           : "Язык:",

From 91fb8e3c8852dc0b2bc2bd437c5d09c1077fc442 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Wed, 3 Jun 2015 16:32:13 -0700
Subject: [PATCH 08/21] GUAC-1176: Only clear entered passwords - do not delete
 the fields entirely.

---
 guacamole/src/main/webapp/app/login/directives/login.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/guacamole/src/main/webapp/app/login/directives/login.js b/guacamole/src/main/webapp/app/login/directives/login.js
index b54ab24cd..a4b55fe63 100644
--- a/guacamole/src/main/webapp/app/login/directives/login.js
+++ b/guacamole/src/main/webapp/app/login/directives/login.js
@@ -166,8 +166,8 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
                     angular.forEach($scope.remainingFields, function clearEnteredValueIfPassword(field) {
 
                         // Remove entered value only if field is a password field
-                        if (field.type === Field.Type.PASSWORD)
-                            delete $scope.enteredValues[field.name];
+                        if (field.type === Field.Type.PASSWORD && field.name in $scope.enteredValues)
+                            $scope.enteredValues[field.name] = '';
 
                     });
                 }

From 4c0cf58d9f34de3406555ba17901aea913f911a5 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Wed, 3 Jun 2015 16:34:52 -0700
Subject: [PATCH 09/21] GUAC-1176: Add Russian translation strings to JDBC
 authentication.

---
 .../src/main/resources/guac-manifest.json                      | 3 ++-
 .../src/main/resources/guac-manifest.json                      | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json
index 6566bcc4b..93d2a5bfe 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json
@@ -10,7 +10,8 @@
     ],
 
     "translations" : [
-        "translations/en_US.json"
+        "translations/en_US.json",
+        "translations/ru_RU.json"
     ]
 
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json
index a3ae33e4e..e838ac7d9 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json
@@ -10,7 +10,8 @@
     ],
 
     "translations" : [
-        "translations/en_US.json"
+        "translations/en_US.json",
+        "translations/ru_RU.json"
     ]
 
 }

From a3d32032113e396145ce277aa808c8020d14644c Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Wed, 3 Jun 2015 16:52:20 -0700
Subject: [PATCH 10/21] GUAC-1176: Add password confirmation to reset
 procedure.

---
 .../auth/jdbc/user/UserContextService.java    | 30 +++++++++++++++----
 .../src/main/resources/translations/en.json   | 10 +++++--
 .../main/resources/translations/ru_RU.json    |  8 ++++-
 3 files changed, 39 insertions(+), 9 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
index 131cd19ce..9aae125b6 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
@@ -62,17 +62,29 @@ public class UserContextService  {
     private Provider<UserContext> userContextProvider;
 
     /**
-     * The name of the HTTP parameter to expect if the user is changing their
-     * expired password upon login.
+     * The name of the HTTP password parameter to expect if the user is
+     * changing their expired password upon login.
      */
     private static final String NEW_PASSWORD_PARAMETER = "new-password";
 
     /**
-     * The field to provide the user when their password is expired and must
-     * be changed.
+     * The password field to provide the user when their password is expired
+     * and must be changed.
      */
     private static final Field NEW_PASSWORD = new Field(NEW_PASSWORD_PARAMETER, "New password", Field.Type.PASSWORD);
 
+    /**
+     * The name of the HTTP password confirmation parameter to expect if the
+     * user is changing their expired password upon login.
+     */
+    private static final String CONFIRM_NEW_PASSWORD_PARAMETER = "confirm-new-password";
+
+    /**
+     * The password confirmation field to provide the user when their password
+     * is expired and must be changed.
+     */
+    private static final Field CONFIRM_NEW_PASSWORD = new Field(CONFIRM_NEW_PASSWORD_PARAMETER, "Confirm new password", Field.Type.PASSWORD);
+
     /**
      * Information describing the expected credentials if a user's password is
      * expired. If a user's password is expired, it must be changed during the
@@ -81,7 +93,8 @@ public class UserContextService  {
     private static final CredentialsInfo EXPIRED_PASSWORD = new CredentialsInfo(Arrays.asList(
         CredentialsInfo.USERNAME,
         CredentialsInfo.PASSWORD,
-        NEW_PASSWORD
+        NEW_PASSWORD,
+        CONFIRM_NEW_PASSWORD
     ));
 
     /**
@@ -115,9 +128,10 @@ public class UserContextService  {
                 // Pull new password from HTTP request
                 HttpServletRequest request = credentials.getRequest();
                 String newPassword = request.getParameter(NEW_PASSWORD_PARAMETER);
+                String confirmNewPassword = request.getParameter(CONFIRM_NEW_PASSWORD_PARAMETER);
 
                 // Require new password if account is expired
-                if (newPassword == null) {
+                if (newPassword == null || confirmNewPassword == null) {
                     logger.info("The password of user \"{}\" has expired and must be reset.", user.getIdentifier());
                     throw new GuacamoleInsufficientCredentialsException("Password expired", EXPIRED_PASSWORD);
                 }
@@ -130,6 +144,10 @@ public class UserContextService  {
                 if (newPassword.isEmpty())
                     throw new GuacamoleClientException("LOGIN.ERROR_PASSWORD_BLANK");
 
+                // Confirm that the password was entered correctly twice
+                if (!newPassword.equals(confirmNewPassword))
+                    throw new GuacamoleClientException("LOGIN.ERROR_PASSWORD_MISMATCH");
+
                 // STUB: Change password if new password given
                 logger.info("Resetting expired password of user \"{}\".", user.getIdentifier());
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
index 2a4098d9a..6bf4fb97b 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
@@ -1,8 +1,14 @@
 {
 
     "LOGIN" : {
-        "ERROR_PASSWORD_BLANK" : "@:APP.ERROR_PASSWORD_BLANK",
-        "ERROR_PASSWORD_SAME"  : "The new password must be different from the expired password."
+
+        "ERROR_PASSWORD_BLANK"    : "@:APP.ERROR_PASSWORD_BLANK",
+        "ERROR_PASSWORD_SAME"     : "The new password must be different from the expired password.",
+        "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
+
+        "FIELD_HEADER_NEW_PASSWORD"         : "New password",
+        "FIELD_HEADER_CONFIRM_NEW_PASSWORD" : "Confirm new password"
+
     },
 
     "USER_ATTRIBUTES" : {
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru_RU.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru_RU.json
index 30a0c2ad6..4811b495e 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru_RU.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru_RU.json
@@ -1,7 +1,13 @@
 {
 
     "LOGIN" : {
-        "ERROR_PASSWORD_BLANK" : "@:APP.ERROR_PASSWORD_BLANK"
+
+        "ERROR_PASSWORD_BLANK"    : "@:APP.ERROR_PASSWORD_BLANK",
+        "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
+
+        "FIELD_HEADER_NEW_PASSWORD"         : "Новый пароль",
+        "FIELD_HEADER_CONFIRM_NEW_PASSWORD" : "Подтверждение пароля"
+
     }
 
 }

From 02ffe81f2c70cbf2a0252cf89f8451303a19ce49 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Sun, 7 Jun 2015 12:00:03 -0700
Subject: [PATCH 11/21] GUAC-1176: Bring up-to-date with changes from
 GUAC-1217.

---
 .../src/main/resources/translations/fr.json         | 13 +++++++++++++
 .../resources/translations/{ru_RU.json => ru.json}  |  0
 .../src/main/resources/guac-manifest.json           |  5 +++--
 .../src/main/resources/guac-manifest.json           |  5 +++--
 4 files changed, 19 insertions(+), 4 deletions(-)
 create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/fr.json
 rename extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/{ru_RU.json => ru.json} (100%)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/fr.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/fr.json
new file mode 100644
index 000000000..5369d51b2
--- /dev/null
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/fr.json
@@ -0,0 +1,13 @@
+{
+
+    "LOGIN" : {
+
+        "ERROR_PASSWORD_BLANK"    : "@:APP.ERROR_PASSWORD_BLANK",
+        "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
+
+        "FIELD_HEADER_NEW_PASSWORD"         : "Mot de passe",
+        "FIELD_HEADER_CONFIRM_NEW_PASSWORD" : "Répéter mot de passe"
+
+    }
+
+}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru_RU.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru.json
similarity index 100%
rename from extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru_RU.json
rename to extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru.json
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json
index 93d2a5bfe..0ca039a5e 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json
@@ -10,8 +10,9 @@
     ],
 
     "translations" : [
-        "translations/en_US.json",
-        "translations/ru_RU.json"
+        "translations/en.json",
+        "translations/fr.json",
+        "translations/ru.json"
     ]
 
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json
index e838ac7d9..18f97e207 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json
@@ -10,8 +10,9 @@
     ],
 
     "translations" : [
-        "translations/en_US.json",
-        "translations/ru_RU.json"
+        "translations/en.json",
+        "translations/fr.json",
+        "translations/ru.json"
     ]
 
 }

From 7826039d1fcb51c120d6842348daebb0fc073d7c Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Sun, 7 Jun 2015 22:15:02 -0700
Subject: [PATCH 12/21] GUAC-1176: Set CSS "continuation" class on login
 interface if login is continuing.

---
 .../main/webapp/app/login/directives/login.js  | 18 +++++++++++++++++-
 .../main/webapp/app/login/templates/login.html |  2 +-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/guacamole/src/main/webapp/app/login/directives/login.js b/guacamole/src/main/webapp/app/login/directives/login.js
index a4b55fe63..c818671a8 100644
--- a/guacamole/src/main/webapp/app/login/directives/login.js
+++ b/guacamole/src/main/webapp/app/login/directives/login.js
@@ -86,7 +86,7 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
 
         /**
          * Whether an error occurred during login.
-         * 
+         *
          * @type Boolean
          */
         $scope.loginError = false;
@@ -105,6 +105,22 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
          */
         $scope.remainingFields = [];
 
+        /**
+         * Returns whether a previous login attempt is continuing.
+         *
+         * @return {Boolean}
+         *     true if a previous login attempt is continuing, false otherwise.
+         */
+        $scope.isContinuation = function isContinuation() {
+
+            // The login is continuing if any parameter values are provided
+            for (var name in $scope.values)
+                return true;
+
+            return false;
+
+        };
+
         $scope.$watch('values', function resetEnteredValues(values) {
             angular.extend($scope.enteredValues, values || {});
         });
diff --git a/guacamole/src/main/webapp/app/login/templates/login.html b/guacamole/src/main/webapp/app/login/templates/login.html
index bcb8ed48e..d00f4a174 100644
--- a/guacamole/src/main/webapp/app/login/templates/login.html
+++ b/guacamole/src/main/webapp/app/login/templates/login.html
@@ -1,4 +1,4 @@
-<div class="login-ui" ng-class="{error: loginError}" >
+<div class="login-ui" ng-class="{error: loginError, continuation: isContinuation(), initial: !isContinuation()}" >
     <!--
     Copyright 2014 Glyptodon LLC.
 

From de6c5fd4dae3a7991742ce5c7973cfffbd71e328 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Mon, 8 Jun 2015 01:19:57 -0700
Subject: [PATCH 13/21] GUAC-1176: Provide user with help text during login.
 Style continuation dialog differently. Add continue button.

