From e35f3bbd6341ec14396100b0bb0651ff7aa9334e Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Sat, 25 Dec 2021 22:24:09 -0500
Subject: [PATCH 001/289] GUACAMOLE-1402: Expose Client state enum values.

---
 .../src/main/webapp/modules/Client.js         | 83 ++++++++++++++-----
 1 file changed, 64 insertions(+), 19 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/Client.js b/guacamole-common-js/src/main/webapp/modules/Client.js
index 866714162..f3ac684d5 100644
--- a/guacamole-common-js/src/main/webapp/modules/Client.js
+++ b/guacamole-common-js/src/main/webapp/modules/Client.js
@@ -32,14 +32,7 @@ Guacamole.Client = function(tunnel) {
 
     var guac_client = this;
 
-    var STATE_IDLE          = 0;
-    var STATE_CONNECTING    = 1;
-    var STATE_WAITING       = 2;
-    var STATE_CONNECTED     = 3;
-    var STATE_DISCONNECTING = 4;
-    var STATE_DISCONNECTED  = 5;
-
-    var currentState = STATE_IDLE;
+    var currentState = Guacamole.Client.State.IDLE;
     
     var currentTimestamp = 0;
     var pingInterval = null;
@@ -132,8 +125,8 @@ Guacamole.Client = function(tunnel) {
     }
 
     function isConnected() {
-        return currentState == STATE_CONNECTED
-            || currentState == STATE_WAITING;
+        return currentState == Guacamole.Client.State.CONNECTED
+            || currentState == Guacamole.Client.State.WAITING;
     }
 
     /**
@@ -1547,8 +1540,8 @@ Guacamole.Client = function(tunnel) {
             });
 
             // If received first update, no longer waiting.
-            if (currentState === STATE_WAITING)
-                setState(STATE_CONNECTED);
+            if (currentState === Guacamole.Client.State.WAITING)
+                setState(Guacamole.Client.State.CONNECTED);
 
             // Call sync handler if defined
             if (guac_client.onsync)
@@ -1653,10 +1646,10 @@ Guacamole.Client = function(tunnel) {
     this.disconnect = function() {
 
         // Only attempt disconnection not disconnected.
-        if (currentState != STATE_DISCONNECTED
-                && currentState != STATE_DISCONNECTING) {
+        if (currentState != Guacamole.Client.State.DISCONNECTED
+                && currentState != Guacamole.Client.State.DISCONNECTING) {
 
-            setState(STATE_DISCONNECTING);
+            setState(Guacamole.Client.State.DISCONNECTING);
 
             // Stop ping
             if (pingInterval)
@@ -1665,7 +1658,7 @@ Guacamole.Client = function(tunnel) {
             // Send disconnect message and disconnect
             tunnel.sendMessage("disconnect");
             tunnel.disconnect();
-            setState(STATE_DISCONNECTED);
+            setState(Guacamole.Client.State.DISCONNECTED);
 
         }
 
@@ -1684,13 +1677,13 @@ Guacamole.Client = function(tunnel) {
      */
     this.connect = function(data) {
 
-        setState(STATE_CONNECTING);
+        setState(Guacamole.Client.State.CONNECTING);
 
         try {
             tunnel.connect(data);
         }
         catch (status) {
-            setState(STATE_IDLE);
+            setState(Guacamole.Client.State.IDLE);
             throw status;
         }
 
@@ -1699,11 +1692,63 @@ Guacamole.Client = function(tunnel) {
             tunnel.sendMessage("nop");
         }, 5000);
 
-        setState(STATE_WAITING);
+        setState(Guacamole.Client.State.WAITING);
     };
 
 };
 
+/**
+ * All possible Guacamole Client states.
+ * 
+ * @type {!Object.<string, number>}
+ */
+Guacamole.Client.State = {
+    
+    /**
+     * The client is idle, with no active connection.
+     * 
+     * @type number
+     */
+    "IDLE" : 0,
+    
+    /**
+     * The client is in the process of establishing a connection.
+     * 
+     * @type {!number}
+     */
+    "CONNECTING" : 1,
+    
+    /**
+     * The client is waiting on further information or a remote server to
+     * establish the connection.
+     * 
+     * @type {!number}
+     */
+    "WAITING" : 2,
+    
+    /**
+     * The client is actively connected to a remote server.
+     * 
+     * @type {!number}
+     */
+    "CONNECTED" : 3,
+    
+    /**
+     * The client is in the process of disconnecting from the remote server.
+     * 
+     * @type {!number}
+     */
+    "DISCONNECTING" : 4,
+    
+    /**
+     * The client has completed the connection and is no longer connected.
+     * 
+     * @type {!number}
+     */
+    "DISCONNECTED" : 5
+    
+};
+
 /**
  * Map of all Guacamole binary raster operations to transfer functions.
  *

From 9fe64a77b8794e976eec5b3019ae1c3a9f1b75ef Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Mon, 27 Dec 2021 09:27:07 -0500
Subject: [PATCH 002/289] GUACAMOLE-1402: Use new Client state enum in webapp.

---
 .../frontend/src/app/client/types/ManagedClient.js | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/client/types/ManagedClient.js b/guacamole/src/main/frontend/src/app/client/types/ManagedClient.js
index fb7c8474e..bb21dca13 100644
--- a/guacamole/src/main/frontend/src/app/client/types/ManagedClient.js
+++ b/guacamole/src/main/frontend/src/app/client/types/ManagedClient.js
@@ -427,25 +427,25 @@ angular.module('client').factory('ManagedClient', ['$rootScope', '$injector',
                 switch (clientState) {
 
                     // Idle
-                    case 0:
+                    case Guacamole.Client.State.IDLE:
                         ManagedClientState.setConnectionState(managedClient.clientState,
                             ManagedClientState.ConnectionState.IDLE);
                         break;
 
                     // Connecting
-                    case 1:
+                    case Guacamole.Client.State.CONNECTING:
                         ManagedClientState.setConnectionState(managedClient.clientState,
                             ManagedClientState.ConnectionState.CONNECTING);
                         break;
 
                     // Connected + waiting
-                    case 2:
+                    case Guacamole.Client.State.WAITING:
                         ManagedClientState.setConnectionState(managedClient.clientState,
                             ManagedClientState.ConnectionState.WAITING);
                         break;
 
                     // Connected
-                    case 3:
+                    case Guacamole.Client.State.CONNECTED:
                         ManagedClientState.setConnectionState(managedClient.clientState,
                             ManagedClientState.ConnectionState.CONNECTED);
 
@@ -461,9 +461,9 @@ angular.module('client').factory('ManagedClient', ['$rootScope', '$injector',
                         ManagedClient.updateThumbnail(managedClient);
                         break;
 
-                    // Update history when disconnecting
-                    case 4: // Disconnecting
-                    case 5: // Disconnected
+                    // Update history during disconnect phases
+                    case Guacamole.Client.State.DISCONNECTING:
+                    case Guacamole.Client.State.DISCONNECTED:
                         ManagedClient.updateThumbnail(managedClient);
                         break;
 

From c2c3428cf0be150650f6a4c9706222c508b9e788 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Mon, 3 Jan 2022 15:31:47 -0500
Subject: [PATCH 003/289] GUACAMOLE-1488: Add support for configuring LDAP SSL
 protocol.

---
 .../auth/ldap/ConnectedLDAPConfiguration.java |   6 +
 .../auth/ldap/LDAPConnectionService.java      | 123 ++++++++++++------
 .../ldap/conf/DefaultLDAPConfiguration.java   |   5 +
 .../conf/EnvironmentLDAPConfiguration.java    |   8 ++
 .../ldap/conf/JacksonLDAPConfiguration.java   |  14 ++
 .../auth/ldap/conf/LDAPConfiguration.java     |  14 ++
 .../ldap/conf/LDAPGuacamoleProperties.java    |   8 ++
 .../auth/ldap/conf/LDAPSSLProtocol.java       |  87 +++++++++++++
 8 files changed, 228 insertions(+), 37 deletions(-)
 create mode 100644 extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPSSLProtocol.java

diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/ConnectedLDAPConfiguration.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/ConnectedLDAPConfiguration.java
index 5617bb785..493cafcb7 100644
--- a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/ConnectedLDAPConfiguration.java
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/ConnectedLDAPConfiguration.java
@@ -27,6 +27,7 @@ import org.apache.directory.ldap.client.api.LdapNetworkConnection;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.auth.ldap.conf.EncryptionMethod;
 import org.apache.guacamole.auth.ldap.conf.LDAPConfiguration;
+import org.apache.guacamole.auth.ldap.conf.LDAPSSLProtocol;
 import org.apache.guacamole.auth.ldap.conf.MemberAttributeType;
 
 /**
@@ -161,6 +162,11 @@ public class ConnectedLDAPConfiguration implements LDAPConfiguration, AutoClosea
     public EncryptionMethod getEncryptionMethod() throws GuacamoleException {
         return config.getEncryptionMethod();
     }
+    
+    @Override
+    public LDAPSSLProtocol getSslProtocol() throws GuacamoleException {
+        return config.getSslProtocol();
+    }
 
     @Override
     public int getMaxResults() throws GuacamoleException {
diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/LDAPConnectionService.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/LDAPConnectionService.java
index b8f5d30ad..06f83b5eb 100644
--- a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/LDAPConnectionService.java
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/LDAPConnectionService.java
@@ -35,6 +35,7 @@ import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.GuacamoleUnsupportedException;
 import org.apache.guacamole.auth.ldap.conf.EncryptionMethod;
 import org.apache.guacamole.auth.ldap.conf.LDAPConfiguration;
+import org.apache.guacamole.auth.ldap.conf.LDAPSSLProtocol;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -51,7 +52,8 @@ public class LDAPConnectionService {
     /**
      * Creates a new instance of LdapNetworkConnection, configured as required
      * to use the given encryption method to communicate with the LDAP server
-     * at the given hostname and port. The returned LdapNetworkConnection is
+     * at the given hostname and port, with the specified encryption method,
+     * SSL protocol version, and timeout. The returned LdapNetworkConnection is
      * configured for use but is not yet connected nor bound to the LDAP
      * server. It will not be bound until a bind operation is explicitly
      * requested, and will not be connected until it is used in an LDAP
@@ -66,6 +68,85 @@ public class LDAPConnectionService {
      * @param encryptionMethod
      *     The encryption method that should be used to communicate with the
      *     LDAP server.
+     * 
+     * @param sslProtocol
+     *     The SSL protocol version to use to make a secure LDAP configuration,
+     *     if SSL or STARTTLS is used.
+     *
+     * @param timeout
+     *     The maximum number of milliseconds to wait for a response from the
+     *     LDAP server.
+     *
+     * @return
+     *     A new instance of LdapNetworkConnection which uses the given
+     *     encryption method to communicate with the LDAP server at the given
+     *     hostname and port.
+     *
+     * @throws GuacamoleException
+     *     If the requested encryption method is actually not implemented (a
+     *     bug).
+     */
+    private LdapNetworkConnection createLDAPConnection(String host, int port,
+            EncryptionMethod encryptionMethod, LDAPSSLProtocol sslProtocol,
+            int timeout)
+            throws GuacamoleException {
+
+        LdapConnectionConfig config = new LdapConnectionConfig();
+        config.setLdapHost(host);
+        config.setLdapPort(port);
+        config.setTimeout(timeout);
+
+        // Map encryption method to proper connection and socket factory
+        switch (encryptionMethod) {
+
+            // Unencrypted LDAP connection
+            case NONE:
+                logger.debug("Connection to LDAP server without encryption.");
+                break;
+
+            // LDAP over SSL (LDAPS)
+            case SSL:
+                logger.debug("Connecting to LDAP server using SSL/TLS.");
+                config.setUseSsl(true);
+                config.setSslProtocol(sslProtocol.toString());
+                break;
+
+            // LDAP + STARTTLS
+            case STARTTLS:
+                logger.debug("Connecting to LDAP server using STARTTLS.");
+                config.setUseTls(true);
+                config.setSslProtocol(sslProtocol.toString());
+                break;
+
+            // The encryption method, though known, is not actually
+            // implemented. If encountered, this would be a bug.
+            default:
+                throw new GuacamoleUnsupportedException("Unimplemented encryption method: " + encryptionMethod);
+
+        }
+
+        return new LdapNetworkConnection(config);
+
+    }
+    
+    /**
+     * Creates a new instance of LdapNetworkConnection, configured as required
+     * to use the given encryption method to communicate with the LDAP server
+     * at the given hostname and port with the encryption method and timeout
+     * specified, as well. The returned LdapNetworkConnection is configured
+     * for use but is not yet connected nor bound to the LDAP server. It will
+     * not be bound until a bind operation is explicitly requested, and will
+     * not be connected until it is used in an LDAP operation (such as a bind).
+     *
+     * @param host
+     *     The hostname or IP address of the LDAP server.
+     *
+     * @param port
+     *     The TCP port that the LDAP server is listening on.
+     *
+     * @param encryptionMethod
+     *     The encryption method that should be used to communicate with the
+     *     LDAP server.
      *
      * @param timeout
      *     The maximum number of milliseconds to wait for a response from the
@@ -83,41 +164,8 @@ public class LDAPConnectionService {
     private LdapNetworkConnection createLDAPConnection(String host, int port,
             EncryptionMethod encryptionMethod, int timeout)
             throws GuacamoleException {
-
-        LdapConnectionConfig config = new LdapConnectionConfig();
-        config.setLdapHost(host);
-        config.setLdapPort(port);
-        config.setTimeout(timeout);
-
-        // Map encryption method to proper connection and socket factory
-        switch (encryptionMethod) {
-
-            // Unencrypted LDAP connection
-            case NONE:
-                logger.debug("Connection to LDAP server without encryption.");
-                break;
-
-            // LDAP over SSL (LDAPS)
-            case SSL:
-                logger.debug("Connecting to LDAP server using SSL/TLS.");
-                config.setUseSsl(true);
-                break;
-
-            // LDAP + STARTTLS
-            case STARTTLS:
-                logger.debug("Connecting to LDAP server using STARTTLS.");
-                config.setUseTls(true);
-                break;
-
-            // The encryption method, though known, is not actually
-            // implemented. If encountered, this would be a bug.
-            default:
-                throw new GuacamoleUnsupportedException("Unimplemented encryption method: " + encryptionMethod);
-
-        }
-
-        return new LdapNetworkConnection(config);
-
+        return createLDAPConnection(host, port, encryptionMethod,
+                LDAPSSLProtocol.TLSv1_3, timeout);
     }
 
     /**
@@ -147,6 +195,7 @@ public class LDAPConnectionService {
                 config.getServerHostname(),
                 config.getServerPort(),
                 config.getEncryptionMethod(),
+                config.getSslProtocol(),
                 config.getNetworkTimeout());
     }
 
@@ -217,7 +266,7 @@ public class LDAPConnectionService {
             port = encryptionMethod.DEFAULT_PORT;
 
         return createLDAPConnection(host, port, encryptionMethod,
-                config.getNetworkTimeout());
+                config.getSslProtocol(), config.getNetworkTimeout());
 
     }
 
diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/DefaultLDAPConfiguration.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/DefaultLDAPConfiguration.java
index 28ab8ed02..cb2db9b6b 100644
--- a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/DefaultLDAPConfiguration.java
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/DefaultLDAPConfiguration.java
@@ -89,6 +89,11 @@ public class DefaultLDAPConfiguration implements LDAPConfiguration {
     public EncryptionMethod getEncryptionMethod() {
         return EncryptionMethod.NONE;
     }
+    
+    @Override
+    public LDAPSSLProtocol getSslProtocol() {
+        return LDAPSSLProtocol.TLSv1_3;
+    }
 
     @Override
     public int getMaxResults() {
diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/EnvironmentLDAPConfiguration.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/EnvironmentLDAPConfiguration.java
index ae2d3cf3f..9fb44a1fa 100644
--- a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/EnvironmentLDAPConfiguration.java
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/EnvironmentLDAPConfiguration.java
@@ -136,6 +136,14 @@ public class EnvironmentLDAPConfiguration implements LDAPConfiguration {
             DEFAULT.getEncryptionMethod()
         );
     }
+    
+    @Override
+    public LDAPSSLProtocol getSslProtocol() throws GuacamoleException {
+        return environment.getProperty(
+            LDAPGuacamoleProperties.LDAP_SSL_PROTOCOL,
+            DEFAULT.getSslProtocol()
+        );
+    }
 
     @Override
     public int getMaxResults() throws GuacamoleException {
diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/JacksonLDAPConfiguration.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/JacksonLDAPConfiguration.java
index f888908ed..01d58a3e4 100644
--- a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/JacksonLDAPConfiguration.java
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/JacksonLDAPConfiguration.java
@@ -116,6 +116,14 @@ public class JacksonLDAPConfiguration implements LDAPConfiguration {
      */
     @JsonProperty("encryption-method")
     private String encryptionMethod;
+    
+    /**
+     * The raw YAML value of {@link LDAPGuacamoleProperties#LDAP_SSL_PROTOCOL}. If
+     * not set within the YAML, this will be null, and will default to the value
+     * specified by the LDAP API library.
+     */
+    @JsonProperty("ssl-protocol")
+    private String sslProtocol;
 
     /**
      * The raw YAML value of {@link LDAPGuacamoleProperties#LDAP_MAX_SEARCH_RESULTS}.
@@ -365,6 +373,12 @@ public class JacksonLDAPConfiguration implements LDAPConfiguration {
         return withDefault(LDAPGuacamoleProperties.LDAP_ENCRYPTION_METHOD,
                 encryptionMethod, defaultConfig::getEncryptionMethod);
     }
+    
+    @Override
+    public LDAPSSLProtocol getSslProtocol() throws GuacamoleException {
+        return withDefault(LDAPGuacamoleProperties.LDAP_SSL_PROTOCOL,
+                sslProtocol, defaultConfig::getSslProtocol);
+    }
 
     @Override
     public int getMaxResults() throws GuacamoleException {
diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPConfiguration.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPConfiguration.java
index 77eb31511..975631d02 100644
--- a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPConfiguration.java
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPConfiguration.java
@@ -183,6 +183,20 @@ public interface LDAPConfiguration {
      *     If the encryption method cannot be retrieved.
      */
     EncryptionMethod getEncryptionMethod() throws GuacamoleException;
+    
+    /**
+     * Returns the SSL protocol that should be used when making a secure
+     * connection to the LDAP server. By default the latest available TLS
+     * version will be used.
+     * 
+     * @return
+     *     The SSL protocol that should be used when making a secure connection
+     *     to the LDAP server.
+     * 
+     * @throws GuacamoleException 
+     *     If the SSL protocol cannot be retrieved.
+     */
+    LDAPSSLProtocol getSslProtocol() throws GuacamoleException;
 
     /**
      * Returns maximum number of results a LDAP query can return.
diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPGuacamoleProperties.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPGuacamoleProperties.java
index 1db4f723c..cd0b724c0 100644
--- a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPGuacamoleProperties.java
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPGuacamoleProperties.java
@@ -170,6 +170,14 @@ public class LDAPGuacamoleProperties {
         public String getName() { return "ldap-encryption-method"; }
 
     };
+    
+    public static final EnumGuacamoleProperty<LDAPSSLProtocol> LDAP_SSL_PROTOCOL =
+            new EnumGuacamoleProperty<LDAPSSLProtocol>(LDAPSSLProtocol.class) {
+    
+        @Override
+        public String getName() { return "ldap-ssl-protocol"; }
+                
+    };
 
     /**
      * The maximum number of results a LDAP query can return.
diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPSSLProtocol.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPSSLProtocol.java
new file mode 100644
index 000000000..c5b1ca88d
--- /dev/null
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPSSLProtocol.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ldap.conf;
+
+import org.apache.guacamole.properties.EnumGuacamoleProperty.PropertyValue;
+
+/**
+ * All possible SSL protocols which may be used for secure LDAP connections.
+ */
+public enum LDAPSSLProtocol {
+
+    /**
+     * Use SSLv3 for secure LDAP connection.
+     */
+    @PropertyValue("SSLv3")
+    SSLv3("SSLv3"),
+    
+    /**
+     * Use original TLS for secure LDAP connection.
+     */
+    @PropertyValue("TLS")
+    TLS("TLS"),
+    
+    /**
+     * Use TLSv1 for secure LDAP connection.
+     */
+    @PropertyValue("TLSv1")
+    TLSv1("TLSv1"),
+    
+    /**
+     * Use TLSv1.1 for secure LDAP connection.
+     */
+    @PropertyValue("TLSv1.1")
+    TLSv1_1("TLSv1.1"),
+    
+    /**
+     * Use TLSv1.2 for secure LDAP connection.
+     */
+    @PropertyValue("TLSv1.2")
+    TLSv1_2("TLSv1.2"),
+    
+    /**
+     * Use TLSv1.3 for secure LDAP connection.
+     */
+    @PropertyValue("TLSv1.3")
+    TLSv1_3("TLSv1.3");
+
+    /**
+     * The string value of the option to use which is ultimately what the LDAP
+     * API consumes to set the SSL protocol.
+     */
+    public final String STRING_VALUE;
+
+    /**
+     * Initializes this SSL protocol such that it is associated with the
+     * given string value.
+     *
+     * @param value
+     *     The string value that will be associated with the enum value.
+     */
+    private LDAPSSLProtocol(String value) {
+        this.STRING_VALUE = value;
+    }
+    
+    @Override
+    public String toString() {
+        return STRING_VALUE;
+    }
+
+}

From a608fa274dc09c805310b230d92290b950a3421e Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Fri, 11 Mar 2022 18:37:18 +0000
Subject: [PATCH 004/289] GUACAMOLE-1550: Allow TOTP key to be cleared by
 setting its generation status.

The previous functionality provided two checkboxes: one for requesting
that the TOTP key be cleared, and another for directly managing whether
the TOTP key has been confirmed. This is confusing as checkboxes
normally represent state, but the "reset" checkbox here is representing
an action.

Instead, both checkboxes should represent state: whether the key has
been generated and whether the generated key has been confirmed.
---
 .../guacamole/auth/totp/user/TOTPUser.java    | 48 ++++++++++---------
 .../auth/totp/user/TOTPUserContext.java       |  2 +-
 .../src/main/resources/translations/en.json   |  6 +--
 3 files changed, 29 insertions(+), 27 deletions(-)

diff --git a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUser.java b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUser.java
index d50e3a68c..0c6f567b8 100644
--- a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUser.java
+++ b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUser.java
@@ -45,17 +45,26 @@ public class TOTPUser extends DelegatingUser {
     public static final String TOTP_KEY_CONFIRMED_ATTRIBUTE_NAME = "guac-totp-key-confirmed";
     
     /**
-     * The name of the field used to trigger a reset of the TOTP data.
+     * The name of the user attribute defines whether the TOTP key has been
+     * generated for the user, regardless of whether that key has been
+     * confirmed. This attribute is not stored, but is instead exposed
+     * dynamically in lieu of exposing the actual TOTP key.
      */
-    public static final String TOTP_KEY_SECRET_RESET_FIELD = "guac-totp-reset";
+    public static final String TOTP_KEY_SECRET_GENERATED_ATTRIBUTE_NAME = "guac-totp-key-generated";
+
+    /**
+     * The string value used by TOTP user attributes to represent the boolean
+     * value "true".
+     */
+    private static final String TRUTH_VALUE = "true";
 
     /**
      * The form which contains all configurable properties for this user.
      */
-    public static final Form TOTP_CONFIG_FORM = new Form("totp-config-form",
+    public static final Form TOTP_ENROLLMENT_STATUS = new Form("totp-enrollment-status",
             Arrays.asList(
-                    new BooleanField(TOTP_KEY_SECRET_RESET_FIELD, "true"),
-                    new BooleanField(TOTP_KEY_CONFIRMED_ATTRIBUTE_NAME, "true")
+                    new BooleanField(TOTP_KEY_SECRET_GENERATED_ATTRIBUTE_NAME, TRUTH_VALUE),
+                    new BooleanField(TOTP_KEY_CONFIRMED_ATTRIBUTE_NAME, TRUTH_VALUE)
             )
     );
     
@@ -86,17 +95,12 @@ public class TOTPUser extends DelegatingUser {
 
         // Create independent, mutable copy of attributes
         Map<String, String> attributes = new HashMap<>(super.getAttributes());
-        
-        // Protect the secret value by removing it
+
+        // Replace secret key with simple boolean attribute representing
+        // whether a key has been generated at all
         String secret = attributes.remove(TOTP_KEY_SECRET_ATTRIBUTE_NAME);
-        
-        // If secret is null or empty, mark the reset as true.
-        if (secret == null || secret.isEmpty())
-            attributes.put(TOTP_KEY_SECRET_RESET_FIELD, "true");
-            
-        // If secret has a value, mark the reset as false.
-        else
-            attributes.put(TOTP_KEY_SECRET_RESET_FIELD, "false");
+        if (secret != null && !secret.isEmpty())
+            attributes.put(TOTP_KEY_SECRET_GENERATED_ATTRIBUTE_NAME, TRUTH_VALUE);
 
         return attributes;
 
@@ -107,15 +111,13 @@ public class TOTPUser extends DelegatingUser {
 
         // Create independent, mutable copy of attributes
         attributes = new HashMap<>(attributes);
-        
-        // Do not expose any TOTP secret attribute outside this extension
+
+        // Do not allow TOTP secret to be directly manipulated
         attributes.remove(TOTP_KEY_SECRET_ATTRIBUTE_NAME);
-        
-        // Pull off the boolean reset field
-        String reset = attributes.remove(TOTP_KEY_SECRET_RESET_FIELD);
-        
-        // If reset has been set to true, clear the secret.
-        if (reset != null && reset.equals("true")) {
+
+        // Reset TOTP status entirely if requested
+        String generated = attributes.remove(TOTP_KEY_SECRET_GENERATED_ATTRIBUTE_NAME);
+        if (generated != null && !generated.equals(TRUTH_VALUE)) {
             attributes.put(TOTP_KEY_SECRET_ATTRIBUTE_NAME, null);
             attributes.put(TOTP_KEY_CONFIRMED_ATTRIBUTE_NAME, null);
         }
diff --git a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUserContext.java b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUserContext.java
index f4785193c..a7a97b022 100644
--- a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUserContext.java
+++ b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUserContext.java
@@ -68,7 +68,7 @@ public class TOTPUserContext extends DelegatingUserContext {
     @Override
     public Collection<Form> getUserAttributes() {
         Collection<Form> userAttrs = new HashSet<>(super.getUserAttributes());
-        userAttrs.add(TOTPUser.TOTP_CONFIG_FORM);
+        userAttrs.add(TOTPUser.TOTP_ENROLLMENT_STATUS);
         return Collections.unmodifiableCollection(userAttrs);
     }
 
diff --git a/extensions/guacamole-auth-totp/src/main/resources/translations/en.json b/extensions/guacamole-auth-totp/src/main/resources/translations/en.json
index 55bd69ac4..80bdaf06a 100644
--- a/extensions/guacamole-auth-totp/src/main/resources/translations/en.json
+++ b/extensions/guacamole-auth-totp/src/main/resources/translations/en.json
@@ -33,10 +33,10 @@
     
     "USER_ATTRIBUTES" : {
         
-        "FIELD_HEADER_GUAC_TOTP_RESET"         : "Clear TOTP secret:",
-        "FIELD_HEADER_GUAC_TOTP_KEY_CONFIRMED" : "TOTP key confirmed:",
+        "FIELD_HEADER_GUAC_TOTP_KEY_GENERATED" : "Secret key generated:",
+        "FIELD_HEADER_GUAC_TOTP_KEY_CONFIRMED" : "Authentication device confirmed:",
         
-        "SECTION_HEADER_TOTP_CONFIG_FORM" : "Configure TOTP"
+        "SECTION_HEADER_TOTP_ENROLLMENT_STATUS" : "TOTP Enrollment Status"
         
     }
 

From d5444a2d1aaf51e9ebdeda45e241b4f94c60efea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexis=20V=C3=A9zina?=
 <8386808+webtroter@users.noreply.github.com>
Date: Tue, 15 Mar 2022 20:49:09 -0400
Subject: [PATCH 005/289] GUACAMOLE-1312: Adds FR-CA keyboard layout

And its French and English traductions
---
 .../src/main/resources/org/apache/guacamole/protocols/rdp.json   | 1 +
 guacamole/src/main/frontend/src/translations/en.json             | 1 +
 guacamole/src/main/frontend/src/translations/fr.json             | 1 +
 3 files changed, 3 insertions(+)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
index badefb11b..e78313d79 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
@@ -100,6 +100,7 @@
                         "failsafe",
                         "fr-be-azerty",
                         "fr-fr-azerty",
+                        "fr-ca-qwerty",
                         "fr-ch-qwertz",
                         "hu-hu-qwertz",                        
                         "it-it-qwerty",
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 6896d0a93..db502311d 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -582,6 +582,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_ES_LATAM_QWERTY" : "Latin American (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_FAILSAFE"     : "Unicode",
         "FIELD_OPTION_SERVER_LAYOUT_FR_BE_AZERTY" : "Belgian French (Azerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_CA_QWERTY" : "Canadian French (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_FR_CH_QWERTZ" : "Swiss French (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_FR_FR_AZERTY" : "French (Azerty)",
         "FIELD_OPTION_SERVER_LAYOUT_HU_HU_QWERTZ" : "Hungarian (Qwertz)",
diff --git a/guacamole/src/main/frontend/src/translations/fr.json b/guacamole/src/main/frontend/src/translations/fr.json
index 110bbe077..3c8dc2712 100644
--- a/guacamole/src/main/frontend/src/translations/fr.json
+++ b/guacamole/src/main/frontend/src/translations/fr.json
@@ -550,6 +550,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_ES_LATAM_QWERTY" : "Latino-Américain (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_FAILSAFE"     : "Unicode",
         "FIELD_OPTION_SERVER_LAYOUT_FR_BE_AZERTY" : "Français Belge (Azerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_CA_QWERTY" : "Français Canada (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_FR_CH_QWERTZ" : "Français Suisse (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_FR_FR_AZERTY" : "Français (Azerty)",
         "FIELD_OPTION_SERVER_LAYOUT_HU_HU_QWERTZ" : "Hongrois (Qwertz)",

From c555fe64112ff6b4212eed7582e367cb204803b4 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Fri, 25 Mar 2022 21:37:17 +0000
Subject: [PATCH 006/289] GUACAMOLE-1562: Ensure "ping" response is not
 erroneously handled as the tunnel UUID.

---
 guacamole-common-js/src/main/webapp/modules/Tunnel.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/Tunnel.js b/guacamole-common-js/src/main/webapp/modules/Tunnel.js
index 23657cddc..f300821e8 100644
--- a/guacamole-common-js/src/main/webapp/modules/Tunnel.js
+++ b/guacamole-common-js/src/main/webapp/modules/Tunnel.js
@@ -1094,7 +1094,7 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
                     if (tunnel.uuid === null) {
 
                         // Associate tunnel UUID if received
-                        if (opcode === Guacamole.Tunnel.INTERNAL_DATA_OPCODE)
+                        if (opcode === Guacamole.Tunnel.INTERNAL_DATA_OPCODE && elements.length === 1)
                             tunnel.setUUID(elements[0]);
 
                         // Tunnel is now open and UUID is available

From b9e79d99c5121cc8b358c71faf810492874ad2d8 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Fri, 25 Mar 2022 21:37:53 +0000
Subject: [PATCH 007/289] GUACAMOLE-1562: Update chained tunnel UUID when
 underlying tunnel receives UUID.

---
 guacamole-common-js/src/main/webapp/modules/Tunnel.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/Tunnel.js b/guacamole-common-js/src/main/webapp/modules/Tunnel.js
index f300821e8..fa886f561 100644
--- a/guacamole-common-js/src/main/webapp/modules/Tunnel.js
+++ b/guacamole-common-js/src/main/webapp/modules/Tunnel.js
@@ -1236,12 +1236,17 @@ Guacamole.ChainedTunnel = function(tunnelChain) {
             tunnel.onstatechange = chained_tunnel.onstatechange;
             tunnel.oninstruction = chained_tunnel.oninstruction;
             tunnel.onerror = chained_tunnel.onerror;
-            tunnel.onuuid = chained_tunnel.onuuid;
 
             // Assign UUID if already known
             if (tunnel.uuid)
                 chained_tunnel.setUUID(tunnel.uuid);
 
+            // Assign any future received UUIDs such that they are
+            // accessible from the main uuid property of the chained tunnel
+            tunnel.onuuid = function uuidReceived(uuid) {
+                chained_tunnel.setUUID(uuid);
+            };
+
             committedTunnel = tunnel;
 
         }

From daadb9d7571d5ec0495fb07af98c6b51aa716e73 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 30 Mar 2022 23:55:17 +0000
Subject: [PATCH 008/289] GUACAMOLE-1571: Properly wrap upload stream JSON
 errors.

---
 .../src/main/frontend/src/app/rest/services/tunnelService.js    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js b/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
index 6a637ff71..5f9a21a7c 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
@@ -323,7 +323,7 @@ angular.module('rest').factory('tunnelService', ['$injector',
 
             // Parse and reject with resulting JSON error
             else if (xhr.getResponseHeader('Content-Type') === 'application/json')
-                deferred.reject(angular.fromJson(xhr.responseText));
+                deferred.reject(new Error(angular.fromJson(xhr.responseText)));
 
             // Warn of lack of permission of a proxy rejects the upload
             else if (xhr.status >= 400 && xhr.status < 500)

From 915596e0d7b2e53baa8f6f888c484271f1d6e3b3 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 30 Mar 2022 23:56:42 +0000
Subject: [PATCH 009/289] GUACAMOLE-1571: Check available translations rather
 than hardcoding which use the default.