---
 .../app/auth/service/authenticationService.js |  7 ++++---
 .../app/index/controllers/indexController.js  | 19 +++++++++++++++----
 .../main/webapp/app/login/directives/login.js |  8 ++++++++
 .../main/webapp/app/login/styles/dialog.css   | 12 ++++++++++++
 .../main/webapp/app/login/styles/input.css    | 11 ++++++++++-
 .../webapp/app/login/templates/login.html     |  4 ++++
 guacamole/src/main/webapp/index.html          |  4 +++-
 .../src/main/webapp/translations/en.json      |  2 ++
 8 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/guacamole/src/main/webapp/app/auth/service/authenticationService.js b/guacamole/src/main/webapp/app/auth/service/authenticationService.js
index 2c0bd6bc0..cece87b17 100644
--- a/guacamole/src/main/webapp/app/auth/service/authenticationService.js
+++ b/guacamole/src/main/webapp/app/auth/service/authenticationService.js
@@ -36,7 +36,8 @@
  * Failed logins may also result in guacInsufficientCredentials or
  * guacInvalidCredentials events, if the provided credentials were rejected for
  * being insufficient or invalid respectively. Both events will be provided
- * the set of parameters originally given to authenticate() and the set of
+ * the set of parameters originally given to authenticate() and the error that
+ * rejected the credentials. The Error object provided will contain set of
  * expected credentials returned by the REST endpoint. This set of credentials
  * will be in the form of a Field array.
  */
@@ -154,11 +155,11 @@ angular.module('auth').factory('authenticationService', ['$injector',
 
             // Request credentials if provided credentials were invalid
             if (error.type === Error.Type.INVALID_CREDENTIALS)
-                $rootScope.$broadcast('guacInvalidCredentials', parameters, error.expected);
+                $rootScope.$broadcast('guacInvalidCredentials', parameters, error);
 
             // Request more credentials if provided credentials were not enough 
             else if (error.type === Error.Type.INSUFFICIENT_CREDENTIALS)
-                $rootScope.$broadcast('guacInsufficientCredentials', parameters, error.expected);
+                $rootScope.$broadcast('guacInsufficientCredentials', parameters, error);
 
             authenticationProcess.reject(error);
         });
diff --git a/guacamole/src/main/webapp/app/index/controllers/indexController.js b/guacamole/src/main/webapp/app/index/controllers/indexController.js
index 283e4a0cf..3980568d1 100644
--- a/guacamole/src/main/webapp/app/index/controllers/indexController.js
+++ b/guacamole/src/main/webapp/app/index/controllers/indexController.js
@@ -36,6 +36,14 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
      */
     $scope.guacNotification = guacNotification;
 
+    /**
+     * The message to display to the user as instructions for the login
+     * process.
+     *
+     * @type String
+     */
+    $scope.loginHelpText = null;
+
     /**
      * The credentials that the authentication service is has already accepted,
      * pending additional credentials, if any. If the user is logged in, or no
@@ -120,23 +128,26 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
     };
 
     // Display login screen if a whole new set of credentials is needed
-    $scope.$on('guacInvalidCredentials', function loginInvalid(event, parameters, expected) {
+    $scope.$on('guacInvalidCredentials', function loginInvalid(event, parameters, error) {
         $scope.page.title = 'APP.NAME';
         $scope.page.bodyClassName = '';
+        $scope.loginHelpText = null;
         $scope.acceptedCredentials = {};
-        $scope.expectedCredentials = expected;
+        $scope.expectedCredentials = error.expected;
     });
 
     // Prompt for remaining credentials if provided credentials were not enough
-    $scope.$on('guacInsufficientCredentials', function loginInsufficient(event, parameters, expected) {
+    $scope.$on('guacInsufficientCredentials', function loginInsufficient(event, parameters, error) {
         $scope.page.title = 'APP.NAME';
         $scope.page.bodyClassName = '';
+        $scope.loginHelpText = error.message;
         $scope.acceptedCredentials = parameters;
-        $scope.expectedCredentials = expected;
+        $scope.expectedCredentials = error.expected;
     });
 
     // Clear login screen if login was successful
     $scope.$on('guacLogin', function loginSuccessful() {
+        $scope.loginHelpText = null;
         $scope.acceptedCredentials = null;
         $scope.expectedCredentials = null;
     });
diff --git a/guacamole/src/main/webapp/app/login/directives/login.js b/guacamole/src/main/webapp/app/login/directives/login.js
index c818671a8..4941396c9 100644
--- a/guacamole/src/main/webapp/app/login/directives/login.js
+++ b/guacamole/src/main/webapp/app/login/directives/login.js
@@ -35,6 +35,14 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
     // Login directive scope
     directive.scope = {
 
+        /**
+         * An optional instructional message to display within the login
+         * dialog.
+         *
+         * @type String
+         */
+        helpText : '=',
+
         /**
          * The login form or set of fields. This will be displayed to the user
          * to capture their credentials.
diff --git a/guacamole/src/main/webapp/app/login/styles/dialog.css b/guacamole/src/main/webapp/app/login/styles/dialog.css
index c2d3a9709..56886c2bc 100644
--- a/guacamole/src/main/webapp/app/login/styles/dialog.css
+++ b/guacamole/src/main/webapp/app/login/styles/dialog.css
@@ -86,3 +86,15 @@
     max-width: 3em;
     margin: 0.5em auto;
 }
+
+.login-ui.continuation div.login-dialog {
+    border-right: none;
+    border-left: none;
+    box-shadow: none;
+    max-width: 6in;
+}
+
+.login-ui.continuation .login-dialog .logo,
+.login-ui.continuation .login-dialog .version {
+    display: none;
+}
diff --git a/guacamole/src/main/webapp/app/login/styles/input.css b/guacamole/src/main/webapp/app/login/styles/input.css
index d56ae5b12..fd4d70527 100644
--- a/guacamole/src/main/webapp/app/login/styles/input.css
+++ b/guacamole/src/main/webapp/app/login/styles/input.css
@@ -38,4 +38,13 @@
 .login-ui .login-dialog .buttons input[type="submit"] {
     width: 100%;
     margin: 0;
-}
\ No newline at end of file
+}
+
+.login-ui.continuation .login-dialog .buttons input[type="submit"] {
+    width: auto;
+}
+
+.login-ui.initial .login-dialog input.continue-login,
+.login-ui.continuation .login-dialog input.login {
+    display: none;
+}
diff --git a/guacamole/src/main/webapp/app/login/templates/login.html b/guacamole/src/main/webapp/app/login/templates/login.html
index d00f4a174..db30bf046 100644
--- a/guacamole/src/main/webapp/app/login/templates/login.html
+++ b/guacamole/src/main/webapp/app/login/templates/login.html
@@ -34,6 +34,9 @@
                 <img class="logo" src="images/guac-tricolor.png" alt=""/>
                 <div class="version">{{'APP.NAME' | translate}}</div>
 
+                <!-- Login message/instructions -->
+                <p ng-show="helpText">{{helpText | translate}}</p>
+
                 <!-- Login fields -->
                 <div class="login-fields">
                     <guac-form namespace="'LOGIN'" content="remainingFields" model="enteredValues"></guac-form>
@@ -42,6 +45,7 @@
                 <!-- Submit button -->
                 <div class="buttons">
                     <input type="submit" name="login" class="login" value="{{'LOGIN.ACTION_LOGIN' | translate}}"/>
+                    <input type="submit" name="login" class="continue-login" value="{{'LOGIN.ACTION_CONTINUE' | translate}}"/>
                 </div>
 
             </form>
diff --git a/guacamole/src/main/webapp/index.html b/guacamole/src/main/webapp/index.html
index 046876f10..6261ec533 100644
--- a/guacamole/src/main/webapp/index.html
+++ b/guacamole/src/main/webapp/index.html
@@ -50,7 +50,9 @@
         </div>
 
         <!-- Login screen for logged-out users -->
-        <guac-login ng-show="expectedCredentials" form="expectedCredentials"
+        <guac-login ng-show="expectedCredentials"
+                    help-text="loginHelpText"
+                    form="expectedCredentials"
                     values="acceptedCredentials"></guac-login>
         
         <script type="text/javascript" src="app.js"></script>
diff --git a/guacamole/src/main/webapp/translations/en.json b/guacamole/src/main/webapp/translations/en.json
index 5a761501f..8f634dca7 100644
--- a/guacamole/src/main/webapp/translations/en.json
+++ b/guacamole/src/main/webapp/translations/en.json
@@ -7,6 +7,7 @@
         "ACTION_ACKNOWLEDGE"        : "OK",
         "ACTION_CANCEL"             : "Cancel",
         "ACTION_CLONE"              : "Clone",
+        "ACTION_CONTINUE"           : "Continue",
         "ACTION_DELETE"             : "Delete",
         "ACTION_DELETE_SESSIONS"    : "Kill Sessions",
         "ACTION_LOGIN"              : "Login",
@@ -145,6 +146,7 @@
     "LOGIN": {
 
         "ACTION_ACKNOWLEDGE" : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CONTINUE"    : "@:APP.ACTION_CONTINUE",
         "ACTION_LOGIN"       : "@:APP.ACTION_LOGIN",
 
         "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",

From 6ea589b7e87125a0e613473d0ec0b003f8ddf73d Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Mon, 8 Jun 2015 01:28:37 -0700
Subject: [PATCH 14/21] GUAC-1176: Use existing login error status. No need for
 modal notifications.

---
 .../main/webapp/app/login/directives/login.js | 36 +++----------------
 .../webapp/app/login/templates/login.html     |  9 +----
 2 files changed, 6 insertions(+), 39 deletions(-)

diff --git a/guacamole/src/main/webapp/app/login/directives/login.js b/guacamole/src/main/webapp/app/login/directives/login.js
index 4941396c9..0cd8f03d5 100644
--- a/guacamole/src/main/webapp/app/login/directives/login.js
+++ b/guacamole/src/main/webapp/app/login/directives/login.js
@@ -73,29 +73,9 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
         var authenticationService = $injector.get('authenticationService');
 
         /**
-         * An action to be provided along with the object assigned to
-         * $scope.loginStatus which closes the currently-shown status dialog.
-         */
-        var ACKNOWLEDGE_ACTION = {
-            name        : "LOGIN.ACTION_ACKNOWLEDGE",
-            // Handle action
-            callback    : function acknowledgeCallback() {
-                $scope.loginStatus = false;
-            }
-        };
-
-        /**
-         * The currently-visible notification describing login status, or false
-         * if no notification should be shown.
+         * A description of the error that occurred during login, if any.
          *
-         * @type Notification|Boolean|Object
-         */
-        $scope.loginStatus = false;
-
-        /**
-         * Whether an error occurred during login.
-         *
-         * @type Boolean
+         * @type String
          */
         $scope.loginError = false;
 
@@ -155,8 +135,7 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
         $scope.login = function login() {
 
             // Start with cleared status
-            $scope.loginError  = false;
-            $scope.loginStatus = false;
+            $scope.loginError  = null;
 
             // Attempt login once existing session is destroyed
             authenticationService.authenticate($scope.enteredValues)
@@ -175,16 +154,11 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
 
                     // Flag generic error for invalid login
                     if (error.type === Error.Type.INVALID_CREDENTIALS)
-                        $scope.loginError = true;
+                        $scope.loginError = 'LOGIN.ERROR_INVALID_LOGIN';
 
                     // Display error if anything else goes wrong
                     else
-                        $scope.loginStatus = {
-                            'className' : 'error',
-                            'title'     : 'LOGIN.DIALOG_HEADER_ERROR',
-                            'text'      : error.message,
-                            'actions'   : [ ACKNOWLEDGE_ACTION ]
-                        };
+                        $scope.loginError = error.message;
 
                     // Clear all visible password fields
                     angular.forEach($scope.remainingFields, function clearEnteredValueIfPassword(field) {
diff --git a/guacamole/src/main/webapp/app/login/templates/login.html b/guacamole/src/main/webapp/app/login/templates/login.html
index db30bf046..3de86f507 100644
--- a/guacamole/src/main/webapp/app/login/templates/login.html
+++ b/guacamole/src/main/webapp/app/login/templates/login.html
@@ -22,7 +22,7 @@
     -->
 
     <!-- Login error message -->
-    <p class="login-error">{{'LOGIN.ERROR_INVALID_LOGIN' | translate}}</p>
+    <p class="login-error">{{loginError | translate}}</p>
 
     <div class="login-dialog-middle">
 
@@ -54,11 +54,4 @@
 
     </div>
 
-    <!-- Login-specific status/error dialog -->
-    <div ng-class="{shown: loginStatus}" class="status-outer">
-        <div class="status-middle">
-            <guac-notification notification="loginStatus"></guac-notification>
-        </div>
-    </div>
-
 </div>

From b53bd3ca4f34301466ea022d5a084438ffd7e8c6 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Mon, 8 Jun 2015 01:40:49 -0700
Subject: [PATCH 15/21] GUAC-1176: Ensure login fields default to blank, not
 null or undefined.

---
 guacamole/src/main/webapp/app/login/directives/login.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/guacamole/src/main/webapp/app/login/directives/login.js b/guacamole/src/main/webapp/app/login/directives/login.js
index 0cd8f03d5..0c836c05a 100644
--- a/guacamole/src/main/webapp/app/login/directives/login.js
+++ b/guacamole/src/main/webapp/app/login/directives/login.js
@@ -109,10 +109,13 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
 
         };
 
+        // Ensure provided values are included within entered values, even if
+        // they have no corresponding input fields
         $scope.$watch('values', function resetEnteredValues(values) {
             angular.extend($scope.enteredValues, values || {});
         });
 
+        // Update field information when form is changed
         $scope.$watch('form', function resetRemainingFields(fields) {
 
             // If no fields are provided, then no fields remain
@@ -126,6 +129,12 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
                 return !(field.name in $scope.values);
             });
 
+            // Set default values for all unset fields
+            angular.forEach($scope.remainingFields, function setDefault(field) {
+                if (!$scope.enteredValues[field.name])
+                    $scope.enteredValues[field.name] = '';
+            });
+
         });
 
         /**

From 0b8b67026a4ed8bb2ee4b5357519c9930100409a Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Mon, 8 Jun 2015 01:44:53 -0700
Subject: [PATCH 16/21] GUAC-1176: Implement password reset logic within
 UserService, like the rest of user auth.

---
 .../auth/jdbc/user/UserContextService.java    |  81 +------------
 .../guacamole/auth/jdbc/user/UserService.java | 113 ++++++++++++++++--
 .../src/main/resources/translations/en.json   |   2 +
 3 files changed, 104 insertions(+), 92 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
index 9aae125b6..b980b10ef 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserContextService.java
@@ -24,17 +24,10 @@ package org.glyptodon.guacamole.auth.jdbc.user;
 
 import com.google.inject.Inject;
 import com.google.inject.Provider;
-import java.util.Arrays;
-import javax.servlet.http.HttpServletRequest;
-import org.glyptodon.guacamole.GuacamoleClientException;
 import org.glyptodon.guacamole.GuacamoleException;
-import org.glyptodon.guacamole.form.Field;
 import org.glyptodon.guacamole.net.auth.Credentials;
 import org.glyptodon.guacamole.net.auth.credentials.CredentialsInfo;
-import org.glyptodon.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
 import org.glyptodon.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Service which creates new UserContext instances for valid users based on
@@ -44,11 +37,6 @@ import org.slf4j.LoggerFactory;
  */
 public class UserContextService  {
 
-    /**
-     * Logger for this class.
-     */
-    private static final Logger logger = LoggerFactory.getLogger(UserService.class);
-
     /**
      * Service for accessing users.
      */
@@ -61,42 +49,6 @@ public class UserContextService  {
     @Inject
     private Provider<UserContext> userContextProvider;
 
-    /**
-     * The name of the HTTP password parameter to expect if the user is
-     * changing their expired password upon login.
-     */
-    private static final String NEW_PASSWORD_PARAMETER = "new-password";
-
-    /**
-     * The password field to provide the user when their password is expired
-     * and must be changed.
-     */
-    private static final Field NEW_PASSWORD = new Field(NEW_PASSWORD_PARAMETER, "New password", Field.Type.PASSWORD);
-
-    /**
-     * The name of the HTTP password confirmation parameter to expect if the
-     * user is changing their expired password upon login.
-     */
-    private static final String CONFIRM_NEW_PASSWORD_PARAMETER = "confirm-new-password";
-
-    /**
-     * The password confirmation field to provide the user when their password
-     * is expired and must be changed.
-     */
-    private static final Field CONFIRM_NEW_PASSWORD = new Field(CONFIRM_NEW_PASSWORD_PARAMETER, "Confirm new password", Field.Type.PASSWORD);
-
-    /**
-     * Information describing the expected credentials if a user's password is
-     * expired. If a user's password is expired, it must be changed during the
-     * login process.
-     */
-    private static final CredentialsInfo EXPIRED_PASSWORD = new CredentialsInfo(Arrays.asList(
-        CredentialsInfo.USERNAME,
-        CredentialsInfo.PASSWORD,
-        NEW_PASSWORD,
-        CONFIRM_NEW_PASSWORD
-    ));
-
     /**
      * Authenticates the user having the given credentials, returning a new
      * UserContext instance only if the credentials are valid. If the
@@ -120,38 +72,7 @@ public class UserContextService  {
 
         // Authenticate user
         ModeledUser user = userService.retrieveUser(credentials);
-        if (user != null && !user.getModel().isDisabled()) {
-
-            // Update password if password is expired
-            if (user.getModel().isExpired()) {
-
-                // Pull new password from HTTP request
-                HttpServletRequest request = credentials.getRequest();
-                String newPassword = request.getParameter(NEW_PASSWORD_PARAMETER);
-                String confirmNewPassword = request.getParameter(CONFIRM_NEW_PASSWORD_PARAMETER);
-
-                // Require new password if account is expired
-                if (newPassword == null || confirmNewPassword == null) {
-                    logger.info("The password of user \"{}\" has expired and must be reset.", user.getIdentifier());
-                    throw new GuacamoleInsufficientCredentialsException("Password expired", EXPIRED_PASSWORD);
-                }
-
-                // New password must be different from old password
-                if (newPassword.equals(credentials.getPassword()))
-                    throw new GuacamoleClientException("LOGIN.ERROR_PASSWORD_SAME");
-
-                // New password must not be blank
-                if (newPassword.isEmpty())
-                    throw new GuacamoleClientException("LOGIN.ERROR_PASSWORD_BLANK");
-
-                // Confirm that the password was entered correctly twice
-                if (!newPassword.equals(confirmNewPassword))
-                    throw new GuacamoleClientException("LOGIN.ERROR_PASSWORD_MISMATCH");
-
-                // STUB: Change password if new password given
-                logger.info("Resetting expired password of user \"{}\".", user.getIdentifier());
-
-            }
+        if (user != null) {
 
             // Upon successful authentication, return new user context
             UserContext context = userContextProvider.get();
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java
index 6cb7ad36b..7495cfa1e 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java
@@ -27,6 +27,7 @@ import com.google.inject.Provider;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
+import javax.servlet.http.HttpServletRequest;
 import org.glyptodon.guacamole.net.auth.Credentials;
 import org.glyptodon.guacamole.auth.jdbc.base.ModeledDirectoryObjectMapper;
 import org.glyptodon.guacamole.auth.jdbc.base.ModeledDirectoryObjectService;
@@ -37,11 +38,16 @@ import org.glyptodon.guacamole.auth.jdbc.permission.ObjectPermissionMapper;
 import org.glyptodon.guacamole.auth.jdbc.permission.ObjectPermissionModel;
 import org.glyptodon.guacamole.auth.jdbc.permission.UserPermissionMapper;
 import org.glyptodon.guacamole.auth.jdbc.security.PasswordEncryptionService;
+import org.glyptodon.guacamole.form.Field;
 import org.glyptodon.guacamole.net.auth.User;
+import org.glyptodon.guacamole.net.auth.credentials.CredentialsInfo;
+import org.glyptodon.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
 import org.glyptodon.guacamole.net.auth.permission.ObjectPermission;
 import org.glyptodon.guacamole.net.auth.permission.ObjectPermissionSet;
 import org.glyptodon.guacamole.net.auth.permission.SystemPermission;
 import org.glyptodon.guacamole.net.auth.permission.SystemPermissionSet;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * Service which provides convenience methods for creating, retrieving, and
@@ -51,6 +57,11 @@ import org.glyptodon.guacamole.net.auth.permission.SystemPermissionSet;
  */
 public class UserService extends ModeledDirectoryObjectService<ModeledUser, User, UserModel> {
     
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(UserService.class);
+
     /**
      * All user permissions which are implicitly granted to the new user upon
      * creation.
@@ -59,7 +70,43 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
         ObjectPermission.Type.READ,
         ObjectPermission.Type.UPDATE
     };
-    
+
+    /**
+     * The name of the HTTP password parameter to expect if the user is
+     * changing their expired password upon login.
+     */
+    private static final String NEW_PASSWORD_PARAMETER = "new-password";
+
+    /**
+     * The password field to provide the user when their password is expired
+     * and must be changed.
+     */
+    private static final Field NEW_PASSWORD = new Field(NEW_PASSWORD_PARAMETER, "New password", Field.Type.PASSWORD);
+
+    /**
+     * The name of the HTTP password confirmation parameter to expect if the
+     * user is changing their expired password upon login.
+     */
+    private static final String CONFIRM_NEW_PASSWORD_PARAMETER = "confirm-new-password";
+
+    /**
+     * The password confirmation field to provide the user when their password
+     * is expired and must be changed.
+     */
+    private static final Field CONFIRM_NEW_PASSWORD = new Field(CONFIRM_NEW_PASSWORD_PARAMETER, "Confirm new password", Field.Type.PASSWORD);
+
+    /**
+     * Information describing the expected credentials if a user's password is
+     * expired. If a user's password is expired, it must be changed during the
+     * login process.
+     */
+    private static final CredentialsInfo EXPIRED_PASSWORD = new CredentialsInfo(Arrays.asList(
+        CredentialsInfo.USERNAME,
+        CredentialsInfo.PASSWORD,
+        NEW_PASSWORD,
+        CONFIRM_NEW_PASSWORD
+    ));
+
     /**
      * Mapper for accessing users.
      */
@@ -213,7 +260,9 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
 
     /**
      * Retrieves the user corresponding to the given credentials from the
-     * database.
+     * database. If the user account is expired, and the credentials contain
+     * the necessary additional parameters to reset the user's password, the
+     * password is reset.
      *
      * @param credentials
      *     The credentials to use when locating the user.
@@ -221,8 +270,12 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
      * @return
      *     The existing ModeledUser object if the credentials given are valid,
      *     null otherwise.
+     *
+     * @throws GuacamoleException
+     *     If the provided credentials to not conform to expectations.
      */
-    public ModeledUser retrieveUser(Credentials credentials) {
+    public ModeledUser retrieveUser(Credentials credentials)
+            throws GuacamoleException {
 
         // Get username and password
         String username = credentials.getUsername();
@@ -233,19 +286,55 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
         if (userModel == null)
             return null;
 
-        // If password hash matches, return the retrieved user
-        byte[] hash = encryptionService.createPasswordHash(password, userModel.getPasswordSalt());
-        if (Arrays.equals(hash, userModel.getPasswordHash())) {
+        // If user is disabled, pretend user does not exist
+        if (userModel.isDisabled())
+            return null;
 
-            // Return corresponding user, set up cyclic reference
-            ModeledUser user = getObjectInstance(null, userModel);
-            user.setCurrentUser(new AuthenticatedUser(user, credentials));
-            return user;
+        // Verify provided password is correct
+        byte[] hash = encryptionService.createPasswordHash(password, userModel.getPasswordSalt());
+        if (!Arrays.equals(hash, userModel.getPasswordHash()))
+            return null;
+
+        // Create corresponding user object, set up cyclic reference
+        ModeledUser user = getObjectInstance(null, userModel);
+        user.setCurrentUser(new AuthenticatedUser(user, credentials));
+
+        // Update password if password is expired
+        if (userModel.isExpired()) {
+
+            // Pull new password from HTTP request
+            HttpServletRequest request = credentials.getRequest();
+            String newPassword = request.getParameter(NEW_PASSWORD_PARAMETER);
+            String confirmNewPassword = request.getParameter(CONFIRM_NEW_PASSWORD_PARAMETER);
+
+            // Require new password if account is expired
+            if (newPassword == null || confirmNewPassword == null) {
+                logger.info("The password of user \"{}\" has expired and must be reset.", username);
+                throw new GuacamoleInsufficientCredentialsException("LOGIN.INFO_PASSWORD_EXPIRED", EXPIRED_PASSWORD);
+            }
+
+            // New password must be different from old password
+            if (newPassword.equals(credentials.getPassword()))
+                throw new GuacamoleClientException("LOGIN.ERROR_PASSWORD_SAME");
+
+            // New password must not be blank
+            if (newPassword.isEmpty())
+                throw new GuacamoleClientException("LOGIN.ERROR_PASSWORD_BLANK");
+
+            // Confirm that the password was entered correctly twice
+            if (!newPassword.equals(confirmNewPassword))
+                throw new GuacamoleClientException("LOGIN.ERROR_PASSWORD_MISMATCH");
+
+            // Change password and reset expiration flag
+            userModel.setExpired(false);
+            user.setPassword(newPassword);
+            userMapper.update(userModel);
+            logger.info("Expired password of user \"{}\" has been reset.", username);
 
         }
 
-        // Otherwise, the credentials do not match
-        return null;
+        // Return now-authenticated user
+        return user;
 
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
index 6bf4fb97b..756aca2f1 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
@@ -6,6 +6,8 @@
         "ERROR_PASSWORD_SAME"     : "The new password must be different from the expired password.",
         "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
 
+        "INFO_PASSWORD_EXPIRED" : "Your password has expired and must be reset. Please enter a new password to continue.",
+
         "FIELD_HEADER_NEW_PASSWORD"         : "New password",
         "FIELD_HEADER_CONFIRM_NEW_PASSWORD" : "Confirm new password"
 

From a532e22926c5633fa7f8c9fb25b1704d6928603d Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Mon, 8 Jun 2015 10:14:10 -0700
Subject: [PATCH 17/21] GUAC-1176: Generalize form fields by removing the value
 property. Add type-specific convenience classes for each field.