---
 .../directives/guacClientNotification.js      | 112 +++++++-----------
 .../app/client/directives/guacFileTransfer.js |  48 +++-----
 .../src/app/client/services/guacTranslate.js  |  82 +++++++++++++
 .../client/templates/guacFileTransfer.html    |   2 +-
 .../src/app/client/types/TranslationResult.js |  59 +++++++++
 5 files changed, 201 insertions(+), 102 deletions(-)
 create mode 100644 guacamole/src/main/frontend/src/app/client/services/guacTranslate.js
 create mode 100644 guacamole/src/main/frontend/src/app/client/types/TranslationResult.js

diff --git a/guacamole/src/main/frontend/src/app/client/directives/guacClientNotification.js b/guacamole/src/main/frontend/src/app/client/directives/guacClientNotification.js
index e1a08ebc6..03344b627 100644
--- a/guacamole/src/main/frontend/src/app/client/directives/guacClientNotification.js
+++ b/guacamole/src/main/frontend/src/app/client/directives/guacClientNotification.js
@@ -34,16 +34,16 @@ angular.module('client').directive('guacClientNotification', [function guacClien
 
         /**
          * The client whose status should be displayed.
-         * 
+         *
          * @type ManagedClient
          */
         client : '='
-        
+
     };
 
     directive.controller = ['$scope', '$injector', '$element',
         function guacClientNotificationController($scope, $injector, $element) {
-   
+
         // Required types
         const ManagedClient      = $injector.get('ManagedClient');
         const ManagedClientState = $injector.get('ManagedClientState');
@@ -53,6 +53,7 @@ angular.module('client').directive('guacClientNotification', [function guacClien
         const $location              = $injector.get('$location');
         const authenticationService  = $injector.get('authenticationService');
         const guacClientManager      = $injector.get('guacClientManager');
+        const guacTranslate          = $injector.get('guacTranslate');
         const requestService         = $injector.get('requestService');
         const userPageService        = $injector.get('userPageService');
 
@@ -65,26 +66,6 @@ angular.module('client').directive('guacClientNotification', [function guacClien
          */
         $scope.status = false;
 
-        /**
-         * All client error codes handled and passed off for translation. Any error
-         * code not present in this list will be represented by the "DEFAULT"
-         * translation.
-         */
-        const CLIENT_ERRORS = {
-            0x0201: true,
-            0x0202: true,
-            0x0203: true,
-            0x0207: true,
-            0x0208: true,
-            0x0209: true,
-            0x020A: true,
-            0x020B: true,
-            0x0301: true,
-            0x0303: true,
-            0x0308: true,
-            0x031D: true
-        };
-
         /**
          * All error codes for which automatic reconnection is appropriate when a
          * client error occurs.
@@ -98,26 +79,7 @@ angular.module('client').directive('guacClientNotification', [function guacClien
             0x0301: true,
             0x0308: true
         };
-     
-        /**
-         * All tunnel error codes handled and passed off for translation. Any error
-         * code not present in this list will be represented by the "DEFAULT"
-         * translation.
-         */
-        const TUNNEL_ERRORS = {
-            0x0201: true,
-            0x0202: true,
-            0x0203: true,
-            0x0204: true,
-            0x0205: true,
-            0x0207: true,
-            0x0208: true,
-            0x0301: true,
-            0x0303: true,
-            0x0308: true,
-            0x031D: true
-        };
-     
+
         /**
          * All error codes for which automatic reconnection is appropriate when a
          * tunnel error occurs.
@@ -239,7 +201,7 @@ angular.module('client').directive('guacClientNotification', [function guacClien
             // Get any associated status code
             const status = $scope.client.clientState.statusCode;
 
-            // Connecting 
+            // Connecting
             if (connectionState === ManagedClientState.ConnectionState.CONNECTING
              || connectionState === ManagedClientState.ConnectionState.WAITING) {
                 $scope.status = {
@@ -254,44 +216,58 @@ angular.module('client').directive('guacClientNotification', [function guacClien
             // Client error
             else if (connectionState === ManagedClientState.ConnectionState.CLIENT_ERROR) {
 
-                // Determine translation name of error
-                const errorName = (status in CLIENT_ERRORS) ? status.toString(16).toUpperCase() : "DEFAULT";
+                // Translation IDs for this error code
+                const errorPrefix = "CLIENT.ERROR_CLIENT_";
+                const errorId = errorPrefix + status.toString(16).toUpperCase();
+                const defaultErrorId = errorPrefix + "DEFAULT";
 
                 // Determine whether the reconnect countdown applies
                 const countdown = (status in CLIENT_AUTO_RECONNECT) ? RECONNECT_COUNTDOWN : null;
 
-                // Show error status
-                notifyConnectionClosed({
-                    className : "error",
-                    title     : "CLIENT.DIALOG_HEADER_CONNECTION_ERROR",
-                    text      : {
-                        key : "CLIENT.ERROR_CLIENT_" + errorName
-                    },
-                    countdown : countdown,
-                    actions   : actions
-                });
+                // Use the guacTranslate service to determine if there is a translation for
+                // this error code; if not, use the default
+                guacTranslate(errorId, defaultErrorId).then(
+
+                    // Show error status
+                    translationResult => notifyConnectionClosed({
+                        className : "error",
+                        title     : "CLIENT.DIALOG_HEADER_CONNECTION_ERROR",
+                        text      : {
+                            key : translationResult.id
+                        },
+                        countdown : countdown,
+                        actions   : actions
+                    })
+                );
 
             }
 
             // Tunnel error
             else if (connectionState === ManagedClientState.ConnectionState.TUNNEL_ERROR) {
 
-                // Determine translation name of error
-                const errorName = (status in TUNNEL_ERRORS) ? status.toString(16).toUpperCase() : "DEFAULT";
+                // Translation IDs for this error code
+                const errorPrefix = "CLIENT.ERROR_TUNNEL_";
+                const errorId = errorPrefix + status.toString(16).toUpperCase();
+                const defaultErrorId = errorPrefix + "DEFAULT";
 
                 // Determine whether the reconnect countdown applies
                 const countdown = (status in TUNNEL_AUTO_RECONNECT) ? RECONNECT_COUNTDOWN : null;
 
-                // Show error status
-                notifyConnectionClosed({
-                    className : "error",
-                    title     : "CLIENT.DIALOG_HEADER_CONNECTION_ERROR",
-                    text      : {
-                        key : "CLIENT.ERROR_TUNNEL_" + errorName
-                    },
-                    countdown : countdown,
-                    actions   : actions
-                });
+                // Use the guacTranslate service to determine if there is a translation for
+                // this error code; if not, use the default
+                guacTranslate(errorId, defaultErrorId).then(
+
+                    // Show error status
+                    translationResult => notifyConnectionClosed({
+                        className : "error",
+                        title     : "CLIENT.DIALOG_HEADER_CONNECTION_ERROR",
+                        text      : {
+                            key : translationResult.id
+                        },
+                        countdown : countdown,
+                        actions   : actions
+                    })
+                );
 
             }
 
diff --git a/guacamole/src/main/frontend/src/app/client/directives/guacFileTransfer.js b/guacamole/src/main/frontend/src/app/client/directives/guacFileTransfer.js
index a9c09bca5..d016a721c 100644
--- a/guacamole/src/main/frontend/src/app/client/directives/guacFileTransfer.js
+++ b/guacamole/src/main/frontend/src/app/client/directives/guacFileTransfer.js
@@ -30,7 +30,7 @@ angular.module('client').directive('guacFileTransfer', [function guacFileTransfe
 
             /**
              * The file transfer to display.
-             * 
+             *
              * @type ManagedFileUpload|ManagedFileDownload
              */
             transfer : '='
@@ -40,27 +40,12 @@ angular.module('client').directive('guacFileTransfer', [function guacFileTransfe
         templateUrl: 'app/client/templates/guacFileTransfer.html',
         controller: ['$scope', '$injector', function guacFileTransferController($scope, $injector) {
 
+            // Required services
+            const guacTranslate = $injector.get('guacTranslate');
+
             // Required types
             var ManagedFileTransferState = $injector.get('ManagedFileTransferState');
 
-            /**
-             * All upload error codes handled and passed off for translation.
-             * Any error code not present in this list will be represented by
-             * the "DEFAULT" translation.
-             */
-            var UPLOAD_ERRORS = {
-                0x0100: true,
-                0x0201: true,
-                0x0202: true,
-                0x0203: true,
-                0x0204: true,
-                0x0205: true,
-                0x0301: true,
-                0x0303: true,
-                0x0308: true,
-                0x031D: true
-            };
-
             /**
              * Returns the unit string that is most appropriate for the
              * number of bytes transferred thus far - either 'gb', 'mb', 'kb',
@@ -193,7 +178,7 @@ angular.module('client').directive('guacFileTransfer', [function guacFileTransfe
                     return;
 
                 // Save file
-                saveAs($scope.transfer.blob, $scope.transfer.filename); 
+                saveAs($scope.transfer.blob, $scope.transfer.filename);
 
             };
 
@@ -210,23 +195,20 @@ angular.module('client').directive('guacFileTransfer', [function guacFileTransfe
                 return $scope.transfer.transferState.streamState === ManagedFileTransferState.StreamState.ERROR;
             };
 
-            /**
-             * Returns the text of the current error as a translation string.
-             *
-             * @returns {String}
-             *     The name of the translation string containing the text
-             *     associated with the current error.
-             */
-            $scope.getErrorText = function getErrorText() {
+            // The translated error message for the current status code
+            $scope.translatedErrorMessage = '';
+
+            $scope.$watch('transfer.transferState.statusCode', function statusCodeChanged(statusCode) {
 
                 // Determine translation name of error
-                var status = $scope.transfer.transferState.statusCode;
-                var errorName = (status in UPLOAD_ERRORS) ? status.toString(16).toUpperCase() : "DEFAULT";
+                const errorName = 'CLIENT.ERROR_UPLOAD_' + statusCode.toString(16).toUpperCase();
 
-                // Return translation string
-                return 'CLIENT.ERROR_UPLOAD_' + errorName;
+                // Use translation string, or the default if no translation is found for this error code
+                guacTranslate(errorName, 'CLIENT.ERROR_UPLOAD_DEFAULT').then(
+                    translationResult => $scope.translatedErrorMessage = translationResult.message
+                );
 
-            };
+            });
 
         }] // end file transfer controller
 
diff --git a/guacamole/src/main/frontend/src/app/client/services/guacTranslate.js b/guacamole/src/main/frontend/src/app/client/services/guacTranslate.js
new file mode 100644
index 000000000..f280e81d7
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/client/services/guacTranslate.js
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * A wrapper around the angular-translate $translate service that offers a
+ * convenient way to fall back to a default translation if the requested
+ * translation is not available.
+ */
+ angular.module('client').factory('guacTranslate', ['$injector', function guacTranslate($injector) {
+
+    // Required services
+    const $q = $injector.get('$q');
+    const $translate = $injector.get('$translate');
+
+    // Required types
+    const TranslationResult = $injector.get('TranslationResult');
+
+    /**
+     * Returns a promise that will be resolved with a TranslationResult containg either the
+     * requested ID and message (if translated), or the default ID and message if translated,
+     * or the literal value of `defaultTranslationId` for both the ID and message if neither
+     * is translated.
+     *
+     * @param {String} translationId
+     *     The requested translation ID, which may or may not be translated.
+     *
+     * @param {Sting} defaultTranslationId
+     *     The translation ID that will be used if no translation is found for `translationId`.
+     *
+     * @returns {Promise.<TranslationResult>}
+     *     A promise which resolves with a TranslationResult containing the results from
+     *     the translation attempt.
+     */
+    function translateWithFallback(translationId, defaultTranslationId) {
+        const deferredTranslation = $q.defer();
+
+        // Attempt to translate the requested translation ID
+        $translate(translationId).then(
+
+            // If the requested translation is available, use that
+            translation => deferredTranslation.resolve(new TranslationResult({
+                id: translationId, message: translation
+            })),
+
+            // Otherwise, try the default translation ID
+            () => $translate(defaultTranslationId).then(
+
+                // Default translation worked, so use that
+                defaultTranslation =>
+                    deferredTranslation.resolve(new TranslationResult({
+                        id: defaultTranslationId, message: defaultTranslation
+                    })),
+
+                // Neither translation is available; as a fallback, return default ID for both
+                () => deferredTranslation.resolve(new TranslationResult({
+                    id: defaultTranslationId, message: defaultTranslationId
+                })),
+            )
+        );
+
+        return deferredTranslation.promise;
+    };
+
+    return translateWithFallback;
+
+}]);
diff --git a/guacamole/src/main/frontend/src/app/client/templates/guacFileTransfer.html b/guacamole/src/main/frontend/src/app/client/templates/guacFileTransfer.html
index dd96baaf4..32ead84e2 100644
--- a/guacamole/src/main/frontend/src/app/client/templates/guacFileTransfer.html
+++ b/guacamole/src/main/frontend/src/app/client/templates/guacFileTransfer.html
@@ -10,7 +10,7 @@
         </div>
 
         <!-- Error text -->
-        <p class="error-text">{{getErrorText() | translate}}</p>
+        <p class="error-text">{{translatedErrorMessage}}</p>
 
     </div>
 
diff --git a/guacamole/src/main/frontend/src/app/client/types/TranslationResult.js b/guacamole/src/main/frontend/src/app/client/types/TranslationResult.js
new file mode 100644
index 000000000..0a81511bb
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/client/types/TranslationResult.js
@@ -0,0 +1,59 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Provides the TranslationResult class used by the guacTranslate service. This class contains
+ * both the translated message and the translation ID that generated the message, in the case
+ * where it's unknown whether a translation is defined or not.
+ */
+ angular.module('client').factory('TranslationResult', [function defineTranslationResult() {
+
+    /**
+     * Object which represents the result of a translation as returned from
+     * the guacTranslate service.
+     *
+     * @constructor
+     * @param {TranslationResult|Object} [template={}]
+     *     The object whose properties should be copied within the new
+     *     TranslationResult.
+     */
+    const TranslationResult = function TranslationResult(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * The translation ID.
+         *
+         * @type {String}
+         */
+        this.id = template.id;
+
+        /**
+         * The translated message.
+         *
+         * @type {String}
+         */
+        this.message = template.message;
+
+    };
+
+    return TranslationResult;
+
+}]);
\ No newline at end of file

From f93015f295e667b6fe8ff7a9eb1910a9e1ade517 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 31 Mar 2022 00:10:13 +0000
Subject: [PATCH 010/289] GUACAMOLE-1571: Match convention for function
 services.

---
 .../src/main/frontend/src/app/client/services/guacTranslate.js  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/app/client/services/guacTranslate.js b/guacamole/src/main/frontend/src/app/client/services/guacTranslate.js
index f280e81d7..c7fe8e9ff 100644
--- a/guacamole/src/main/frontend/src/app/client/services/guacTranslate.js
+++ b/guacamole/src/main/frontend/src/app/client/services/guacTranslate.js
@@ -47,7 +47,7 @@
      *     A promise which resolves with a TranslationResult containing the results from
      *     the translation attempt.
      */
-    function translateWithFallback(translationId, defaultTranslationId) {
+    var translateWithFallback = function translateWithFallback(translationId, defaultTranslationId) {
         const deferredTranslation = $q.defer();
 
         // Attempt to translate the requested translation ID

From 3071bb157733a3d4c3c111967c1061a9ae1df7a9 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 8 Apr 2022 21:48:33 +0000
Subject: [PATCH 011/289] GUACAMOLE-1579: Stop including the auth token when
 making requests to the /api/patches endpoint.

---
 .../main/frontend/src/app/rest/services/patchService.js  | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/rest/services/patchService.js b/guacamole/src/main/frontend/src/app/rest/services/patchService.js
index 991a54a52..ea06e5b40 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/patchService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/patchService.js
@@ -25,17 +25,16 @@ angular.module('rest').factory('patchService', ['$injector',
 
     // Required services
     var requestService        = $injector.get('requestService');
-    var authenticationService = $injector.get('authenticationService');
     var cacheService          = $injector.get('cacheService');
 
     var service = {};
-    
+
     /**
      * Makes a request to the REST API to get the list of patches, returning
      * a promise that provides the array of all applicable patches if
      * successful. Each patch is a string of raw HTML with meta information
      * describing the patch operation stored within meta tags.
-     *                          
+     *
      * @returns {Promise.<String[]>}
      *     A promise which will resolve with an array of HTML patches upon
      *     success.
@@ -43,14 +42,14 @@ angular.module('rest').factory('patchService', ['$injector',
     service.getPatches = function getPatches() {
 
         // Retrieve all applicable HTML patches
-        return authenticationService.request({
+        return requestService({
             cache   : cacheService.patches,
             method  : 'GET',
             url     : 'api/patches'
         });
 
     };
-    
+
     return service;
 
 }]);

From ed390839d76bd8a57e18bec01d3f2a3ea60ada53 Mon Sep 17 00:00:00 2001
From: Dustin Lang <dstndstn@gmail.com>
Date: Mon, 18 Apr 2022 14:44:27 -0400
Subject: [PATCH 012/289] GUACAMOLE-1584: add CSS ids to section headers on
 home page

---
 guacamole/src/main/frontend/src/app/home/templates/home.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/home/templates/home.html b/guacamole/src/main/frontend/src/app/home/templates/home.html
index b2b3db5bd..06c0f2211 100644
--- a/guacamole/src/main/frontend/src/app/home/templates/home.html
+++ b/guacamole/src/main/frontend/src/app/home/templates/home.html
@@ -4,14 +4,14 @@
 
         <!-- The recent connections for this user -->
         <div class="header">
-            <h2>{{'HOME.SECTION_HEADER_RECENT_CONNECTIONS' | translate}}</h2>
+            <h2 id="section-header-recent-connections">{{'HOME.SECTION_HEADER_RECENT_CONNECTIONS' | translate}}</h2>
             <guac-user-menu></guac-user-menu>
         </div>
         <guac-recent-connections root-groups="rootConnectionGroups"></guac-recent-connections>
 
         <!-- All connections for this user -->
         <div class="header">
-            <h2>{{'HOME.SECTION_HEADER_ALL_CONNECTIONS' | translate}}</h2>
+            <h2 id="section-header-all-connections">{{'HOME.SECTION_HEADER_ALL_CONNECTIONS' | translate}}</h2>
             <guac-group-list-filter connection-groups="rootConnectionGroups"
                 filtered-connection-groups="filteredRootConnectionGroups"
                 placeholder="'HOME.FIELD_PLACEHOLDER_FILTER' | translate"

From 4b6629fa3fcfc9f66b0cdbb311377ea8c926b910 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 2 May 2022 18:49:00 +0000
Subject: [PATCH 013/289] GUACAMOLE-1594: Update jackson-databind to 2.13.2.1
 and bump other dependencies as needed.

---
 doc/licenses/jackson-2.13.1/dep-coordinates.txt           | 5 -----
 doc/licenses/{jackson-2.13.1 => jackson-2.13.2}/NOTICE    | 0
 doc/licenses/{jackson-2.13.1 => jackson-2.13.2}/README    | 2 +-
 doc/licenses/jackson-2.13.2/dep-coordinates.txt           | 4 ++++
 doc/licenses/jackson-databind-2.13.2.1/NOTICE             | 4 ++++
 doc/licenses/jackson-databind-2.13.2.1/README             | 8 ++++++++
 .../jackson-databind-2.13.2.1/dep-coordinates.txt         | 1 +
 doc/licenses/snakeyaml-1.27/README                        | 8 --------
 doc/licenses/snakeyaml-1.27/dep-coordinates.txt           | 1 -
 doc/licenses/snakeyaml-1.28/dep-coordinates.txt           | 1 -
 doc/licenses/{snakeyaml-1.28 => snakeyaml-1.30}/README    | 2 +-
 doc/licenses/snakeyaml-1.30/dep-coordinates.txt           | 1 +
 pom.xml                                                   | 5 +++--
 13 files changed, 23 insertions(+), 19 deletions(-)
 delete mode 100644 doc/licenses/jackson-2.13.1/dep-coordinates.txt
 rename doc/licenses/{jackson-2.13.1 => jackson-2.13.2}/NOTICE (100%)
 rename doc/licenses/{jackson-2.13.1 => jackson-2.13.2}/README (90%)
 create mode 100644 doc/licenses/jackson-2.13.2/dep-coordinates.txt
 create mode 100644 doc/licenses/jackson-databind-2.13.2.1/NOTICE
 create mode 100644 doc/licenses/jackson-databind-2.13.2.1/README
 create mode 100644 doc/licenses/jackson-databind-2.13.2.1/dep-coordinates.txt
 delete mode 100644 doc/licenses/snakeyaml-1.27/README
 delete mode 100644 doc/licenses/snakeyaml-1.27/dep-coordinates.txt
 delete mode 100644 doc/licenses/snakeyaml-1.28/dep-coordinates.txt
 rename doc/licenses/{snakeyaml-1.28 => snakeyaml-1.30}/README (91%)
 create mode 100644 doc/licenses/snakeyaml-1.30/dep-coordinates.txt

diff --git a/doc/licenses/jackson-2.13.1/dep-coordinates.txt b/doc/licenses/jackson-2.13.1/dep-coordinates.txt
deleted file mode 100644
index f2cbd8d67..000000000
--- a/doc/licenses/jackson-2.13.1/dep-coordinates.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-com.fasterxml.jackson.core:jackson-databind:jar:2.13.1
-com.fasterxml.jackson.core:jackson-core:jar:2.13.1
-com.fasterxml.jackson.core:jackson-annotations:jar:2.13.1
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.13.1
-com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:2.13.1
diff --git a/doc/licenses/jackson-2.13.1/NOTICE b/doc/licenses/jackson-2.13.2/NOTICE
similarity index 100%
rename from doc/licenses/jackson-2.13.1/NOTICE
rename to doc/licenses/jackson-2.13.2/NOTICE
diff --git a/doc/licenses/jackson-2.13.1/README b/doc/licenses/jackson-2.13.2/README
similarity index 90%
rename from doc/licenses/jackson-2.13.1/README
rename to doc/licenses/jackson-2.13.2/README
index 5e5ce8eb1..1b2e7efc6 100644
--- a/doc/licenses/jackson-2.13.1/README
+++ b/doc/licenses/jackson-2.13.2/README
@@ -1,7 +1,7 @@
 Jackson (https://github.com/FasterXML/jackson)
 ----------------------------------------------
 
-    Version: 2.13.1
+    Version: 2.13.2
     From: 'FasterXML, LLC' (https://github.com/FasterXML)
     License(s):
         Apache v2.0
diff --git a/doc/licenses/jackson-2.13.2/dep-coordinates.txt b/doc/licenses/jackson-2.13.2/dep-coordinates.txt
new file mode 100644
index 000000000..5a8f7cabc
--- /dev/null
+++ b/doc/licenses/jackson-2.13.2/dep-coordinates.txt
@@ -0,0 +1,4 @@
+com.fasterxml.jackson.core:jackson-core:jar:2.13.2
+com.fasterxml.jackson.core:jackson-annotations:jar:2.13.2
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.13.2
+com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:2.13.2
diff --git a/doc/licenses/jackson-databind-2.13.2.1/NOTICE b/doc/licenses/jackson-databind-2.13.2.1/NOTICE
new file mode 100644
index 000000000..e0b3fa0ed
--- /dev/null
+++ b/doc/licenses/jackson-databind-2.13.2.1/NOTICE
@@ -0,0 +1,4 @@
+Jackson is a high-performance, Free/Open Source JSON processing library.
+It was originally written by Tatu Saloranta (tatu.saloranta@iki.fi), and has
+been in development since 2007.
+It is currently developed by a community of developers.
diff --git a/doc/licenses/jackson-databind-2.13.2.1/README b/doc/licenses/jackson-databind-2.13.2.1/README
new file mode 100644
index 000000000..41d421838
--- /dev/null
+++ b/doc/licenses/jackson-databind-2.13.2.1/README
@@ -0,0 +1,8 @@
+Jackson-databind (https://github.com/FasterXML/jackson-databind)
+----------------------------------------------
+
+    Version: 2.13.2.1
+    From: 'FasterXML, LLC' (https://github.com/FasterXML)
+    License(s):
+        Apache v2.0
+
diff --git a/doc/licenses/jackson-databind-2.13.2.1/dep-coordinates.txt b/doc/licenses/jackson-databind-2.13.2.1/dep-coordinates.txt
new file mode 100644
index 000000000..c35811fd8
--- /dev/null
+++ b/doc/licenses/jackson-databind-2.13.2.1/dep-coordinates.txt
@@ -0,0 +1 @@
+com.fasterxml.jackson.core:jackson-databind:jar:2.13.2.1
diff --git a/doc/licenses/snakeyaml-1.27/README b/doc/licenses/snakeyaml-1.27/README
deleted file mode 100644
index 3fcd837d6..000000000
--- a/doc/licenses/snakeyaml-1.27/README
+++ /dev/null
@@ -1,8 +0,0 @@
-SnakeYAML (https://bitbucket.org/asomov/snakeyaml/)
----------------------------------------------------
-
-    Version: 1.27
-    From: 'Andrey Somov' (https://bitbucket.org/asomov/)
-    License(s):
-        Apache v2.0
-
diff --git a/doc/licenses/snakeyaml-1.27/dep-coordinates.txt b/doc/licenses/snakeyaml-1.27/dep-coordinates.txt
deleted file mode 100644
index d7cbad91a..000000000
--- a/doc/licenses/snakeyaml-1.27/dep-coordinates.txt
+++ /dev/null
@@ -1 +0,0 @@
-org.yaml:snakeyaml:jar:1.27
diff --git a/doc/licenses/snakeyaml-1.28/dep-coordinates.txt b/doc/licenses/snakeyaml-1.28/dep-coordinates.txt
deleted file mode 100644
index 614b28b37..000000000
--- a/doc/licenses/snakeyaml-1.28/dep-coordinates.txt
+++ /dev/null
@@ -1 +0,0 @@
-org.yaml:snakeyaml:jar:1.28
diff --git a/doc/licenses/snakeyaml-1.28/README b/doc/licenses/snakeyaml-1.30/README
similarity index 91%
rename from doc/licenses/snakeyaml-1.28/README
rename to doc/licenses/snakeyaml-1.30/README
index e89d2a8c3..6d0335f75 100644
--- a/doc/licenses/snakeyaml-1.28/README
+++ b/doc/licenses/snakeyaml-1.30/README
@@ -1,7 +1,7 @@
 SnakeYAML (https://bitbucket.org/snakeyaml/snakeyaml/
 -----------------------------------------------------
 
-    Version: 1.28
+    Version: 1.30
     From: 'Andrey Somov' (https://bitbucket.org/asomov/)
     License(s):
         Apache v2.0
diff --git a/doc/licenses/snakeyaml-1.30/dep-coordinates.txt b/doc/licenses/snakeyaml-1.30/dep-coordinates.txt
new file mode 100644
index 000000000..d158332f3
--- /dev/null
+++ b/doc/licenses/snakeyaml-1.30/dep-coordinates.txt
@@ -0,0 +1 @@
+org.yaml:snakeyaml:jar:1.30
diff --git a/pom.xml b/pom.xml
index 2dd057056..2ba032085 100644
--- a/pom.xml
+++ b/pom.xml
@@ -39,7 +39,8 @@
         <guava.version>31.0.1-jre</guava.version>
         <guice.version>5.0.1</guice.version>
         <hk2.version>2.6.1</hk2.version>
-        <jackson.version>2.13.1</jackson.version>
+        <jackson.version>2.13.2</jackson.version>
+        <jackson-databind.version>2.13.2.1</jackson-databind.version>
         <jersey.version>2.35</jersey.version>
         <junit.version>5.8.2</junit.version>
         <junit4.version>4.13.2</junit4.version>
@@ -375,7 +376,7 @@
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-databind</artifactId>
-                <version>${jackson.version}</version>
+                <version>${jackson-databind.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.dataformat</groupId>

From d6db8fac7ea01d8a6a4a8c2b8bc84b66be4fb471 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Fri, 23 Jul 2021 23:45:12 -0700
Subject: [PATCH 014/289] GUACAMOLE-377: Flush frames asynchronously with
 requestAnimationFrame() if possible.

---
 .../src/main/webapp/modules/Display.js        | 87 ++++++++++++++++++-
 1 file changed, 85 insertions(+), 2 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/Display.js b/guacamole-common-js/src/main/webapp/modules/Display.js
index 8baa6b7d7..be01e8353 100644
--- a/guacamole-common-js/src/main/webapp/modules/Display.js
+++ b/guacamole-common-js/src/main/webapp/modules/Display.js
@@ -163,10 +163,28 @@ Guacamole.Display = function() {
     var frames = [];
 
     /**
-     * Flushes all pending frames.
+     * The ID of the animation frame request returned by the last call to
+     * requestAnimationFrame(). This value will only be set if the browser
+     * supports requestAnimationFrame(), if a frame render is currently
+     * pending, and if the current browser tab is currently focused (likely to
+     * handle requests for animation frames). In all other cases, this will be
+     * null.
+     *
+     * @private
+     * @type {number}
+     */
+    var inProgressFrame = null;
+
+    /**
+     * Flushes all pending frames synchronously. This function will block until
+     * all pending frames have rendered. If a frame is currently blocked by an
+     * asynchronous operation like an image load, this function will return
+     * after reaching that operation and the flush operation will
+     * automamtically resume after that operation completes.
+     *
      * @private
      */
-    function __flush_frames() {
+    var syncFlush = function syncFlush() {
 
         var rendered_frames = 0;
 
@@ -185,6 +203,71 @@ Guacamole.Display = function() {
         // Remove rendered frames from array
         frames.splice(0, rendered_frames);
 
+    };
+
+    /**
+     * Flushes all pending frames asynchronously. This function returns
+     * immediately, relying on requestAnimationFrame() to dictate when each
+     * frame should be flushed.
+     *
+     * @private
+     */
+    var asyncFlush = function asyncFlush() {
+
+        var continueFlush = function continueFlush() {
+
+            // We're no longer waiting to render a frame
+            inProgressFrame = null;
+
+            // Nothing to do if there are no frames remaining
+            if (!frames.length)
+                return;
+
+            // Flush the next frame only if it is ready (not awaiting
+            // completion of some asynchronous operation like an image load)
+            if (frames[0].isReady())
+                frames.shift().flush();
+
+            // Request yet another animation frame if frames remain to be
+            // flushed
+            if (frames.length)
+                inProgressFrame = window.requestAnimationFrame(continueFlush);
+
+        };
+
+        // Begin flushing frames if not already waiting to render a frame
+        if (!inProgressFrame)
+            inProgressFrame = window.requestAnimationFrame(continueFlush);
+
+    };
+
+    // Switch from asynchronous frame handling to synchronous frame handling if
+    // requestAnimationFrame() is unlikely to be usable (browsers may not
+    // invoke the animation frame callback if the relevant tab is not focused)
+    window.addEventListener('blur', function switchToSyncFlush() {
+        if (inProgressFrame && !document.hasFocus()) {
+
+            // Cancel pending asynchronous processing of frame ...
+            window.cancelAnimationFrame(inProgressFrame);
+            inProgressFrame = null;
+
+            // ... and instead process it synchronously
+            syncFlush();
+
+        }
+    }, true);
+
+    /**
+     * Flushes all pending frames.
+     * @private
+     */
+    function __flush_frames() {
+
+        if (window.requestAnimationFrame && document.hasFocus())
+            asyncFlush();
+        else
+            syncFlush();
+
     }
 
     /**

From 93d97e8c9713bcb4f771082c2afaa50037c78ac2 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 2 Sep 2021 17:34:07 -0700
Subject: [PATCH 015/289] GUACAMOLE-377: Add parameter definition and
 translation for "enable-gfx".

---
 .../main/resources/org/apache/guacamole/protocols/rdp.json   | 5 +++++
 guacamole/src/main/frontend/src/translations/en.json         | 1 +
 2 files changed, 6 insertions(+)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
index e78313d79..77855f3db 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
@@ -254,6 +254,11 @@
         {
             "name" : "performance",
             "fields" : [
+                {
+                    "name"    : "enable-gfx",
+                    "type"    : "BOOLEAN",
+                    "options" : [ "true" ]
+                },
                 {
                     "name"    : "enable-wallpaper",
                     "type"    : "BOOLEAN",
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index db502311d..3ee46a313 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -490,6 +490,7 @@
         "FIELD_HEADER_ENABLE_DRIVE"               : "Enable drive:",
         "FIELD_HEADER_ENABLE_FONT_SMOOTHING"      : "Enable font smoothing (ClearType):",
         "FIELD_HEADER_ENABLE_FULL_WINDOW_DRAG"    : "Enable full-window drag:",
+        "FIELD_HEADER_ENABLE_GFX"                 : "Enable Graphics Pipeline Extension (RemoteFX):",
         "FIELD_HEADER_ENABLE_MENU_ANIMATIONS"     : "Enable menu animations:",
         "FIELD_HEADER_DISABLE_BITMAP_CACHING"     : "Disable bitmap caching:",
         "FIELD_HEADER_DISABLE_OFFSCREEN_CACHING"  : "Disable off-screen caching:",

From e5dccc865724efd45d871cc1bc9488cc0c9791c2 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Fri, 3 Sep 2021 00:25:27 -0700
Subject: [PATCH 016/289] GUACAMOLE-377: Add JavaScript API support for
 tracking display render statistics.