---
 .../guacamole/auth/jdbc/user/ModeledUser.java |  7 +-
 .../guacamole/auth/jdbc/user/UserService.java |  5 +-
 .../guacamole/form/BooleanField.java          | 58 ++++++++++++++
 .../glyptodon/guacamole/form/EnumField.java   | 51 ++++++++++++
 .../org/glyptodon/guacamole/form/Field.java   | 63 +++++----------
 .../guacamole/form/MultilineField.java        | 45 +++++++++++
 .../guacamole/form/NumericField.java          | 45 +++++++++++
 .../guacamole/form/PasswordField.java         | 46 +++++++++++
 .../glyptodon/guacamole/form/TextField.java   | 46 +++++++++++
 .../guacamole/form/UsernameField.java         | 46 +++++++++++
 .../net/auth/credentials/CredentialsInfo.java |  6 +-
 .../glyptodon/guacamole/protocols/rdp.json    | 77 ++++++++++++-------
 .../glyptodon/guacamole/protocols/ssh.json    | 11 ++-
 .../glyptodon/guacamole/protocols/vnc.json    | 33 +++++---
 .../controllers/checkboxFieldController.js    |  4 +-
 .../src/main/webapp/app/rest/types/Field.js   | 15 +---
 16 files changed, 452 insertions(+), 106 deletions(-)
 create mode 100644 guacamole-ext/src/main/java/org/glyptodon/guacamole/form/BooleanField.java
 create mode 100644 guacamole-ext/src/main/java/org/glyptodon/guacamole/form/EnumField.java
 create mode 100644 guacamole-ext/src/main/java/org/glyptodon/guacamole/form/MultilineField.java
 create mode 100644 guacamole-ext/src/main/java/org/glyptodon/guacamole/form/NumericField.java
 create mode 100644 guacamole-ext/src/main/java/org/glyptodon/guacamole/form/PasswordField.java
 create mode 100644 guacamole-ext/src/main/java/org/glyptodon/guacamole/form/TextField.java
 create mode 100644 guacamole-ext/src/main/java/org/glyptodon/guacamole/form/UsernameField.java

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java
index d35b9c07b..aba2d4f02 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java
@@ -37,6 +37,7 @@ import org.glyptodon.guacamole.auth.jdbc.activeconnection.ActiveConnectionPermis
 import org.glyptodon.guacamole.auth.jdbc.permission.ConnectionGroupPermissionService;
 import org.glyptodon.guacamole.auth.jdbc.permission.ConnectionPermissionService;
 import org.glyptodon.guacamole.auth.jdbc.permission.UserPermissionService;
+import org.glyptodon.guacamole.form.BooleanField;
 import org.glyptodon.guacamole.form.Field;
 import org.glyptodon.guacamole.form.Form;
 import org.glyptodon.guacamole.net.auth.User;
@@ -68,9 +69,9 @@ public class ModeledUser extends ModeledDirectoryObject<UserModel> implements Us
      * All attributes related to restricting user accounts, within a logical
      * form.
      */
-    public static final Form ACCOUNT_RESTRICTIONS = new Form("restrictions", "Account Restrictions", Arrays.asList(
-        new Field(DISABLED_ATTRIBUTE_NAME, "Disabled", "true"),
-        new Field(EXPIRED_ATTRIBUTE_NAME, "Password expired", "true")
+    public static final Form ACCOUNT_RESTRICTIONS = new Form("restrictions", "Account Restrictions", Arrays.<Field>asList(
+        new BooleanField(DISABLED_ATTRIBUTE_NAME, "Disabled", "true"),
+        new BooleanField(EXPIRED_ATTRIBUTE_NAME, "Password expired", "true")
     ));
 
     /**
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java
index 7495cfa1e..3e1752eff 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java
@@ -39,6 +39,7 @@ import org.glyptodon.guacamole.auth.jdbc.permission.ObjectPermissionModel;
 import org.glyptodon.guacamole.auth.jdbc.permission.UserPermissionMapper;
 import org.glyptodon.guacamole.auth.jdbc.security.PasswordEncryptionService;
 import org.glyptodon.guacamole.form.Field;
+import org.glyptodon.guacamole.form.PasswordField;
 import org.glyptodon.guacamole.net.auth.User;
 import org.glyptodon.guacamole.net.auth.credentials.CredentialsInfo;
 import org.glyptodon.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
@@ -81,7 +82,7 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
      * The password field to provide the user when their password is expired
      * and must be changed.
      */
-    private static final Field NEW_PASSWORD = new Field(NEW_PASSWORD_PARAMETER, "New password", Field.Type.PASSWORD);
+    private static final Field NEW_PASSWORD = new PasswordField(NEW_PASSWORD_PARAMETER, "New password");
 
     /**
      * The name of the HTTP password confirmation parameter to expect if the
@@ -93,7 +94,7 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
      * The password confirmation field to provide the user when their password
      * is expired and must be changed.
      */
-    private static final Field CONFIRM_NEW_PASSWORD = new Field(CONFIRM_NEW_PASSWORD_PARAMETER, "Confirm new password", Field.Type.PASSWORD);
+    private static final Field CONFIRM_NEW_PASSWORD = new PasswordField(CONFIRM_NEW_PASSWORD_PARAMETER, "Confirm new password");
 
     /**
      * Information describing the expected credentials if a user's password is
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/BooleanField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/BooleanField.java
new file mode 100644
index 000000000..64af6fc06
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/BooleanField.java
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2015 Glyptodon LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.glyptodon.guacamole.form;
+
+import java.util.Collections;
+
+/**
+ * Represents a field with strictly one possible value. It is assumed that the
+ * field may be blank, but that its sole non-blank value is the value provided.
+ * The provided value represents "true" while all other values, including
+ * having no associated value, represent "false".
+ *
+ * @author Michael Jumper
+ */
+public class BooleanField extends Field {
+
+    /**
+     * Creates a new BooleanField with the given name, title, and truth value.
+     * The truth value is the value that, when assigned to this field, means
+     * that this field is "true".
+     *
+     * @param name
+     *     The unique name to associate with this field.
+     *
+     * @param title
+     *     The human-readable title to associate with this field.
+     *
+     * @param truthValue
+     *     The value to consider "true" for this field. All other values will
+     *     be considered "false".
+     */
+    public BooleanField(String name, String title, String truthValue) {
+        super(name, title, Field.Type.BOOLEAN, Collections.singletonList(
+            new FieldOption(truthValue, truthValue)
+        ));
+    }
+
+}
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/EnumField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/EnumField.java
new file mode 100644
index 000000000..61e3b7323
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/EnumField.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2015 Glyptodon LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.glyptodon.guacamole.form;
+
+import java.util.Collection;
+
+/**
+ * Represents an arbitrary field with a finite, enumerated set of possible
+ * values.
+ *
+ * @author Michael Jumper
+ */
+public class EnumField extends Field {
+
+    /**
+     * Creates a new EnumField with the given name, title, and possible values.
+     *
+     * @param name
+     *     The unique name to associate with this field.
+     *
+     * @param title
+     *     The human-readable title to associate with this field.
+     *
+     * @param options
+     *     All possible legal options for this field.
+     */
+    public EnumField(String name, String title, Collection<FieldOption> options) {
+        super(name, title, Field.Type.ENUM, options);
+    }
+
+}
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java
index 91e4c6ffd..7da40ec75 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Glyptodon LLC
+ * Copyright (C) 2015 Glyptodon LLC
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -27,7 +27,11 @@ import org.codehaus.jackson.map.annotate.JsonSerialize;
 
 /**
  * Represents an arbitrary field, such as an HTTP parameter, the parameter of a
- * remote desktop protocol, or an input field within a form.
+ * remote desktop protocol, or an input field within a form. Fields are generic
+ * and typed dynamically through a type string, with the semantics of the field
+ * defined by the type string. The behavior of each field type is defined
+ * either through the web application itself (see FormService.js) or through
+ * extensions.
  *
  * @author Michael Jumper
  */
@@ -94,13 +98,7 @@ public class Field {
     private String type;
 
     /**
-     * The value of this field, when checked. This is only applicable to
-     * BOOLEAN fields.
-     */
-    private String value;
-
-    /**
-     * A collection of all associated field options.
+     * A collection of all legal values of this field.
      */
     private Collection<FieldOption> options;
 
@@ -111,7 +109,7 @@ public class Field {
     }
 
     /**
-     * Creates a new Parameter with the given name, title, and type.
+     * Creates a new Field with the given name, title, and type.
      *
      * @param name
      *     The unique name to associate with this field.
@@ -123,13 +121,14 @@ public class Field {
      *     The type of this field.
      */
     public Field(String name, String title, String type) {
-        this.name    = name;
-        this.title   = title;
-        this.type    = type;
+        this.name  = name;
+        this.title = title;
+        this.type  = type;
     }
 
     /**
-     * Creates a new ENUM Parameter with the given name, title, and options.
+     * Creates a new Field with the given name, title, type, and possible
+     * values.
      *
      * @param name
      *     The unique name to associate with this field.
@@ -137,13 +136,17 @@ public class Field {
      * @param title
      *     The human-readable title to associate with this field.
      *
+     * @param type
+     *     The type of this field.
+     *
      * @param options
      *     A collection of all possible valid options for this field.
      */
-    public Field(String name, String title, Collection<FieldOption> options) {
+    public Field(String name, String title, String type,
+            Collection<FieldOption> options) {
         this.name    = name;
         this.title   = title;
-        this.type    = Type.ENUM;
+        this.type    = type;
         this.options = options;
     }
 
@@ -188,28 +191,6 @@ public class Field {
         this.title = title;
     }
 
-    /**
-     * Returns the value that should be assigned to this field if enabled. This
-     * is only applicable to BOOLEAN fields.
-     *
-     * @return
-     *     The value that should be assigned to this field if enabled.
-     */
-    public String getValue() {
-        return value;
-    }
-
-    /**
-     * Sets the value that should be assigned to this field if enabled. This is
-     * only applicable to BOOLEAN fields.
-     *
-     * @param value
-     *     The value that should be assigned to this field if enabled.
-     */
-    public void setValue(String value) {
-        this.value = value;
-    }
-
     /**
      * Returns the type of this field.
      *
@@ -232,8 +213,7 @@ public class Field {
 
     /**
      * Returns a mutable collection of field options. Changes to this
-     * collection directly affect the available options. This is only
-     * applicable to ENUM fields.
+     * collection directly affect the available options.
      *
      * @return
      *     A mutable collection of field options, or null if the field has no
@@ -244,8 +224,7 @@ public class Field {
     }
 
     /**
-     * Sets the options available as possible values of this field. This is
-     * only applicable to ENUM fields.
+     * Sets the options available as possible values of this field.
      *
      * @param options
      *     The options to associate with this field.
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/MultilineField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/MultilineField.java
new file mode 100644
index 000000000..f216a45f6
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/MultilineField.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2015 Glyptodon LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.glyptodon.guacamole.form;
+
+/**
+ * Represents a field which can contain multiple lines of text.
+ *
+ * @author Michael Jumper
+ */
+public class MultilineField extends Field {
+
+    /**
+     * Creates a new MultilineField with the given name and title.
+     *
+     * @param name
+     *     The unique name to associate with this field.
+     *
+     * @param title
+     *     The human-readable title to associate with this field.
+     */
+    public MultilineField(String name, String title) {
+        super(name, title, Field.Type.MULTILINE);
+    }
+
+}
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/NumericField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/NumericField.java
new file mode 100644
index 000000000..3b4b992c1
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/NumericField.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2015 Glyptodon LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.glyptodon.guacamole.form;
+
+/**
+ * Represents a field which may contain only integer values.
+ *
+ * @author Michael Jumper
+ */
+public class NumericField extends Field {
+
+    /**
+     * Creates a new NumericField with the given name and title.
+     *
+     * @param name
+     *     The unique name to associate with this field.
+     *
+     * @param title
+     *     The human-readable title to associate with this field.
+     */
+    public NumericField(String name, String title) {
+        super(name, title, Field.Type.NUMERIC);
+    }
+
+}
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/PasswordField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/PasswordField.java
new file mode 100644
index 000000000..e8197563a
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/PasswordField.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Glyptodon LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.glyptodon.guacamole.form;
+
+/**
+ * Represents a field which contains sensitive text information related to
+ * authenticating a user.
+ *
+ * @author Michael Jumper
+ */
+public class PasswordField extends Field {
+
+    /**
+     * Creates a new PasswordField with the given name and title.
+     *
+     * @param name
+     *     The unique name to associate with this field.
+     *
+     * @param title
+     *     The human-readable title to associate with this field.
+     */
+    public PasswordField(String name, String title) {
+        super(name, title, Field.Type.PASSWORD);
+    }
+
+}
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/TextField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/TextField.java
new file mode 100644
index 000000000..60a6e9467
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/TextField.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Glyptodon LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.glyptodon.guacamole.form;
+
+/**
+ * Represents a basic text field. The field may generally contain any data, but
+ * may not contain multiple lines.
+ *
+ * @author Michael Jumper
+ */
+public class TextField extends Field {
+
+    /**
+     * Creates a new TextField with the given name and title.
+     *
+     * @param name
+     *     The unique name to associate with this field.
+     *
+     * @param title
+     *     The human-readable title to associate with this field.
+     */
+    public TextField(String name, String title) {
+        super(name, title, Field.Type.TEXT);
+    }
+
+}
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/UsernameField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/UsernameField.java
new file mode 100644
index 000000000..60879ee28
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/UsernameField.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Glyptodon LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.glyptodon.guacamole.form;
+
+/**
+ * Represents a text field which will contain the uniquely-identifying name of
+ * a user.
+ *
+ * @author Michael Jumper
+ */
+public class UsernameField extends Field {
+
+    /**
+     * Creates a new UsernameField with the given name and title.
+     *
+     * @param name
+     *     The unique name to associate with this field.
+     *
+     * @param title
+     *     The human-readable title to associate with this field.
+     */
+    public UsernameField(String name, String title) {
+        super(name, title, Field.Type.USERNAME);
+    }
+
+}
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java
index b3c7c1175..e693dbc79 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java
@@ -26,6 +26,8 @@ import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import org.glyptodon.guacamole.form.Field;
+import org.glyptodon.guacamole.form.PasswordField;
+import org.glyptodon.guacamole.form.UsernameField;
 
 /**
  * Information which describes a set of valid credentials.
@@ -71,13 +73,13 @@ public class CredentialsInfo {
      * A field describing the username HTTP parameter expected by Guacamole
      * during login, if usernames are being used.
      */
-    public static final Field USERNAME = new Field("username", "username", Field.Type.USERNAME);
+    public static final Field USERNAME = new UsernameField("username", "username");
 
     /**
      * A field describing the password HTTP parameter expected by Guacamole
      * during login, if passwords are being used.
      */
-    public static final Field PASSWORD = new Field("password", "password", Field.Type.PASSWORD);
+    public static final Field PASSWORD = new PasswordField("password", "password");
 
     /**
      * CredentialsInfo object which describes standard username/password
diff --git a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/rdp.json b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/rdp.json
index 0480c7528..98f64ab94 100644
--- a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/rdp.json
+++ b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/rdp.json
@@ -67,16 +67,22 @@
                     ]
                 },
                 {
-                    "name"  : "disable-auth",
-                    "title" : "Disable authentication",
-                    "type"  : "BOOLEAN",
-                    "value" : "true"
+                    "name"    : "disable-auth",
+                    "title"   : "Disable authentication",
+                    "type"    : "BOOLEAN",
+                    "options" : [{
+                        "value" : "true",
+                        "title" : "true"
+                    }]
                 },
                 {
-                    "name"  : "ignore-cert",
-                    "title" : "Ignore server certificate",
-                    "type"  : "BOOLEAN",
-                    "value" : "true"
+                    "name"    : "ignore-cert",
+                    "title"   : "Ignore server certificate",
+                    "type"    : "BOOLEAN",
+                    "options" : [{
+                        "value" : "true",
+                        "title" : "true"
+                    }]
                 }
             ]
         },
@@ -131,10 +137,13 @@
                     ]
                 },
                 {
-                    "name"  : "console",
-                    "title" : "Administrator console",
-                    "type"  : "BOOLEAN",
-                    "value" : "true"
+                    "name"    : "console",
+                    "title"   : "Administrator console",
+                    "type"    : "BOOLEAN",
+                    "options" : [{
+                        "value" : "true",
+                        "title" : "true"
+                    }]
                 }
             ]
         },
@@ -193,28 +202,40 @@
             "name"  : "device-redirection",
             "fields" : [
                 {
-                    "name"  : "console-audio",
-                    "title" : "Support audio in console",
-                    "type"  : "BOOLEAN",
-                    "value" : "true"
+                    "name"    : "console-audio",
+                    "title"   : "Support audio in console",
+                    "type"    : "BOOLEAN",
+                    "options" : [{
+                        "value" : "true",
+                        "title" : "true"
+                    }]
                 },
                 {
-                    "name"  : "disable-audio",
-                    "title" : "Disable audio",
-                    "type"  : "BOOLEAN",
-                    "value" : "true"
+                    "name"    : "disable-audio",
+                    "title"   : "Disable audio",
+                    "type"    : "BOOLEAN",
+                    "options" : [{
+                        "value" : "true",
+                        "title" : "true"
+                    }]
                 },
                 {
-                    "name"  : "enable-printing",
-                    "title" : "Enable printing",
-                    "type"  : "BOOLEAN",
-                    "value" : "true"
+                    "name"    : "enable-printing",
+                    "title"   : "Enable printing",
+                    "type"    : "BOOLEAN",
+                    "options" : [{
+                        "value" : "true",
+                        "title" : "true"
+                    }]
                 },
                 {
-                    "name"  : "enable-drive",
-                    "title" : "Enable drive",
-                    "type"  : "BOOLEAN",
-                    "value" : "true"
+                    "name"    : "enable-drive",
+                    "title"   : "Enable drive",
+                    "type"    : "BOOLEAN",
+                    "options" : [{
+                        "value" : "true",
+                        "title" : "true"
+                    }]
                 },
                 {
                     "name"  : "drive-path",
diff --git a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/ssh.json b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/ssh.json
index fa692975b..4efbfaf44 100644
--- a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/ssh.json
+++ b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/ssh.json
@@ -131,10 +131,13 @@
             "name"  : "sftp",
             "fields" : [
                 {
-                    "name"  : "enable-sftp",
-                    "title" : "Enable SFTP",
-                    "type"  : "BOOLEAN",
-                    "value" : "true"
+                    "name"    : "enable-sftp",
+                    "title"   : "Enable SFTP",
+                    "type"    : "BOOLEAN",
+                    "options" : [{
+                        "value" : "true",
+                        "title" : "true"
+                    }]
                 }
             ]
         }
diff --git a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/vnc.json b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/vnc.json
index c7d51d034..d91cdb2e9 100644
--- a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/vnc.json
+++ b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/vnc.json
@@ -37,16 +37,22 @@
             "name"  : "display",
             "fields" : [
                 {
-                    "name"  : "read-only",
-                    "title" : "Read-only",
-                    "type"  : "BOOLEAN",
-                    "value" : "true"
+                    "name"    : "read-only",
+                    "title"   : "Read-only",
+                    "type"    : "BOOLEAN",
+                    "options" : [{
+                        "value" : "true",
+                        "title" : "true"
+                    }]
                 },
                 {
-                    "name"  : "swap-red-blue",
-                    "title" : "Swap red/blue components",
-                    "type"  : "BOOLEAN",
-                    "value" : "true"
+                    "name"    : "swap-red-blue",
+                    "title"   : "Swap red/blue components",
+                    "type"    : "BOOLEAN",
+                    "options" : [{
+                        "value" : "true",
+                        "title" : "true"
+                    }]
                 },
                 {
                     "name"  : "cursor",
@@ -119,10 +125,13 @@
             "name"  : "audio",
             "fields" : [
                 {
-                    "name"  : "enable-audio",
-                    "title" : "Enable audio",
-                    "type"  : "BOOLEAN",
-                    "value" : "true"
+                    "name"    : "enable-audio",
+                    "title"   : "Enable audio",
+                    "type"    : "BOOLEAN",
+                    "options" : [{
+                        "value" : "true",
+                        "title" : "true"
+                    }]
                 },
                 {
                     "name"  : "audio-servername",
diff --git a/guacamole/src/main/webapp/app/form/controllers/checkboxFieldController.js b/guacamole/src/main/webapp/app/form/controllers/checkboxFieldController.js
index eb15d37a5..830ef0d23 100644
--- a/guacamole/src/main/webapp/app/form/controllers/checkboxFieldController.js
+++ b/guacamole/src/main/webapp/app/form/controllers/checkboxFieldController.js
@@ -29,12 +29,12 @@ angular.module('form').controller('checkboxFieldController', ['$scope',
 
     // Update typed value when model is changed
     $scope.$watch('model', function modelChanged(model) {
-        $scope.typedValue = (model === $scope.field.value);
+        $scope.typedValue = (model === $scope.field.options[0].value);
     });
 
     // Update string value in model when typed value is changed
     $scope.$watch('typedValue', function typedValueChanged(typedValue) {
-        $scope.model = (typedValue ? $scope.field.value : '');
+        $scope.model = (typedValue ? $scope.field.options[0].value : '');
     });
 
 }]);
diff --git a/guacamole/src/main/webapp/app/rest/types/Field.js b/guacamole/src/main/webapp/app/rest/types/Field.js
index 66b3aea71..d1e2b0a85 100644
--- a/guacamole/src/main/webapp/app/rest/types/Field.js
+++ b/guacamole/src/main/webapp/app/rest/types/Field.js
@@ -64,16 +64,7 @@ angular.module('rest').factory('Field', [function defineField() {
         this.type = template.type || Field.Type.TEXT;
 
         /**
-         * The value to set the parameter to, in the case of a BOOLEAN
-         * parameter, to enable that parameter's effect.
-         *
-         * @type String
-         */
-        this.value = template.value;
-
-        /**
-         * All possible legal values for this parameter. This property is only
-         * applicable to ENUM type parameters.
+         * All possible legal values for this parameter.
          *
          * @type FieldOption[]
          */
@@ -123,7 +114,9 @@ angular.module('rest').factory('Field', [function defineField() {
         /**
          * The type string associated with parameters that may contain only a
          * single possible value, where that value enables the parameter's
-         * effect.
+         * effect. It is assumed that each BOOLEAN field will provide exactly
+         * one possible value (option), which will be the value if that field
+         * is true.
          * 
          * @type String
          */

From 68af0bab7ea5b6072957f9c8a7925f9d41cabccd Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Mon, 8 Jun 2015 10:16:32 -0700
Subject: [PATCH 18/21] GUAC-1176: Field.Type is no longer absolutely all
 possible types - it is only the set of types supported by default.

---
 .../src/main/java/org/glyptodon/guacamole/form/Field.java   | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java
index 7da40ec75..4f29ee8e0 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java
@@ -39,7 +39,11 @@ import org.codehaus.jackson.map.annotate.JsonSerialize;
 public class Field {
 
     /**
-     * All possible types of field.
+     * All types of fields which are available by default. Additional field
+     * types may be defined by extensions by using a unique field type name and
+     * registering that name with the form service within JavaScript.
+     *
+     * See FormService.js.
      */
     public static class Type {
 

From 9ac64441cdfe94f50697e58f7b2ba6473427b41a Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Mon, 8 Jun 2015 10:27:38 -0700
Subject: [PATCH 19/21] GUAC-1176: Explicitly specify ng-trim="false" for
 password fields. The AngularJS documentation states password fields will not
 be trimmed, but that is apparently only true if the input field type does not
 vary dynamically. The trimmed/untrimmed state seems only to be set when the
 directive initially loads.

---
 guacamole/src/main/webapp/app/form/templates/passwordField.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/webapp/app/form/templates/passwordField.html b/guacamole/src/main/webapp/app/form/templates/passwordField.html
index 644566f8e..506d8b6b2 100644
--- a/guacamole/src/main/webapp/app/form/templates/passwordField.html
+++ b/guacamole/src/main/webapp/app/form/templates/passwordField.html
@@ -1,4 +1,4 @@
 <div class="password-field">
-    <input type="{{passwordInputType}}" ng-model="model" autocorrect="off" autocapitalize="off"/>
+    <input type="{{passwordInputType}}" ng-model="model" ng-trim="false" autocorrect="off" autocapitalize="off"/>
     <div class="icon toggle-password" ng-click="togglePassword()" title="{{getTogglePasswordHelpText() | translate}}"></div>
 </div>
\ No newline at end of file

From 4eb5989c18c49a4c3150cc6a2ec55cc55d1bf4c2 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Mon, 8 Jun 2015 13:18:59 -0700
Subject: [PATCH 20/21] GUAC-1176: Ensure blank values are interpreted
 consistently (no multiple blank options in select fields).

---
 .../webapp/app/form/controllers/selectFieldController.js    | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/guacamole/src/main/webapp/app/form/controllers/selectFieldController.js b/guacamole/src/main/webapp/app/form/controllers/selectFieldController.js
index 593cc716b..f3af8d821 100644
--- a/guacamole/src/main/webapp/app/form/controllers/selectFieldController.js
+++ b/guacamole/src/main/webapp/app/form/controllers/selectFieldController.js
@@ -30,6 +30,12 @@ angular.module('form').controller('selectFieldController', ['$scope', '$injector
     // Required services
     var translationStringService = $injector.get('translationStringService');
 
+    // Interpret undefined/null as empty string
+    $scope.$watch('model', function setModel(model) {
+        if (!model && model !== '')
+            $scope.model = '';
+    });
+
     /**
      * Produces the translation string for the given field option
      * value. The translation string will be of the form:

From dcd82f9e63d980731c148649d7b50ea9ba549ea0 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Mon, 8 Jun 2015 16:15:31 -0700
Subject: [PATCH 21/21] GUAC-1176: Remove all human-readable title properties
 from the REST form objects.