---
 .../src/main/webapp/modules/Client.js         |  11 +-
 .../src/main/webapp/modules/Display.js        | 264 +++++++++++++++++-
 2 files changed, 267 insertions(+), 8 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/Client.js b/guacamole-common-js/src/main/webapp/modules/Client.js
index 83d89abaa..2cc9c28b1 100644
--- a/guacamole-common-js/src/main/webapp/modules/Client.js
+++ b/guacamole-common-js/src/main/webapp/modules/Client.js
@@ -840,6 +840,12 @@ Guacamole.Client = function(tunnel) {
      * @event
      * @param {!number} timestamp
      *     The timestamp associated with the sync instruction.
+     *
+     * @param {!number} frames
+     *     The number of frames that were considered or combined to produce the
+     *     frame associated with this sync instruction, or zero if this value
+     *     is not known or the remote desktop server provides no concept of
+     *     frames.
      */
     this.onsync = null;
 
@@ -1530,6 +1536,7 @@ Guacamole.Client = function(tunnel) {
         "sync": function(parameters) {
 
             var timestamp = parseInt(parameters[0]);
+            var frames = parameters[1] ? parseInt(parameters[1]) : 0;
 
             // Flush display, send sync when done
             display.flush(function displaySyncComplete() {
@@ -1547,7 +1554,7 @@ Guacamole.Client = function(tunnel) {
                     currentTimestamp = timestamp;
                 }
 
-            });
+            }, timestamp, frames);
 
             // If received first update, no longer waiting.
             if (currentState === STATE_WAITING)
@@ -1555,7 +1562,7 @@ Guacamole.Client = function(tunnel) {
 
             // Call sync handler if defined
             if (guac_client.onsync)
-                guac_client.onsync(timestamp);
+                guac_client.onsync(timestamp, frames);
 
         },
 
diff --git a/guacamole-common-js/src/main/webapp/modules/Display.js b/guacamole-common-js/src/main/webapp/modules/Display.js
index be01e8353..374a7620d 100644
--- a/guacamole-common-js/src/main/webapp/modules/Display.js
+++ b/guacamole-common-js/src/main/webapp/modules/Display.js
@@ -112,6 +112,17 @@ Guacamole.Display = function() {
      */
     this.cursorY = 0;
 
+    /**
+     * The number of milliseconds over which display rendering statistics
+     * should be gathered, dispatching {@link #onstatistics} events as those
+     * statistics are available. If set to zero, no statistics will be
+     * gathered.
+     *
+     * @default 0
+     * @type {!number}
+     */
+    this.statisticWindow = 0;
+
     /**
      * Fired when the default layer (and thus the entire Guacamole display)
      * is resized.
@@ -142,6 +153,18 @@ Guacamole.Display = function() {
      */
     this.oncursor = null;
 
+    /**
+     * Fired whenever performance statistics are available for recently-
+     * rendered frames. This event will fire only if {@link #statisticWindow}
+     * is non-zero.
+     *
+     * @event
+     * @param {!Guacamole.Display.Statistics} stats
+     *     An object containing general rendering performance statistics for
+     *     the remote desktop, Guacamole server, and Guacamole client.
+     */
+    this.onstatistics = null;
+
     /**
      * The queue of all pending Tasks. Tasks will be run in order, with new
      * tasks added at the end of the queue and old tasks removed from the
@@ -186,6 +209,10 @@ Guacamole.Display = function() {
      */
     var syncFlush = function syncFlush() {
 
+        var localTimestamp = 0;
+        var remoteTimestamp = 0;
+
+        var renderedLogicalFrames = 0;
         var rendered_frames = 0;
 
         // Draw all pending frames, if ready
@@ -196,6 +223,10 @@ Guacamole.Display = function() {
                 break;
 
             frame.flush();
+
+            localTimestamp = frame.localTimestamp;
+            remoteTimestamp = frame.remoteTimestamp;
+            renderedLogicalFrames += frame.logicalFrames;
             rendered_frames++;
 
         } 
@@ -203,6 +234,9 @@ Guacamole.Display = function() {
         // Remove rendered frames from array
         frames.splice(0, rendered_frames);
 
+        if (rendered_frames)
+            notifyFlushed(localTimestamp, remoteTimestamp, renderedLogicalFrames);
+
     };
 
     /**
@@ -225,8 +259,11 @@ Guacamole.Display = function() {
 
             // Flush the next frame only if it is ready (not awaiting
             // completion of some asynchronous operation like an image load)
-            if (frames[0].isReady())
-                frames.shift().flush();
+            if (frames[0].isReady()) {
+                var frame = frames.shift();
+                frame.flush();
+                notifyFlushed(frame.localTimestamp, frame.remoteTimestamp, frame.logicalFrames);
+            }
 
             // Request yet another animation frame if frames remain to be
             // flushed
@@ -241,6 +278,101 @@ Guacamole.Display = function() {
 
     };
 
+    /**
+     * Recently-gathered display render statistics, as made available by calls
+     * to notifyFlushed(). The contents of this array will be trimmed to
+     * contain only up to {@link #statisticWindow} milliseconds of statistics.
+     *
+     * @private
+     * @type {Guacamole.Display.Statistics[]}
+     */
+    var statistics = [];
+
+    /**
+     * Notifies that one or more frames have been successfully rendered
+     * (flushed) to the display.
+     *
+     * @private
+     * @param {!number} localTimestamp
+     *     The local timestamp of the point in time at which the most recent,
+     *     flushed frame was received by the display, in milliseconds since the
+     *     Unix Epoch.
+     *
+     * @param {!number} remoteTimestamp
+     *     The remote timestamp of sync instruction associated with the most
+     *     recent, flushed frame received by the display. This timestamp is in
+     *     milliseconds, but is arbitrary, having meaning only relative to
+     *     other timestamps in the same connection.
+     *
+     * @param {!number} logicalFrames
+     *     The number of remote desktop frames that were flushed.
+     */
+    var notifyFlushed = function notifyFlushed(localTimestamp, remoteTimestamp, logicalFrames) {
+
+        // Ignore if statistics are not being gathered
+        if (!guac_display.statisticWindow)
+            return;
+
+        var current = new Date().getTime();
+
+        // Find the first statistic that is still within the configured time
+        // window
+        for (var first = 0; first < statistics.length; first++) {
+            if (current - statistics[first].timestamp <= guac_display.statisticWindow)
+                break;
+        }
+
+        // Remove all statistics except those within the time window
+        statistics.splice(0, first - 1);
+
+        // Record statistics for latest frame
+        statistics.push({
+            localTimestamp : localTimestamp,
+            remoteTimestamp : remoteTimestamp,
+            timestamp : current,
+            frames : logicalFrames
+        });
+
+        // Determine the actual time interval of the available statistics (this
+        // will not perfectly match the configured interval, which is an upper
+        // bound)
+        var statDuration = (statistics[statistics.length - 1].timestamp - statistics[0].timestamp) / 1000;
+
+        // Determine the amount of time that elapsed remotely (within the
+        // remote desktop)
+        var remoteDuration = (statistics[statistics.length - 1].remoteTimestamp - statistics[0].remoteTimestamp) / 1000;
+
+        // Calculate the number of frames that have been rendered locally
+        // within the configured time interval
+        var localFrames = statistics.length;
+
+        // Calculate the number of frames actually received from the remote
+        // desktop by the Guacamole server
+        var remoteFrames = statistics.reduce(function sumFrames(prev, stat) {
+            return prev + stat.frames;
+        }, 0);
+
+        // Calculate the number of frames that the Guacamole server had to
+        // drop or combine with other frames
+        var drops = statistics.reduce(function sumDrops(prev, stat) {
+            return prev + Math.max(0, stat.frames - 1);
+        }, 0);
+
+        // Produce lag and FPS statistics from above raw measurements
+        var stats = new Guacamole.Display.Statistics({
+            processingLag : current - localTimestamp,
+            desktopFps : (remoteDuration && remoteFrames) ? remoteFrames / remoteDuration : null,
+            clientFps : statDuration ? localFrames / statDuration : null,
+            serverFps : remoteDuration ? localFrames / remoteDuration : null,
+            dropRate : remoteDuration ? drops / remoteDuration : null
+        });
+
+        // Notify of availability of new statistics
+        if (guac_display.onstatistics)
+            guac_display.onstatistics(stats);
+
+    };
+
     // Switch from asynchronous frame handling to synchronous frame handling if
     // requestAnimationFrame() is unlikely to be usable (browsers may not
     // invoke the animation frame callback if the relevant tab is not focused)
@@ -281,8 +413,43 @@ Guacamole.Display = function() {
      *
      * @param {!Task[]} tasks
      *     The set of tasks which must be executed to render this frame.
+     *
+     * @param {number} [timestamp]
+     *     The remote timestamp of sync instruction associated with this frame.
+     *     This timestamp is in milliseconds, but is arbitrary, having meaning
+     *     only relative to other remote timestamps in the same connection. If
+     *     omitted, a compatible but local timestamp will be used instead.
+     *
+     * @param {number} [logicalFrames=0]
+     *     The number of remote desktop frames that were combined to produce
+     *     this frame, or zero if this value is unknown or inapplicable.
      */
-    function Frame(callback, tasks) {
+    var Frame = function Frame(callback, tasks, timestamp, logicalFrames) {
+
+        /**
+         * The local timestamp of the point in time at which this frame was
+         * received by the display, in milliseconds since the Unix Epoch.
+         *
+         * @type {!number}
+         */
+        this.localTimestamp = new Date().getTime();
+
+        /**
+         * The remote timestamp of sync instruction associated with this frame.
+         * This timestamp is in milliseconds, but is arbitrary, having meaning
+         * only relative to other remote timestamps in the same connection.
+         *
+         * @type {!number}
+         */
+        this.remoteTimestamp = timestamp || this.localTimestamp;
+
+        /**
+         * The number of remote desktop frames that were combined to produce
+         * this frame. If unknown or not applicable, this will be zero.
+         *
+         * @type {!number}
+         */
+        this.logicalFrames = logicalFrames || 0;
 
         /**
          * Cancels rendering of this frame and all associated tasks. The
@@ -337,7 +504,7 @@ Guacamole.Display = function() {
 
         };
 
-    }
+    };
 
     /**
      * A container for an task handler. Each operation which must be ordered
@@ -514,11 +681,20 @@ Guacamole.Display = function() {
      * @param {function} [callback]
      *     The function to call when this frame is flushed. This may happen
      *     immediately, or later when blocked tasks become unblocked.
+     *
+     * @param {number} timestamp
+     *     The remote timestamp of sync instruction associated with this frame.
+     *     This timestamp is in milliseconds, but is arbitrary, having meaning
+     *     only relative to other remote timestamps in the same connection.
+     *
+     * @param {number} logicalFrames
+     *     The number of remote desktop frames that were combined to produce
+     *     this frame.
      */
-    this.flush = function(callback) {
+    this.flush = function(callback, timestamp, logicalFrames) {
 
         // Add frame, reset tasks
-        frames.push(new Frame(callback, tasks));
+        frames.push(new Frame(callback, tasks, timestamp, logicalFrames));
         tasks = [];
 
         // Attempt flush
@@ -1938,3 +2114,79 @@ Guacamole.Display.VisibleLayer = function(width, height) {
  * @type {!number}
  */
 Guacamole.Display.VisibleLayer.__next_id = 0;
+
+/**
+ * A set of Guacamole display performance statistics, describing the speed at
+ * which the remote desktop, Guacamole server, and Guacamole client are
+ * rendering frames.
+ *
+ * @constructor
+ * @param {Guacamole.Display.Statistics|Object} [template={}]
+ *     The object whose properties should be copied within the new
+ *     Guacamole.Display.Statistics.
+ */
+Guacamole.Display.Statistics = function Statistics(template) {
+
+    template = template || {};
+
+    /**
+     * The amount of time that the Guacamole client is taking to render
+     * individual frames, in milliseconds, if known. If this value is unknown,
+     * such as if the there are insufficient frame statistics recorded to
+     * calculate this value, this will be null.
+     *
+     * @type {?number}
+     */
+    this.processingLag = template.processingLag;
+
+    /**
+     * The framerate of the remote desktop currently being viewed within the
+     * relevant Gucamole.Display, independent of Guacamole, in frames per
+     * second. This represents the speed at which the remote desktop is
+     * producing frame data for the Guacamole server to consume. If this
+     * value is unknown, such as if the remote desktop server does not actually
+     * define frame boundaries, this will be null.
+     *
+     * @type {?number}
+     */
+    this.desktopFps = template.desktopFps;
+
+    /**
+     * The rate at which the Guacamole server is generating frames for the
+     * Guacamole client to consume, in frames per second. If the Guacamole
+     * server is correctly adjusting for variance in client/browser processing
+     * power, this rate should closely match the client rate, and should remain
+     * independent of any network latency. If this value is unknown, such as if
+     * the there are insufficient frame statistics recorded to calculate this
+     * value, this will be null.
+     *
+     * @type {?number}
+     */
+    this.serverFps = template.serverFps;
+
+    /**
+     * The rate at which the Guacamole client is consuming frames generated by
+     * the Guacamole server, in frames per second. If the Guacamole server is
+     * correctly adjusting for variance in client/browser processing power,
+     * this rate should closely match the server rate, regardless of any
+     * latency on the network between the server and client. If this value is
+     * unknown, such as if the there are insufficient frame statistics recorded
+     * to calculate this value, this will be null.
+     *
+     * @type {?number}
+     */
+    this.clientFps = template.clientFps;
+
+    /**
+     * The rate at which the Guacamole server is dropping or combining frames
+     * received from the remote desktop server to compensate for variance in
+     * client/browser processing power, in frames per second. This value may
+     * also be non-zero if the server is compensating for variances in its own
+     * processing power, or relative slowness in image compression vs. the rate
+     * that inbound frames are received. If this value is unknown, such as if
+     * the remote desktop server does not actually define frame boundaries,
+     * this will be null.
+     */
+    this.dropRate = template.dropRate;
+
+};

From 59ace6c49399c865ff2ca36f61ee937cd7099fc2 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Fri, 3 Sep 2021 00:52:30 -0700
Subject: [PATCH 017/289] GUACAMOLE-377: Add extension for displaying render
 statistics in a toolbar.

---
 .../guacamole-display-statistics/.gitignore   |   1 +
 .../guacamole-display-statistics/.ratignore   |   1 +
 .../guacamole-display-statistics/pom.xml      | 124 ++++++++++++++++++
 .../src/main/assembly/dist.xml                |  53 ++++++++
 .../directives/guacClientStatistics.js        | 108 +++++++++++++++
 .../src/main/resources/guac-manifest.json     |  28 ++++
 .../main/resources/html/add-statistics.html   |   4 +
 .../src/main/resources/license.txt            |  18 +++
 .../resources/styles/clientStatistics.css     |  57 ++++++++
 .../templates/guacClientStatistics.html       |  39 ++++++
 .../src/main/resources/translations/en.json   |  12 ++
 extensions/pom.xml                            |   3 +
 12 files changed, 448 insertions(+)
 create mode 100644 extensions/guacamole-display-statistics/.gitignore
 create mode 100644 extensions/guacamole-display-statistics/.ratignore
 create mode 100644 extensions/guacamole-display-statistics/pom.xml
 create mode 100644 extensions/guacamole-display-statistics/src/main/assembly/dist.xml
 create mode 100644 extensions/guacamole-display-statistics/src/main/resources/directives/guacClientStatistics.js
 create mode 100644 extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
 create mode 100644 extensions/guacamole-display-statistics/src/main/resources/html/add-statistics.html
 create mode 100644 extensions/guacamole-display-statistics/src/main/resources/license.txt
 create mode 100644 extensions/guacamole-display-statistics/src/main/resources/styles/clientStatistics.css
 create mode 100644 extensions/guacamole-display-statistics/src/main/resources/templates/guacClientStatistics.html
 create mode 100644 extensions/guacamole-display-statistics/src/main/resources/translations/en.json

diff --git a/extensions/guacamole-display-statistics/.gitignore b/extensions/guacamole-display-statistics/.gitignore
new file mode 100644
index 000000000..e55f47f1f
--- /dev/null
+++ b/extensions/guacamole-display-statistics/.gitignore
@@ -0,0 +1 @@
+src/main/resources/generated/
diff --git a/extensions/guacamole-display-statistics/.ratignore b/extensions/guacamole-display-statistics/.ratignore
new file mode 100644
index 000000000..da318d12f
--- /dev/null
+++ b/extensions/guacamole-display-statistics/.ratignore
@@ -0,0 +1 @@
+src/main/resources/html/*.html
diff --git a/extensions/guacamole-display-statistics/pom.xml b/extensions/guacamole-display-statistics/pom.xml
new file mode 100644
index 000000000..403d974cf
--- /dev/null
+++ b/extensions/guacamole-display-statistics/pom.xml
@@ -0,0 +1,124 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
+                        http://maven.apache.org/maven-v4_0_0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.apache.guacamole</groupId>
+    <artifactId>guacamole-display-statistics</artifactId>
+    <packaging>jar</packaging>
+    <version>1.4.0</version>
+    <name>guacamole-display-statistics</name>
+    <url>http://guacamole.apache.org/</url>
+
+    <parent>
+        <groupId>org.apache.guacamole</groupId>
+        <artifactId>extensions</artifactId>
+        <version>1.4.0</version>
+        <relativePath>../</relativePath>
+    </parent>
+
+    <build>
+        <plugins>
+
+            <!-- Pre-cache Angular templates with maven-angular-plugin -->
+            <plugin>
+                <groupId>com.keithbranton.mojo</groupId>
+                <artifactId>angular-maven-plugin</artifactId>
+                <version>0.3.4</version>
+                <executions>
+                    <execution>
+                        <phase>generate-resources</phase>
+                        <goals>
+                            <goal>html2js</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <sourceDir>${basedir}/src/main/resources</sourceDir>
+                    <include>**/*.html</include>
+                    <target>${basedir}/src/main/resources/generated/templates-main/templates.js</target>
+                    <prefix>app/ext/display-stats</prefix>
+                </configuration>
+            </plugin>
+
+            <!-- JS/CSS Minification Plugin -->
+            <plugin>
+                <groupId>com.github.buckelieg</groupId>
+                <artifactId>minify-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>default-cli</id>
+                        <configuration>
+                            <charset>UTF-8</charset>
+
+                            <webappSourceDir>${basedir}/src/main/resources</webappSourceDir>
+                            <webappTargetDir>${project.build.directory}/classes</webappTargetDir>
+
+                            <cssSourceDir>/</cssSourceDir>
+                            <cssTargetDir>/</cssTargetDir>
+                            <cssFinalFile>display-stats.css</cssFinalFile>
+
+                            <cssSourceFiles>
+                                <cssSourceFile>license.txt</cssSourceFile>
+                            </cssSourceFiles>
+
+                            <cssSourceIncludes>
+                                <cssSourceInclude>**/*.css</cssSourceInclude>
+                            </cssSourceIncludes>
+
+                            <jsSourceDir>/</jsSourceDir>
+                            <jsTargetDir>/</jsTargetDir>
+                            <jsFinalFile>display-stats.js</jsFinalFile>
+
+                            <jsSourceFiles>
+                                <jsSourceFile>license.txt</jsSourceFile>
+                            </jsSourceFiles>
+
+                            <jsSourceIncludes>
+                                <jsSourceInclude>**/*.js</jsSourceInclude>
+                            </jsSourceIncludes>
+
+                            <!-- Do not minify and include tests -->
+                            <jsSourceExcludes>
+                                <jsSourceExclude>**/*.test.js</jsSourceExclude>
+                            </jsSourceExcludes>
+                            <jsEngine>CLOSURE</jsEngine>
+
+                            <!-- Disable warnings for JSDoc annotations -->
+                            <closureWarningLevels>
+                                <misplacedTypeAnnotation>OFF</misplacedTypeAnnotation>
+                                <nonStandardJsDocs>OFF</nonStandardJsDocs>
+                            </closureWarningLevels>
+
+                        </configuration>
+                        <goals>
+                            <goal>minify</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+
+        </plugins>
+    </build>
+
+</project>
diff --git a/extensions/guacamole-display-statistics/src/main/assembly/dist.xml b/extensions/guacamole-display-statistics/src/main/assembly/dist.xml
new file mode 100644
index 000000000..0b16a7147
--- /dev/null
+++ b/extensions/guacamole-display-statistics/src/main/assembly/dist.xml
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<assembly
+    xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0 http://maven.apache.org/xsd/assembly-1.1.0.xsd">
+    
+    <id>dist</id>
+    <baseDirectory>${project.artifactId}-${project.version}</baseDirectory>
+
+    <!-- Output tar.gz -->
+    <formats>
+        <format>tar.gz</format>
+    </formats>
+
+    <!-- Include licenses and extension .jar -->
+    <fileSets>
+
+        <!-- Include licenses -->
+        <fileSet>
+            <outputDirectory></outputDirectory>
+            <directory>target/licenses</directory>
+        </fileSet>
+
+        <!-- Include extension .jar -->
+        <fileSet>
+            <directory>target</directory>
+            <outputDirectory></outputDirectory>
+            <includes>
+                <include>*.jar</include>
+            </includes>
+        </fileSet>
+
+    </fileSets>
+
+</assembly>
diff --git a/extensions/guacamole-display-statistics/src/main/resources/directives/guacClientStatistics.js b/extensions/guacamole-display-statistics/src/main/resources/directives/guacClientStatistics.js
new file mode 100644
index 000000000..4dc6b8a15
--- /dev/null
+++ b/extensions/guacamole-display-statistics/src/main/resources/directives/guacClientStatistics.js
@@ -0,0 +1,108 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * A directive which displays frame rendering performance statistics for a
+ * Guacamole client.
+ */
+angular.module('client').directive('guacClientStatistics', [function guacClientStatistics() {
+
+    const directive = {
+        restrict: 'E',
+        templateUrl: 'app/ext/display-stats/templates/guacClientStatistics.html',
+    };
+
+    directive.scope = {
+
+        /**
+         * The Guacamole client to display frame rendering statistics for.
+         *
+         * @type ManagedClient
+         */
+        client : '='
+
+    };
+
+    directive.controller = ['$scope', function guacClientStatisticsController($scope) {
+
+        /**
+         * Updates the displayed frame rendering statistics to the values
+         * within the given statistics object.
+         *
+         * @param {!Guacamole.Display.Statistics} stats
+         *     An object containing general rendering performance statistics for
+         *     the remote desktop, Guacamole server, and Guacamole client.
+         */
+        var updateStatistics = function updateStatistics(stats) {
+            $scope.$apply(function statisticsChanged() {
+                $scope.statistics = stats;
+            });
+        };
+
+        /**
+         * Returns whether the given value is a defined value that should be
+         * rendered within the statistics toolbar.
+         *
+         * @param {number} value
+         *     The value to test.
+         *
+         * @returns {!boolean}
+         *     true if the given value should be rendered within the statistics
+         *     toolbar, false otherwise.
+         */
+        $scope.hasValue = function hasValue(value) {
+            return value || value === 0;
+        };
+
+        /**
+         * Rounds the given numeric value to the nearest hundredth (two decimal places).
+         *
+         * @param {!number} value
+         *     The value to round.
+         *
+         * @param {!number}
+         *     The given value, rounded to the nearest hundredth.
+         */
+        $scope.round = function round(value) {
+            return Math.round(value * 100) / 100;
+        };
+
+        // Assign/remove onstatistics handlers to track the statistics of the
+        // current client
+        $scope.$watch('client', function clientChanged(client, oldClient) {
+
+            if (oldClient)
+                oldClient.managedDisplay.display.onstatistics = null;
+
+            client.managedDisplay.display.statisticWindow = 1000;
+            client.managedDisplay.display.onstatistics = updateStatistics;
+
+        });
+
+        // Clear onstatistics handler when directive is being unloaded
+        $scope.$on('$destroy', function scopeDestroyed() {
+            if ($scope.client)
+                $scope.client.managedDisplay.display.onstatistics = null;
+        });
+
+    }];
+
+    return directive;
+
+}]);
diff --git a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
new file mode 100644
index 000000000..71c84b384
--- /dev/null
+++ b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
@@ -0,0 +1,28 @@
+{
+
+    "guacamoleVersion" : "1.4.0",
+
+    "name"      : "Display Statistic Toolbar",
+    "namespace" : "display-stats",
+
+    "translations" : [
+        "translations/en.json"
+    ],
+
+    "js" : [
+        "display-stats.min.js"
+    ],
+
+    "css" : [
+        "display-stats.min.css"
+    ],
+
+    "html" : [
+        "html/add-statistics.html"
+    ],
+
+    "resources" : {
+        "templates/guacClientStatistics.html" : "text/html"
+    }
+
+}
diff --git a/extensions/guacamole-display-statistics/src/main/resources/html/add-statistics.html b/extensions/guacamole-display-statistics/src/main/resources/html/add-statistics.html
new file mode 100644
index 000000000..5978f7f58
--- /dev/null
+++ b/extensions/guacamole-display-statistics/src/main/resources/html/add-statistics.html
@@ -0,0 +1,4 @@
+<meta name="after" content=".client-tile guac-client">
+
+<!-- Guacamole display statistics -->
+<guac-client-statistics client="client"></guac-client-statistics>
diff --git a/extensions/guacamole-display-statistics/src/main/resources/license.txt b/extensions/guacamole-display-statistics/src/main/resources/license.txt
new file mode 100644
index 000000000..042f3ce1f
--- /dev/null
+++ b/extensions/guacamole-display-statistics/src/main/resources/license.txt
@@ -0,0 +1,18 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
diff --git a/extensions/guacamole-display-statistics/src/main/resources/styles/clientStatistics.css b/extensions/guacamole-display-statistics/src/main/resources/styles/clientStatistics.css
new file mode 100644
index 000000000..ba4661469
--- /dev/null
+++ b/extensions/guacamole-display-statistics/src/main/resources/styles/clientStatistics.css
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+guac-client-statistics {
+    font-size: 13px;
+    color: white;
+    background: #111;
+}
+
+guac-client-statistics dl.client-statistics {
+    display: table;
+    margin: 0;
+    padding: 0.25em;
+}
+
+guac-client-statistics dl.client-statistics dt,
+guac-client-statistics dl.client-statistics dd {
+    display: table-cell;
+    padding: 0.25em;
+}
+
+guac-client-statistics dl.client-statistics dt {
+    padding-right: 0.5em;
+    padding-left: 1em;
+}
+
+guac-client-statistics dl.client-statistics dt:first-child {
+    padding-left: 0.5em;
+}
+
+guac-client-statistics dl.client-statistics dd {
+    min-width: 6em;
+    border: 1px solid rgba(255, 255, 255, 0.125);
+    border-radius: 3px;
+    background: black;
+}
+
+guac-client-statistics dl.client-statistics dd.no-value::before {
+    color: #888;
+    content: '-';
+}
diff --git a/extensions/guacamole-display-statistics/src/main/resources/templates/guacClientStatistics.html b/extensions/guacamole-display-statistics/src/main/resources/templates/guacClientStatistics.html
new file mode 100644
index 000000000..ae7537c0f
--- /dev/null
+++ b/extensions/guacamole-display-statistics/src/main/resources/templates/guacClientStatistics.html
@@ -0,0 +1,39 @@
+<dl class="client-statistics">
+
+    <dt class="client-statistic desktop-fps">
+        {{ 'CLIENT.FIELD_HEADER_DESKTOP_FRAMERATE' | translate }}
+    </dt>
+    <dd ng-class="{ 'no-value' : !hasValue(statistics.desktopFps) }">
+        <span ng-show="hasValue(statistics.desktopFps)"
+            translate="CLIENT.INFO_FRAMERATE"
+            translate-values="{ VALUE : round(statistics.desktopFps) }"></span>
+    </dd>
+
+    <dt class="client-statistic server-fps">
+        {{ 'CLIENT.FIELD_HEADER_SERVER_FRAMERATE' | translate }}
+    </dt>
+    <dd ng-class="{ 'no-value' : !hasValue(statistics.serverFps) }">
+        <span ng-show="hasValue(statistics.serverFps)"
+            translate="CLIENT.INFO_FRAMERATE"
+            translate-values="{ VALUE : round(statistics.serverFps) }"></span>
+    </dd>
+
+    <dt class="client-statistic client-fps">
+        {{ 'CLIENT.FIELD_HEADER_CLIENT_FRAMERATE' | translate }}
+    </dt>
+    <dd ng-class="{ 'no-value' : !hasValue(statistics.clientFps) }">
+        <span ng-show="hasValue(statistics.clientFps)"
+            translate="CLIENT.INFO_FRAMERATE"
+            translate-values="{ VALUE : round(statistics.clientFps) }"></span>
+    </dd>
+
+    <dt class="client-statistic drop-rate">
+        {{ 'CLIENT.FIELD_HEADER_DROP_FRAMERATE' | translate }}
+    </dt>
+    <dd ng-class="{ 'no-value' : !hasValue(statistics.dropRate) }">
+        <span ng-show="hasValue(statistics.dropRate)"
+            translate="CLIENT.INFO_FRAMERATE"
+            translate-values="{ VALUE : round(statistics.dropRate) }"></span>
+    </dd>
+
+</dl>
\ No newline at end of file
diff --git a/extensions/guacamole-display-statistics/src/main/resources/translations/en.json b/extensions/guacamole-display-statistics/src/main/resources/translations/en.json
new file mode 100644
index 000000000..ef42908e4
--- /dev/null
+++ b/extensions/guacamole-display-statistics/src/main/resources/translations/en.json
@@ -0,0 +1,12 @@
+{
+    "CLIENT" : {
+
+        "FIELD_HEADER_CLIENT_FRAMERATE"  : "Guacamole (Client):",
+        "FIELD_HEADER_DESKTOP_FRAMERATE" : "Remote Desktop:",
+        "FIELD_HEADER_DROP_FRAMERATE"    : "Drop:",
+        "FIELD_HEADER_SERVER_FRAMERATE"  : "Guacamole (Server):",
+
+        "INFO_FRAMERATE" : "{VALUE} fps"
+
+    }
+}
diff --git a/extensions/pom.xml b/extensions/pom.xml
index de2b24556..3bab33257 100644
--- a/extensions/pom.xml
+++ b/extensions/pom.xml
@@ -53,6 +53,9 @@
         <module>guacamole-history-recording-storage</module>
         <module>guacamole-vault</module>
 
+        <!-- Utility extensions -->
+        <module>guacamole-display-statistics</module>
+
     </modules>
 
     <build>

From be90de9a9dd56d4d79808fee6f5b60b525e770a3 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 18 May 2022 15:40:31 -0700
Subject: [PATCH 018/289] GUACAMOLE-377: Switch over to "disable-gfx" parameter
 (enable RDPGFX by default).

---
 .../resources/org/apache/guacamole/protocols/rdp.json  | 10 +++++-----
 guacamole/src/main/frontend/src/translations/en.json   |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
index 77855f3db..c51f76209 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
@@ -254,11 +254,6 @@
         {
             "name" : "performance",
             "fields" : [
-                {
-                    "name"    : "enable-gfx",
-                    "type"    : "BOOLEAN",
-                    "options" : [ "true" ]
-                },
                 {
                     "name"    : "enable-wallpaper",
                     "type"    : "BOOLEAN",
@@ -303,6 +298,11 @@
                     "name"    : "disable-glyph-caching",
                     "type"    : "BOOLEAN",
                     "options" : [ "true" ]
+                },
+                {
+                    "name"    : "disable-gfx",
+                    "type"    : "BOOLEAN",
+                    "options" : [ "true" ]
                 }
             ]
         },
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 3ee46a313..05a9fa279 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -490,11 +490,11 @@
         "FIELD_HEADER_ENABLE_DRIVE"               : "Enable drive:",
         "FIELD_HEADER_ENABLE_FONT_SMOOTHING"      : "Enable font smoothing (ClearType):",
         "FIELD_HEADER_ENABLE_FULL_WINDOW_DRAG"    : "Enable full-window drag:",
-        "FIELD_HEADER_ENABLE_GFX"                 : "Enable Graphics Pipeline Extension (RemoteFX):",
         "FIELD_HEADER_ENABLE_MENU_ANIMATIONS"     : "Enable menu animations:",
         "FIELD_HEADER_DISABLE_BITMAP_CACHING"     : "Disable bitmap caching:",
         "FIELD_HEADER_DISABLE_OFFSCREEN_CACHING"  : "Disable off-screen caching:",
         "FIELD_HEADER_DISABLE_GLYPH_CACHING"      : "Disable glyph caching:",
+        "FIELD_HEADER_DISABLE_GFX"                : "Disable Graphics Pipeline Extension:",
         "FIELD_HEADER_ENABLE_PRINTING"            : "Enable printing:",
         "FIELD_HEADER_ENABLE_SFTP"     : "Enable SFTP:",
         "FIELD_HEADER_ENABLE_THEMING"             : "Enable theming:",

From 0404bff11bd1cfc74386218dadcf9d38d4d82d88 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 24 May 2022 20:18:20 +0000
Subject: [PATCH 019/289] GUACAMOLE-1614: Upgrade to latest
 jasmine-maven-plugin version to avoid PhantomJS use entirely.

---
 guacamole-common-js/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole-common-js/pom.xml b/guacamole-common-js/pom.xml
index 5d7585b18..41cc7907a 100644
--- a/guacamole-common-js/pom.xml
+++ b/guacamole-common-js/pom.xml
@@ -118,7 +118,7 @@
             <plugin>
                 <groupId>com.github.searls</groupId>
                 <artifactId>jasmine-maven-plugin</artifactId>
-                <version>2.2</version>
+                <version>3.0-beta-02</version>
                 <executions>
                     <execution>
                         <goals>

From cd3c1fbf3532e5b5d942d1b418aa1bb193fed1f7 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 26 May 2022 23:22:34 +0000
Subject: [PATCH 020/289] GUACAMOLE-1616: Write history records for external
 connections if configured to do so.