---
 .../guacamole/auth/jdbc/user/ModeledUser.java |   6 +-
 .../guacamole/auth/jdbc/user/UserService.java |   4 +-
 .../guacamole/form/BooleanField.java          |  15 +-
 .../glyptodon/guacamole/form/EnumField.java   |   9 +-
 .../org/glyptodon/guacamole/form/Field.java   |  52 +-----
 .../org/glyptodon/guacamole/form/Form.java    |  43 +----
 .../guacamole/form/MultilineField.java        |   9 +-
 .../guacamole/form/NumericField.java          |   9 +-
 .../guacamole/form/PasswordField.java         |   9 +-
 .../glyptodon/guacamole/form/TextField.java   |   9 +-
 .../guacamole/form/UsernameField.java         |   9 +-
 .../net/auth/credentials/CredentialsInfo.java |   4 +-
 .../guacamole/protocols/ProtocolInfo.java     |  43 +----
 .../glyptodon/guacamole/protocols/rdp.json    | 148 ++----------------
 .../glyptodon/guacamole/protocols/ssh.json    |  82 +---------
 .../glyptodon/guacamole/protocols/telnet.json |  74 +--------
 .../glyptodon/guacamole/protocols/vnc.json    |  70 +--------
 .../controllers/checkboxFieldController.js    |   4 +-
 .../app/form/templates/selectField.html       |   2 +-
 .../src/main/webapp/app/rest/types/Field.js   |   9 +-
 .../main/webapp/app/rest/types/FieldOption.js |  61 --------
 .../src/main/webapp/app/rest/types/Form.js    |  12 +-
 .../main/webapp/app/rest/types/Protocol.js    |   7 -
 23 files changed, 79 insertions(+), 611 deletions(-)
 delete mode 100644 guacamole/src/main/webapp/app/rest/types/FieldOption.js

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java
index aba2d4f02..0e0e840ff 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/ModeledUser.java
@@ -69,9 +69,9 @@ public class ModeledUser extends ModeledDirectoryObject<UserModel> implements Us
      * All attributes related to restricting user accounts, within a logical
      * form.
      */
-    public static final Form ACCOUNT_RESTRICTIONS = new Form("restrictions", "Account Restrictions", Arrays.<Field>asList(
-        new BooleanField(DISABLED_ATTRIBUTE_NAME, "Disabled", "true"),
-        new BooleanField(EXPIRED_ATTRIBUTE_NAME, "Password expired", "true")
+    public static final Form ACCOUNT_RESTRICTIONS = new Form("restrictions", Arrays.<Field>asList(
+        new BooleanField(DISABLED_ATTRIBUTE_NAME, "true"),
+        new BooleanField(EXPIRED_ATTRIBUTE_NAME, "true")
     ));
 
     /**
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java
index 3e1752eff..969741bf4 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/glyptodon/guacamole/auth/jdbc/user/UserService.java
@@ -82,7 +82,7 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
      * The password field to provide the user when their password is expired
      * and must be changed.
      */
-    private static final Field NEW_PASSWORD = new PasswordField(NEW_PASSWORD_PARAMETER, "New password");
+    private static final Field NEW_PASSWORD = new PasswordField(NEW_PASSWORD_PARAMETER);
 
     /**
      * The name of the HTTP password confirmation parameter to expect if the
@@ -94,7 +94,7 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
      * The password confirmation field to provide the user when their password
      * is expired and must be changed.
      */
-    private static final Field CONFIRM_NEW_PASSWORD = new PasswordField(CONFIRM_NEW_PASSWORD_PARAMETER, "Confirm new password");
+    private static final Field CONFIRM_NEW_PASSWORD = new PasswordField(CONFIRM_NEW_PASSWORD_PARAMETER);
 
     /**
      * Information describing the expected credentials if a user's password is
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/BooleanField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/BooleanField.java
index 64af6fc06..d033a7dc4 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/BooleanField.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/BooleanField.java
@@ -35,24 +35,19 @@ import java.util.Collections;
 public class BooleanField extends Field {
 
     /**
-     * Creates a new BooleanField with the given name, title, and truth value.
-     * The truth value is the value that, when assigned to this field, means
-     * that this field is "true".
+     * Creates a new BooleanField with the given name and truth value. The
+     * truth value is the value that, when assigned to this field, means that
+     * this field is "true".
      *
      * @param name
      *     The unique name to associate with this field.
      *
-     * @param title
-     *     The human-readable title to associate with this field.
-     *
      * @param truthValue
      *     The value to consider "true" for this field. All other values will
      *     be considered "false".
      */
-    public BooleanField(String name, String title, String truthValue) {
-        super(name, title, Field.Type.BOOLEAN, Collections.singletonList(
-            new FieldOption(truthValue, truthValue)
-        ));
+    public BooleanField(String name, String truthValue) {
+        super(name, Field.Type.BOOLEAN, Collections.singletonList(truthValue));
     }
 
 }
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/EnumField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/EnumField.java
index 61e3b7323..272b52f22 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/EnumField.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/EnumField.java
@@ -33,19 +33,16 @@ import java.util.Collection;
 public class EnumField extends Field {
 
     /**
-     * Creates a new EnumField with the given name, title, and possible values.
+     * Creates a new EnumField with the given name and possible values.
      *
      * @param name
      *     The unique name to associate with this field.
      *
-     * @param title
-     *     The human-readable title to associate with this field.
-     *
      * @param options
      *     All possible legal options for this field.
      */
-    public EnumField(String name, String title, Collection<FieldOption> options) {
-        super(name, title, Field.Type.ENUM, options);
+    public EnumField(String name, Collection<String> options) {
+        super(name, Field.Type.ENUM, options);
     }
 
 }
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java
index 4f29ee8e0..c463c47b3 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Field.java
@@ -91,11 +91,6 @@ public class Field {
      */
     private String name;
 
-    /**
-     * A human-readable name to be presented to the user.
-     */
-    private String title;
-
     /**
      * The type of this field.
      */
@@ -104,52 +99,42 @@ public class Field {
     /**
      * A collection of all legal values of this field.
      */
-    private Collection<FieldOption> options;
+    private Collection<String> options;
 
     /**
-     * Creates a new Parameter with no associated name, title, or type.
+     * Creates a new Parameter with no associated name or type.
      */
     public Field() {
     }
 
     /**
-     * Creates a new Field with the given name, title, and type.
+     * Creates a new Field with the given name  and type.
      *
      * @param name
      *     The unique name to associate with this field.
      *
-     * @param title
-     *     The human-readable title to associate with this field.
-     *
      * @param type
      *     The type of this field.
      */
-    public Field(String name, String title, String type) {
+    public Field(String name, String type) {
         this.name  = name;
-        this.title = title;
         this.type  = type;
     }
 
     /**
-     * Creates a new Field with the given name, title, type, and possible
-     * values.
+     * Creates a new Field with the given name, type, and possible values.
      *
      * @param name
      *     The unique name to associate with this field.
      *
-     * @param title
-     *     The human-readable title to associate with this field.
-     *
      * @param type
      *     The type of this field.
      *
      * @param options
      *     A collection of all possible valid options for this field.
      */
-    public Field(String name, String title, String type,
-            Collection<FieldOption> options) {
+    public Field(String name, String type, Collection<String> options) {
         this.name    = name;
-        this.title   = title;
         this.type    = type;
         this.options = options;
     }
@@ -174,27 +159,6 @@ public class Field {
         this.name = name;
     }
 
-    /**
-     * Returns the human-readable title associated with this field.
-     *
-     * @return
-     *     The human-readable title associated with this field.
-     */
-    public String getTitle() {
-        return title;
-    }
-
-    /**
-     * Sets the title associated with this field. The title must be a human-
-     * readable string which describes accurately this field.
-     *
-     * @param title
-     *     A human-readable string describing this field.
-     */
-    public void setTitle(String title) {
-        this.title = title;
-    }
-
     /**
      * Returns the type of this field.
      *
@@ -223,7 +187,7 @@ public class Field {
      *     A mutable collection of field options, or null if the field has no
      *     options.
      */
-    public Collection<FieldOption> getOptions() {
+    public Collection<String> getOptions() {
         return options;
     }
 
@@ -233,7 +197,7 @@ public class Field {
      * @param options
      *     The options to associate with this field.
      */
-    public void setOptions(Collection<FieldOption> options) {
+    public void setOptions(Collection<String> options) {
         this.options = options;
     }
 
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Form.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Form.java
index f85f755f3..3052d6283 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Form.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/Form.java
@@ -40,41 +40,32 @@ public class Form {
      */
     private String name;
 
-    /**
-     * The a human-readable title describing this form.
-     */
-    private String title;
-
     /**
      * All fields associated with this form.
      */
     private Collection<Field> fields;
 
     /**
-     * Creates a new Form object with no associated fields. The name and title
-     * of the form are left unset as null. If no form name is provided, this
-     * form must not be used in the same context as another unnamed form.
+     * Creates a new Form object with no associated fields. The name is left
+     * unset as null. If no form name is provided, this form must not be used
+     * in the same context as another unnamed form.
      */
     public Form() {
         fields = new ArrayList<Field>();
     }
 
     /**
-     * Creates a new Form object having the given name and title, and
-     * containing the given fields.
+     * Creates a new Form object having the given name and containing the given
+     * fields.
      *
      * @param name
      *     A name which uniquely identifies this form.
      *
-     * @param title
-     *     A human-readable title describing this form.
-     *
      * @param fields
      *     The fields to provided within the new Form.
      */
-    public Form(String name, String title, Collection<Field> fields) {
+    public Form(String name, Collection<Field> fields) {
         this.name = name;
-        this.title = title;
         this.fields = fields;
     }
 
@@ -120,26 +111,4 @@ public class Form {
         this.name = name;
     }
 
-    /**
-     * Returns the human-readable title associated with this form. A form's
-     * title describes the form, but need not be unique.
-     *
-     * @return
-     *     A human-readable title describing this form.
-     */
-    public String getTitle() {
-        return title;
-    }
-
-    /**
-     * Sets the human-readable title associated with this form. A form's title
-     * describes the form, but need not be unique.
-     *
-     * @param title
-     *     A human-readable title describing this form.
-     */
-    public void setTitle(String title) {
-        this.title = title;
-    }
-
 }
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/MultilineField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/MultilineField.java
index f216a45f6..158eec786 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/MultilineField.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/MultilineField.java
@@ -30,16 +30,13 @@ package org.glyptodon.guacamole.form;
 public class MultilineField extends Field {
 
     /**
-     * Creates a new MultilineField with the given name and title.
+     * Creates a new MultilineField with the given name.
      *
      * @param name
      *     The unique name to associate with this field.
-     *
-     * @param title
-     *     The human-readable title to associate with this field.
      */
-    public MultilineField(String name, String title) {
-        super(name, title, Field.Type.MULTILINE);
+    public MultilineField(String name) {
+        super(name, Field.Type.MULTILINE);
     }
 
 }
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/NumericField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/NumericField.java
index 3b4b992c1..5e06cb33e 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/NumericField.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/NumericField.java
@@ -30,16 +30,13 @@ package org.glyptodon.guacamole.form;
 public class NumericField extends Field {
 
     /**
-     * Creates a new NumericField with the given name and title.
+     * Creates a new NumericField with the given name.
      *
      * @param name
      *     The unique name to associate with this field.
-     *
-     * @param title
-     *     The human-readable title to associate with this field.
      */
-    public NumericField(String name, String title) {
-        super(name, title, Field.Type.NUMERIC);
+    public NumericField(String name) {
+        super(name, Field.Type.NUMERIC);
     }
 
 }
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/PasswordField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/PasswordField.java
index e8197563a..c48a6596b 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/PasswordField.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/PasswordField.java
@@ -31,16 +31,13 @@ package org.glyptodon.guacamole.form;
 public class PasswordField extends Field {
 
     /**
-     * Creates a new PasswordField with the given name and title.
+     * Creates a new PasswordField with the given name.
      *
      * @param name
      *     The unique name to associate with this field.
-     *
-     * @param title
-     *     The human-readable title to associate with this field.
      */
-    public PasswordField(String name, String title) {
-        super(name, title, Field.Type.PASSWORD);
+    public PasswordField(String name) {
+        super(name, Field.Type.PASSWORD);
     }
 
 }
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/TextField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/TextField.java
index 60a6e9467..75cae7bb6 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/TextField.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/TextField.java
@@ -31,16 +31,13 @@ package org.glyptodon.guacamole.form;
 public class TextField extends Field {
 
     /**
-     * Creates a new TextField with the given name and title.
+     * Creates a new TextField with the given name.
      *
      * @param name
      *     The unique name to associate with this field.
-     *
-     * @param title
-     *     The human-readable title to associate with this field.
      */
-    public TextField(String name, String title) {
-        super(name, title, Field.Type.TEXT);
+    public TextField(String name) {
+        super(name, Field.Type.TEXT);
     }
 
 }
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/UsernameField.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/UsernameField.java
index 60879ee28..9b2701df4 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/UsernameField.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/form/UsernameField.java
@@ -31,16 +31,13 @@ package org.glyptodon.guacamole.form;
 public class UsernameField extends Field {
 
     /**
-     * Creates a new UsernameField with the given name and title.
+     * Creates a new UsernameField with the given name.
      *
      * @param name
      *     The unique name to associate with this field.
-     *
-     * @param title
-     *     The human-readable title to associate with this field.
      */
-    public UsernameField(String name, String title) {
-        super(name, title, Field.Type.USERNAME);
+    public UsernameField(String name) {
+        super(name, Field.Type.USERNAME);
     }
 