---
 .../jdbc/AuthenticationProviderService.java   |  30 +++++
 .../auth/jdbc/HistoryTrackingConnection.java  | 117 ++++++++++++++++++
 .../HistoryTrackingConnectionDirectory.java   |  96 ++++++++++++++
 .../auth/jdbc/HistoryTrackingTunnel.java      |  81 ++++++++++++
 .../auth/jdbc/HistoryTrackingUserContext.java |  75 +++++++++++
 .../jdbc/InjectedAuthenticationProvider.java  |   8 ++
 .../JDBCAuthenticationProviderService.java    |  31 ++++-
 .../guacamole/auth/jdbc/JDBCEnvironment.java  |  53 +++++---
 .../SharedAuthenticationProviderService.java  |   9 ++
 .../auth/mysql/conf/MySQLEnvironment.java     |  88 +++++++------
 .../mysql/conf/MySQLGuacamoleProperties.java  |  59 +++++----
 .../conf/PostgreSQLEnvironment.java           |  82 ++++++------
 .../conf/PostgreSQLGuacamoleProperties.java   |  53 +++++---
 .../sqlserver/conf/SQLServerEnvironment.java  |  38 +++---
 .../conf/SQLServerGuacamoleProperties.java    |  23 +++-
 15 files changed, 679 insertions(+), 164 deletions(-)
 create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java
 create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnectionDirectory.java
 create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingTunnel.java
 create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingUserContext.java

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/AuthenticationProviderService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/AuthenticationProviderService.java
index afdaf332b..5fedd23e9 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/AuthenticationProviderService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/AuthenticationProviderService.java
@@ -110,4 +110,34 @@ public interface AuthenticationProviderService  {
             UserContext context, AuthenticatedUser authenticatedUser,
             Credentials credentials) throws GuacamoleException;
 
+    /**
+     * Decorates a UserContext instance for the given already-authenticated user.
+     * If no decoration is required, the original UserContext will be returned.
+     *
+     * @param authenticationProvider
+     *     The AuthenticationProvider on behalf of which the UserContext is
+     *     being decorated.
+     *
+     * @param context
+     *     The UserContext to decorate.
+     *
+     * @param authenticatedUser
+     *     The AuthenticatedUser associated with the UserContext being decorated.
+     *
+     * @param credentials
+     *     The credentials most recently submitted by the user. These
+     *     credentials are not guaranteed to be the same as the credentials
+     *     already associated with the AuthenticatedUser.
+     *
+     * @return
+     *     A decorated UserContext instance for the user identified by the given
+     *     credentials, or the original user context if no decoration is required.
+     *
+     * @throws GuacamoleException
+     *     If the an error occurs during decoration of the UserContext.
+     */
+    public UserContext decorateUserContext(AuthenticationProvider authenticationProvider,
+            UserContext context, AuthenticatedUser authenticatedUser,
+            Credentials credentials) throws GuacamoleException;
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java
new file mode 100644
index 000000000..2a0bc3cc3
--- /dev/null
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java
@@ -0,0 +1,117 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.jdbc;
+
+import java.util.Date;
+import java.util.Map;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordMapper;
+import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordModel;
+import org.apache.guacamole.net.GuacamoleTunnel;
+import org.apache.guacamole.net.auth.Connection;
+import org.apache.guacamole.net.auth.DelegatingConnection;
+import org.apache.guacamole.net.auth.User;
+import org.apache.guacamole.protocol.GuacamoleClientInformation;
+
+/**
+ * Connection implementation that creates a history record when the connection
+ * is established, and returns a HistoryTrackingTunnel to automatically set the
+ * end date when the connection is closed.
+ */
+public class HistoryTrackingConnection extends DelegatingConnection {
+
+    /**
+     * The current Guacamole user.
+     */
+    private final User currentUser;
+
+    /**
+     * The remote host that the user connected from.
+     */
+    private final String remoteHost;
+
+    /**
+     * The connection record mapper to use when writing history entries for
+     * established connections.
+     */
+    private final ConnectionRecordMapper connectionRecordMapper;
+
+    /**
+     * Creates a new HistoryConnection that wraps the given connection,
+     * automatically creating a history record when the connection is
+     * established, and returning a HistoryTrackingTunnel to set the end
+     * date on the history entry when the connection is closed.
+     *
+     * @param currentUser
+     *     The current Guacamole user.
+     *
+     * @param remoteHost
+     *     The remote host that the user connected from.
+     *
+     * @param connection
+     *     The connection to wrap.
+     *
+     * @param connectionRecordMapper
+     *     The connection record mapper that will be used to write the connection history records.
+     */
+    public HistoryTrackingConnection(User currentUser, String remoteHost, Connection connection, ConnectionRecordMapper connectionRecordMapper) {
+        super(connection);
+
+        this.currentUser = currentUser;
+        this.remoteHost = remoteHost;
+        this.connectionRecordMapper = connectionRecordMapper;
+    }
+
+    @Override
+    public GuacamoleTunnel connect(GuacamoleClientInformation info,
+            Map<String, String> tokens) throws GuacamoleException {
+
+        // Create a connection record model, starting at the current date/time
+        ConnectionRecordModel connectionRecordModel = new ConnectionRecordModel();
+        connectionRecordModel.setStartDate(new Date());
+
+        // Set the user information
+        connectionRecordModel.setUsername(this.currentUser.getIdentifier());
+        connectionRecordModel.setRemoteHost(this.remoteHost);
+
+        // Set the connection information
+        connectionRecordModel.setConnectionName(this.getDelegateConnection().getName());
+
+        // Insert the connection history record to mark the start of this connection
+        connectionRecordMapper.insert(connectionRecordModel);
+
+        // Connect, and wrap the tunnel for return
+        GuacamoleTunnel tunnel = super.connect(info, tokens);
+        return new HistoryTrackingTunnel(
+            tunnel, this.connectionRecordMapper, connectionRecordModel);
+    }
+
+    /**
+     * Get the Connection wrapped by this HistoryTrackingConnection.
+     *
+     * @return
+     *     The wrapped Connection.
+     */
+    public Connection getWrappedConnection() {
+        return getDelegateConnection();
+    }
+
+}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnectionDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnectionDirectory.java
new file mode 100644
index 000000000..ddc3afb19
--- /dev/null
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnectionDirectory.java
@@ -0,0 +1,96 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.jdbc;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordMapper;
+import org.apache.guacamole.net.auth.Connection;
+import org.apache.guacamole.net.auth.DecoratingDirectory;
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.User;
+
+/**
+ * A connection directory that returns HistoryTrackingConnection-wrapped connections
+ * when queried.
+ */
+public class HistoryTrackingConnectionDirectory extends DecoratingDirectory<Connection> {
+
+    /**
+     * The connection record mapper to use when writing history entries for
+     * established connections.
+     */
+    private final ConnectionRecordMapper connectionRecordMapper;
+
+    /**
+     * The user that directory operations are being performed for.
+     */
+    private final User user;
+
+    /**
+     * The remote host that the user connected from.
+     */
+    private final String remoteHost;
+
+    /**
+     * Create a new history tracking connection directory. Any connection retrieved from this
+     * directory will be wrapped in a HistoryTrackingConnection, enabling connection history
+     * records to be written with the provided connection record mapper.
+     *
+     * @param directory
+     *     The connection directory to wrap.
+     *
+     * @param user
+     *     The user associated with the connection directory.
+     *
+     * @param remoteHost
+     *     The remote host that the user connected from.
+     *
+     * @param connectionRecordMapper
+     *     The connection record mapper that will be used to write the connection history records.
+     */
+    public HistoryTrackingConnectionDirectory(Directory<Connection> directory, User user, String remoteHost, ConnectionRecordMapper connectionRecordMapper) {
+        super(directory);
+
+        this.user = user;
+        this.remoteHost = remoteHost;
+        this.connectionRecordMapper = connectionRecordMapper;
+    }
+
+    @Override
+    protected Connection decorate(Connection connection) throws GuacamoleException {
+
+         // Wrap the connection in a history-tracking layer
+         return new HistoryTrackingConnection(
+            this.user, this.remoteHost, connection, this.connectionRecordMapper);
+    }
+
+    @Override
+    protected Connection undecorate(Connection connection) throws GuacamoleException {
+
+        // If the connection was wrapped, unwrap it
+        if (connection instanceof HistoryTrackingConnection) {
+            return ((HistoryTrackingConnection) connection).getWrappedConnection();
+        }
+
+        // Otherwise, return the unwrapped connection directly
+        return connection;
+    }
+
+}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingTunnel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingTunnel.java
new file mode 100644
index 000000000..aeccc3a0b
--- /dev/null
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingTunnel.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.jdbc;
+
+import java.util.Date;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordMapper;
+import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordModel;
+import org.apache.guacamole.net.DelegatingGuacamoleTunnel;
+import org.apache.guacamole.net.GuacamoleTunnel;
+
+/**
+ * Tunnel implementation which automatically writes an end date for the
+ * provided connection history record model using the provided connection
+ * history mapper, when the tunnel is closed.
+ */
+public class HistoryTrackingTunnel extends DelegatingGuacamoleTunnel {
+
+    /**
+     * The connection for which this tunnel was established.
+     */
+    private final ConnectionRecordMapper connectionRecordMapper;
+
+    /**
+     * The user for which this tunnel was established.
+     */
+    private final ConnectionRecordModel connectionRecordModel;
+
+    /**
+     * Creates a new HistoryTrackingTunnel that wraps the given tunnel,
+     * automatically setting the end date for the provided connection history records,
+     * using the provided connection history record mapper.
+     *
+     * @param tunnel
+     *     The tunnel to wrap.
+     *
+     * @param connectionRecordMapper
+     *     The mapper to use when writing connection history records.
+     *
+     * @param connectionRecordModel
+     *     The connection history record model representing the in-progress connection.
+     */
+    public HistoryTrackingTunnel(GuacamoleTunnel tunnel,
+            ConnectionRecordMapper connectionRecordMapper, ConnectionRecordModel connectionRecordModel) {
+
+        super(tunnel);
+
+        // Store the connection record mapper and model for history tracking
+        this.connectionRecordMapper = connectionRecordMapper;
+        this.connectionRecordModel = connectionRecordModel;
+    }
+
+    @Override
+    public void close() throws GuacamoleException {
+
+        // Set the end date to complete the connection history record
+        this.connectionRecordModel.setEndDate(new Date());
+        this.connectionRecordMapper.updateEndDate(this.connectionRecordModel);
+
+        super.close();
+    }
+
+}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingUserContext.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingUserContext.java
new file mode 100644
index 000000000..2c13a7ec8
--- /dev/null
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingUserContext.java
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.jdbc;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordMapper;
+import org.apache.guacamole.net.auth.Connection;
+import org.apache.guacamole.net.auth.DelegatingUserContext;
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.UserContext;
+
+/**
+ * DelegatingUserContext implementation which writes connection history records
+ * when connections are established and closed.
+ */
+public class HistoryTrackingUserContext extends DelegatingUserContext {
+
+    /**
+     * The remote host that the user associated with the user context
+     * connected from.
+     */
+    private final String remoteHost;
+
+    /**
+     * The connection record mapper to use when writing history entries for
+     * established connections.
+     */
+    private final ConnectionRecordMapper connectionRecordMapper;
+
+    /**
+     * Creates a new HistoryTrackingUserContext which wraps the given
+     * UserContext, allowing for tracking of connection history external to
+     * this authentication provider.
+     *
+     * @param userContext
+     *     The UserContext to wrap.
+     *
+     * @param remoteHost
+     *     The host that the user associated with the given user context connected from.
+     *
+     * @param connectionRecordMapper
+     *     The mapper to use when writing connection history entries to the DB.
+     */
+    public HistoryTrackingUserContext(UserContext userContext, String remoteHost, ConnectionRecordMapper connectionRecordMapper) {
+        super(userContext);
+
+        this.remoteHost = remoteHost;
+        this.connectionRecordMapper = connectionRecordMapper;
+    }
+
+    @Override
+    public Directory<Connection> getConnectionDirectory() throws GuacamoleException {
+        return new HistoryTrackingConnectionDirectory(
+                super.getConnectionDirectory(), self(),
+                this.remoteHost, this.connectionRecordMapper);
+    }
+
+}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/InjectedAuthenticationProvider.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/InjectedAuthenticationProvider.java
index fddb20447..8ae2eea63 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/InjectedAuthenticationProvider.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/InjectedAuthenticationProvider.java
@@ -90,4 +90,12 @@ public abstract class InjectedAuthenticationProvider extends AbstractAuthenticat
                 authenticatedUser, credentials);
     }
 
+    @Override
+    public UserContext decorate(UserContext context,
+            AuthenticatedUser authenticatedUser, Credentials credentials)
+            throws GuacamoleException {
+        return authProviderService.decorateUserContext(this, context,
+                authenticatedUser, credentials);
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java
index 2f38ebe23..d2576ec2b 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java
@@ -22,6 +22,7 @@ package org.apache.guacamole.auth.jdbc;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordMapper;
 import org.apache.guacamole.auth.jdbc.security.PasswordPolicyService;
 import org.apache.guacamole.auth.jdbc.sharing.user.SharedAuthenticatedUser;
 import org.apache.guacamole.auth.jdbc.user.ModeledAuthenticatedUser;
@@ -68,6 +69,12 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
     @Inject
     private Provider<ModeledUserContext> userContextProvider;
 
+    /**
+     * Mapper for writing connection history.
+     */
+    @Inject
+    private ConnectionRecordMapper connectionRecordMapper;
+
     @Override
     public AuthenticatedUser authenticateUser(AuthenticationProvider authenticationProvider,
             Credentials credentials) throws GuacamoleException {
@@ -99,7 +106,7 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
         ModeledUser user = userService.retrieveUser(authenticationProvider, authenticatedUser);
         ModeledUserContext context = userContextProvider.get();
         if (user != null && !user.isDisabled()) {
-            
+
             // Enforce applicable account restrictions
             if (databaseRestrictionsApplicable) {
 
@@ -125,18 +132,18 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
             }
 
         }
-        
+
         // If no user account is found, and database-specific account
         // restrictions do not apply, get a skeleton user.
         else if (!databaseRestrictionsApplicable) {
             user = userService.retrieveSkeletonUser(authenticationProvider, authenticatedUser);
-            
+
             // If auto account creation is enabled, add user to DB.
             if (environment.autoCreateAbsentAccounts()) {
                 ModeledUser createdUser = userService.createObject(new PrivilegedModeledAuthenticatedUser(user.getCurrentUser()), user);
                 user.setModel(createdUser.getModel());
             }
-            
+
         }
 
         // Veto authentication result only if database-specific account
@@ -144,7 +151,7 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
         else
             throw new GuacamoleInvalidCredentialsException("Invalid login",
                     CredentialsInfo.USERNAME_PASSWORD);
-        
+
         // Initialize the UserContext with the user account and return it.
         context.init(user.getCurrentUser());
         context.recordUserLogin();
@@ -162,4 +169,18 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
 
     }
 
+    @Override
+    public UserContext decorateUserContext(AuthenticationProvider authenticationProvider,
+            UserContext context, AuthenticatedUser authenticatedUser,
+            Credentials credentials) throws GuacamoleException {
+
+        // Track connection history only for external connections, and only if enabled in the config
+        if (environment.trackExternalConnectionHistory() && context.getAuthenticationProvider() != authenticationProvider) {
+            return new HistoryTrackingUserContext(context, credentials.getRemoteHostname(), connectionRecordMapper);
+        }
+
+        return context;
+
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
index 19544447d..763793d62 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
@@ -30,7 +30,7 @@ import org.apache.ibatis.session.SqlSession;
  * intended for use within JDBC based authentication providers.
  */
 public abstract class JDBCEnvironment extends DelegatingEnvironment {
-    
+
     /**
      * Constructs a new JDBCEnvironment using an underlying LocalEnviroment to
      * read properties from the file system.
@@ -68,12 +68,12 @@ public abstract class JDBCEnvironment extends DelegatingEnvironment {
     public abstract int getAbsoluteMaxConnections() throws GuacamoleException;
 
     /**
-     * Returns the default maximum number of concurrent connections to allow to 
-     * any one connection, unless specified differently on an individual 
+     * Returns the default maximum number of concurrent connections to allow to
+     * any one connection, unless specified differently on an individual
      * connection. Zero denotes unlimited.
-     * 
+     *
      * @return
-     *     The default maximum allowable number of concurrent connections 
+     *     The default maximum allowable number of concurrent connections
      *     to any connection.
      *
      * @throws GuacamoleException
@@ -82,10 +82,10 @@ public abstract class JDBCEnvironment extends DelegatingEnvironment {
     public abstract int getDefaultMaxConnections() throws GuacamoleException;
 
     /**
-     * Returns the default maximum number of concurrent connections to allow to 
-     * any one connection group, unless specified differently on an individual 
+     * Returns the default maximum number of concurrent connections to allow to
+     * any one connection group, unless specified differently on an individual
      * connection group. Zero denotes unlimited.
-     * 
+     *
      * @return
      *     The default maximum allowable number of concurrent connections
      *     to any connection group.
@@ -95,12 +95,12 @@ public abstract class JDBCEnvironment extends DelegatingEnvironment {
      */
     public abstract int getDefaultMaxGroupConnections()
             throws GuacamoleException;
-    
+
     /**
-     * Returns the default maximum number of concurrent connections to allow to 
+     * Returns the default maximum number of concurrent connections to allow to
      * any one connection by an individual user, unless specified differently on
      * an individual connection. Zero denotes unlimited.
-     * 
+     *
      * @return
      *     The default maximum allowable number of concurrent connections to
      *     any connection by an individual user.
@@ -110,12 +110,12 @@ public abstract class JDBCEnvironment extends DelegatingEnvironment {
      */
     public abstract int getDefaultMaxConnectionsPerUser()
             throws GuacamoleException;
-    
+
     /**
-     * Returns the default maximum number of concurrent connections to allow to 
-     * any one connection group by an individual user, unless specified 
+     * Returns the default maximum number of concurrent connections to allow to
+     * any one connection group by an individual user, unless specified
      * differently on an individual connection group. Zero denotes unlimited.
-     * 
+     *
      * @return
      *     The default maximum allowable number of concurrent connections to
      *     any connection group by an individual user.
@@ -149,19 +149,19 @@ public abstract class JDBCEnvironment extends DelegatingEnvironment {
      *     true if the database supports recursive queries, false otherwise.
      */
     public abstract boolean isRecursiveQuerySupported(SqlSession session);
-    
+
     /**
      * Returns a boolean value representing whether or not the JDBC module
      * should automatically create accounts within the database for users that
      * are successfully authenticated via other extensions. Returns true if
      * accounts should be auto-created, otherwise returns false.
-     * 
+     *
      * @return
      *     true if user accounts should be automatically created within the
      *     database when authentication succeeds from another extension;
      *     otherwise false.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If guacamole.properties cannot be parsed.
      */
     public abstract boolean autoCreateAbsentAccounts() throws GuacamoleException;
@@ -212,4 +212,19 @@ public abstract class JDBCEnvironment extends DelegatingEnvironment {
         }
     }
 
+    /**
+     * Returns a boolean value representing whether or not the JDBC module
+     * should automatically track connection history for external connections,
+     * i.e. connections not originated from within the JDBC auth provider
+     * itself.
+     *
+     * @return
+     *     true if connection history should be tracked for connections that
+     *     do not originate from within this JDBC auth provider, false otherwise.
+     *
+     * @throws GuacamoleException
+     *     If guacamole.properties cannot be parsed.
+     */
+    public abstract boolean trackExternalConnectionHistory() throws GuacamoleException;
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/SharedAuthenticationProviderService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/SharedAuthenticationProviderService.java
index 40df1e3d3..8cd6edc36 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/SharedAuthenticationProviderService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/SharedAuthenticationProviderService.java
@@ -109,4 +109,13 @@ public class SharedAuthenticationProviderService implements AuthenticationProvid
 
     }
 
+    @Override
+    public UserContext decorateUserContext(AuthenticationProvider authenticationProvider,
+            UserContext context, AuthenticatedUser authenticatedUser,
+            Credentials credentials) {
+
+        // There's no need to decorate the user context here
+        return context;
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java
index ee3fd8aa1..d8344ec81 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java
@@ -99,7 +99,7 @@ public class MySQLEnvironment extends JDBCEnvironment {
      * allowed to any one connection group.
      */
     private final int DEFAULT_MAX_GROUP_CONNECTIONS = 0;
-    
+
     /**
      * The default SSL mode for connecting to MySQL servers.
      */
@@ -108,8 +108,8 @@ public class MySQLEnvironment extends JDBCEnvironment {
     /**
      * Constructs a new MySQLEnvironment, providing access to MySQL-specific
      * configuration options.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If an error occurs while setting up the underlying JDBCEnvironment
      *     or while parsing legacy MySQL configuration options.
      */
@@ -177,12 +177,12 @@ public class MySQLEnvironment extends JDBCEnvironment {
      * database server hosting the Guacamole database. If unspecified, the
      * installed MySQL driver will be automatically detected by inspecting the
      * classes available in the classpath.
-     * 
+     *
      * @return
      *     The MySQL driver that will be used to communicate with the MySQL-
      *     compatible server.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If guacamole.properties cannot be parsed, or if no MySQL-compatible
      *     JDBC driver is present.
      */
@@ -210,15 +210,15 @@ public class MySQLEnvironment extends JDBCEnvironment {
         throw new GuacamoleServerException("No JDBC driver for MySQL/MariaDB is installed.");
 
     }
-    
+
     /**
      * Returns the hostname of the MySQL server hosting the Guacamole
      * authentication tables. If unspecified, this will be "localhost".
-     * 
+     *
      * @return
      *     The URL of the MySQL server.
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs while retrieving the property value.
      */
     public String getMySQLHostname() throws GuacamoleException {
@@ -227,30 +227,30 @@ public class MySQLEnvironment extends JDBCEnvironment {
             DEFAULT_HOSTNAME
         );
     }
-    
+
     /**
      * Returns the port number of the MySQL server hosting the Guacamole
      * authentication tables. If unspecified, this will be the default MySQL
      * port of 3306.
-     * 
+     *
      * @return
      *     The port number of the MySQL server.
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs while retrieving the property value.
      */
     public int getMySQLPort() throws GuacamoleException {
         return getProperty(MySQLGuacamoleProperties.MYSQL_PORT, DEFAULT_PORT);
     }
-    
+
     /**
-     * Returns the name of the MySQL database containing the Guacamole 
+     * Returns the name of the MySQL database containing the Guacamole
      * authentication tables.
-     * 
+     *
      * @return
      *     The name of the MySQL database.
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs while retrieving the property value, or if the
      *     value was not set, as this property is required.
      */
@@ -262,7 +262,7 @@ public class MySQLEnvironment extends JDBCEnvironment {
     public String getUsername() throws GuacamoleException {
         return getRequiredProperty(MySQLGuacamoleProperties.MYSQL_USERNAME);
     }
-    
+
     @Override
     public String getPassword() throws GuacamoleException {
         return getRequiredProperty(MySQLGuacamoleProperties.MYSQL_PASSWORD);
@@ -303,15 +303,15 @@ public class MySQLEnvironment extends JDBCEnvironment {
         }
 
     }
-    
+
     /**
      * Return the MySQL SSL mode as configured in guacamole.properties, or the
      * default value of PREFERRED if not configured.
-     * 
+     *
      * @return
      *     The SSL mode to use when connecting to the MySQL server.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If an error occurs retrieving the property value.
      */
     public MySQLSSLMode getMySQLSSLMode() throws GuacamoleException {
@@ -319,71 +319,71 @@ public class MySQLEnvironment extends JDBCEnvironment {
                 MySQLGuacamoleProperties.MYSQL_SSL_MODE,
                 DEFAULT_SSL_MODE);
     }
-    
+
     /**
      * Returns the File where the trusted certificate store is located as
      * configured in guacamole.properties, or null if no value has been
      * configured.  The trusted certificate store is used to validate server
      * certificates when making SSL connections to MySQL servers.
-     * 
+     *
      * @return
      *     The File where the trusted certificate store is located, or null
      *     if the value has not been configured.
-     * 
+     *
      * @throws GuacamoleException
      *     If guacamole.properties cannot be parsed.
      */
     public File getMySQLSSLTrustStore() throws GuacamoleException {
         return getProperty(MySQLGuacamoleProperties.MYSQL_SSL_TRUST_STORE);
     }
-    
+
     /**
      * Returns the password used to access the trusted certificate store as
      * configured in guacamole.properties, or null if no password has been
      * specified.
-     * 
+     *
      * @return
      *     The password used to access the trusted certificate store.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If guacamole.properties cannot be parsed.
      */
     public String getMySQLSSLTrustPassword() throws GuacamoleException {
         return getProperty(MySQLGuacamoleProperties.MYSQL_SSL_TRUST_PASSWORD);
     }
-    
+
     /**
      * Returns the File used to store the client SSL certificate as configured
      * in guacamole.properties, or null if no value has been specified.  This
      * file will be used to load the client certificate used for SSL connections
      * to MySQL servers, if the SSL connection is so configured to require
      * client certificate authentication.
-     * 
+     *
      * @return
      *     The File where the client SSL certificate is stored.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If guacamole.properties cannot be parsed.
      */
     public File getMySQLSSLClientStore() throws GuacamoleException {
         return getProperty(MySQLGuacamoleProperties.MYSQL_SSL_CLIENT_STORE);
     }
-    
+
     /**
      * Returns the password used to access the client certificate store as
      * configured in guacamole.properties, or null if no value has been
      * specified.
-     * 
+     *
      * @return
      *     The password used to access the client SSL certificate store.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If guacamole.properties cannot be parsed.
      */
     public String getMYSQLSSLClientPassword() throws GuacamoleException {
         return getProperty(MySQLGuacamoleProperties.MYSQL_SSL_CLIENT_PASSWORD);
     }
-    
+
     @Override
     public boolean autoCreateAbsentAccounts() throws GuacamoleException {
         return getProperty(MySQLGuacamoleProperties.MYSQL_AUTO_CREATE_ACCOUNTS,
@@ -393,15 +393,23 @@ public class MySQLEnvironment extends JDBCEnvironment {
     /**
      * Return the server timezone if configured in guacamole.properties, or
      * null if the configuration option is not present.
-     * 
+     *
      * @return
      *     The server timezone as configured in guacamole.properties.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If an error occurs retrieving the configuration value.
      */
     public TimeZone getServerTimeZone() throws GuacamoleException {
         return getProperty(MySQLGuacamoleProperties.SERVER_TIMEZONE);
     }
 
+    @Override
+    public boolean trackExternalConnectionHistory() throws GuacamoleException {
+
+        // Track external connection history unless explicitly disabled
+        return getProperty(MySQLGuacamoleProperties.MYSQL_TRACK_EXTERNAL_CONNECTION_HISTORY,
+                true);
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
index 925f82a72..6a5944fd3 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
@@ -35,7 +35,7 @@ public class MySQLGuacamoleProperties {
      * This class should not be instantiated.
      */
     private MySQLGuacamoleProperties() {}
-    
+
     /**
      * The JDBC driver that should be used to talk to MySQL-compatible servers.
      */
@@ -48,7 +48,7 @@ public class MySQLGuacamoleProperties {
     };
 
     /**
-     * The hostname of the MySQL server hosting the Guacamole authentication 
+     * The hostname of the MySQL server hosting the Guacamole authentication
      * tables.
      */
     public static final StringGuacamoleProperty MYSQL_HOSTNAME = new StringGuacamoleProperty() {
@@ -59,7 +59,7 @@ public class MySQLGuacamoleProperties {
     };
 
     /**
-     * The port number of the MySQL server hosting the Guacamole authentication 
+     * The port number of the MySQL server hosting the Guacamole authentication
      * tables.
      */
     public static final IntegerGuacamoleProperty MYSQL_PORT = new IntegerGuacamoleProperty() {
@@ -70,7 +70,7 @@ public class MySQLGuacamoleProperties {
     };
 
     /**
-     * The name of the MySQL database containing the Guacamole authentication 
+     * The name of the MySQL database containing the Guacamole authentication
      * tables.
      */
     public static final StringGuacamoleProperty MYSQL_DATABASE = new StringGuacamoleProperty() {
@@ -179,19 +179,19 @@ public class MySQLGuacamoleProperties {
         public String getName() { return "mysql-default-max-group-connections-per-user"; }
 
     };
-    
+
     /**
      * The SSL mode used to connect to the MySQL Server.  By default the driver
      * will attempt SSL connections and fall back to plain-text if SSL fails.
      */
     public static final EnumGuacamoleProperty<MySQLSSLMode> MYSQL_SSL_MODE =
             new EnumGuacamoleProperty<MySQLSSLMode>(MySQLSSLMode.class) {
-        
+
         @Override
         public String getName() { return "mysql-ssl-mode" ; }
-        
+
     };
-    
+
     /**
      * The File where trusted SSL certificate authorities and server certificates
      * are stored.  By default no file is specified, and the default Java
@@ -199,24 +199,24 @@ public class MySQLGuacamoleProperties {
      */
     public static final FileGuacamoleProperty MYSQL_SSL_TRUST_STORE =
             new FileGuacamoleProperty() {
-        
+
         @Override
         public String getName() { return "mysql-ssl-trust-store"; }
-        
+
     };
-    
+
     /**
      * The password to use to access the mysql-ssl-trust-store, if required.  By
      * default no password will be used to attempt to access the store.
      */
     public static final StringGuacamoleProperty MYSQL_SSL_TRUST_PASSWORD =
             new StringGuacamoleProperty() {
-        
+
         @Override
         public String getName() { return "mysql-ssl-trust-password"; }
-        
+
     };
-    
+
     /**
      * The File used to store the client certificate for configurations where
      * a client certificate is required for authentication.  By default no
@@ -224,24 +224,24 @@ public class MySQLGuacamoleProperties {
      */
     public static final FileGuacamoleProperty MYSQL_SSL_CLIENT_STORE =
             new FileGuacamoleProperty() {
-        
+
         @Override
         public String getName() { return "mysql-ssl-client-store"; }
-        
+
     };
-    
+
     /**
      * The password to use to access the mysql-ssl-client-store file.  By
      * default no password will be used to attempt to access the file.
      */
     public static final StringGuacamoleProperty MYSQL_SSL_CLIENT_PASSWORD =
             new StringGuacamoleProperty() {
-        
+
         @Override
         public String getName() { return "mysql-ssl-client-password"; }
-        
+
     };
-    
+
     /**
      * Whether or not to automatically create accounts in the MySQL database for
      * users who successfully authenticate through another extension. By default
@@ -249,7 +249,7 @@ public class MySQLGuacamoleProperties {
      */
     public static final BooleanGuacamoleProperty MYSQL_AUTO_CREATE_ACCOUNTS =
             new BooleanGuacamoleProperty() {
-    
+
         @Override
         public String getName() { return "mysql-auto-create-accounts"; }
     };
@@ -259,10 +259,23 @@ public class MySQLGuacamoleProperties {
      */
     public static final TimeZoneGuacamoleProperty SERVER_TIMEZONE =
             new TimeZoneGuacamoleProperty() {
-                
+
         @Override
         public String getName() { return "mysql-server-timezone"; }
-                
+
+    };
+
+    /**
+     * Whether or not to track connection history for connections that do not originate
+     * from within the MySQL database. By default, external connection history will be
+     * tracked.
+     */
+    public static final BooleanGuacamoleProperty MYSQL_TRACK_EXTERNAL_CONNECTION_HISTORY =
+            new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "mysql-track-external-connection-history"; }
+
     };
 
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java
index 2ead15b6e..ac08e0ae0 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java
@@ -110,7 +110,7 @@ public class PostgreSQLEnvironment extends JDBCEnvironment {
      * the values that should be used in the absence of the correct properties.
      */
     private final int DEFAULT_MAX_GROUP_CONNECTIONS = 0;
-    
+
     /**
      * The default value to use for SSL mode if none is explicitly configured.
      */
@@ -119,8 +119,8 @@ public class PostgreSQLEnvironment extends JDBCEnvironment {
     /**
      * Constructs a new PostgreSQLEnvironment, providing access to PostgreSQL-specific
      * configuration options.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If an error occurs while setting up the underlying JDBCEnvironment
      *     or while parsing legacy PostgreSQL configuration options.
      */
@@ -186,11 +186,11 @@ public class PostgreSQLEnvironment extends JDBCEnvironment {
     /**
      * Returns the hostname of the PostgreSQL server hosting the Guacamole
      * authentication tables. If unspecified, this will be "localhost".
-     * 
+     *
      * @return
      *     The URL of the PostgreSQL server.
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs while retrieving the property value.
      */
     public String getPostgreSQLHostname() throws GuacamoleException {
@@ -199,16 +199,16 @@ public class PostgreSQLEnvironment extends JDBCEnvironment {
             DEFAULT_HOSTNAME
         );
     }
-    
+
     /**
      * Returns the port number of the PostgreSQL server hosting the Guacamole
      * authentication tables. If unspecified, this will be the default
      * PostgreSQL port of 5432.
-     * 
+     *
      * @return
      *     The port number of the PostgreSQL server.
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs while retrieving the property value.
      */
     public int getPostgreSQLPort() throws GuacamoleException {
@@ -217,15 +217,15 @@ public class PostgreSQLEnvironment extends JDBCEnvironment {
             DEFAULT_PORT
         );
     }
-    
+
     /**
      * Returns the name of the PostgreSQL database containing the Guacamole
      * authentication tables.
-     * 
+     *
      * @return
      *     The name of the PostgreSQL database.
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs while retrieving the property value, or if the
      *     value was not set, as this property is required.
      */
@@ -242,16 +242,16 @@ public class PostgreSQLEnvironment extends JDBCEnvironment {
     public String getPassword() throws GuacamoleException {
         return getRequiredProperty(PostgreSQLGuacamoleProperties.POSTGRESQL_PASSWORD);
     }
-    
+
     /**
      * Returns the defaultStatementTimeout set for PostgreSQL connections.
      * If unspecified, this will default to 0,
      * and should not be passed through to the backend.
-     * 
+     *
      * @return
      *     The statement timeout (in seconds)
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs while retrieving the property value.
      */
     public int getPostgreSQLDefaultStatementTimeout() throws GuacamoleException {
@@ -260,15 +260,15 @@ public class PostgreSQLEnvironment extends JDBCEnvironment {
             DEFAULT_STATEMENT_TIMEOUT
         );
     }
-    
+
     /**
      * Returns the socketTimeout property to set on PostgreSQL connections.
      * If unspecified, this will default to 0 (no timeout)
-     * 
+     *
      * @return
      *     The socketTimeout to use when waiting on read operations (in seconds)
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs while retrieving the property value.
      */
     public int getPostgreSQLSocketTimeout() throws GuacamoleException {
@@ -282,85 +282,93 @@ public class PostgreSQLEnvironment extends JDBCEnvironment {
     public boolean isRecursiveQuerySupported(SqlSession session) {
         return true; // All versions of PostgreSQL support recursive queries through CTEs
     }
-    
+
     /**
      * Get the SSL mode to use to make the JDBC connection to the PostgreSQL
      * server.  If unspecified this will default to PREFER, attempting SSL
      * and falling back to plain-text if SSL fails.
-     * 
+     *
      * @return
      *     The enum value of the SSL mode to use to make the JDBC connection
      *     to the server.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If an error occurs retrieving the value from guacamole.properties.
      */
     public PostgreSQLSSLMode getPostgreSQLSSLMode() throws GuacamoleException {
         return getProperty(PostgreSQLGuacamoleProperties.POSTGRESQL_SSL_MODE,
                 DEFAULT_SSL_MODE);
     }
-    
+
     /**
      * Return the SSL client certificate file to use to make the connection
      * to the PostgreSQL server.
-     * 
+     *
      * @return
      *     The SSL client certificate file to use for the PostgreSQL connection.
-     * 
+     *
      * @throws GuacamoleException
      *     If an error occurs retrieving the value from guacamole.properties.
      */
     public File getPostgreSQLSSLClientCertFile() throws GuacamoleException {
         return getProperty(PostgreSQLGuacamoleProperties.POSTGRESQL_SSL_CERT_FILE);
     }
-    
+
     /**
      * Return the SSL client private key file to use to make the connection to the
      * PostgreSQL server.
-     * 
+     *
      * @return
      *     The SSL client private key file to use for the PostgreSQL connection.
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs retrieving the value from guacamole.properties.
      */
     public File getPostgreSQLSSLClientKeyFile() throws GuacamoleException {
         return getProperty(PostgreSQLGuacamoleProperties.POSTGRESQL_SSL_KEY_FILE);
     }
-    
+
     /**
      * Return the SSL client root certificate file to use to make the connection
      * to the PostgreSQL server.
-     * 
+     *
      * @return
      *     The SSL client root certificate file to use to make the connection
      *     to the PostgreSQL server.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If an error occurs retrieving the value from guacamole.properties.
      */
     public File getPostgreSQLSSLClientRootCertFile() throws GuacamoleException {
         return getProperty(PostgreSQLGuacamoleProperties.POSTGRESQL_SSL_ROOT_CERT_FILE);
     }
-    
+
     /**
      * Return the password to use to decrypt the private SSL key file when making
      * the connection to the PostgreSQL server.
-     * 
+     *
      * @return
      *     The password to use to decrypt the private SSL key file when making
      *     the connection to the PostgreSQL server.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If an error occurs retrieving the value from guacamole.properties.
      */
     public String getPostgreSQLSSLClientKeyPassword() throws GuacamoleException {
         return getProperty(PostgreSQLGuacamoleProperties.POSTGRESQL_SSL_KEY_PASSWORD);
     }
-    
+
     @Override
     public boolean autoCreateAbsentAccounts() throws GuacamoleException {
         return getProperty(PostgreSQLGuacamoleProperties.POSTGRESQL_AUTO_CREATE_ACCOUNTS,
                 false);
     }
-    
+
+    @Override
+    public boolean trackExternalConnectionHistory() throws GuacamoleException {
+
+        // Track external connection history unless explicitly disabled
+        return getProperty(PostgreSQLGuacamoleProperties.POSTGRESQL_TRACK_EXTERNAL_CONNECTION_HISTORY,
+                true);
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
index 271d9c0dd..dfa00b68c 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
@@ -111,7 +111,7 @@ public class PostgreSQLGuacamoleProperties {
      * The number of seconds to wait for socket read operations.
      * If reading from the server takes longer than this value, the
      * connection will be closed. This can be used to handle network problems
-     * such as a dropped connection to the database. Similar to 
+     * such as a dropped connection to the database. Similar to
      * postgresql-default-statement-timeout, it will have the effect of
      * aborting queries that take too long.
      * A value of 0 (the default) means the timeout is disabled.
@@ -202,7 +202,7 @@ public class PostgreSQLGuacamoleProperties {
         public String getName() { return "postgresql-default-max-group-connections-per-user"; }
 
     };
-    
+
     /**
      * The SSL mode that should be used by the JDBC driver when making
      * connections to the remote server.  By default SSL will be attempted but
@@ -210,60 +210,60 @@ public class PostgreSQLGuacamoleProperties {
      */
     public static final EnumGuacamoleProperty<PostgreSQLSSLMode> POSTGRESQL_SSL_MODE =
             new EnumGuacamoleProperty<PostgreSQLSSLMode>(PostgreSQLSSLMode.class) {
-        
+
         @Override
         public String getName() { return "postgresql-ssl-mode"; }
-        
+
     };
-    
+
     /**
      * The client SSL certificate file used by the JDBC driver to make the
      * SSL connection.
      */
     public static final FileGuacamoleProperty POSTGRESQL_SSL_CERT_FILE =
             new FileGuacamoleProperty() {
-             
+
         @Override
         public String getName() { return "postgresql-ssl-cert-file"; }
-                
+
     };
-    
+
     /**
      * The client SSL private key file used by the JDBC driver to make the
      * SSL connection.
      */
     public static final FileGuacamoleProperty POSTGRESQL_SSL_KEY_FILE =
             new FileGuacamoleProperty() {
-    
+
         @Override
         public String getName() { return "postgresql-ssl-key-file"; }
-        
+
     };
-    
+
     /**
      * The client SSL root certificate file used by the JDBC driver to validate
      * certificates when making the SSL connection.
      */
     public static final FileGuacamoleProperty POSTGRESQL_SSL_ROOT_CERT_FILE =
             new FileGuacamoleProperty() {
-        
+
         @Override
         public String getName() { return "postgresql-ssl-root-cert-file"; }
-        
+
     };
-    
+
     /**
      * The password of the SSL private key used by the JDBC driver to make
      * the SSL connection to the PostgreSQL server.
      */
     public static final StringGuacamoleProperty POSTGRESQL_SSL_KEY_PASSWORD =
             new StringGuacamoleProperty() {
-        
+
         @Override
         public String getName() { return "postgresql-ssl-key-password"; }
-        
+
     };
-    
+
     /**
      * Whether or not to automatically create accounts in the PostgreSQL
      * database for users who successfully authenticate through another
@@ -271,10 +271,23 @@ public class PostgreSQLGuacamoleProperties {
      */
     public static final BooleanGuacamoleProperty POSTGRESQL_AUTO_CREATE_ACCOUNTS =
             new BooleanGuacamoleProperty() {
-                
+
         @Override
         public String getName() { return "postgresql-auto-create-accounts"; }
-                
+
     };
-    
+
+    /**
+     * Whether or not to track connection history for connections that do not originate
+     * from within the Postgres database. By default, external connection history will be
+     * tracked.
+     */
+    public static final BooleanGuacamoleProperty POSTGRESQL_TRACK_EXTERNAL_CONNECTION_HISTORY =
+            new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "postgresql-track-external-connection-history"; }
+
+    };
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
index 0e1554371..0b6983691 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
@@ -91,8 +91,8 @@ public class SQLServerEnvironment extends JDBCEnvironment {
     /**
      * Constructs a new SQLServerEnvironment, providing access to SQLServer-specific
      * configuration options.
-     * 
-     * @throws GuacamoleException 
+     *
+     * @throws GuacamoleException
      *     If an error occurs while setting up the underlying JDBCEnvironment
      *     or while parsing legacy SQLServer configuration options.
      */
@@ -158,11 +158,11 @@ public class SQLServerEnvironment extends JDBCEnvironment {
     /**
      * Returns the hostname of the SQLServer server hosting the Guacamole
      * authentication tables. If unspecified, this will be "localhost".
-     * 
+     *
      * @return
      *     The URL of the SQLServer server.
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs while retrieving the property value.
      */
     public String getSQLServerHostname() throws GuacamoleException {
@@ -171,15 +171,15 @@ public class SQLServerEnvironment extends JDBCEnvironment {
             DEFAULT_HOSTNAME
         );
     }
-    
+
     /**
      * Returns the instance name of the SQL Server installation hosting the
      * Guacamole database, if any.  If unspecified it will be null.
-     * 
+     *
      * @return
      *     The instance name of the SQL Server install hosting the Guacamole
      *     database, or null if undefined.
-     * 
+     *
      * @throws GuacamoleException
      *     If an error occurs reading guacamole.properties.
      */
@@ -188,16 +188,16 @@ public class SQLServerEnvironment extends JDBCEnvironment {
             SQLServerGuacamoleProperties.SQLSERVER_INSTANCE
         );
     }
-    
+
     /**
      * Returns the port number of the SQLServer server hosting the Guacamole
      * authentication tables. If unspecified, this will be the default
      * SQLServer port of 5432.
-     * 
+     *
      * @return
      *     The port number of the SQLServer server.
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs while retrieving the property value.
      */
     public int getSQLServerPort() throws GuacamoleException {
@@ -206,15 +206,15 @@ public class SQLServerEnvironment extends JDBCEnvironment {
             DEFAULT_PORT
         );
     }
-    
+
     /**
      * Returns the name of the SQLServer database containing the Guacamole
      * authentication tables.
-     * 
+     *
      * @return
      *     The name of the SQLServer database.
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs while retrieving the property value, or if the
      *     value was not set, as this property is required.
      */
@@ -226,7 +226,7 @@ public class SQLServerEnvironment extends JDBCEnvironment {
     public String getUsername() throws GuacamoleException {
         return getRequiredProperty(SQLServerGuacamoleProperties.SQLSERVER_USERNAME);
     }
-    
+
     @Override
     public String getPassword() throws GuacamoleException {
         return getRequiredProperty(SQLServerGuacamoleProperties.SQLSERVER_PASSWORD);
@@ -253,11 +253,19 @@ public class SQLServerEnvironment extends JDBCEnvironment {
     public boolean isRecursiveQuerySupported(SqlSession session) {
         return true; // All versions of SQL Server support recursive queries through CTEs
     }
-    
+
     @Override
     public boolean autoCreateAbsentAccounts() throws GuacamoleException {
         return getProperty(SQLServerGuacamoleProperties.SQLSERVER_AUTO_CREATE_ACCOUNTS,
                 false);
     }
 
+    @Override
+    public boolean trackExternalConnectionHistory() throws GuacamoleException {
+
+        // Track external connection history unless explicitly disabled
+        return getProperty(SQLServerGuacamoleProperties.SQLSERVER_TRACK_EXTERNAL_CONNECTION_HISTORY,
+                true);
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
index df63c53e9..432454ed8 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
@@ -44,7 +44,7 @@ public class SQLServerGuacamoleProperties {
         public String getName() { return "sqlserver-hostname"; }
 
     };
-    
+
     /**
      * The instance name of the SQL Server where the Guacamole database is running.
      */
@@ -53,7 +53,7 @@ public class SQLServerGuacamoleProperties {
 
         @Override
         public String getName() { return "sqlserver-instance"; }
-                
+
     };
 
     /**
@@ -193,7 +193,7 @@ public class SQLServerGuacamoleProperties {
         public String getName() { return "sqlserver-driver"; }
 
     };
-    
+
     /**
      * Whether or not to automatically create accounts in the SQL Server
      * database for users who successfully authenticate through another
@@ -201,10 +201,23 @@ public class SQLServerGuacamoleProperties {
      */
     public static final BooleanGuacamoleProperty SQLSERVER_AUTO_CREATE_ACCOUNTS =
             new BooleanGuacamoleProperty() {
-        
+
         @Override
         public String getName() { return "sqlserver-auto-create-accounts"; }
-        
+
+    };
+
+    /**
+     * Whether or not to track connection history for connections that do not originate
+     * from within the SQL Server database. By default, external connection history will be
+     * tracked.
+     */
+    public static final BooleanGuacamoleProperty SQLSERVER_TRACK_EXTERNAL_CONNECTION_HISTORY =
+            new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "sqlserver-track-external-connection-history"; }
+
     };
 
 }

From 7e4627c9434e88e0ccf15f7b39ebfcfb1d6308cb Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 31 May 2022 21:36:08 +0000
Subject: [PATCH 021/289] GUACAMOLE-1616: Store HISTORY_UUID in tokens for use
 by other extensions.

---
 .../guacamole/auth/jdbc/HistoryTrackingConnection.java     | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java
index 2a0bc3cc3..de02063d7 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java
@@ -20,11 +20,13 @@
 package org.apache.guacamole.auth.jdbc;
 
 import java.util.Date;
+import java.util.HashMap;
 import java.util.Map;
 
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordMapper;
 import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordModel;
+import org.apache.guacamole.auth.jdbc.connection.ModeledConnectionRecord;
 import org.apache.guacamole.net.GuacamoleTunnel;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.DelegatingConnection;
@@ -98,6 +100,11 @@ public class HistoryTrackingConnection extends DelegatingConnection {
         // Insert the connection history record to mark the start of this connection
         connectionRecordMapper.insert(connectionRecordModel);
 
+        // Include history record UUID as token
+        ModeledConnectionRecord modeledRecord = new ModeledConnectionRecord(connectionRecordModel);
+        Map<String, String> updatedTokens = new HashMap<>(tokens);
+        updatedTokens.put("HISTORY_UUID", modeledRecord.getUUID().toString());
+
         // Connect, and wrap the tunnel for return
         GuacamoleTunnel tunnel = super.connect(info, tokens);
         return new HistoryTrackingTunnel(

From 31f9107ca23618746edf2de4b13b03e33a3e3fec Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 3 Jun 2022 20:51:59 +0000
Subject: [PATCH 022/289] GUACAMOLE-1616: Send updated tokens after adding
 HISTORY_UUID.

---
 .../apache/guacamole/auth/jdbc/HistoryTrackingConnection.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java
index de02063d7..f25620bda 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/HistoryTrackingConnection.java
@@ -106,7 +106,7 @@ public class HistoryTrackingConnection extends DelegatingConnection {
         updatedTokens.put("HISTORY_UUID", modeledRecord.getUUID().toString());
 
         // Connect, and wrap the tunnel for return
-        GuacamoleTunnel tunnel = super.connect(info, tokens);
+        GuacamoleTunnel tunnel = super.connect(info, updatedTokens);
         return new HistoryTrackingTunnel(
             tunnel, this.connectionRecordMapper, connectionRecordModel);
     }

From eaab38c200cfc77ff7a9ce27046e6eaaa7a99021 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Mon, 6 Jun 2022 11:20:35 -0400
Subject: [PATCH 023/289] GUACAMOLE-1606: UserGroup should retrieve UserGroup
 attributes, not User attributes.

---
 .../guacamole/rest/usergroup/UserGroupObjectTranslator.java     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java
index 721156ac6..88000b010 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java
@@ -57,7 +57,7 @@ public class UserGroupObjectTranslator
             throws GuacamoleException {
 
         // Filter object attributes by defined schema
-        object.setAttributes(filterAttributes(userContext.getUserAttributes(),
+        object.setAttributes(filterAttributes(userContext.getUserGroupAttributes(),
                 object.getAttributes()));
 
     }

From 647cfa6a0c039fb00d12b3843390bb07593bb3f2 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 15 Jun 2022 22:44:32 +0000
Subject: [PATCH 024/289] GUACAMOLE-1623: Extract domain field directly from
 the vault, or split out of username.

---
 .../modules/guacamole-vault-base/pom.xml      |   7 +
 .../vault/conf/VaultConfigurationService.java |  27 ++-
 .../vault/secret/WindowsUsername.java         | 157 ++++++++++++++++++
 .../vault/secret/WindowsUsernameTest.java     |  81 +++++++++
 .../ksm/conf/KsmConfigurationService.java     |  17 ++
 .../guacamole/vault/ksm/secret/KsmClient.java |   7 +-
 .../vault/ksm/secret/KsmRecordService.java    |  58 ++++++-
 .../vault/ksm/secret/KsmSecretService.java    |  49 +++++-
 8 files changed, 381 insertions(+), 22 deletions(-)
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/secret/WindowsUsername.java
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-base/src/test/java/org/apache/guacamole/vault/secret/WindowsUsernameTest.java

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/pom.xml b/extensions/guacamole-vault/modules/guacamole-vault-base/pom.xml
index 96fe1180a..a8137b52f 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/pom.xml
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/pom.xml
@@ -59,6 +59,13 @@
             <artifactId>jackson-dataformat-yaml</artifactId>
         </dependency>
 
+        <!-- JUnit -->
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+
         <!-- Guice -->
         <dependency>
             <groupId>com.google.inject</groupId>
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultConfigurationService.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultConfigurationService.java
index a666a7b97..490da6816 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultConfigurationService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultConfigurationService.java
@@ -55,7 +55,7 @@ public abstract class VaultConfigurationService {
 
     @Inject
     private VaultSecretService secretService;
-    
+
     /**
      * ObjectMapper for deserializing YAML.
      */
@@ -127,7 +127,7 @@ public abstract class VaultConfigurationService {
                 return Collections.emptyMap();
 
             return mapping;
-            
+
         }
 
         // Fail if YAML is invalid/unreadable
@@ -169,7 +169,7 @@ public abstract class VaultConfigurationService {
                     String secretName = super.getProperty(name);
                     if (secretName == null)
                         return null;
-                    
+
                     return secretService.getValue(secretName).get();
 
                 }
@@ -177,7 +177,7 @@ public abstract class VaultConfigurationService {
 
                     if (e.getCause() instanceof GuacamoleException)
                         throw (GuacamoleException) e;
-                    
+
                     throw new GuacamoleServerException(String.format("Property "
                             + "\"%s\" could not be retrieved from the vault.", name), e);
                 }
@@ -187,4 +187,23 @@ public abstract class VaultConfigurationService {
 
     }
 
+    /**
+     * Return whether Windows domains should be split out from usernames when
+     * fetched from the vault.
+     *
+     * For example: "DOMAIN\\user" or "user@DOMAIN" should both
+     * be split into seperate username and domain tokens if this configuration
+     * is true. If false, no domain token should be created and the above values
+     * should be stored directly in the username token.
+     *
+     * @return
+     *     true if windows domains should be split out from usernames, false
+     *     otherwise.
+     *
+     * @throws GuacamoleException
+     *     If the value specified within guacamole.properties cannot be
+     *     parsed.
+     */
+    public abstract boolean getSplitWindowsUsernames() throws GuacamoleException;
+
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/secret/WindowsUsername.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/secret/WindowsUsername.java
new file mode 100644
index 000000000..36d8a1b05
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/secret/WindowsUsername.java
@@ -0,0 +1,157 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.secret;
+
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import javax.annotation.Nonnull;
+
+/**
+ * A class representing a Windows username, which may optionally also include
+ * a domain. This class can be used to parse the username and domain out of a
+ * username from a vault.
+ */
+public class WindowsUsername {
+
+    /**
+     * A pattern for matching a down-level logon name containing a Windows
+     * domain and username - e.g. domain\\user. For more information, see
+     * https://docs.microsoft.com/en-us/windows/win32/secauthn/user-name-formats#down-level-logon-name
+     */
+    private static final Pattern DOWN_LEVEL_LOGON_NAME_PATTERN = Pattern.compile(
+            "(?<domain>[^@\\\\]+)\\\\(?<username>[^@\\\\]+)");
+
+    /**
+     * A pattern for matching a user principal name containing a Windows
+     * domain and username - e.g. user@domain. For more information, see
+     * https://docs.microsoft.com/en-us/windows/win32/secauthn/user-name-formats#user-principal-name
+     */
+    private static final  Pattern USER_PRINCIPAL_NAME_PATTERN = Pattern.compile(
+            "(?<username>[^@\\\\]+)@(?<domain>[^@\\\\]+)");
+
+    /**
+     * The username associated with the potential Windows domain/username
+     * value. If no domain is found, the username field will contain the
+     * entire value as read from the vault.
+     */
+    private final String username;
+
+    /**
+     * The dinaun associated with the potential Windows domain/username
+     * value. If no domain is found, this will be null.
+     */
+    private final String domain;
+
+    /**
+     * Create a WindowsUsername record with no associated domain.
+     *
+     * @param username
+     *     The username, which should be the entire value as extracted
+     *     from the vault.
+     */
+    private WindowsUsername(@Nonnull String username) {
+        this.username = username;
+        this.domain = null;
+    }
+
+    /**
+     * Create a WindowsUsername record with a username and a domain.
+     *
+     * @param username
+     *     The username portion of the field value from the vault.
+     *
+     * @param domain
+     *     The domain portion of the field value from the vault.
+     */
+    private WindowsUsername(
+            @Nonnull String username, @Nonnull String domain) {
+        this.username = username;
+        this.domain = domain;
+    }
+
+    /**
+     * Return the value of the username as extracted from the vault field.
+     * If the domain is null, this will be the entire field value.
+     *
+     * @return
+     *     The username value as extracted from the vault field.
+     */
+    public String getUsername() {
+        return username;
+    }
+
+    /**
+     * Return the value of the domain as extracted from the vault field.
+     * If this is null, it means that no domain was found in the vault field.
+     *
+     * @return
+     *     The domain value as extracted from the vault field.
+     */
+    public String getDomain() {
+        return domain;
+    }
+
+    /**
+     * Return true if a domain was found in the vault field, false otherwise.
+     *
+     * @return
+     *     true if a domain was found in the vault field, false otherwise.
+     */
+    public boolean hasDomain() {
+        return this.domain != null;
+    }
+
+    /**
+     * Strip off a Windows domain from the provided username, if one is
+     * present. For example: "DOMAIN\\user" or "user@DOMAIN" will both
+     * be stripped to just "user". Note: neither the '@' or '\\' characters
+     * are valid in Windows usernames.
+     *
+     * @param vaultField
+     *     The raw field value as retrieved from the vault. This might contain
+     *     a Windows domain.
+     *
+     * @return
+     *     The provided username with the Windows domain stripped off, if one
+     *     is present.
+     */
+    public static WindowsUsername splitWindowsUsernameFromDomain(String vaultField) {
+
+        // If it's the down-level logon format, return the extracted username and domain
+        Matcher downLevelLogonMatcher = DOWN_LEVEL_LOGON_NAME_PATTERN.matcher(vaultField);
+        if (downLevelLogonMatcher.matches())
+            return new WindowsUsername(
+                    downLevelLogonMatcher.group("username"),
+                    downLevelLogonMatcher.group("domain"));
+
+        // If it's the user principal format, return the extracted username and domain
+        Matcher userPrincipalMatcher = USER_PRINCIPAL_NAME_PATTERN.matcher(vaultField);
+        if (userPrincipalMatcher.matches())
+            return new WindowsUsername(
+                    userPrincipalMatcher.group("username"),
+                    userPrincipalMatcher.group("domain"));
+
+        // If none of the expected formats matched, return the username with do domain
+        return new WindowsUsername(vaultField);
+
+    }
+
+}
\ No newline at end of file
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/test/java/org/apache/guacamole/vault/secret/WindowsUsernameTest.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/test/java/org/apache/guacamole/vault/secret/WindowsUsernameTest.java
new file mode 100644
index 000000000..9a4c5c716
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/test/java/org/apache/guacamole/vault/secret/WindowsUsernameTest.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.secret;
+
+import org.junit.Test;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.util.List;
+
+/**
+ * Class to test the parsing functionality of the WindowsUsername class.
+ */
+public class WindowsUsernameTest {
+
+    /**
+     * Verify that the splitWindowsUsernameFromDomain() method correctly strips Windows
+     * domains from provided usernames that include them, and does not modify
+     * usernames that do not have Windows domains.
+     */
+    @Test
+    public void testSplitWindowsUsernameFromDomain() {
+
+        WindowsUsername usernameAndDomain;
+
+        // If no Windows domain is present in the provided field, the username should
+        // contain the entire field, and no domain should be returned
+        usernameAndDomain = WindowsUsername.splitWindowsUsernameFromDomain("bob");
+        assertEquals(usernameAndDomain.getUsername(), "bob");
+        assertFalse(usernameAndDomain.hasDomain());
+
+        // It should parse down-level logon name style domains
+        usernameAndDomain = WindowsUsername.splitWindowsUsernameFromDomain("localhost\\bob");
+        assertEquals("bob", usernameAndDomain.getUsername(), "bob");
+        assertTrue(usernameAndDomain.hasDomain());
+        assertEquals("localhost", usernameAndDomain.getDomain());
+
+        // It should parse user principal name style domains
+        usernameAndDomain = WindowsUsername.splitWindowsUsernameFromDomain("bob@localhost");
+        assertEquals("bob", usernameAndDomain.getUsername(), "bob");
+        assertTrue(usernameAndDomain.hasDomain());
+        assertEquals("localhost", usernameAndDomain.getDomain());
+
+        // It should not match if there are an invalid number of separators
+        List<String> invalidSeparators = List.of(
+                "bob@local@host", "local\\host\\bob",
+                "bob\\local@host", "local@host\\bob");
+        invalidSeparators.stream().forEach(
+            invalidSeparator -> {
+
+                // An invalid number of separators means that the parse failed -
+                // there should be no detected domain, and the entire field value
+                // should be returned as the username
+                WindowsUsername parseOutput =
+                        WindowsUsername.splitWindowsUsernameFromDomain(invalidSeparator);
+                assertFalse(parseOutput.hasDomain());
+                assertEquals(invalidSeparator, parseOutput.getUsername());
+
+            });
+
+    }
+
+}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
index 38bcaaef1..0bd3f40da 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
@@ -76,6 +76,18 @@ public class KsmConfigurationService extends VaultConfigurationService {
         }
     };
 
+    /**
+     * Whether windows domains should be stripped off from usernames that are
+     * read from the KSM vault.
+     */
+    private static final BooleanGuacamoleProperty STRIP_WINDOWS_DOMAINS = new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() {
+            return "ksm-strip-windows-domains";
+        }
+    };
+
     /**
      * Creates a new KsmConfigurationService which reads the configuration
      * from "ksm-token-mapping.yml" and properties from
@@ -105,6 +117,11 @@ public class KsmConfigurationService extends VaultConfigurationService {
         return environment.getProperty(ALLOW_UNVERIFIED_CERT, false);
     }
 
+    @Override
+    public boolean getSplitWindowsUsernames() throws GuacamoleException {
+        return environment.getProperty(STRIP_WINDOWS_DOMAINS, false);
+    }
+
     /**
      * Returns the options required to authenticate with Keeper Secrets Manager
      * when retrieving secrets. These options are read from the contents of
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index 2372dcb29..fa177014b 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -22,7 +22,6 @@ package org.apache.guacamole.vault.ksm.secret;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import com.keepersecurity.secretsManager.core.Hosts;
-import com.keepersecurity.secretsManager.core.KeeperFile;
 import com.keepersecurity.secretsManager.core.KeeperRecord;
 import com.keepersecurity.secretsManager.core.KeeperSecrets;
 import com.keepersecurity.secretsManager.core.Login;
@@ -119,7 +118,7 @@ public class KsmClient {
      * {@link #cacheLock} acquired appropriately.
      */
     private KeeperSecrets cachedSecrets = null;
-    
+
     /**
      * All records retrieved from Keeper Secrets Manager, where each key is the
      * UID of the corresponding record. The contents of this Map are
@@ -216,7 +215,7 @@ public class KsmClient {
 
             // Store all secrets within cache
             cachedSecrets = secrets;
-            
+
             // Clear unambiguous cache of all records by UID
             cachedRecordsByUid.clear();
 
@@ -398,7 +397,7 @@ public class KsmClient {
      *     The record associated with the given username, or null if there is
      *     no such record or multiple such records.
      *
-     * @throws GuacamoleException 
+     * @throws GuacamoleException
      *     If an error occurs that prevents the record from being retrieved.
      */
     public KeeperRecord getRecordByLogin(String username) throws GuacamoleException {
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java
index d67b5816a..a3d79b49e 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java
@@ -41,12 +41,20 @@ import java.util.function.Function;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
+
 /**
  * Service for automatically parsing out secrets and data from Keeper records.
  */
 @Singleton
 public class KsmRecordService {
 
+    /**
+     * Regular expression which matches the labels of custom fields containing
+     * domains.
+     */
+    private static final Pattern DOMAIN_LABEL_PATTERN =
+            Pattern.compile("domain", Pattern.CASE_INSENSITIVE);
+
     /**
      * Regular expression which matches the labels of custom fields containing
      * hostnames/addresses.
@@ -143,13 +151,13 @@ public class KsmRecordService {
      * empty or contains multiple values, null is returned. Note that null will
      * also be returned if the mapping transformation returns null for the
      * single value stored in the list.
-     * 
+     *
      * @param <T>
      *     The type of object stored in the list.
-     *     
+     *
      * @param <R>
      *     The type of object to return.
-     *     
+     *
      * @param values
      *     The list to retrieve a single value from.
      *
@@ -168,7 +176,7 @@ public class KsmRecordService {
             return null;
 
         return mapper.apply(value);
-        
+
     }
 
     /**
@@ -271,7 +279,7 @@ public class KsmRecordService {
      * multiple such fields, null is returned. Both standard and custom fields
      * are searched. As standard fields do not have labels, any given label
      * pattern is ignored for standard fields.
-     * 
+     *
      * @param <T>
      *     The type of field to return.
      *
@@ -339,7 +347,7 @@ public class KsmRecordService {
                 return null;
 
             foundFile = file;
-            
+
         }
 
         return foundFile;
@@ -362,7 +370,7 @@ public class KsmRecordService {
 
         if (file == null)
             return CompletableFuture.completedFuture(null);
-        
+
         return CompletableFuture.supplyAsync(() -> {
             return new String(SecretsManager.downloadFile(file), StandardCharsets.UTF_8);
         });
@@ -445,6 +453,38 @@ public class KsmRecordService {
 
     }
 
+    /**
+     * Returns the single domain associated with the given record. If the
+     * record has no associated domain, or multiple domains, null is
+     * returned. Domains are retrieved from "Text" and "Hidden" fields
+     * that have the label "domain" (case-insensitive).
+     *
+     * @param record
+     *     The record to retrieve the domain from.
+     *
+     * @return
+     *     The domain associated with the given record, or null if the record
+     *     has no associated domain or multiple domains.
+     */
+    public String getDomain(KeeperRecord record) {
+
+        KeeperRecordData data = record.getData();
+        List<KeeperRecordField> custom = data.getCustom();
+
+        // First check text "domain" custom field ...
+        Text textField = getField(custom, Text.class, DOMAIN_LABEL_PATTERN);
+        if (textField != null)
+            return getSingleStringValue(textField.getValue());
+
+        // ... or hidden "domain" custom field if that's not found
+        HiddenField hiddenField = getField(custom, HiddenField.class, DOMAIN_LABEL_PATTERN);
+        if (hiddenField != null)
+            return getSingleStringValue(hiddenField.getValue());
+
+        return null;
+
+    }
+
     /**
      * Returns the password associated with the given record. Both standard and
      * custom fields are searched. Only "Password" and "Hidden" field types are
@@ -555,7 +595,7 @@ public class KsmRecordService {
         // a pair of custom hidden fields for the private key and passphrase:
         // the standard password field of the "Login" record refers to the
         // user's own password, if any, not the passphrase of their key)
-        
+
         // Use password "private key" custom field as fallback ...
         Password passwordField = getField(custom, Password.class, PASSPHRASE_LABEL_PATTERN);
         if (passwordField != null)
@@ -567,7 +607,7 @@ public class KsmRecordService {
             return getSingleStringValue(hiddenField.getValue());
 
         return null;
-        
+
     }
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index 824f9e54e..21d7c91ac 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -32,7 +32,9 @@ import java.util.concurrent.Future;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.protocol.GuacamoleConfiguration;
 import org.apache.guacamole.token.TokenFilter;
+import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
 import org.apache.guacamole.vault.secret.VaultSecretService;
+import org.apache.guacamole.vault.secret.WindowsUsername;
 
 /**
  * Service which retrieves secrets from Keeper Secrets Manager.
@@ -52,6 +54,12 @@ public class KsmSecretService implements VaultSecretService {
     @Inject
     private KsmRecordService recordService;
 
+    /**
+     * Service for retrieving configuration information.
+     */
+    @Inject
+    private KsmConfigurationService confService;
+
     @Override
     public String canonicalize(String nameComponent) {
         try {
@@ -86,17 +94,48 @@ public class KsmSecretService implements VaultSecretService {
      * @param record
      *     The record to retrieve secrets from when generating tokens. This may
      *     be null.
+     *
+     * @throws GuacamoleException
+     *     If configuration details in guacamole.properties cannot be parsed.
      */
     private void addRecordTokens(Map<String, Future<String>> tokens, String prefix,
-            KeeperRecord record) {
+            KeeperRecord record) throws GuacamoleException {
 
         if (record == null)
             return;
 
+        // Domain of server-related record
+        String domain = recordService.getDomain(record);
+        if (domain != null)
+            tokens.put(prefix + "DOMAIN", CompletableFuture.completedFuture(domain));
+
         // Username of server-related record
         String username = recordService.getUsername(record);
-        if (username != null)
-            tokens.put(prefix + "USERNAME", CompletableFuture.completedFuture(username));
+        if (username != null) {
+
+            // If the record had no directly defined domain, but there is a
+            // username, and the configuration is enabled to split Windows
+            // domains out of usernames, attempt to split the domain out now
+            if (domain == null && confService.getSplitWindowsUsernames()) {
+                WindowsUsername usernameAndDomain =
+                        WindowsUsername.splitWindowsUsernameFromDomain(username);
+
+                // Always store the username token
+                tokens.put(prefix + "USERNAME", CompletableFuture.completedFuture(
+                        usernameAndDomain.getUsername()));
+
+                // Only store the domain if one is detected
+                if (usernameAndDomain.hasDomain())
+                    tokens.put(prefix + "DOMAIN", CompletableFuture.completedFuture(
+                        usernameAndDomain.getDomain()));
+
+            }
+
+            // If splitting is not enabled, store the whole value in the USERNAME token
+            else {
+                tokens.put(prefix + "USERNAME", CompletableFuture.completedFuture(username));
+            }
+        }
 
         // Password of server-related record
         String password = recordService.getPassword(record);
@@ -113,7 +152,7 @@ public class KsmSecretService implements VaultSecretService {
         tokens.put(prefix + "KEY", privateKey);
 
     }
-    
+
     @Override
     public Map<String, Future<String>> getTokens(GuacamoleConfiguration config,
             TokenFilter filter) throws GuacamoleException {
@@ -135,7 +174,7 @@ public class KsmSecretService implements VaultSecretService {
 
         // Tokens specific to RDP
         if ("rdp".equals(config.getProtocol())) {
-        
+
             // Retrieve and define gateway server-specific tokens, if any
             String gatewayHostname = parameters.get("gateway-hostname");
             if (gatewayHostname != null && !gatewayHostname.isEmpty())

From f64bd30e9de561e01fcb23ba11e9444c0076f46f Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 23 Jun 2022 02:18:21 +0000
Subject: [PATCH 025/289] GUACAMOLE-1623: Use Java 8 List initializer to fix
 Java 8 builds.