 }
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java
index e693dbc79..a0c471686 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/net/auth/credentials/CredentialsInfo.java
@@ -73,13 +73,13 @@ public class CredentialsInfo {
      * A field describing the username HTTP parameter expected by Guacamole
      * during login, if usernames are being used.
      */
-    public static final Field USERNAME = new UsernameField("username", "username");
+    public static final Field USERNAME = new UsernameField("username");
 
     /**
      * A field describing the password HTTP parameter expected by Guacamole
      * during login, if passwords are being used.
      */
-    public static final Field PASSWORD = new PasswordField("password", "password");
+    public static final Field PASSWORD = new PasswordField("password");
 
     /**
      * CredentialsInfo object which describes standard username/password
diff --git a/guacamole-ext/src/main/java/org/glyptodon/guacamole/protocols/ProtocolInfo.java b/guacamole-ext/src/main/java/org/glyptodon/guacamole/protocols/ProtocolInfo.java
index 69b7966f1..36d88b4a8 100644
--- a/guacamole-ext/src/main/java/org/glyptodon/guacamole/protocols/ProtocolInfo.java
+++ b/guacamole-ext/src/main/java/org/glyptodon/guacamole/protocols/ProtocolInfo.java
@@ -35,11 +35,6 @@ import org.glyptodon.guacamole.form.Form;
  */
 public class ProtocolInfo {
 
-    /**
-     * The human-readable title associated with this protocol.
-     */
-    private String title;
-
     /**
      * The unique name associated with this protocol.
      */
@@ -51,65 +46,37 @@ public class ProtocolInfo {
     private Collection<Form> forms;
 
     /**
-     * Creates a new ProtocolInfo with no associated name, title, or
-     * forms.
+     * Creates a new ProtocolInfo with no associated name or forms.
      */
     public ProtocolInfo() {
         this.forms = new ArrayList<Form>();
     }
 
     /**
-     * Creates a new ProtocolInfo having the given name and title, but without
-     * any forms.
+     * Creates a new ProtocolInfo having the given name, but without any forms.
      *
      * @param name
      *     The unique name associated with the protocol.
-     *
-     * @param title
-     *     The human-readable title to associate with the protocol.
      */
-    public ProtocolInfo(String name, String title) {
+    public ProtocolInfo(String name) {
         this.name  = name;
-        this.title = title;
         this.forms = new ArrayList<Form>();
     }
 
     /**
-     * Creates a new ProtocolInfo having the given name, title, and forms.
+     * Creates a new ProtocolInfo having the given name and forms.
      *
      * @param name
      *     The unique name associated with the protocol.
      *
-     * @param title
-     *     The human-readable title to associate with the protocol.
-     * 
      * @param forms
      *     The forms to associate with the protocol.
      */
-    public ProtocolInfo(String name, String title, Collection<Form> forms) {
+    public ProtocolInfo(String name, Collection<Form> forms) {
         this.name  = name;
-        this.title = title;
         this.forms = forms;
     }
 
-    /**
-     * Returns the human-readable title associated with this protocol.
-     *
-     * @return The human-readable title associated with this protocol.
-     */
-    public String getTitle() {
-        return title;
-    }
-
-    /**
-     * Sets the human-readable title associated with this protocol.
-     *
-     * @param title The human-readable title to associate with this protocol.
-     */
-    public void setTitle(String title) {
-        this.title = title;
-    }
-
     /**
      * Returns the unique name of this protocol. The protocol name is the
      * value required by the corresponding protocol plugin for guacd.
diff --git a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/rdp.json b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/rdp.json
index 98f64ab94..739ab2af2 100644
--- a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/rdp.json
+++ b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/rdp.json
@@ -1,272 +1,156 @@
 {
-    "title" : "RDP",
     "name"  : "rdp",
     "forms" : [
 
         {
-            "title" : "Network",
             "name"  : "network",
             "fields" : [
                 {
                     "name"  : "hostname",
-                    "title" : "Hostname",
                     "type"  : "TEXT"
                 },
                 {
                     "name"  : "port",
-                    "title" : "Port",
                     "type"  : "NUMERIC"
                 }
             ]
         },
 
         {
-            "title" : "Authentication",
             "name"  : "authentication",
             "fields" : [
                 {
                     "name"  : "username",
-                    "title" : "Username",
                     "type"  : "USERNAME"
                 },
                 {
                     "name"  : "password",
-                    "title" : "Password",
                     "type"  : "PASSWORD"
                 },
                 {
                     "name"  : "domain",
-                    "title" : "Domain",
                     "type"  : "TEXT"
                 },
                 {
                     "name"    : "security",
-                    "title"   : "Security mode",
                     "type"    : "ENUM",
-                    "options" : [
-                        {
-                            "value" : "",
-                            "title" : ""
-                        },
-                        {
-                            "value" : "rdp",
-                            "title" : "RDP encryption"
-                        },
-                        {
-                            "value" : "tls",
-                            "title" : "TLS encryption"
-                        },
-                        {
-                            "value" : "nla",
-                            "title" : "NLA (Network Level Authentication)"
-                        },
-                        {
-                            "value" : "any",
-                            "title" : "Any"
-                        }
-                    ]
+                    "options" : [ "", "rdp", "tls", "nla", "any" ]
                 },
                 {
                     "name"    : "disable-auth",
-                    "title"   : "Disable authentication",
                     "type"    : "BOOLEAN",
-                    "options" : [{
-                        "value" : "true",
-                        "title" : "true"
-                    }]
+                    "options" : [ "true" ]
                 },
                 {
                     "name"    : "ignore-cert",
-                    "title"   : "Ignore server certificate",
                     "type"    : "BOOLEAN",
-                    "options" : [{
-                        "value" : "true",
-                        "title" : "true"
-                    }]
+                    "options" : [ "true" ]
                 }
             ]
         },
 
         {
-            "title" : "Basic Parameters",
             "name"  : "basic-parameters",
             "fields" : [
                 {
                     "name"  : "initial-program",
-                    "title" : "Initial program",
                     "type"  : "TEXT"
                 },
                 {
                     "name"  : "client-name",
-                    "title" : "Client name",
                     "type"  : "TEXT"
                 },
                 {
                     "name"    : "server-layout",
-                    "title"   : "Keyboard layout",
                     "type"    : "ENUM",
                     "options" : [
-                        {
-                            "value" : "",
-                            "title" : ""
-                        },
-                        {
-                            "value" : "en-us-qwerty",
-                            "title" : "US English (Qwerty)"
-                        },
-                        {
-                            "value" : "fr-fr-azerty",
-                            "title" : "French (Azerty)"
-                        },
-                        {
-                            "value" : "de-de-qwertz",
-                            "title" : "German (Qwertz)"
-                        },
-                        {
-                            "value" : "it-it-qwerty",
-                            "title" : "Italian (Qwerty)"
-                        },
-                        {
-                            "value" : "sv-se-qwerty",
-                            "title" : "Swedish (Qwerty)"
-                        },
-                        {
-                            "value" : "failsafe",
-                            "title" : "Unicode"
-                        }
+                        "",
+                        "en-us-qwerty",
+                        "fr-fr-azerty",
+                        "de-de-qwertz",
+                        "it-it-qwerty",
+                        "sv-se-qwerty",
+                        "failsafe"
                     ]
                 },
                 {
                     "name"    : "console",
-                    "title"   : "Administrator console",
                     "type"    : "BOOLEAN",
-                    "options" : [{
-                        "value" : "true",
-                        "title" : "true"
-                    }]
+                    "options" : [ "true" ]
                 }
             ]
         },
 
         {
-            "title" : "Display",
             "name"  : "display",
             "fields" : [
                 {
                     "name"  : "width",
-                    "title" : "Display width",
                     "type"  : "NUMERIC"
                 },
                 {
                     "name"  : "height",
-                    "title" : "Display height",
                     "type"  : "NUMERIC"
                 },
                 {
                     "name"  : "dpi",
-                    "title" : "Display resolution (DPI)",
                     "type"  : "NUMERIC"
                 },
                 {
                     "name"    : "color-depth",
-                    "title"   : "Color depth",
                     "type"    : "ENUM",
-                    "options" : [
-                        {
-                            "value" : "",
-                            "title" : ""
-                        },
-                        {
-                            "value" : "8",
-                            "title" : "256 color"
-                        },
-                        {
-                            "value" : "16",
-                            "title" : "Low color (16-bit)"
-                        },
-                        {
-                            "value" : "24",
-                            "title" : "True color (24-bit)"
-                        },
-                        {
-                            "value" : "32",
-                            "title" : "True color (32-bit)"
-                        }
-                    ]
+                    "options" : [ "", "8", "16", "24", "32" ]
                 }
             ]
         },
 
         {
-            "title" : "Device Redirection",
             "name"  : "device-redirection",
             "fields" : [
                 {
                     "name"    : "console-audio",
-                    "title"   : "Support audio in console",
                     "type"    : "BOOLEAN",
-                    "options" : [{
-                        "value" : "true",
-                        "title" : "true"
-                    }]
+                    "options" : [ "true" ]
                 },
                 {
                     "name"    : "disable-audio",
-                    "title"   : "Disable audio",
                     "type"    : "BOOLEAN",
-                    "options" : [{
-                        "value" : "true",
-                        "title" : "true"
-                    }]
+                    "options" : [ "true" ]
                 },
                 {
                     "name"    : "enable-printing",
-                    "title"   : "Enable printing",
                     "type"    : "BOOLEAN",
-                    "options" : [{
-                        "value" : "true",
-                        "title" : "true"
-                    }]
+                    "options" : [ "true" ]
                 },
                 {
                     "name"    : "enable-drive",
-                    "title"   : "Enable drive",
                     "type"    : "BOOLEAN",
-                    "options" : [{
-                        "value" : "true",
-                        "title" : "true"
-                    }]
+                    "options" : [ "true" ]
                 },
                 {
                     "name"  : "drive-path",
-                    "title" : "Drive path",
                     "type"  : "TEXT"
                 },
                 {
                     "name"  : "static-channels",
-                    "title" : "Static channel names",
                     "type"  : "TEXT"
                 }
             ]
         },
 
         {
-            "title" : "RemoteApp",
             "name"  : "remoteapp",
             "fields" : [
                 {
                     "name"  : "remote-app",
-                    "title" : "RemoteApp program",
                     "type"  : "TEXT"
                 },
                 {
                     "name"  : "remote-app-dir",
-                    "title" : "RemoteApp working directory",
                     "type"  : "TEXT"
                 },
                 {
                     "name"  : "remote-app-args",
-                    "title" : "RemoteApp parameters",
                     "type"  : "TEXT"
                 }
             ]
diff --git a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/ssh.json b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/ssh.json
index 4efbfaf44..0e6fdb38b 100644
--- a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/ssh.json
+++ b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/ssh.json
@@ -1,143 +1,65 @@
 {
-    "title" : "SSH",
     "name"  : "ssh",
     "forms" : [
 
         {
-            "title" : "Network",
             "name"  : "network",
             "fields" : [
                 {
                     "name"  : "hostname",
-                    "title" : "Hostname",
                     "type"  : "TEXT"
                 },
                 {
                     "name"  : "port",
-                    "title" : "Port",
                     "type"  : "NUMERIC"
                 }
             ]
         },
 
         {
-            "title" : "Authentication",
             "name"  : "authentication",
             "fields" : [
                 {
                     "name"  : "username",
-                    "title" : "Username",
                     "type"  : "USERNAME"
                 },
                 {
                     "name"  : "password",
-                    "title" : "Password",
                     "type"  : "PASSWORD"
                 },
                 {
                     "name"  : "private-key",
-                    "title" : "Private key",
                     "type"  : "MULTILINE"
                 },
                 {
                     "name"  : "passphrase",
-                    "title" : "Passphrase",
                     "type"  : "PASSWORD"
                 }
             ]
         },
 
         {
-            "title" : "Display",
             "name"  : "display",
             "fields" : [
                 {
                     "name"  : "font-name",
-                    "title" : "Font name",
                     "type"  : "TEXT"
                 },
                 {
                     "name"  : "font-size",
-                    "title" : "Font size",
                     "type"  : "ENUM",
-                    "options" : [
-                        {
-                            "value" : "",
-                            "title" : ""
-                        },
-                        {
-                            "value" : "8",
-                            "title" : "8"
-                        },
-                        {
-                            "value" : "9",
-                            "title" : "9"
-                        },
-                        {
-                            "value" : "10",
-                            "title" : "10"
-                        },
-                        {
-                            "value" : "11",
-                            "title" : "11"
-                        },
-                        {
-                            "value" : "12",
-                            "title" : "12"
-                        },
-                        {
-                            "value" : "14",
-                            "title" : "14"
-                        },
-                        {
-                            "value" : "18",
-                            "title" : "18"
-                        },
-                        {
-                            "value" : "24",
-                            "title" : "24"
-                        },
-                        {
-                            "value" : "30",
-                            "title" : "30"
-                        },
-                        {
-                            "value" : "36",
-                            "title" : "36"
-                        },
-                        {
-                            "value" : "48",
-                            "title" : "48"
-                        },
-                        {
-                            "value" : "60",
-                            "title" : "60"
-                        },
-                        {
-                            "value" : "72",
-                            "title" : "72"
-                        },
-                        {
-                            "value" : "96",
-                            "title" : "96"
-                        }
-                    ]
+                    "options" : [ "", "8", "9", "10", "11", "12", "14", "18", "24", "30", "36", "48", "60", "72", "96" ]
                 }
             ]
         },
 