---
 .../org/apache/guacamole/vault/secret/WindowsUsernameTest.java | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/test/java/org/apache/guacamole/vault/secret/WindowsUsernameTest.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/test/java/org/apache/guacamole/vault/secret/WindowsUsernameTest.java
index 9a4c5c716..61f454683 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/test/java/org/apache/guacamole/vault/secret/WindowsUsernameTest.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/test/java/org/apache/guacamole/vault/secret/WindowsUsernameTest.java
@@ -24,6 +24,7 @@ import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 
+import java.util.Arrays;
 import java.util.List;
 
 /**
@@ -60,7 +61,7 @@ public class WindowsUsernameTest {
         assertEquals("localhost", usernameAndDomain.getDomain());
 
         // It should not match if there are an invalid number of separators
-        List<String> invalidSeparators = List.of(
+        List<String> invalidSeparators = Arrays.asList(
                 "bob@local@host", "local\\host\\bob",
                 "bob\\local@host", "local@host\\bob");
         invalidSeparators.stream().forEach(

From f7d90a641ee4d0d715c4b0f53f7ed1368cb850cc Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 28 Jun 2022 20:55:19 +0000
Subject: [PATCH 026/289] GUACAMOLE-1629: Add configuration properties and
 associated translations.

---
 .../vault/conf/VaultAttributeService.java     | 40 ++++++++++++
 .../vault/user/VaultUserContext.java          | 16 +++++
 .../ksm/KsmAuthenticationProviderModule.java  |  3 +
 .../vault/ksm/conf/KsmAttributeService.java   | 63 +++++++++++++++++++
 .../src/main/resources/translations/en.json   | 12 ++++
 5 files changed, 134 insertions(+)
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
new file mode 100644
index 000000000..b77601621
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.conf;
+
+import java.util.Collection;
+
+import org.apache.guacamole.form.Form;
+
+/**
+ * A service that exposes attributes for the admin UI, specific to the vault
+ * implementation. Any vault implementation will need to expose the attributes
+ * necessary for that implementation.
+ */
+public interface VaultAttributeService {
+
+    /**
+     * Return all connection group attributes to be exposed through the admin UI.
+     *
+     * @return
+     *     All connection group attributes to be exposed through the admin UI.
+     */
+    public Collection<Form> getConnectionGroupAttributes();
+}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
index 53901483e..58056842b 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
@@ -22,12 +22,15 @@ package org.apache.guacamole.vault.user;
 import com.google.inject.Inject;
 import com.google.inject.assistedinject.Assisted;
 import com.google.inject.assistedinject.AssistedInject;
+
+import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.Future;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.form.Form;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.ConnectionGroup;
 import org.apache.guacamole.net.auth.TokenInjectingUserContext;
@@ -35,6 +38,7 @@ import org.apache.guacamole.net.auth.UserContext;
 import org.apache.guacamole.protocol.GuacamoleConfiguration;
 import org.apache.guacamole.token.GuacamoleTokenUndefinedException;
 import org.apache.guacamole.token.TokenFilter;
+import org.apache.guacamole.vault.conf.VaultAttributeService;
 import org.apache.guacamole.vault.conf.VaultConfigurationService;
 import org.apache.guacamole.vault.secret.VaultSecretService;
 import org.slf4j.Logger;
@@ -121,6 +125,13 @@ public class VaultUserContext extends TokenInjectingUserContext {
     @Inject
     private VaultSecretService secretService;
 
+    /**
+     * Service for retrieving any custom attributes defined for the
+     * current vault implementation.
+     */
+    @Inject
+    private VaultAttributeService attributeService;
+
     /**
      * Creates a new VaultUserContext which automatically injects tokens
      * containing values of secrets retrieved from a vault. The given
@@ -403,4 +414,9 @@ public class VaultUserContext extends TokenInjectingUserContext {
 
     }
 
+    @Override
+    public Collection<Form> getConnectionGroupAttributes() {
+        return attributeService.getConnectionGroupAttributes();
+    }
+
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
index bcc5a784e..17580b8a0 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
@@ -21,8 +21,10 @@ package org.apache.guacamole.vault.ksm;
 
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.vault.VaultAuthenticationProviderModule;
+import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
 import org.apache.guacamole.vault.ksm.secret.KsmSecretService;
+import org.apache.guacamole.vault.conf.VaultAttributeService;
 import org.apache.guacamole.vault.conf.VaultConfigurationService;
 import org.apache.guacamole.vault.ksm.secret.KsmClient;
 import org.apache.guacamole.vault.ksm.secret.KsmRecordService;
@@ -51,6 +53,7 @@ public class KsmAuthenticationProviderModule
         // Bind services specific to Keeper Secrets Manager
         bind(KsmClient.class);
         bind(KsmRecordService.class);
+        bind(VaultAttributeService.class).to(KsmAttributeService.class);
         bind(VaultConfigurationService.class).to(KsmConfigurationService.class);
         bind(VaultSecretService.class).to(KsmSecretService.class);
     }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
new file mode 100644
index 000000000..ade0f97e9
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.conf;
+
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+
+import org.apache.guacamole.form.Form;
+import org.apache.guacamole.form.MultilineField;
+import org.apache.guacamole.vault.conf.VaultAttributeService;
+
+import com.google.inject.Singleton;
+
+/**
+ * A service that exposes KSM-specific attributes, allowing setting KSM
+ * configuration through the admin interface.
+ */
+@Singleton
+public class KsmAttributeService implements VaultAttributeService {
+
+    /**
+     * The name of the attribute which can contain a KSM configuration blob
+     * associated with a connection group.
+     */
+    public static final String KSM_CONFIGURATION_ATTRIBUTE = "ksm-config";
+
+    /**
+     * All attributes related to configuring the KSM vault on a
+     * per-connection-group basis.
+     */
+    public static final Form KSM_CONFIGURATION_FORM = new Form("ksm-config",
+            Arrays.asList(new MultilineField(KSM_CONFIGURATION_ATTRIBUTE)));
+
+    /**
+     * All KSM-specific connection group attributes, organized by form.
+     */
+    public static final Collection<Form> KSM_CONNECTION_GROUP_ATTRIBUTES =
+            Collections.unmodifiableCollection(Arrays.asList(KSM_CONFIGURATION_FORM));
+
+    @Override
+    public Collection<Form> getConnectionGroupAttributes() {
+        return KSM_CONNECTION_GROUP_ATTRIBUTES;
+    }
+
+}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json
new file mode 100644
index 000000000..abda16cef
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json
@@ -0,0 +1,12 @@
+{
+
+    "DATA_SOURCE_KEEPER_SECRETS_MANAGER" : {
+        "NAME" : "Keeper Secrets Manager"
+    },
+
+    "CONNECTION_GROUP_ATTRIBUTES" : {
+        "SECTION_HEADER_KSM_CONFIG" : "Keeper Secrets Manager",
+        "FIELD_HEADER_KSM_CONFIG"   : "KSM Service Configuration "
+    }
+
+}

From 16efc0cdc1836617933c701505ed53b877f1a121 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 28 Jun 2022 23:19:15 +0000
Subject: [PATCH 027/289] GUACAMOLE-1629: Implement multiple-vault support for
 KSM codebase.

---
 .../ksm/KsmAuthenticationProviderModule.java  |   9 +
 .../guacamole/vault/ksm/conf/KsmConfig.java   |  60 +++
 .../vault/ksm/conf/KsmConfigProperty.java     |  13 +-
 .../ksm/conf/KsmConfigurationService.java     |  30 +-
 .../guacamole/vault/ksm/secret/KsmCache.java  | 484 ++++++++++++++++++
 .../vault/ksm/secret/KsmCacheFactory.java     |  45 ++
 .../guacamole/vault/ksm/secret/KsmClient.java | 426 ++++-----------
 7 files changed, 712 insertions(+), 355 deletions(-)
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfig.java
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCache.java
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCacheFactory.java

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
index 17580b8a0..9d54439ea 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
@@ -26,10 +26,14 @@ import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
 import org.apache.guacamole.vault.ksm.secret.KsmSecretService;
 import org.apache.guacamole.vault.conf.VaultAttributeService;
 import org.apache.guacamole.vault.conf.VaultConfigurationService;
+import org.apache.guacamole.vault.ksm.secret.KsmCache;
+import org.apache.guacamole.vault.ksm.secret.KsmCacheFactory;
 import org.apache.guacamole.vault.ksm.secret.KsmClient;
 import org.apache.guacamole.vault.ksm.secret.KsmRecordService;
 import org.apache.guacamole.vault.secret.VaultSecretService;
 
+import com.google.inject.assistedinject.FactoryModuleBuilder;
+
 /**
  * Guice module which configures injections specific to Keeper Secrets
  * Manager support.
@@ -56,6 +60,11 @@ public class KsmAuthenticationProviderModule
         bind(VaultAttributeService.class).to(KsmAttributeService.class);
         bind(VaultConfigurationService.class).to(KsmConfigurationService.class);
         bind(VaultSecretService.class).to(KsmSecretService.class);
+
+        // Bind factory for creating KSM Caches
+        install(new FactoryModuleBuilder()
+                .implement(KsmCache.class, KsmCache.class)
+                .build(KsmCacheFactory.class));
     }
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfig.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfig.java
new file mode 100644
index 000000000..54aaec753
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfig.java
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.conf;
+
+import com.keepersecurity.secretsManager.core.InMemoryStorage;
+import com.keepersecurity.secretsManager.core.KeyValueStorage;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleServerException;
+
+/**
+ * A utility for parsing base64-encoded JSON, as output by the Keeper Commander
+ * CLI tool via the "sm client add" command into a Keeper Secrets Manager
+ * {@link KeyValueStorage} object.
+ */
+public class KsmConfig {
+
+    /**
+     * Given a base64-encoded JSON KSM configuration, parse and return a
+     * KeyValueStorage object.
+     *
+     * @param value
+     *     The base64-encoded JSON KSM configuration to parse.
+     *
+     * @return
+     *     The KeyValueStorage that is a result of the parsing operation
+     *
+     * @throws GuacamoleException
+     *     If the provided value is not valid base-64 encoded JSON KSM configuration.
+     */
+    public static KeyValueStorage parseKsmConfig(String value) throws GuacamoleException {
+
+        // Parse base64 value as KSM config storage
+        try {
+            return new InMemoryStorage(value);
+        }
+        catch (IllegalArgumentException e) {
+            throw new GuacamoleServerException("Invalid base64 configuration "
+                    + "for Keeper Secrets Manager.", e);
+        }
+
+    }
+
+}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigProperty.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigProperty.java
index aaddb0de0..afd8c921a 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigProperty.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigProperty.java
@@ -19,10 +19,8 @@
 
 package org.apache.guacamole.vault.ksm.conf;
 
-import com.keepersecurity.secretsManager.core.InMemoryStorage;
 import com.keepersecurity.secretsManager.core.KeyValueStorage;
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.properties.GuacamoleProperty;
 
 /**
@@ -39,15 +37,8 @@ public abstract class KsmConfigProperty implements GuacamoleProperty<KeyValueSto
         if (value == null)
             return null;
 
-        // Parse base64 value as KSM config storage
-        try {
-            return new InMemoryStorage(value);
-        }
-        catch (IllegalArgumentException e) {
-            throw new GuacamoleServerException("Invalid base64 configuration "
-                    + "for Keeper Secrets Manager.", e);
-        }
-
+        // Parse the base-64 encoded JSON into a KeyValueStorage object
+        return KsmConfig.parseKsmConfig(value);
     }
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
index 0bd3f40da..c50662cf5 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
@@ -21,10 +21,15 @@ package org.apache.guacamole.vault.ksm.conf;
 
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
+
+import javax.annotation.Nullable;
+
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.properties.BooleanGuacamoleProperty;
 import org.apache.guacamole.vault.conf.VaultConfigurationService;
+
+import com.keepersecurity.secretsManager.core.KeyValueStorage;
 import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
 
 /**
@@ -126,18 +131,31 @@ public class KsmConfigurationService extends VaultConfigurationService {
      * Returns the options required to authenticate with Keeper Secrets Manager
      * when retrieving secrets. These options are read from the contents of
      * base64-encoded JSON configuration data generated by the Keeper Commander
-     * CLI tool.
+     * CLI tool. This configuration data may be passed directly as an argument.
+     * If not provided as an argument, it must be present in the config file.
+     *
+     * @param ksmConfig
+     *     Optional KSM config data. If provided, it will be used instead of any
+     *     KSM config data present in the config file. If not provided, the value
+     *     in the config file will be used.
      *
      * @return
      *     The options that should be used when connecting to Keeper Secrets
      *     Manager when retrieving secrets.
      *
      * @throws GuacamoleException
-     *     If required properties are not specified within
-     *     guacamole.properties or cannot be parsed.
+     *     If an invalid ksmConfig parameter is provided, or required properties
+     *     are not specified within guacamole.properties or cannot be parsed, or
+     *     the KSM configuration cannot be parsed.
      */
-    public SecretsManagerOptions getSecretsManagerOptions() throws GuacamoleException {
-        return new SecretsManagerOptions(environment.getRequiredProperty(KSM_CONFIG), null,
-                getAllowUnverifiedCertificate());
+    public SecretsManagerOptions getSecretsManagerOptions(@Nullable String ksmConfig) throws GuacamoleException {
+
+        // Attempt to parse the KSM config provided as an argument if available.
+        // If not provided as an argument, it must be present in the config file.
+        KeyValueStorage parsedKsmConfig = ksmConfig != null
+                ? KsmConfig.parseKsmConfig(ksmConfig)
+                : environment.getRequiredProperty(KSM_CONFIG);
+
+        return new SecretsManagerOptions(parsedKsmConfig, null, getAllowUnverifiedCertificate());
     }
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCache.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCache.java
new file mode 100644
index 000000000..178493871
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCache.java
@@ -0,0 +1,484 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.secret;
+
+import com.google.inject.Inject;
+import com.google.inject.assistedinject.Assisted;
+import com.google.inject.assistedinject.AssistedInject;
+import com.keepersecurity.secretsManager.core.Hosts;
+import com.keepersecurity.secretsManager.core.KeeperRecord;
+import com.keepersecurity.secretsManager.core.KeeperSecrets;
+import com.keepersecurity.secretsManager.core.Login;
+import com.keepersecurity.secretsManager.core.Notation;
+import com.keepersecurity.secretsManager.core.SecretsManager;
+import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.Future;
+import java.util.concurrent.locks.ReadWriteLock;
+import java.util.concurrent.locks.ReentrantReadWriteLock;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.apache.guacamole.GuacamoleException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A cache of Keeper Secrets Manager records, specific to a single KSM account. This class
+ * includes internal functionality necessary to fetch records from KSM as needed.
+ */
+public class KsmCache {
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(KsmCache.class);
+
+    /**
+     * Service for retrieving data from records.
+     */
+    @Inject
+    private KsmRecordService recordService;
+
+    /**
+     * The publicly-accessible URL for Keeper's documentation covering Keeper
+     * notation.
+     */
+    private static final String KEEPER_NOTATION_DOC_URL =
+            "https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation";
+
+    /**
+     * The regular expression that Keeper notation must match to be related to
+     * file retrieval. As the Keeper SDK provides mutually-exclusive for
+     * retrieving secret values and files via notation, the notation must first
+     * be tested to determine whether it refers to a file.
+     */
+    private static final Pattern KEEPER_FILE_NOTATION = Pattern.compile("^(keeper://)?[^/]*/file/.+");
+
+    /**
+     * The maximum amount of time that an entry will be stored in the cache
+     * before being refreshed, in milliseconds.
+     */
+    private static final long CACHE_INTERVAL = 5000;
+
+    /**
+     * The KSM configuration associated with this cache instance.
+     */
+    private final SecretsManagerOptions ksmConfig;
+
+    /**
+     * Create a new KSM cache instance based around the provided KSM configuration.
+     *
+     * @param ksmConfig
+     *     The KSM configuration to use when retrieving properties from KSM.
+     */
+    @AssistedInject
+    public KsmCache(@Assisted SecretsManagerOptions ksmConfig) {
+        this.ksmConfig = ksmConfig;
+    }
+
+    /**
+     * Read/write lock which guards access to all cached data, including the
+     * timestamp recording the last time the cache was refreshed. Readers of
+     * the cache must first acquire (and eventually release) the read lock, and
+     * writers of the cache must first acquire (and eventually release) the
+     * write lock.
+     */
+    private final ReadWriteLock cacheLock = new ReentrantReadWriteLock();
+
+    /**
+     * The timestamp that the cache was last refreshed, in milliseconds, as
+     * returned by System.currentTimeMillis(). This value is automatically
+     * updated if {@link #validateCache()} refreshes the cache. This value must
+     * not be accessed without {@link #cacheLock} acquired appropriately.
+     */
+    private volatile long cacheTimestamp = 0;
+
+    /**
+     * The full cached set of secrets last retrieved from Keeper Secrets
+     * Manager. This value is automatically updated if {@link #validateCache()}
+     * refreshes the cache. This value must not be accessed without
+     * {@link #cacheLock} acquired appropriately.
+     */
+    private KeeperSecrets cachedSecrets = null;
+
+    /**
+     * All records retrieved from Keeper Secrets Manager, where each key is the
+     * UID of the corresponding record. The contents of this Map are
+     * automatically updated if {@link #validateCache()} refreshes the cache.
+     * This Map must not be accessed without {@link #cacheLock} acquired
+     * appropriately.
+     */
+    private final Map<String, KeeperRecord> cachedRecordsByUid = new HashMap<>();
+
+    /**
+     * All records retrieved from Keeper Secrets Manager, where each key is the
+     * hostname or IP address of the corresponding record. The hostname or IP
+     * address of a record is determined by {@link Hosts} fields, thus a record
+     * may be associated with multiple hosts. If a record is associated with
+     * multiple hosts, there will be multiple references to that record within
+     * this Map. The contents of this Map are automatically updated if
+     * {@link #validateCache()} refreshes the cache. This Map must not be
+     * accessed without {@link #cacheLock} acquired appropriately. Before using
+     * a value from this Map, {@link #cachedAmbiguousHosts} must first be
+     * checked to verify that there is indeed only one record associated with
+     * that host.
+     */
+    private final Map<String, KeeperRecord> cachedRecordsByHost = new HashMap<>();
+
+    /**
+     * The set of all hostnames or IP addresses that are associated with
+     * multiple records, and thus cannot uniquely identify a record. The
+     * contents of this Set are automatically updated if
+     * {@link #validateCache()} refreshes the cache. This Set must not be
+     * accessed without {@link #cacheLock} acquired appropriately.This Set
+     * must be checked before using a value retrieved from
+     * {@link #cachedRecordsByHost}.
+     */
+    private final Set<String> cachedAmbiguousHosts = new HashSet<>();
+
+    /**
+     * All records retrieved from Keeper Secrets Manager, where each key is the
+     * username of the corresponding record. The username of a record is
+     * determined by {@link Login} fields, thus a record may be associated with
+     * multiple users. If a record is associated with multiple users, there
+     * will be multiple references to that record within this Map. The contents
+     * of this Map are automatically updated if {@link #validateCache()}
+     * refreshes the cache. This Map must not be accessed without
+     * {@link #cacheLock} acquired appropriately. Before using a value from
+     * this Map, {@link #cachedAmbiguousUsernames} must first be checked to
+     * verify that there is indeed only one record associated with that user.
+     */
+    private final Map<String, KeeperRecord> cachedRecordsByUsername = new HashMap<>();
+
+    /**
+     * The set of all usernames that are associated with multiple records, and
+     * thus cannot uniquely identify a record. The contents of this Set are
+     * automatically updated if {@link #validateCache()} refreshes the cache.
+     * This Set must not be accessed without {@link #cacheLock} acquired
+     * appropriately.This Set must be checked before using a value retrieved
+     * from {@link #cachedRecordsByUsername}.
+     */
+    private final Set<String> cachedAmbiguousUsernames = new HashSet<>();
+
+    /**
+     * Validates that all cached data is current with respect to
+     * {@link #CACHE_INTERVAL}, refreshing data from the server as needed.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs preventing the cached data from being refreshed.
+     */
+    private void validateCache() throws GuacamoleException {
+
+        long currentTime = System.currentTimeMillis();
+
+        // Perform a read-only check that the cache has actually expired before
+        // continuing
+        cacheLock.readLock().lock();
+        try {
+            if (currentTime - cacheTimestamp < CACHE_INTERVAL)
+                return;
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
+
+        cacheLock.writeLock().lock();
+        try {
+
+            // Cache may have been updated since the read-only check. Re-verify
+            // that the cache has expired before continuing with a full refresh
+            if (currentTime - cacheTimestamp < CACHE_INTERVAL)
+                return;
+
+            // Attempt to pull all records first, allowing that operation to
+            // succeed/fail BEFORE we clear out the last cached success
+            KeeperSecrets secrets = SecretsManager.getSecrets(ksmConfig);
+            List<KeeperRecord> records = secrets.getRecords();
+
+            // Store all secrets within cache
+            cachedSecrets = secrets;
+
+            // Clear unambiguous cache of all records by UID
+            cachedRecordsByUid.clear();
+
+            // Clear cache of host-based records
+            cachedAmbiguousHosts.clear();
+            cachedRecordsByHost.clear();
+
+            // Clear cache of login-based records
+            cachedAmbiguousUsernames.clear();
+            cachedRecordsByUsername.clear();
+
+            // Store all records, sorting each into host-based and login-based
+            // buckets
+            records.forEach(record -> {
+
+                // Store based on UID ...
+                cachedRecordsByUid.put(record.getRecordUid(), record);
+
+                // ... and hostname/address
+                String hostname = recordService.getHostname(record);
+                addRecordForHost(record, hostname);
+
+                // Store based on username ONLY if no hostname (will otherwise
+                // result in ambiguous entries for servers tied to identical
+                // accounts)
+                if (hostname == null)
+                    addRecordForLogin(record, recordService.getUsername(record));
+
+            });
+
+            // Cache has been refreshed
+            this.cacheTimestamp = System.currentTimeMillis();
+
+        }
+        finally {
+            cacheLock.writeLock().unlock();
+        }
+
+    }
+
+    /**
+     * Associates the given record with the given hostname. The hostname may be
+     * null. Both {@link #cachedRecordsByHost} and {@link #cachedAmbiguousHosts}
+     * are updated appropriately. The write lock of {@link #cacheLock} must
+     * already be acquired before invoking this function.
+     *
+     * @param record
+     *     The record to associate with the hosts in the given field.
+     *
+     * @param hostname
+     *     The hostname/address that the given record should be associated
+     *     with. This may be null.
+     */
+    private void addRecordForHost(KeeperRecord record, String hostname) {
+
+        if (hostname == null)
+            return;
+
+        KeeperRecord existing = cachedRecordsByHost.putIfAbsent(hostname, record);
+        if (existing != null && record != existing)
+            cachedAmbiguousHosts.add(hostname);
+
+    }
+
+    /**
+     * Associates the given record with the given username. The given username
+     * may be null. Both {@link #cachedRecordsByUsername} and
+     * {@link #cachedAmbiguousUsernames} are updated appropriately. The write
+     * lock of {@link #cacheLock} must already be acquired before invoking this
+     * function.
+     *
+     * @param record
+     *     The record to associate with the given username.
+     *
+     * @param username
+     *     The username that the given record should be associated with. This
+     *     may be null.
+     */
+    private void addRecordForLogin(KeeperRecord record, String username) {
+
+        if (username == null)
+            return;
+
+        KeeperRecord existing = cachedRecordsByUsername.putIfAbsent(username, record);
+        if (existing != null && record != existing)
+            cachedAmbiguousUsernames.add(username);
+
+    }
+
+    /**
+     * Returns all records accessible via Keeper Secrets Manager. The records
+     * returned are arbitrarily ordered.
+     *
+     * @return
+     *     An unmodifiable Collection of all records accessible via Keeper
+     *     Secrets Manager,  in no particular order.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs that prevents records from being retrieved.
+     */
+    public Collection<KeeperRecord> getRecords() throws GuacamoleException {
+        validateCache();
+        cacheLock.readLock().lock();
+        try {
+            return Collections.unmodifiableCollection(cachedRecordsByUid.values());
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
+    }
+
+    /**
+     * Returns the record having the given UID. If no such record exists, null
+     * is returned.
+     *
+     * @param uid
+     *     The UID of the record to return.
+     *
+     * @return
+     *     The record having the given UID, or null if there is no such record.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs that prevents the record from being retrieved.
+     */
+    public KeeperRecord getRecord(String uid) throws GuacamoleException {
+        validateCache();
+        cacheLock.readLock().lock();
+        try {
+            return cachedRecordsByUid.get(uid);
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
+    }
+
+    /**
+     * Returns the record associated with the given hostname or IP address. If
+     * no such record exists, or there are multiple such records, null is
+     * returned.
+     *
+     * @param hostname
+     *     The hostname of the record to return.
+     *
+     * @return
+     *     The record associated with the given hostname, or null if there is
+     *     no such record or multiple such records.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs that prevents the record from being retrieved.
+     */
+    public KeeperRecord getRecordByHost(String hostname) throws GuacamoleException {
+        validateCache();
+        cacheLock.readLock().lock();
+        try {
+
+            if (cachedAmbiguousHosts.contains(hostname)) {
+                logger.debug("The hostname/address \"{}\" is referenced by "
+                        + "multiple Keeper records and cannot be used to "
+                        + "locate individual secrets.", hostname);
+                return null;
+            }
+
+            return cachedRecordsByHost.get(hostname);
+
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
+    }
+
+    /**
+     * Returns the record associated with the given username. If no such record
+     * exists, or there are multiple such records, null is returned.
+     *
+     * @param username
+     *     The username of the record to return.
+     *
+     * @return
+     *     The record associated with the given username, or null if there is
+     *     no such record or multiple such records.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs that prevents the record from being retrieved.
+     */
+    public KeeperRecord getRecordByLogin(String username) throws GuacamoleException {
+        validateCache();
+        cacheLock.readLock().lock();
+        try {
+
+            if (cachedAmbiguousUsernames.contains(username)) {
+                logger.debug("The username \"{}\" is referenced by multiple "
+                        + "Keeper records and cannot be used to locate "
+                        + "individual secrets.", username);
+                return null;
+            }
+
+            return cachedRecordsByUsername.get(username);
+
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
+    }
+
+    /**
+     * Returns the value of the secret stored within Keeper Secrets Manager and
+     * represented by the given Keeper notation. Keeper notation locates the
+     * value of a specific field, custom field, or file associated with a
+     * specific record. See: https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation
+     *
+     * @param notation
+     *     The Keeper notation of the secret to retrieve.
+     *
+     * @return
+     *     A Future which completes with the value of the secret represented by
+     *     the given Keeper notation, or null if there is no such secret.
+     *
+     * @throws GuacamoleException
+     *     If the requested secret cannot be retrieved or the Keeper notation
+     *     is invalid.
+     */
+    public Future<String> getSecret(String notation) throws GuacamoleException {
+        validateCache();
+        cacheLock.readLock().lock();
+        try {
+
+            // Retrieve any relevant file asynchronously
+            Matcher fileNotationMatcher = KEEPER_FILE_NOTATION.matcher(notation);
+            if (fileNotationMatcher.matches())
+                return recordService.download(Notation.getFile(cachedSecrets, notation));
+
+            // Retrieve string values synchronously
+            return CompletableFuture.completedFuture(Notation.getValue(cachedSecrets, notation));
+
+        }
+
+        // Unfortunately, the notation parser within the Keeper SDK throws
+        // plain Errors for retrieval failures ...
+        catch (Error e) {
+            logger.warn("Record \"{}\" does not exist.", notation);
+            logger.debug("Retrieval of record by Keeper notation failed.", e);
+            return CompletableFuture.completedFuture(null);
+        }
+
+        // ... and plain Exceptions for parse failures (no subclasses)
+        catch (Exception e) {
+            logger.warn("\"{}\" is not valid Keeper notation. Please check "
+                    + "the documentation at {} for valid formatting.",
+                    notation, KEEPER_NOTATION_DOC_URL);
+            logger.debug("Provided Keeper notation could not be parsed.", e);
+            return CompletableFuture.completedFuture(null);
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
+
+    }
+
+}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCacheFactory.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCacheFactory.java
new file mode 100644
index 000000000..4da9ee6bd
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCacheFactory.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.secret;
+
+import javax.annotation.Nonnull;
+
+import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
+
+/**
+ * Factory for creating KsmCache instances.
+ */
+public interface KsmCacheFactory {
+
+    /**
+     * Returns a new instance of a KsmCache instance associated with
+     * the provided KSM configuration options.
+     *
+     * @param ksmConfigOptions
+     *     The KSM config options to use when constructing the KsmCache
+     *     object.
+     *
+     * @return
+     *     A new KsmCache instance associated with the provided KSM config
+     *     options.
+     */
+    KsmCache create(@Nonnull SecretsManagerOptions ksmConfigOptions);
+
+}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index fa177014b..ae80e68e2 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -21,29 +21,18 @@ package org.apache.guacamole.vault.ksm.secret;
 
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
-import com.keepersecurity.secretsManager.core.Hosts;
 import com.keepersecurity.secretsManager.core.KeeperRecord;
-import com.keepersecurity.secretsManager.core.KeeperSecrets;
-import com.keepersecurity.secretsManager.core.Login;
-import com.keepersecurity.secretsManager.core.Notation;
-import com.keepersecurity.secretsManager.core.SecretsManager;
+import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
+
 import java.util.Collection;
-import java.util.Collections;
 import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
 import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.Future;
-import java.util.concurrent.locks.ReadWriteLock;
-import java.util.concurrent.locks.ReentrantReadWriteLock;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
+
+import javax.annotation.Nullable;
+
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Client which retrieves records from Keeper Secrets Manager, allowing
@@ -56,11 +45,6 @@ import org.slf4j.LoggerFactory;
 @Singleton
 public class KsmClient {
 
-    /**
-     * Logger for this class.
-     */
-    private static final Logger logger = LoggerFactory.getLogger(KsmClient.class);
-
     /**
      * Service for retrieving configuration information.
      */
@@ -68,268 +52,78 @@ public class KsmClient {
     private KsmConfigurationService confService;
 
     /**
-     * Service for retrieving data from records.
+     * Factory for creating KSM cache instances for particular KSM configs.
      */
     @Inject
-    private KsmRecordService recordService;
+    private KsmCacheFactory ksmCacheFactory;
 
     /**
-     * The publicly-accessible URL for Keeper's documentation covering Keeper
-     * notation.
+     * A map of base-64 encoded JSON KSM config blobs to associated KSM cache instances.
+     * The `null` entry in this Map is associated with the KSM configuration parsed
+     * from the guacamole.properties config file.
      */
-    private static final String KEEPER_NOTATION_DOC_URL =
-            "https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation";
+    private final Map<String, KsmCache> ksmCacheMap = new HashMap<>();
 
     /**
-     * The regular expression that Keeper notation must match to be related to
-     * file retrieval. As the Keeper SDK provides mutually-exclusive for
-     * retrieving secret values and files via notation, the notation must first
-     * be tested to determine whether it refers to a file.
-     */
-    private static final Pattern KEEPER_FILE_NOTATION = Pattern.compile("^(keeper://)?[^/]*/file/.+");
-
-    /**
-     * The maximum amount of time that an entry will be stored in the cache
-     * before being refreshed, in milliseconds.
-     */
-    private static final long CACHE_INTERVAL = 5000;
-
-    /**
-     * Read/write lock which guards access to all cached data, including the
-     * timestamp recording the last time the cache was refreshed. Readers of
-     * the cache must first acquire (and eventually release) the read lock, and
-     * writers of the cache must first acquire (and eventually release) the
-     * write lock.
-     */
-    private final ReadWriteLock cacheLock = new ReentrantReadWriteLock();
-
-    /**
-     * The timestamp that the cache was last refreshed, in milliseconds, as
-     * returned by System.currentTimeMillis(). This value is automatically
-     * updated if {@link #validateCache()} refreshes the cache. This value must
-     * not be accessed without {@link #cacheLock} acquired appropriately.
-     */
-    private volatile long cacheTimestamp = 0;
-
-    /**
-     * The full cached set of secrets last retrieved from Keeper Secrets
-     * Manager. This value is automatically updated if {@link #validateCache()}
-     * refreshes the cache. This value must not be accessed without
-     * {@link #cacheLock} acquired appropriately.
-     */
-    private KeeperSecrets cachedSecrets = null;
-
-    /**
-     * All records retrieved from Keeper Secrets Manager, where each key is the
-     * UID of the corresponding record. The contents of this Map are
-     * automatically updated if {@link #validateCache()} refreshes the cache.
-     * This Map must not be accessed without {@link #cacheLock} acquired
-     * appropriately.
-     */
-    private final Map<String, KeeperRecord> cachedRecordsByUid = new HashMap<>();
-
-    /**
-     * All records retrieved from Keeper Secrets Manager, where each key is the
-     * hostname or IP address of the corresponding record. The hostname or IP
-     * address of a record is determined by {@link Hosts} fields, thus a record
-     * may be associated with multiple hosts. If a record is associated with
-     * multiple hosts, there will be multiple references to that record within
-     * this Map. The contents of this Map are automatically updated if
-     * {@link #validateCache()} refreshes the cache. This Map must not be
-     * accessed without {@link #cacheLock} acquired appropriately. Before using
-     * a value from this Map, {@link #cachedAmbiguousHosts} must first be
-     * checked to verify that there is indeed only one record associated with
-     * that host.
-     */
-    private final Map<String, KeeperRecord> cachedRecordsByHost = new HashMap<>();
-
-    /**
-     * The set of all hostnames or IP addresses that are associated with
-     * multiple records, and thus cannot uniquely identify a record. The
-     * contents of this Set are automatically updated if
-     * {@link #validateCache()} refreshes the cache. This Set must not be
-     * accessed without {@link #cacheLock} acquired appropriately.This Set
-     * must be checked before using a value retrieved from
-     * {@link #cachedRecordsByHost}.
-     */
-    private final Set<String> cachedAmbiguousHosts = new HashSet<>();
-
-    /**
-     * All records retrieved from Keeper Secrets Manager, where each key is the
-     * username of the corresponding record. The username of a record is
-     * determined by {@link Login} fields, thus a record may be associated with
-     * multiple users. If a record is associated with multiple users, there
-     * will be multiple references to that record within this Map. The contents
-     * of this Map are automatically updated if {@link #validateCache()}
-     * refreshes the cache. This Map must not be accessed without
-     * {@link #cacheLock} acquired appropriately. Before using a value from
-     * this Map, {@link #cachedAmbiguousUsernames} must first be checked to
-     * verify that there is indeed only one record associated with that user.
-     */
-    private final Map<String, KeeperRecord> cachedRecordsByUsername = new HashMap<>();
-
-    /**
-     * The set of all usernames that are associated with multiple records, and
-     * thus cannot uniquely identify a record. The contents of this Set are
-     * automatically updated if {@link #validateCache()} refreshes the cache.
-     * This Set must not be accessed without {@link #cacheLock} acquired
-     * appropriately.This Set must be checked before using a value retrieved
-     * from {@link #cachedRecordsByUsername}.
-     */
-    private final Set<String> cachedAmbiguousUsernames = new HashSet<>();
-
-    /**
-     * Validates that all cached data is current with respect to
-     * {@link #CACHE_INTERVAL}, refreshing data from the server as needed.
+     * Create and return a KSM cache for the provided KSM config if not already
+     * present in the cache map, the existing cache entry.
+     *
+     * @param ksmConfig
+     *     The base-64 encoded JSON KSM config blob associated with the cache entry.
+     *     If an associated entry does not already exist, it will be created using
+     *     this configuration.
+     *
+     * @return
+     *     A KSM cache for the provided KSM config if not already present in the
+     *     cache map, otherwise the existing cache entry.
      *
      * @throws GuacamoleException
-     *     If an error occurs preventing the cached data from being refreshed.
+     *     If an error occurs while creating the KSM cache.
      */
-    private void validateCache() throws GuacamoleException {
+    private KsmCache createCacheIfNeeded(@Nullable String ksmConfig)
+            throws GuacamoleException {
 
-        long currentTime = System.currentTimeMillis();
-
-        // Perform a read-only check that the cache has actually expired before
-        // continuing
-        cacheLock.readLock().lock();
-        try {
-            if (currentTime - cacheTimestamp < CACHE_INTERVAL)
-                return;
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
-
-        cacheLock.writeLock().lock();
-        try {
-
-            // Cache may have been updated since the read-only check. Re-verify
-            // that the cache has expired before continuing with a full refresh
-            if (currentTime - cacheTimestamp < CACHE_INTERVAL)
-                return;
-
-            // Attempt to pull all records first, allowing that operation to
-            // succeed/fail BEFORE we clear out the last cached success
-            KeeperSecrets secrets = SecretsManager.getSecrets(confService.getSecretsManagerOptions());
-            List<KeeperRecord> records = secrets.getRecords();
-
-            // Store all secrets within cache
-            cachedSecrets = secrets;
-
-            // Clear unambiguous cache of all records by UID
-            cachedRecordsByUid.clear();
-
-            // Clear cache of host-based records
-            cachedAmbiguousHosts.clear();
-            cachedRecordsByHost.clear();
-
-            // Clear cache of login-based records
-            cachedAmbiguousUsernames.clear();
-            cachedRecordsByUsername.clear();
-
-            // Store all records, sorting each into host-based and login-based
-            // buckets
-            records.forEach(record -> {
-
-                // Store based on UID ...
-                cachedRecordsByUid.put(record.getRecordUid(), record);
-
-                // ... and hostname/address
-                String hostname = recordService.getHostname(record);
-                addRecordForHost(record, hostname);
-
-                // Store based on username ONLY if no hostname (will otherwise
-                // result in ambiguous entries for servers tied to identical
-                // accounts)
-                if (hostname == null)
-                    addRecordForLogin(record, recordService.getUsername(record));
-
-            });
-
-            // Cache has been refreshed
-            this.cacheTimestamp = System.currentTimeMillis();
-
-        }
-        finally {
-            cacheLock.writeLock().unlock();
-        }
+        // If a cache already exists for the provided config, use it
+        KsmCache ksmCache = ksmCacheMap.get(ksmConfig);
+        if (ksmCache != null)
+            return ksmCache;
 
+        // Create and store a new KSM cache instance for the provided KSM config blob
+        SecretsManagerOptions options = confService.getSecretsManagerOptions(ksmConfig);
+        return ksmCacheMap.put(ksmConfig, ksmCacheFactory.create(options));
     }
 
     /**
-     * Associates the given record with the given hostname. The hostname may be
-     * null. Both {@link #cachedRecordsByHost} and {@link #cachedAmbiguousHosts}
-     * are updated appropriately. The write lock of {@link #cacheLock} must
-     * already be acquired before invoking this function.
+     * Returns all records accessible via Keeper Secrets Manager, associated
+     * with the provided KSM config. If no KSM config is provided, records
+     * associated with the default configuration as retrieved from the config
+     * file will be used. The records returned are arbitrarily ordered.
      *
-     * @param record
-     *     The record to associate with the hosts in the given field.
-     *
-     * @param hostname
-     *     The hostname/address that the given record should be associated
-     *     with. This may be null.
-     */
-    private void addRecordForHost(KeeperRecord record, String hostname) {
-
-        if (hostname == null)
-            return;
-
-        KeeperRecord existing = cachedRecordsByHost.putIfAbsent(hostname, record);
-        if (existing != null && record != existing)
-            cachedAmbiguousHosts.add(hostname);
-
-    }
-
-    /**
-     * Associates the given record with the given username. The given username
-     * may be null. Both {@link #cachedRecordsByUsername} and
-     * {@link #cachedAmbiguousUsernames} are updated appropriately. The write
-     * lock of {@link #cacheLock} must already be acquired before invoking this
-     * function.
-     *
-     * @param record
-     *     The record to associate with the given username.
-     *
-     * @param username
-     *     The username that the given record should be associated with. This
-     *     may be null.
-     */
-    private void addRecordForLogin(KeeperRecord record, String username) {
-
-        if (username == null)
-            return;
-
-        KeeperRecord existing = cachedRecordsByUsername.putIfAbsent(username, record);
-        if (existing != null && record != existing)
-            cachedAmbiguousUsernames.add(username);
-
-    }
-
-    /**
-     * Returns all records accessible via Keeper Secrets Manager. The records
-     * returned are arbitrarily ordered.
+     * @param ksmConfig
+     *     The base-64 encoded JSON KSM config blob associated associated with
+     *     the KSM vault that should be used to fetch the records.
      *
      * @return
      *     An unmodifiable Collection of all records accessible via Keeper
-     *     Secrets Manager,  in no particular order.
+     *     Secrets Manager, in no particular order.
      *
      * @throws GuacamoleException
      *     If an error occurs that prevents records from being retrieved.
      */
-    public Collection<KeeperRecord> getRecords() throws GuacamoleException {
-        validateCache();
-        cacheLock.readLock().lock();
-        try {
-            return Collections.unmodifiableCollection(cachedRecordsByUid.values());
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
+    public Collection<KeeperRecord> getRecords(
+                @Nullable String ksmConfig) throws GuacamoleException {
+
+        // Call through to the associated KSM cache instance
+        return createCacheIfNeeded(ksmConfig).getRecords();
     }
 
     /**
-     * Returns the record having the given UID. If no such record exists, null
-     * is returned.
+     * Returns the record having the given KSM config, and the given UID.
+     * If no such record exists, null is returned.
+     *
+     * @param ksmConfig
+     *     The base-64 encoded JSON KSM config blob associated associated with
+     *     the KSM vault that should be used to fetch the record.
      *
      * @param uid
      *     The UID of the record to return.
@@ -340,21 +134,21 @@ public class KsmClient {
      * @throws GuacamoleException
      *     If an error occurs that prevents the record from being retrieved.
      */
-    public KeeperRecord getRecord(String uid) throws GuacamoleException {
-        validateCache();
-        cacheLock.readLock().lock();
-        try {
-            return cachedRecordsByUid.get(uid);
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
+    public KeeperRecord getRecord(
+                @Nullable String ksmConfig, String uid) throws GuacamoleException {
+
+        // Call through to the associated KSM cache instance
+        return createCacheIfNeeded(ksmConfig).getRecord(uid);
     }
 
     /**
-     * Returns the record associated with the given hostname or IP address. If
-     * no such record exists, or there are multiple such records, null is
-     * returned.
+     * Returns the record associated with the given hostname or IP address
+     * and the given KSM config. If no such record exists, or there are multiple
+     * such records, null is returned.
+     *
+     * @param ksmConfig
+     *     The base-64 encoded JSON KSM config blob associated associated with
+     *     the KSM vault that should be used to fetch the record.
      *
      * @param hostname
      *     The hostname of the record to return.
@@ -366,30 +160,22 @@ public class KsmClient {
      * @throws GuacamoleException
      *     If an error occurs that prevents the record from being retrieved.
      */
-    public KeeperRecord getRecordByHost(String hostname) throws GuacamoleException {
-        validateCache();
-        cacheLock.readLock().lock();
-        try {
+    public KeeperRecord getRecordByHost(
+                @Nullable String ksmConfig, String hostname) throws GuacamoleException {
 
-            if (cachedAmbiguousHosts.contains(hostname)) {
-                logger.debug("The hostname/address \"{}\" is referenced by "
-                        + "multiple Keeper records and cannot be used to "
-                        + "locate individual secrets.", hostname);
-                return null;
-            }
+        // Call through to the associated KSM cache instance
+        return createCacheIfNeeded(ksmConfig).getRecordByHost(hostname);
 
-            return cachedRecordsByHost.get(hostname);
-
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
     }
 
     /**
      * Returns the record associated with the given username. If no such record
      * exists, or there are multiple such records, null is returned.
      *
+     * @param ksmConfig
+     *     The base-64 encoded JSON KSM config blob associated associated with
+     *     the KSM vault that should be used to fetch the record.
+     *
      * @param username
      *     The username of the record to return.
      *
@@ -400,31 +186,24 @@ public class KsmClient {
      * @throws GuacamoleException
      *     If an error occurs that prevents the record from being retrieved.
      */
-    public KeeperRecord getRecordByLogin(String username) throws GuacamoleException {
-        validateCache();
-        cacheLock.readLock().lock();
-        try {
+    public KeeperRecord getRecordByLogin(
+                @Nullable String ksmConfig, String username) throws GuacamoleException {
 
-            if (cachedAmbiguousUsernames.contains(username)) {
-                logger.debug("The username \"{}\" is referenced by multiple "
-                        + "Keeper records and cannot be used to locate "
-                        + "individual secrets.", username);
-                return null;
-            }
+        // Call through to the associated KSM cache instance
+        return createCacheIfNeeded(ksmConfig).getRecordByLogin(username);
 
-            return cachedRecordsByUsername.get(username);
-
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
     }
 
     /**
-     * Returns the value of the secret stored within Keeper Secrets Manager and
-     * represented by the given Keeper notation. Keeper notation locates the
-     * value of a specific field, custom field, or file associated with a
-     * specific record. See: https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation
+     * Returns the value of the secret stored within the Keeper Secrets Manager vault
+     * associated with the provided KSM config, and represented by the given Keeper
+     * notation. Keeper notation locates the value of a specific field, custom field,
+     * or file associated with a specific record.
+     * See: https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation
+     *
+     * @param ksmConfig
+     *     The base-64 encoded JSON KSM config blob associated associated with
+     *     the KSM vault that should be used to fetch the record.
      *
      * @param notation
      *     The Keeper notation of the secret to retrieve.
@@ -437,40 +216,11 @@ public class KsmClient {
      *     If the requested secret cannot be retrieved or the Keeper notation
      *     is invalid.
      */
-    public Future<String> getSecret(String notation) throws GuacamoleException {
-        validateCache();
-        cacheLock.readLock().lock();
-        try {
+    public Future<String> getSecret(
+        @Nullable String ksmConfig, String notation) throws GuacamoleException {
 
-            // Retrieve any relevant file asynchronously
-            Matcher fileNotationMatcher = KEEPER_FILE_NOTATION.matcher(notation);
-            if (fileNotationMatcher.matches())
-                return recordService.download(Notation.getFile(cachedSecrets, notation));
-
-            // Retrieve string values synchronously
-            return CompletableFuture.completedFuture(Notation.getValue(cachedSecrets, notation));
-
-        }
-
-        // Unfortunately, the notation parser within the Keeper SDK throws
-        // plain Errors for retrieval failures ...
-        catch (Error e) {
-            logger.warn("Record \"{}\" does not exist.", notation);
-            logger.debug("Retrieval of record by Keeper notation failed.", e);
-            return CompletableFuture.completedFuture(null);
-        }
-
-        // ... and plain Exceptions for parse failures (no subclasses)
-        catch (Exception e) {
-            logger.warn("\"{}\" is not valid Keeper notation. Please check "
-                    + "the documentation at {} for valid formatting.",
-                    notation, KEEPER_NOTATION_DOC_URL);
-            logger.debug("Provided Keeper notation could not be parsed.", e);
-            return CompletableFuture.completedFuture(null);
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
+        // Call through to the associated KSM cache instance
+        return createCacheIfNeeded(ksmConfig).getSecret(notation);
 
     }
 

From fee2f8b416afdaf8d574d8b9a3bb2f98addaa133 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 29 Jun 2022 20:29:58 +0000
Subject: [PATCH 028/289] GUACAMOLE-1629: Hook KSM vault code into base vault
 code and clean up.

---
 .../vault/secret/VaultSecretService.java      |  45 +-
 .../vault/user/VaultUserContext.java          |  23 +-
 .../ksm/KsmAuthenticationProviderModule.java  |  10 +-
 .../vault/ksm/conf/KsmConfigProperty.java     |  44 --
 .../ksm/conf/KsmConfigurationService.java     |  72 ++-
 .../guacamole/vault/ksm/secret/KsmCache.java  | 484 ------------------
 .../guacamole/vault/ksm/secret/KsmClient.java | 448 ++++++++++++----
 ...acheFactory.java => KsmClientFactory.java} |  12 +-
 .../vault/ksm/secret/KsmSecretService.java    | 156 +++++-
 9 files changed, 627 insertions(+), 667 deletions(-)
 delete mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigProperty.java
 delete mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCache.java
 rename extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/{KsmCacheFactory.java => KsmClientFactory.java} (79%)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/secret/VaultSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/secret/VaultSecretService.java
index 76349bad9..81204beb5 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/secret/VaultSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/secret/VaultSecretService.java
@@ -22,6 +22,8 @@ package org.apache.guacamole.vault.secret;
 import java.util.Map;
 import java.util.concurrent.Future;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.Connectable;
+import org.apache.guacamole.net.auth.UserContext;
 import org.apache.guacamole.protocol.GuacamoleConfiguration;
 import org.apache.guacamole.token.TokenFilter;
 
@@ -55,7 +57,9 @@ public interface VaultSecretService {
     /**
      * Returns a Future which eventually completes with the value of the secret
      * having the given name. If no such secret exists, the Future will be
-     * completed with null.
+     * completed with null. The secrets retrieved from this method are independent
+     * of the context of the particular connection being established, or any
+     * associated user context.
      *
      * @param name
      *     The name of the secret to retrieve.
@@ -72,6 +76,35 @@ public interface VaultSecretService {
      */
     Future<String> getValue(String name) throws GuacamoleException;
 
+    /**
+     * Returns a Future which eventually completes with the value of the secret
+     * having the given name. If no such secret exists, the Future will be
+     * completed with null. The connection or connection group, as well as the
+     * user context associated with the request are provided for additional context.
+     *
+     * @param userContext
+     *     The user context associated with the connection or connection group for
+     *     which the secret is being retrieved.
+     *
+     * @param connectable
+     *     The connection or connection group for which the secret is being retrieved.
+     *
+     * @param name
+     *     The name of the secret to retrieve.
+     *
+     * @return
+     *     A Future which completes with value of the secret having the given
+     *     name. If no such secret exists, the Future will be completed with
+     *     null. If an error occurs asynchronously which prevents retrieval of
+     *     the secret, that error will be exposed through an ExecutionException
+     *     when an attempt is made to retrieve the value from the Future.
+     *
+     * @throws GuacamoleException
+     *     If the secret cannot be retrieved due to an error.
+     */
+    Future<String> getValue(UserContext userContext, Connectable connectable,
+            String name) throws GuacamoleException;
+
     /**
      * Returns a map of token names to corresponding Futures which eventually
      * complete with the value of that token, where each token is dynamically
@@ -80,6 +113,12 @@ public interface VaultSecretService {
      * function should be implemented to provide automatic tokens for those
      * secrets and remove the need for manual mapping via YAML.
      *
+     * @param userContext
+     *     The user context from which the connectable originated.
+     *
+     * @param connectable
+     *     The connection or connection group for which the tokens are being replaced.
+     *
      * @param config
      *     The configuration of the Guacamole connection for which tokens are
      *     being generated. This configuration may be empty or partial,
@@ -99,7 +138,7 @@ public interface VaultSecretService {
      *     If an error occurs producing the tokens and values required for the
      *     given configuration.
      */
-    Map<String, Future<String>> getTokens(GuacamoleConfiguration config,
-            TokenFilter filter) throws GuacamoleException;
+    Map<String, Future<String>> getTokens(UserContext userContext, Connectable connectable,
+            GuacamoleConfiguration config, TokenFilter filter) throws GuacamoleException;
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
index 58056842b..876d7d186 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
@@ -31,6 +31,7 @@ import java.util.concurrent.Future;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.form.Form;
+import org.apache.guacamole.net.auth.Connectable;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.ConnectionGroup;
 import org.apache.guacamole.net.auth.TokenInjectingUserContext;
@@ -193,6 +194,10 @@ public class VaultUserContext extends TokenInjectingUserContext {
      * corresponding values from the vault, using the given TokenFilter to
      * filter tokens within the secret names prior to retrieving those secrets.
      *
+     * @param connectable
+     *     The connection or connection group to which the connection is being
+     *     established.
+     *
      * @param tokenMapping
      *     The mapping dictating the name of the secret which maps to each
      *     parameter token, where the key is the name of the parameter token
@@ -222,7 +227,8 @@ public class VaultUserContext extends TokenInjectingUserContext {
      *     If the value for any applicable secret cannot be retrieved from the
      *     vault due to an error.
      */
-    private Map<String, Future<String>> getTokens(Map<String, String> tokenMapping,
+    private Map<String, Future<String>> getTokens(
+            Connectable connectable, Map<String, String> tokenMapping,
             TokenFilter secretNameFilter, GuacamoleConfiguration config,
             TokenFilter configFilter) throws GuacamoleException {
 
@@ -247,14 +253,16 @@ public class VaultUserContext extends TokenInjectingUserContext {
 
             // Initiate asynchronous retrieval of the token value
             String tokenName = entry.getKey();
-            Future<String> secret = secretService.getValue(secretName);
+            Future<String> secret = secretService.getValue(
+                    this, connectable, secretName);
             pendingTokens.put(tokenName, secret);
 
         }
 
         // Additionally include any dynamic, parameter-based tokens
-        pendingTokens.putAll(secretService.getTokens(config, configFilter));
-        
+        pendingTokens.putAll(secretService.getTokens(
+                this, connectable, config, configFilter));
+
         return pendingTokens;
 
     }
@@ -329,7 +337,8 @@ public class VaultUserContext extends TokenInjectingUserContext {
 
         // Substitute tokens producing secret names, retrieving and storing
         // those secrets as parameter tokens
-        tokens.putAll(resolve(getTokens(confService.getTokenMapping(), filter,
+        tokens.putAll(resolve(getTokens(
+                connectionGroup, confService.getTokenMapping(), filter,
                 null, new TokenFilter(tokens))));
 
     }
@@ -409,8 +418,8 @@ public class VaultUserContext extends TokenInjectingUserContext {
 
         // Substitute tokens producing secret names, retrieving and storing
         // those secrets as parameter tokens
-        tokens.putAll(resolve(getTokens(confService.getTokenMapping(), filter,
-                config, new TokenFilter(tokens))));
+        tokens.putAll(resolve(getTokens(connection, confService.getTokenMapping(),
+                filter, config, new TokenFilter(tokens))));
 
     }
 
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
index 9d54439ea..6a7a70c83 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
@@ -26,9 +26,8 @@ import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
 import org.apache.guacamole.vault.ksm.secret.KsmSecretService;
 import org.apache.guacamole.vault.conf.VaultAttributeService;
 import org.apache.guacamole.vault.conf.VaultConfigurationService;
-import org.apache.guacamole.vault.ksm.secret.KsmCache;
-import org.apache.guacamole.vault.ksm.secret.KsmCacheFactory;
 import org.apache.guacamole.vault.ksm.secret.KsmClient;
+import org.apache.guacamole.vault.ksm.secret.KsmClientFactory;
 import org.apache.guacamole.vault.ksm.secret.KsmRecordService;
 import org.apache.guacamole.vault.secret.VaultSecretService;
 
@@ -55,16 +54,15 @@ public class KsmAuthenticationProviderModule
     protected void configureVault() {
 
         // Bind services specific to Keeper Secrets Manager
-        bind(KsmClient.class);
         bind(KsmRecordService.class);
         bind(VaultAttributeService.class).to(KsmAttributeService.class);
         bind(VaultConfigurationService.class).to(KsmConfigurationService.class);
         bind(VaultSecretService.class).to(KsmSecretService.class);
 
-        // Bind factory for creating KSM Caches
+        // Bind factory for creating KSM Clients
         install(new FactoryModuleBuilder()
-                .implement(KsmCache.class, KsmCache.class)
-                .build(KsmCacheFactory.class));
+                .implement(KsmClient.class, KsmClient.class)
+                .build(KsmClientFactory.class));
     }
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigProperty.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigProperty.java
deleted file mode 100644
index afd8c921a..000000000
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigProperty.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.vault.ksm.conf;
-
-import com.keepersecurity.secretsManager.core.KeyValueStorage;
-import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.properties.GuacamoleProperty;
-
-/**
- * A GuacamoleProperty whose value is Keeper Secrets Manager {@link KeyValueStorage}
- * object. The value of this property must be base64-encoded JSON, as output by
- * the Keeper Commander CLI tool via the "sm client add" command.
- */
-public abstract class KsmConfigProperty implements GuacamoleProperty<KeyValueStorage> {
-
-    @Override
-    public KeyValueStorage parseValue(String value) throws GuacamoleException {
-
-        // If no property provided, return null.
-        if (value == null)
-            return null;
-
-        // Parse the base-64 encoded JSON into a KeyValueStorage object
-        return KsmConfig.parseKsmConfig(value);
-    }
-
-}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
index c50662cf5..3ef02b8b9 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
@@ -22,13 +22,16 @@ package org.apache.guacamole.vault.ksm.conf;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 
-import javax.annotation.Nullable;
+import javax.annotation.Nonnull;
 
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.properties.BooleanGuacamoleProperty;
+import org.apache.guacamole.properties.StringGuacamoleProperty;
 import org.apache.guacamole.vault.conf.VaultConfigurationService;
 
+import com.keepersecurity.secretsManager.core.InMemoryStorage;
 import com.keepersecurity.secretsManager.core.KeyValueStorage;
 import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
 
@@ -62,7 +65,7 @@ public class KsmConfigurationService extends VaultConfigurationService {
      * The base64-encoded configuration information generated by the Keeper
      * Commander CLI tool.
      */
-    private static final KsmConfigProperty KSM_CONFIG = new KsmConfigProperty() {
+    private static final StringGuacamoleProperty KSM_CONFIG = new StringGuacamoleProperty() {
 
         @Override
         public String getName() {
@@ -127,35 +130,68 @@ public class KsmConfigurationService extends VaultConfigurationService {
         return environment.getProperty(STRIP_WINDOWS_DOMAINS, false);
     }
 
+
+    /**
+     * Return the globally-defined base-64-encoded JSON KSM configuration blob
+     * as a string.
+     *
+     * @return
+     *     The globally-defined base-64-encoded JSON KSM configuration blob
+     *     as a string.
+     *
+     * @throws GuacamoleException
+     *     If the value specified within guacamole.properties cannot be
+     *     parsed or does not exist.
+     */
+    public String getKsmConfig() throws GuacamoleException {
+        return environment.getRequiredProperty(KSM_CONFIG);
+    }
+
+    /**
+     * Given a base64-encoded JSON KSM configuration, parse and return a
+     * KeyValueStorage object.
+     *
+     * @param value
+     *     The base64-encoded JSON KSM configuration to parse.
+     *
+     * @return
+     *     The KeyValueStorage that is a result of the parsing operation
+     *
+     * @throws GuacamoleException
+     *     If the provided value is not valid base-64 encoded JSON KSM configuration.
+     */
+    private static KeyValueStorage parseKsmConfig(String value) throws GuacamoleException {
+
+        // Parse base64 value as KSM config storage
+        try {
+            return new InMemoryStorage(value);
+        }
+        catch (IllegalArgumentException e) {
+            throw new GuacamoleServerException("Invalid base64 configuration "
+                    + "for Keeper Secrets Manager.", e);
+        }
+
+    }
+
     /**
      * Returns the options required to authenticate with Keeper Secrets Manager
      * when retrieving secrets. These options are read from the contents of
      * base64-encoded JSON configuration data generated by the Keeper Commander
-     * CLI tool. This configuration data may be passed directly as an argument.
-     * If not provided as an argument, it must be present in the config file.
+     * CLI tool. This configuration data must be passed directly as an argument.
      *
      * @param ksmConfig
-     *     Optional KSM config data. If provided, it will be used instead of any
-     *     KSM config data present in the config file. If not provided, the value
-     *     in the config file will be used.
+     *     The KSM configuration blob to parse.
      *
      * @return
      *     The options that should be used when connecting to Keeper Secrets
      *     Manager when retrieving secrets.
      *
      * @throws GuacamoleException
-     *     If an invalid ksmConfig parameter is provided, or required properties
-     *     are not specified within guacamole.properties or cannot be parsed, or
-     *     the KSM configuration cannot be parsed.
+     *     If an invalid ksmConfig parameter is provided.
      */
-    public SecretsManagerOptions getSecretsManagerOptions(@Nullable String ksmConfig) throws GuacamoleException {
+    public SecretsManagerOptions getSecretsManagerOptions(@Nonnull String ksmConfig) throws GuacamoleException {
 
-        // Attempt to parse the KSM config provided as an argument if available.
-        // If not provided as an argument, it must be present in the config file.
-        KeyValueStorage parsedKsmConfig = ksmConfig != null
-                ? KsmConfig.parseKsmConfig(ksmConfig)
-                : environment.getRequiredProperty(KSM_CONFIG);
-
-        return new SecretsManagerOptions(parsedKsmConfig, null, getAllowUnverifiedCertificate());
+        return new SecretsManagerOptions(
+                parseKsmConfig(ksmConfig), null, getAllowUnverifiedCertificate());
     }
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCache.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCache.java
deleted file mode 100644
index 178493871..000000000
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCache.java
+++ /dev/null
@@ -1,484 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.vault.ksm.secret;
-
-import com.google.inject.Inject;
-import com.google.inject.assistedinject.Assisted;
-import com.google.inject.assistedinject.AssistedInject;
-import com.keepersecurity.secretsManager.core.Hosts;
-import com.keepersecurity.secretsManager.core.KeeperRecord;
-import com.keepersecurity.secretsManager.core.KeeperSecrets;
-import com.keepersecurity.secretsManager.core.Login;
-import com.keepersecurity.secretsManager.core.Notation;
-import com.keepersecurity.secretsManager.core.SecretsManager;
-import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
-
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.Future;
-import java.util.concurrent.locks.ReadWriteLock;
-import java.util.concurrent.locks.ReentrantReadWriteLock;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-import org.apache.guacamole.GuacamoleException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * A cache of Keeper Secrets Manager records, specific to a single KSM account. This class
- * includes internal functionality necessary to fetch records from KSM as needed.
- */
-public class KsmCache {
-    /**
-     * Logger for this class.
-     */
-    private static final Logger logger = LoggerFactory.getLogger(KsmCache.class);
-
-    /**
-     * Service for retrieving data from records.
-     */
-    @Inject
-    private KsmRecordService recordService;
-
-    /**
-     * The publicly-accessible URL for Keeper's documentation covering Keeper
-     * notation.
-     */
-    private static final String KEEPER_NOTATION_DOC_URL =
-            "https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation";
-
-    /**
-     * The regular expression that Keeper notation must match to be related to
-     * file retrieval. As the Keeper SDK provides mutually-exclusive for
-     * retrieving secret values and files via notation, the notation must first
-     * be tested to determine whether it refers to a file.
-     */
-    private static final Pattern KEEPER_FILE_NOTATION = Pattern.compile("^(keeper://)?[^/]*/file/.+");
-
-    /**
-     * The maximum amount of time that an entry will be stored in the cache
-     * before being refreshed, in milliseconds.
-     */
-    private static final long CACHE_INTERVAL = 5000;
-
-    /**
-     * The KSM configuration associated with this cache instance.
-     */
-    private final SecretsManagerOptions ksmConfig;
-
-    /**
-     * Create a new KSM cache instance based around the provided KSM configuration.
-     *
-     * @param ksmConfig
-     *     The KSM configuration to use when retrieving properties from KSM.
-     */
-    @AssistedInject
-    public KsmCache(@Assisted SecretsManagerOptions ksmConfig) {
-        this.ksmConfig = ksmConfig;
-    }
-
-    /**
-     * Read/write lock which guards access to all cached data, including the
-     * timestamp recording the last time the cache was refreshed. Readers of
-     * the cache must first acquire (and eventually release) the read lock, and
-     * writers of the cache must first acquire (and eventually release) the
-     * write lock.
-     */
-    private final ReadWriteLock cacheLock = new ReentrantReadWriteLock();
-
-    /**
-     * The timestamp that the cache was last refreshed, in milliseconds, as
-     * returned by System.currentTimeMillis(). This value is automatically
-     * updated if {@link #validateCache()} refreshes the cache. This value must
-     * not be accessed without {@link #cacheLock} acquired appropriately.
-     */
-    private volatile long cacheTimestamp = 0;
-
-    /**
-     * The full cached set of secrets last retrieved from Keeper Secrets
-     * Manager. This value is automatically updated if {@link #validateCache()}
-     * refreshes the cache. This value must not be accessed without
-     * {@link #cacheLock} acquired appropriately.
-     */
-    private KeeperSecrets cachedSecrets = null;
-
-    /**
-     * All records retrieved from Keeper Secrets Manager, where each key is the
-     * UID of the corresponding record. The contents of this Map are
-     * automatically updated if {@link #validateCache()} refreshes the cache.
-     * This Map must not be accessed without {@link #cacheLock} acquired
-     * appropriately.
-     */
-    private final Map<String, KeeperRecord> cachedRecordsByUid = new HashMap<>();
-
-    /**
-     * All records retrieved from Keeper Secrets Manager, where each key is the
-     * hostname or IP address of the corresponding record. The hostname or IP
-     * address of a record is determined by {@link Hosts} fields, thus a record
-     * may be associated with multiple hosts. If a record is associated with
-     * multiple hosts, there will be multiple references to that record within
-     * this Map. The contents of this Map are automatically updated if
-     * {@link #validateCache()} refreshes the cache. This Map must not be
-     * accessed without {@link #cacheLock} acquired appropriately. Before using
-     * a value from this Map, {@link #cachedAmbiguousHosts} must first be
-     * checked to verify that there is indeed only one record associated with
-     * that host.
-     */
-    private final Map<String, KeeperRecord> cachedRecordsByHost = new HashMap<>();
-
-    /**
-     * The set of all hostnames or IP addresses that are associated with
-     * multiple records, and thus cannot uniquely identify a record. The
-     * contents of this Set are automatically updated if
-     * {@link #validateCache()} refreshes the cache. This Set must not be
-     * accessed without {@link #cacheLock} acquired appropriately.This Set
-     * must be checked before using a value retrieved from
-     * {@link #cachedRecordsByHost}.
-     */
-    private final Set<String> cachedAmbiguousHosts = new HashSet<>();
-
-    /**
-     * All records retrieved from Keeper Secrets Manager, where each key is the
-     * username of the corresponding record. The username of a record is
-     * determined by {@link Login} fields, thus a record may be associated with
-     * multiple users. If a record is associated with multiple users, there
-     * will be multiple references to that record within this Map. The contents
-     * of this Map are automatically updated if {@link #validateCache()}
-     * refreshes the cache. This Map must not be accessed without
-     * {@link #cacheLock} acquired appropriately. Before using a value from
-     * this Map, {@link #cachedAmbiguousUsernames} must first be checked to
-     * verify that there is indeed only one record associated with that user.
-     */
-    private final Map<String, KeeperRecord> cachedRecordsByUsername = new HashMap<>();
-
-    /**
-     * The set of all usernames that are associated with multiple records, and
-     * thus cannot uniquely identify a record. The contents of this Set are
-     * automatically updated if {@link #validateCache()} refreshes the cache.
-     * This Set must not be accessed without {@link #cacheLock} acquired
-     * appropriately.This Set must be checked before using a value retrieved
-     * from {@link #cachedRecordsByUsername}.
-     */
-    private final Set<String> cachedAmbiguousUsernames = new HashSet<>();
-
-    /**
-     * Validates that all cached data is current with respect to
-     * {@link #CACHE_INTERVAL}, refreshing data from the server as needed.
-     *
-     * @throws GuacamoleException
-     *     If an error occurs preventing the cached data from being refreshed.
-     */
-    private void validateCache() throws GuacamoleException {
-
-        long currentTime = System.currentTimeMillis();
-
-        // Perform a read-only check that the cache has actually expired before
-        // continuing
-        cacheLock.readLock().lock();
-        try {
-            if (currentTime - cacheTimestamp < CACHE_INTERVAL)
-                return;
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
-
-        cacheLock.writeLock().lock();
-        try {
-
-            // Cache may have been updated since the read-only check. Re-verify
-            // that the cache has expired before continuing with a full refresh
-            if (currentTime - cacheTimestamp < CACHE_INTERVAL)
-                return;
-
-            // Attempt to pull all records first, allowing that operation to
-            // succeed/fail BEFORE we clear out the last cached success
-            KeeperSecrets secrets = SecretsManager.getSecrets(ksmConfig);
-            List<KeeperRecord> records = secrets.getRecords();
-
-            // Store all secrets within cache
-            cachedSecrets = secrets;
-
-            // Clear unambiguous cache of all records by UID
-            cachedRecordsByUid.clear();
-
-            // Clear cache of host-based records
-            cachedAmbiguousHosts.clear();
-            cachedRecordsByHost.clear();
-
-            // Clear cache of login-based records
-            cachedAmbiguousUsernames.clear();
-            cachedRecordsByUsername.clear();
-
-            // Store all records, sorting each into host-based and login-based
-            // buckets
-            records.forEach(record -> {
-
-                // Store based on UID ...
-                cachedRecordsByUid.put(record.getRecordUid(), record);
-
-                // ... and hostname/address
-                String hostname = recordService.getHostname(record);
-                addRecordForHost(record, hostname);
-
-                // Store based on username ONLY if no hostname (will otherwise
-                // result in ambiguous entries for servers tied to identical
-                // accounts)
-                if (hostname == null)
-                    addRecordForLogin(record, recordService.getUsername(record));
-
-            });
-
-            // Cache has been refreshed
-            this.cacheTimestamp = System.currentTimeMillis();
-
-        }
-        finally {
-            cacheLock.writeLock().unlock();
-        }
-
-    }
-
-    /**
-     * Associates the given record with the given hostname. The hostname may be
-     * null. Both {@link #cachedRecordsByHost} and {@link #cachedAmbiguousHosts}
-     * are updated appropriately. The write lock of {@link #cacheLock} must
-     * already be acquired before invoking this function.
-     *
-     * @param record
-     *     The record to associate with the hosts in the given field.
-     *
-     * @param hostname
-     *     The hostname/address that the given record should be associated
-     *     with. This may be null.
-     */
-    private void addRecordForHost(KeeperRecord record, String hostname) {
-
-        if (hostname == null)
-            return;
-
-        KeeperRecord existing = cachedRecordsByHost.putIfAbsent(hostname, record);
-        if (existing != null && record != existing)
-            cachedAmbiguousHosts.add(hostname);
-
-    }
-
-    /**
-     * Associates the given record with the given username. The given username
-     * may be null. Both {@link #cachedRecordsByUsername} and
-     * {@link #cachedAmbiguousUsernames} are updated appropriately. The write
-     * lock of {@link #cacheLock} must already be acquired before invoking this
-     * function.
-     *
-     * @param record
-     *     The record to associate with the given username.
-     *
-     * @param username
-     *     The username that the given record should be associated with. This
-     *     may be null.
-     */
-    private void addRecordForLogin(KeeperRecord record, String username) {
-
-        if (username == null)
-            return;
-
-        KeeperRecord existing = cachedRecordsByUsername.putIfAbsent(username, record);
-        if (existing != null && record != existing)
-            cachedAmbiguousUsernames.add(username);
-
-    }
-
-    /**
-     * Returns all records accessible via Keeper Secrets Manager. The records
-     * returned are arbitrarily ordered.
-     *
-     * @return
-     *     An unmodifiable Collection of all records accessible via Keeper
-     *     Secrets Manager,  in no particular order.
-     *
-     * @throws GuacamoleException
-     *     If an error occurs that prevents records from being retrieved.
-     */
-    public Collection<KeeperRecord> getRecords() throws GuacamoleException {
-        validateCache();
-        cacheLock.readLock().lock();
-        try {
-            return Collections.unmodifiableCollection(cachedRecordsByUid.values());
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
-    }
-
-    /**
-     * Returns the record having the given UID. If no such record exists, null
-     * is returned.
-     *
-     * @param uid
-     *     The UID of the record to return.
-     *
-     * @return
-     *     The record having the given UID, or null if there is no such record.
-     *
-     * @throws GuacamoleException
-     *     If an error occurs that prevents the record from being retrieved.
-     */
-    public KeeperRecord getRecord(String uid) throws GuacamoleException {
-        validateCache();
-        cacheLock.readLock().lock();
-        try {
-            return cachedRecordsByUid.get(uid);
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
-    }
-
-    /**
-     * Returns the record associated with the given hostname or IP address. If
-     * no such record exists, or there are multiple such records, null is
-     * returned.
-     *
-     * @param hostname
-     *     The hostname of the record to return.
-     *
-     * @return
-     *     The record associated with the given hostname, or null if there is
-     *     no such record or multiple such records.
-     *
-     * @throws GuacamoleException
-     *     If an error occurs that prevents the record from being retrieved.
-     */
-    public KeeperRecord getRecordByHost(String hostname) throws GuacamoleException {
-        validateCache();
-        cacheLock.readLock().lock();
-        try {
-
-            if (cachedAmbiguousHosts.contains(hostname)) {
-                logger.debug("The hostname/address \"{}\" is referenced by "
-                        + "multiple Keeper records and cannot be used to "
-                        + "locate individual secrets.", hostname);
-                return null;
-            }
-
-            return cachedRecordsByHost.get(hostname);
-
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
-    }
-
-    /**
-     * Returns the record associated with the given username. If no such record
-     * exists, or there are multiple such records, null is returned.
-     *
-     * @param username
-     *     The username of the record to return.
-     *
-     * @return
-     *     The record associated with the given username, or null if there is
-     *     no such record or multiple such records.
-     *
-     * @throws GuacamoleException
-     *     If an error occurs that prevents the record from being retrieved.
-     */
-    public KeeperRecord getRecordByLogin(String username) throws GuacamoleException {
-        validateCache();
-        cacheLock.readLock().lock();
-        try {
-
-            if (cachedAmbiguousUsernames.contains(username)) {
-                logger.debug("The username \"{}\" is referenced by multiple "
-                        + "Keeper records and cannot be used to locate "
-                        + "individual secrets.", username);
-                return null;
-            }
-
-            return cachedRecordsByUsername.get(username);
-
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
-    }
-
-    /**
-     * Returns the value of the secret stored within Keeper Secrets Manager and
-     * represented by the given Keeper notation. Keeper notation locates the
-     * value of a specific field, custom field, or file associated with a
-     * specific record. See: https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation
-     *
-     * @param notation
-     *     The Keeper notation of the secret to retrieve.
-     *
-     * @return
-     *     A Future which completes with the value of the secret represented by
-     *     the given Keeper notation, or null if there is no such secret.
-     *
-     * @throws GuacamoleException
-     *     If the requested secret cannot be retrieved or the Keeper notation
-     *     is invalid.
-     */
-    public Future<String> getSecret(String notation) throws GuacamoleException {
-        validateCache();
-        cacheLock.readLock().lock();
-        try {
-
-            // Retrieve any relevant file asynchronously
-            Matcher fileNotationMatcher = KEEPER_FILE_NOTATION.matcher(notation);
-            if (fileNotationMatcher.matches())
-                return recordService.download(Notation.getFile(cachedSecrets, notation));
-
-            // Retrieve string values synchronously
-            return CompletableFuture.completedFuture(Notation.getValue(cachedSecrets, notation));
-
-        }
-
-        // Unfortunately, the notation parser within the Keeper SDK throws
-        // plain Errors for retrieval failures ...
-        catch (Error e) {
-            logger.warn("Record \"{}\" does not exist.", notation);
-            logger.debug("Retrieval of record by Keeper notation failed.", e);
-            return CompletableFuture.completedFuture(null);
-        }
-
-        // ... and plain Exceptions for parse failures (no subclasses)
-        catch (Exception e) {
-            logger.warn("\"{}\" is not valid Keeper notation. Please check "
-                    + "the documentation at {} for valid formatting.",
-                    notation, KEEPER_NOTATION_DOC_URL);
-            logger.debug("Provided Keeper notation could not be parsed.", e);
-            return CompletableFuture.completedFuture(null);
-        }
-        finally {
-            cacheLock.readLock().unlock();
-        }
-
-    }
-
-}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index ae80e68e2..be514ddfe 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -20,19 +20,33 @@
 package org.apache.guacamole.vault.ksm.secret;
 