         {
-            "title" : "SFTP",
             "name"  : "sftp",
             "fields" : [
                 {
                     "name"    : "enable-sftp",
-                    "title"   : "Enable SFTP",
                     "type"    : "BOOLEAN",
-                    "options" : [{
-                        "value" : "true",
-                        "title" : "true"
-                    }]
+                    "options" : [ "true" ]
                 }
             ]
         }
diff --git a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/telnet.json b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/telnet.json
index 12f30407f..d09457114 100644
--- a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/telnet.json
+++ b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/telnet.json
@@ -1,122 +1,50 @@
 {
-    "title" : "Telnet",
     "name"  : "telnet",
     "forms" : [
 
         {
-            "title" : "Network",
             "name"  : "network",
             "fields" : [
                 {
                     "name"  : "hostname",
-                    "title" : "Hostname",
                     "type"  : "TEXT"
                 },
                 {
                     "name"  : "port",
-                    "title" : "Port",
                     "type"  : "NUMERIC"
                 }
             ]
         },
 
         {
-            "title" : "Authentication",
             "name"  : "authentication",
             "fields" : [
                 {
                     "name"  : "username",
-                    "title" : "Username",
                     "type"  : "USERNAME"
                 },
                 {
                     "name"  : "password",
-                    "title" : "Password",
                     "type"  : "PASSWORD"
                 },
                 {
                     "name"  : "password-regex",
-                    "title" : "Password regular expression",
                     "type"  : "TEXT"
                 }
             ]
         },
 
         {
-            "title" : "Display",
             "name"  : "display",
             "fields" : [
                 {
                     "name"  : "font-name",
-                    "title" : "Font name",
                     "type"  : "TEXT"
                 },
                 {
                     "name"  : "font-size",
-                    "title" : "Font size",
                     "type"  : "ENUM",
-                    "options" : [
-                        {
-                            "value" : "",
-                            "title" : ""
-                        },
-                        {
-                            "value" : "8",
-                            "title" : "8"
-                        },
-                        {
-                            "value" : "9",
-                            "title" : "9"
-                        },
-                        {
-                            "value" : "10",
-                            "title" : "10"
-                        },
-                        {
-                            "value" : "11",
-                            "title" : "11"
-                        },
-                        {
-                            "value" : "12",
-                            "title" : "12"
-                        },
-                        {
-                            "value" : "14",
-                            "title" : "14"
-                        },
-                        {
-                            "value" : "18",
-                            "title" : "18"
-                        },
-                        {
-                            "value" : "24",
-                            "title" : "24"
-                        },
-                        {
-                            "value" : "30",
-                            "title" : "30"
-                        },
-                        {
-                            "value" : "36",
-                            "title" : "36"
-                        },
-                        {
-                            "value" : "48",
-                            "title" : "48"
-                        },
-                        {
-                            "value" : "60",
-                            "title" : "60"
-                        },
-                        {
-                            "value" : "72",
-                            "title" : "72"
-                        },
-                        {
-                            "value" : "96",
-                            "title" : "96"
-                        }
-                    ]
+                    "options" : [ "", "8", "9", "10", "11", "12", "14", "18", "24", "30", "36", "48", "60", "72", "96" ]
                 }
             ]
         }
diff --git a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/vnc.json b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/vnc.json
index d91cdb2e9..a1dc13d8f 100644
--- a/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/vnc.json
+++ b/guacamole-ext/src/main/resources/org/glyptodon/guacamole/protocols/vnc.json
@@ -1,141 +1,81 @@
 {
-    "title" : "VNC",
     "name"  : "vnc",
     "forms" : [
 
         {
-            "title" : "Network",
             "name"  : "network",
             "fields" : [
                 {
                     "name"  : "hostname",
-                    "title" : "Hostname",
                     "type"  : "TEXT"
                 },
                 {
                     "name"  : "port",
-                    "title" : "Port",
                     "type"  : "NUMERIC"
                 }
             ]
         },
 
         {
-            "title" : "Authentication",
             "name"  : "authentication",
             "fields" : [
                 {
                     "name"  : "password",
-                    "title" : "Password",
                     "type"  : "PASSWORD"
                 }
             ]
         },
 
         {
-            "title" : "Display",
             "name"  : "display",
             "fields" : [
                 {
                     "name"    : "read-only",
-                    "title"   : "Read-only",
                     "type"    : "BOOLEAN",
-                    "options" : [{
-                        "value" : "true",
-                        "title" : "true"
-                    }]
+                    "options" : [ "true" ]
                 },
                 {
                     "name"    : "swap-red-blue",
-                    "title"   : "Swap red/blue components",
                     "type"    : "BOOLEAN",
-                    "options" : [{
-                        "value" : "true",
-                        "title" : "true"
-                    }]
+                    "options" : [ "true" ]
                 },
                 {
                     "name"  : "cursor",
-                    "title" : "Cursor",
                     "type"  : "ENUM",
-                    "options" : [
-                        {
-                            "value" : "",
-                            "title" : ""
-                        },
-                        {
-                            "value" : "local",
-                            "title" : "Local"
-                        },
-                        {
-                            "value" : "remote",
-                            "title" : "Remote"
-                        }
-                    ]
+                    "options" : [ "", "local", "remote" ]
                 },
                 {
                     "name"  : "color-depth",
-                    "title" : "Color depth",
                     "type"  : "ENUM",
-                    "options" : [
-                        {
-                            "value" : "",
-                            "title" : ""
-                        },
-                        {
-                            "value" : "8",
-                            "title" : "256 color"
-                        },
-                        {
-                            "value" : "16",
-                            "title" : "Low color (16-bit)"
-                        },
-                        {
-                            "value" : "24",
-                            "title" : "True color (24-bit)"
-                        },
-                        {
-                            "value" : "32",
-                            "title" : "True color (32-bit)"
-                        }
-                    ]
+                    "options" : [ "", "8", "16", "24", "32" ]
                 }
             ]
         },
 
         {
-            "title" : "Repeater",
             "name"  : "repeater",
             "fields" : [
                 {
                     "name"  : "dest-host",
-                    "title" : "Repeater destination host",
                     "type"  : "TEXT"
                 },
                 {
                     "name"  : "dest-port",
-                    "title" : "Repeater destination port",
                     "type"  : "NUMERIC"
                 }
             ]
         },
 
         {
-            "title" : "Audio",
             "name"  : "audio",
             "fields" : [
                 {
                     "name"    : "enable-audio",
-                    "title"   : "Enable audio",
                     "type"    : "BOOLEAN",
-                    "options" : [{
-                        "value" : "true",
-                        "title" : "true"
-                    }]
+                    "options" : [ "true" ]
                 },
                 {
                     "name"  : "audio-servername",
-                    "title" : "Audio server name",
                     "type"  : "TEXT"
                 }
             ]
diff --git a/guacamole/src/main/webapp/app/form/controllers/checkboxFieldController.js b/guacamole/src/main/webapp/app/form/controllers/checkboxFieldController.js
index 830ef0d23..3f9da9534 100644
--- a/guacamole/src/main/webapp/app/form/controllers/checkboxFieldController.js
+++ b/guacamole/src/main/webapp/app/form/controllers/checkboxFieldController.js
@@ -29,12 +29,12 @@ angular.module('form').controller('checkboxFieldController', ['$scope',
 
     // Update typed value when model is changed
     $scope.$watch('model', function modelChanged(model) {
-        $scope.typedValue = (model === $scope.field.options[0].value);
+        $scope.typedValue = (model === $scope.field.options[0]);
     });
 
     // Update string value in model when typed value is changed
     $scope.$watch('typedValue', function typedValueChanged(typedValue) {
-        $scope.model = (typedValue ? $scope.field.options[0].value : '');
+        $scope.model = (typedValue ? $scope.field.options[0] : '');
     });
 
 }]);
diff --git a/guacamole/src/main/webapp/app/form/templates/selectField.html b/guacamole/src/main/webapp/app/form/templates/selectField.html
index 9df1f0769..3bd2bb876 100644
--- a/guacamole/src/main/webapp/app/form/templates/selectField.html
+++ b/guacamole/src/main/webapp/app/form/templates/selectField.html
@@ -1 +1 @@
-<select ng-model="model" ng-options="option.value as getFieldOption(option.value) | translate for option in field.options | orderBy: value"></select>
\ No newline at end of file
+<select ng-model="model" ng-options="option as getFieldOption(option) | translate for option in field.options | orderBy: value"></select>
\ No newline at end of file
diff --git a/guacamole/src/main/webapp/app/rest/types/Field.js b/guacamole/src/main/webapp/app/rest/types/Field.js
index d1e2b0a85..77dd8fff7 100644
--- a/guacamole/src/main/webapp/app/rest/types/Field.js
+++ b/guacamole/src/main/webapp/app/rest/types/Field.js
@@ -46,13 +46,6 @@ angular.module('rest').factory('Field', [function defineField() {
          */
         this.name = template.name;
 
-        /**
-         * A human-readable name for this parameter.
-         *
-         * @type String
-         */
-        this.title = template.title;
-
         /**
          * The type string defining which values this parameter may contain,
          * as well as what properties are applicable. Valid types are listed
@@ -66,7 +59,7 @@ angular.module('rest').factory('Field', [function defineField() {
         /**
          * All possible legal values for this parameter.
          *
-         * @type FieldOption[]
+         * @type String[]
          */
         this.options = template.options;
 
diff --git a/guacamole/src/main/webapp/app/rest/types/FieldOption.js b/guacamole/src/main/webapp/app/rest/types/FieldOption.js
deleted file mode 100644
index 7c4f9a933..000000000
--- a/guacamole/src/main/webapp/app/rest/types/FieldOption.js
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2014 Glyptodon LLC
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-/**
- * Service which defines the FieldOption class.
- */
-angular.module('rest').factory('FieldOption', [function defineFieldOption() {
-            
-    /**
-     * The object returned by REST API calls when representing a single possible
-     * legal value of a field.
-     * 
-     * @constructor
-     * @param {FieldOption|Object} [template={}]
-     *     The object whose properties should be copied within the new
-     *     FieldOption.
-     */
-    var FieldOption = function FieldOption(template) {
-
-        // Use empty object by default
-        template = template || {};
-
-        /**
-         * A human-readable name for this parameter value.
-         *
-         * @type String
-         */
-        this.title = template.title;
-
-        /**
-         * The actual value to set the parameter to, if this option is
-         * selected.
-         *
-         * @type String
-         */
-        this.value = template.value;
-
-    };
-
-    return FieldOption;
-
-}]);
\ No newline at end of file
diff --git a/guacamole/src/main/webapp/app/rest/types/Form.js b/guacamole/src/main/webapp/app/rest/types/Form.js
index a402ccc07..d73604426 100644
--- a/guacamole/src/main/webapp/app/rest/types/Form.js
+++ b/guacamole/src/main/webapp/app/rest/types/Form.js
@@ -40,21 +40,13 @@ angular.module('rest').factory('Form', [function defineForm() {
         template = template || {};
 
         /**
-         * The name which uniquely identifies this parameter, or null if this
-         * field has no name.
+         * The name which uniquely identifies this form, or null if this form
+         * has no name.
          *
          * @type String
          */
         this.name = template.name;
 
-        /**
-         * A human-readable name for this form, or null if this form has no
-         * name.
-         *
-         * @type String
-         */
-        this.title = template.title;
-
         /**
          * All fields contained within this form.
          *
diff --git a/guacamole/src/main/webapp/app/rest/types/Protocol.js b/guacamole/src/main/webapp/app/rest/types/Protocol.js
index 73e66506c..fff1049d6 100644
--- a/guacamole/src/main/webapp/app/rest/types/Protocol.js
+++ b/guacamole/src/main/webapp/app/rest/types/Protocol.js
@@ -46,13 +46,6 @@ angular.module('rest').factory('Protocol', [function defineProtocol() {
          */
         this.name = template.name;
 
-        /**
-         * A human-readable name for this protocol.
-         *
-         * @type String
-         */
-        this.title = template.title;
-
         /**
          * An array of forms containing all known parameters for this protocol,
          * their types, and other information.