 import com.google.inject.Inject;
-import com.google.inject.Singleton;
+import com.google.inject.assistedinject.Assisted;
+import com.google.inject.assistedinject.AssistedInject;
+import com.keepersecurity.secretsManager.core.Hosts;
 import com.keepersecurity.secretsManager.core.KeeperRecord;
+import com.keepersecurity.secretsManager.core.KeeperSecrets;
+import com.keepersecurity.secretsManager.core.Login;
+import com.keepersecurity.secretsManager.core.Notation;
+import com.keepersecurity.secretsManager.core.SecretsManager;
 import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
 
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.Future;
-
-import javax.annotation.Nullable;
+import java.util.concurrent.locks.ReadWriteLock;
+import java.util.concurrent.locks.ReentrantReadWriteLock;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * Client which retrieves records from Keeper Secrets Manager, allowing
@@ -42,88 +56,292 @@ import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
  * information), it's not possible for the server to perform a search of
  * content on the client's behalf. The client has to perform its own search.
  */
-@Singleton
 public class KsmClient {
 
     /**
-     * Service for retrieving configuration information.
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(KsmClient.class);
+
+    /**
+     * Service for retrieving data from records.
      */
     @Inject
-    private KsmConfigurationService confService;
+    private KsmRecordService recordService;
 
     /**
-     * Factory for creating KSM cache instances for particular KSM configs.
+     * The publicly-accessible URL for Keeper's documentation covering Keeper
+     * notation.
      */
-    @Inject
-    private KsmCacheFactory ksmCacheFactory;
+    private static final String KEEPER_NOTATION_DOC_URL =
+            "https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation";
 
     /**
-     * A map of base-64 encoded JSON KSM config blobs to associated KSM cache instances.
-     * The `null` entry in this Map is associated with the KSM configuration parsed
-     * from the guacamole.properties config file.
+     * The regular expression that Keeper notation must match to be related to
+     * file retrieval. As the Keeper SDK provides mutually-exclusive for
+     * retrieving secret values and files via notation, the notation must first
+     * be tested to determine whether it refers to a file.
      */
-    private final Map<String, KsmCache> ksmCacheMap = new HashMap<>();
+    private static final Pattern KEEPER_FILE_NOTATION = Pattern.compile("^(keeper://)?[^/]*/file/.+");
 
     /**
-     * Create and return a KSM cache for the provided KSM config if not already
-     * present in the cache map, the existing cache entry.
+     * The maximum amount of time that an entry will be stored in the cache
+     * before being refreshed, in milliseconds.
+     */
+    private static final long CACHE_INTERVAL = 5000;
+
+    /**
+     * The KSM configuration associated with this client instance.
+     */
+    private final SecretsManagerOptions ksmConfig;
+
+    /**
+     * Read/write lock which guards access to all cached data, including the
+     * timestamp recording the last time the cache was refreshed. Readers of
+     * the cache must first acquire (and eventually release) the read lock, and
+     * writers of the cache must first acquire (and eventually release) the
+     * write lock.
+     */
+    private final ReadWriteLock cacheLock = new ReentrantReadWriteLock();
+
+    /**
+     * The timestamp that the cache was last refreshed, in milliseconds, as
+     * returned by System.currentTimeMillis(). This value is automatically
+     * updated if {@link #validateCache()} refreshes the cache. This value must
+     * not be accessed without {@link #cacheLock} acquired appropriately.
+     */
+    private volatile long cacheTimestamp = 0;
+
+    /**
+     * The full cached set of secrets last retrieved from Keeper Secrets
+     * Manager. This value is automatically updated if {@link #validateCache()}
+     * refreshes the cache. This value must not be accessed without
+     * {@link #cacheLock} acquired appropriately.
+     */
+    private KeeperSecrets cachedSecrets = null;
+
+    /**
+     * All records retrieved from Keeper Secrets Manager, where each key is the
+     * UID of the corresponding record. The contents of this Map are
+     * automatically updated if {@link #validateCache()} refreshes the cache.
+     * This Map must not be accessed without {@link #cacheLock} acquired
+     * appropriately.
+     */
+    private final Map<String, KeeperRecord> cachedRecordsByUid = new HashMap<>();
+
+    /**
+     * All records retrieved from Keeper Secrets Manager, where each key is the
+     * hostname or IP address of the corresponding record. The hostname or IP
+     * address of a record is determined by {@link Hosts} fields, thus a record
+     * may be associated with multiple hosts. If a record is associated with
+     * multiple hosts, there will be multiple references to that record within
+     * this Map. The contents of this Map are automatically updated if
+     * {@link #validateCache()} refreshes the cache. This Map must not be
+     * accessed without {@link #cacheLock} acquired appropriately. Before using
+     * a value from this Map, {@link #cachedAmbiguousHosts} must first be
+     * checked to verify that there is indeed only one record associated with
+     * that host.
+     */
+    private final Map<String, KeeperRecord> cachedRecordsByHost = new HashMap<>();
+
+    /**
+     * The set of all hostnames or IP addresses that are associated with
+     * multiple records, and thus cannot uniquely identify a record. The
+     * contents of this Set are automatically updated if
+     * {@link #validateCache()} refreshes the cache. This Set must not be
+     * accessed without {@link #cacheLock} acquired appropriately.This Set
+     * must be checked before using a value retrieved from
+     * {@link #cachedRecordsByHost}.
+     */
+    private final Set<String> cachedAmbiguousHosts = new HashSet<>();
+
+    /**
+     * All records retrieved from Keeper Secrets Manager, where each key is the
+     * username of the corresponding record. The username of a record is
+     * determined by {@link Login} fields, thus a record may be associated with
+     * multiple users. If a record is associated with multiple users, there
+     * will be multiple references to that record within this Map. The contents
+     * of this Map are automatically updated if {@link #validateCache()}
+     * refreshes the cache. This Map must not be accessed without
+     * {@link #cacheLock} acquired appropriately. Before using a value from
+     * this Map, {@link #cachedAmbiguousUsernames} must first be checked to
+     * verify that there is indeed only one record associated with that user.
+     */
+    private final Map<String, KeeperRecord> cachedRecordsByUsername = new HashMap<>();
+
+    /**
+     * The set of all usernames that are associated with multiple records, and
+     * thus cannot uniquely identify a record. The contents of this Set are
+     * automatically updated if {@link #validateCache()} refreshes the cache.
+     * This Set must not be accessed without {@link #cacheLock} acquired
+     * appropriately.This Set must be checked before using a value retrieved
+     * from {@link #cachedRecordsByUsername}.
+     */
+    private final Set<String> cachedAmbiguousUsernames = new HashSet<>();
+
+    /**
+     * Create a new KSM client based around the provided KSM configuration.
      *
      * @param ksmConfig
-     *     The base-64 encoded JSON KSM config blob associated with the cache entry.
-     *     If an associated entry does not already exist, it will be created using
-     *     this configuration.
-     *
-     * @return
-     *     A KSM cache for the provided KSM config if not already present in the
-     *     cache map, otherwise the existing cache entry.
-     *
-     * @throws GuacamoleException
-     *     If an error occurs while creating the KSM cache.
+     *     The KSM configuration to use when retrieving properties from KSM.
      */
-    private KsmCache createCacheIfNeeded(@Nullable String ksmConfig)
-            throws GuacamoleException {
-
-        // If a cache already exists for the provided config, use it
-        KsmCache ksmCache = ksmCacheMap.get(ksmConfig);
-        if (ksmCache != null)
-            return ksmCache;
-
-        // Create and store a new KSM cache instance for the provided KSM config blob
-        SecretsManagerOptions options = confService.getSecretsManagerOptions(ksmConfig);
-        return ksmCacheMap.put(ksmConfig, ksmCacheFactory.create(options));
+    @AssistedInject
+    public KsmClient(@Assisted SecretsManagerOptions ksmConfig) {
+        this.ksmConfig = ksmConfig;
     }
 
     /**
-     * Returns all records accessible via Keeper Secrets Manager, associated
-     * with the provided KSM config. If no KSM config is provided, records
-     * associated with the default configuration as retrieved from the config
-     * file will be used. The records returned are arbitrarily ordered.
+     * Validates that all cached data is current with respect to
+     * {@link #CACHE_INTERVAL}, refreshing data from the server as needed.
      *
-     * @param ksmConfig
-     *     The base-64 encoded JSON KSM config blob associated associated with
-     *     the KSM vault that should be used to fetch the records.
+     * @throws GuacamoleException
+     *     If an error occurs preventing the cached data from being refreshed.
+     */
+    private void validateCache() throws GuacamoleException {
+
+        long currentTime = System.currentTimeMillis();
+
+        // Perform a read-only check that the cache has actually expired before
+        // continuing
+        cacheLock.readLock().lock();
+        try {
+            if (currentTime - cacheTimestamp < CACHE_INTERVAL)
+                return;
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
+
+        cacheLock.writeLock().lock();
+        try {
+
+            // Client may have been updated since the read-only check. Re-verify
+            // that the cache has expired before continuing with a full refresh
+            if (currentTime - cacheTimestamp < CACHE_INTERVAL)
+                return;
+
+            // Attempt to pull all records first, allowing that operation to
+            // succeed/fail BEFORE we clear out the last cached success
+            KeeperSecrets secrets = SecretsManager.getSecrets(ksmConfig);
+            List<KeeperRecord> records = secrets.getRecords();
+
+            // Store all secrets within cache
+            cachedSecrets = secrets;
+
+            // Clear unambiguous cache of all records by UID
+            cachedRecordsByUid.clear();
+
+            // Clear cache of host-based records
+            cachedAmbiguousHosts.clear();
+            cachedRecordsByHost.clear();
+
+            // Clear cache of login-based records
+            cachedAmbiguousUsernames.clear();
+            cachedRecordsByUsername.clear();
+
+            // Store all records, sorting each into host-based and login-based
+            // buckets
+            records.forEach(record -> {
+
+                // Store based on UID ...
+                cachedRecordsByUid.put(record.getRecordUid(), record);
+
+                // ... and hostname/address
+                String hostname = recordService.getHostname(record);
+                addRecordForHost(record, hostname);
+
+                // Store based on username ONLY if no hostname (will otherwise
+                // result in ambiguous entries for servers tied to identical
+                // accounts)
+                if (hostname == null)
+                    addRecordForLogin(record, recordService.getUsername(record));
+
+            });
+
+            // Client has been refreshed
+            this.cacheTimestamp = System.currentTimeMillis();
+
+        }
+        finally {
+            cacheLock.writeLock().unlock();
+        }
+
+    }
+
+    /**
+     * Associates the given record with the given hostname. The hostname may be
+     * null. Both {@link #cachedRecordsByHost} and {@link #cachedAmbiguousHosts}
+     * are updated appropriately. The write lock of {@link #cacheLock} must
+     * already be acquired before invoking this function.
+     *
+     * @param record
+     *     The record to associate with the hosts in the given field.
+     *
+     * @param hostname
+     *     The hostname/address that the given record should be associated
+     *     with. This may be null.
+     */
+    private void addRecordForHost(KeeperRecord record, String hostname) {
+
+        if (hostname == null)
+            return;
+
+        KeeperRecord existing = cachedRecordsByHost.putIfAbsent(hostname, record);
+        if (existing != null && record != existing)
+            cachedAmbiguousHosts.add(hostname);
+
+    }
+
+    /**
+     * Associates the given record with the given username. The given username
+     * may be null. Both {@link #cachedRecordsByUsername} and
+     * {@link #cachedAmbiguousUsernames} are updated appropriately. The write
+     * lock of {@link #cacheLock} must already be acquired before invoking this
+     * function.
+     *
+     * @param record
+     *     The record to associate with the given username.
+     *
+     * @param username
+     *     The username that the given record should be associated with. This
+     *     may be null.
+     */
+    private void addRecordForLogin(KeeperRecord record, String username) {
+
+        if (username == null)
+            return;
+
+        KeeperRecord existing = cachedRecordsByUsername.putIfAbsent(username, record);
+        if (existing != null && record != existing)
+            cachedAmbiguousUsernames.add(username);
+
+    }
+
+    /**
+     * Returns all records accessible via Keeper Secrets Manager. The records
+     * returned are arbitrarily ordered.
      *
      * @return
      *     An unmodifiable Collection of all records accessible via Keeper
-     *     Secrets Manager, in no particular order.
+     *     Secrets Manager,  in no particular order.
      *
      * @throws GuacamoleException
      *     If an error occurs that prevents records from being retrieved.
      */
-    public Collection<KeeperRecord> getRecords(
-                @Nullable String ksmConfig) throws GuacamoleException {
-
-        // Call through to the associated KSM cache instance
-        return createCacheIfNeeded(ksmConfig).getRecords();
+    public Collection<KeeperRecord> getRecords() throws GuacamoleException {
+        validateCache();
+        cacheLock.readLock().lock();
+        try {
+            return Collections.unmodifiableCollection(cachedRecordsByUid.values());
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
     }
 
     /**
-     * Returns the record having the given KSM config, and the given UID.
-     * If no such record exists, null is returned.
-     *
-     * @param ksmConfig
-     *     The base-64 encoded JSON KSM config blob associated associated with
-     *     the KSM vault that should be used to fetch the record.
+     * Returns the record having the given UID. If no such record exists, null
+     * is returned.
      *
      * @param uid
      *     The UID of the record to return.
@@ -134,21 +352,21 @@ public class KsmClient {
      * @throws GuacamoleException
      *     If an error occurs that prevents the record from being retrieved.
      */
-    public KeeperRecord getRecord(
-                @Nullable String ksmConfig, String uid) throws GuacamoleException {
-
-        // Call through to the associated KSM cache instance
-        return createCacheIfNeeded(ksmConfig).getRecord(uid);
+    public KeeperRecord getRecord(String uid) throws GuacamoleException {
+        validateCache();
+        cacheLock.readLock().lock();
+        try {
+            return cachedRecordsByUid.get(uid);
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
     }
 
     /**
-     * Returns the record associated with the given hostname or IP address
-     * and the given KSM config. If no such record exists, or there are multiple
-     * such records, null is returned.
-     *
-     * @param ksmConfig
-     *     The base-64 encoded JSON KSM config blob associated associated with
-     *     the KSM vault that should be used to fetch the record.
+     * Returns the record associated with the given hostname or IP address. If
+     * no such record exists, or there are multiple such records, null is
+     * returned.
      *
      * @param hostname
      *     The hostname of the record to return.
@@ -160,22 +378,30 @@ public class KsmClient {
      * @throws GuacamoleException
      *     If an error occurs that prevents the record from being retrieved.
      */
-    public KeeperRecord getRecordByHost(
-                @Nullable String ksmConfig, String hostname) throws GuacamoleException {
+    public KeeperRecord getRecordByHost(String hostname) throws GuacamoleException {
+        validateCache();
+        cacheLock.readLock().lock();
+        try {
 
-        // Call through to the associated KSM cache instance
-        return createCacheIfNeeded(ksmConfig).getRecordByHost(hostname);
+            if (cachedAmbiguousHosts.contains(hostname)) {
+                logger.debug("The hostname/address \"{}\" is referenced by "
+                        + "multiple Keeper records and cannot be used to "
+                        + "locate individual secrets.", hostname);
+                return null;
+            }
 
+            return cachedRecordsByHost.get(hostname);
+
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
     }
 
     /**
      * Returns the record associated with the given username. If no such record
      * exists, or there are multiple such records, null is returned.
      *
-     * @param ksmConfig
-     *     The base-64 encoded JSON KSM config blob associated associated with
-     *     the KSM vault that should be used to fetch the record.
-     *
      * @param username
      *     The username of the record to return.
      *
@@ -186,24 +412,31 @@ public class KsmClient {
      * @throws GuacamoleException
      *     If an error occurs that prevents the record from being retrieved.
      */
-    public KeeperRecord getRecordByLogin(
-                @Nullable String ksmConfig, String username) throws GuacamoleException {
+    public KeeperRecord getRecordByLogin(String username) throws GuacamoleException {
+        validateCache();
+        cacheLock.readLock().lock();
+        try {
 
-        // Call through to the associated KSM cache instance
-        return createCacheIfNeeded(ksmConfig).getRecordByLogin(username);
+            if (cachedAmbiguousUsernames.contains(username)) {
+                logger.debug("The username \"{}\" is referenced by multiple "
+                        + "Keeper records and cannot be used to locate "
+                        + "individual secrets.", username);
+                return null;
+            }
 
+            return cachedRecordsByUsername.get(username);
+
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
     }
 
     /**
-     * Returns the value of the secret stored within the Keeper Secrets Manager vault
-     * associated with the provided KSM config, and represented by the given Keeper
-     * notation. Keeper notation locates the value of a specific field, custom field,
-     * or file associated with a specific record.
-     * See: https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation
-     *
-     * @param ksmConfig
-     *     The base-64 encoded JSON KSM config blob associated associated with
-     *     the KSM vault that should be used to fetch the record.
+     * Returns the value of the secret stored within Keeper Secrets Manager and
+     * represented by the given Keeper notation. Keeper notation locates the
+     * value of a specific field, custom field, or file associated with a
+     * specific record. See: https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation
      *
      * @param notation
      *     The Keeper notation of the secret to retrieve.
@@ -216,11 +449,40 @@ public class KsmClient {
      *     If the requested secret cannot be retrieved or the Keeper notation
      *     is invalid.
      */
-    public Future<String> getSecret(
-        @Nullable String ksmConfig, String notation) throws GuacamoleException {
+    public Future<String> getSecret(String notation) throws GuacamoleException {
+        validateCache();
+        cacheLock.readLock().lock();
+        try {
 
-        // Call through to the associated KSM cache instance
-        return createCacheIfNeeded(ksmConfig).getSecret(notation);
+            // Retrieve any relevant file asynchronously
+            Matcher fileNotationMatcher = KEEPER_FILE_NOTATION.matcher(notation);
+            if (fileNotationMatcher.matches())
+                return recordService.download(Notation.getFile(cachedSecrets, notation));
+
+            // Retrieve string values synchronously
+            return CompletableFuture.completedFuture(Notation.getValue(cachedSecrets, notation));
+
+        }
+
+        // Unfortunately, the notation parser within the Keeper SDK throws
+        // plain Errors for retrieval failures ...
+        catch (Error e) {
+            logger.warn("Record \"{}\" does not exist.", notation);
+            logger.debug("Retrieval of record by Keeper notation failed.", e);
+            return CompletableFuture.completedFuture(null);
+        }
+
+        // ... and plain Exceptions for parse failures (no subclasses)
+        catch (Exception e) {
+            logger.warn("\"{}\" is not valid Keeper notation. Please check "
+                    + "the documentation at {} for valid formatting.",
+                    notation, KEEPER_NOTATION_DOC_URL);
+            logger.debug("Provided Keeper notation could not be parsed.", e);
+            return CompletableFuture.completedFuture(null);
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
 
     }
 
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCacheFactory.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClientFactory.java
similarity index 79%
rename from extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCacheFactory.java
rename to extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClientFactory.java
index 4da9ee6bd..f8220c16f 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmCacheFactory.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClientFactory.java
@@ -24,22 +24,22 @@ import javax.annotation.Nonnull;
 import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
 
 /**
- * Factory for creating KsmCache instances.
+ * Factory for creating KsmClient instances.
  */
-public interface KsmCacheFactory {
+public interface KsmClientFactory {
 
     /**
-     * Returns a new instance of a KsmCache instance associated with
+     * Returns a new instance of a KsmClient instance associated with
      * the provided KSM configuration options.
      *
      * @param ksmConfigOptions
-     *     The KSM config options to use when constructing the KsmCache
+     *     The KSM config options to use when constructing the KsmClient
      *     object.
      *
      * @return
-     *     A new KsmCache instance associated with the provided KSM config
+     *     A new KsmClient instance associated with the provided KSM config
      *     options.
      */
-    KsmCache create(@Nonnull SecretsManagerOptions ksmConfigOptions);
+    KsmClient create(@Nonnull SecretsManagerOptions ksmConfigOptions);
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index 21d7c91ac..6e2c8f201 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -22,31 +22,47 @@ package org.apache.guacamole.vault.ksm.secret;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import com.keepersecurity.secretsManager.core.KeeperRecord;
+import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
+
 import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.Future;
 
+import javax.annotation.Nonnull;
+
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.Connectable;
+import org.apache.guacamole.net.auth.Connection;
+import org.apache.guacamole.net.auth.ConnectionGroup;
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.UserContext;
 import org.apache.guacamole.protocol.GuacamoleConfiguration;
 import org.apache.guacamole.token.TokenFilter;
+import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
 import org.apache.guacamole.vault.secret.VaultSecretService;
 import org.apache.guacamole.vault.secret.WindowsUsername;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * Service which retrieves secrets from Keeper Secrets Manager.
+ * The configuration used to connect to KSM can be set at a global
+ * level using guacamole.properties, or using a connection group
+ * attribute.
  */
 @Singleton
 public class KsmSecretService implements VaultSecretService {
 
     /**
-     * Client for retrieving records and secrets from Keeper Secrets Manager.
+     * Logger for this class.
      */
-    @Inject
-    private KsmClient ksm;
+    private static final Logger logger = LoggerFactory.getLogger(VaultSecretService.class);
 
     /**
      * Service for retrieving data from records.
@@ -60,6 +76,53 @@ public class KsmSecretService implements VaultSecretService {
     @Inject
     private KsmConfigurationService confService;
 
+    /**
+     * Factory for creating KSM client instances.
+     */
+    @Inject
+    private KsmClientFactory ksmClientFactory;
+
+    /**
+     * A map of base-64 encoded JSON KSM config blobs to associated KSM client instances.
+     * The `null` entry in this Map is associated with the KSM configuration parsed
+     * from the guacamole.properties config file. A distinct KSM client will exist for
+     * every KSM config.
+     */
+    private final ConcurrentMap<String, KsmClient> ksmClientMap = new ConcurrentHashMap<>();
+
+    /**
+     * Create and return a KSM cache for the provided KSM config if not already
+     * present in the cache map, otherwise return the existing cache entry.
+     *
+     * @param ksmConfig
+     *     The base-64 encoded JSON KSM config blob associated with the cache entry.
+     *     If an associated entry does not already exist, it will be created using
+     *     this configuration.
+     *
+     * @return
+     *     A KSM cache for the provided KSM config if not already present in the
+     *     cache map, otherwise the existing cache entry.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while creating the KSM cache.
+     */
+    private KsmClient getClient(@Nonnull String ksmConfig)
+            throws GuacamoleException {
+
+        // If a cache already exists for the provided config, use it
+        KsmClient ksmClient = ksmClientMap.get(ksmConfig);
+        if (ksmClient != null)
+            return ksmClient;
+
+        // Create and store a new KSM cache instance for the provided KSM config blob
+        SecretsManagerOptions options = confService.getSecretsManagerOptions(ksmConfig);
+        ksmClient = ksmClientFactory.create(options);
+        KsmClient prevClient = ksmClientMap.putIfAbsent(ksmConfig, ksmClient);
+
+        // If the cache was already set before this thread got there, use the existing one
+        return prevClient != null ? prevClient : ksmClient;
+    }
+
     @Override
     public String canonicalize(String nameComponent) {
         try {
@@ -74,9 +137,21 @@ public class KsmSecretService implements VaultSecretService {
         }
     }
 
+    @Override
+    public Future<String> getValue(UserContext userContext, Connectable connectable,
+            String name) throws GuacamoleException {
+
+        // Attempt to find a KSM config for this connection or group
+        String ksmConfig = getConnectionGroupKsmConfig(userContext, connectable);
+
+        return getClient(ksmConfig).getSecret(name);
+    }
+
     @Override
     public Future<String> getValue(String name) throws GuacamoleException {
-        return ksm.getSecret(name);
+
+        // Use the default KSM configuration from guacamole.properties
+        return getClient(confService.getKsmConfig()).getSecret(name);
     }
 
     /**
@@ -153,13 +228,82 @@ public class KsmSecretService implements VaultSecretService {
 
     }
 
+    /**
+     * Search for a KSM configuration attribute, recursing up the connection group tree
+     * until a connection group with the appropriate attribute is found. If the KSM config
+     * is found, it will be returned. If not, the default value from the config file will
+     * be returned.
+     *
+     * @param userContext
+     *     The userContext associated with the connection or connection group.
+     *
+     * @param connectable
+     *     A connection or connection group for which the tokens are being replaced.
+     *
+     * @return
+     *     The value of the KSM configuration attribute if found in the tree, the default
+     *     KSM config blob defined in guacamole.properties otherwise.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while attempting to retrieve the KSM config attribute, or if
+     *     no KSM config is found in the connection group tree, and the value is also not
+     *     defined in the config file.
+     */
+    private String getConnectionGroupKsmConfig(
+            UserContext userContext, Connectable connectable) throws GuacamoleException {
+
+        // Check to make sure it's a usable type before proceeding
+        if (
+                !(connectable instanceof Connection)
+                && !(connectable instanceof ConnectionGroup)) {
+            logger.warn(
+                    "Unsupported Connectable type: {}; skipping KSM config lookup.",
+                    connectable.getClass());
+
+            // Use the default value if searching is impossible
+            return confService.getKsmConfig();
+        }
+
+        // For connections, start searching the parent group for the KSM config
+        // For connection groups, start searching the group directly
+        String parentIdentifier = (connectable instanceof Connection)
+                ? ((Connection) connectable).getParentIdentifier()
+                : ((ConnectionGroup) connectable).getIdentifier();
+
+        Directory<ConnectionGroup> connectionGroupDirectory = userContext.getConnectionGroupDirectory();
+        while (true) {
+
+            // Fetch the parent group, if one exists
+            ConnectionGroup group = connectionGroupDirectory.get(parentIdentifier);
+            if (group == null)
+                break;
+
+            // If the current connection group has the KSM configuration attribute, return immediately
+            String ksmConfig = group.getAttributes().get(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
+            if (ksmConfig != null)
+                return ksmConfig;
+
+            // Otherwise, keep searching up the tree until an appropriate configuration is found
+            parentIdentifier = group.getParentIdentifier();
+        }
+
+        // If no KSM configuration was ever found, use the default value
+        return confService.getKsmConfig();
+    }
+
     @Override
-    public Map<String, Future<String>> getTokens(GuacamoleConfiguration config,
-            TokenFilter filter) throws GuacamoleException {
+    public Map<String, Future<String>> getTokens(UserContext userContext, Connectable connectable,
+            GuacamoleConfiguration config, TokenFilter filter) throws GuacamoleException {
 
         Map<String, Future<String>> tokens = new HashMap<>();
         Map<String, String> parameters = config.getParameters();
 
+        // Attempt to find a KSM config for this connection or group
+        String ksmConfig = getConnectionGroupKsmConfig(userContext, connectable);
+
+        // Get a client instance for this KSM config
+        KsmClient ksm = getClient(ksmConfig);
+
         // Retrieve and define server-specific tokens, if any
         String hostname = parameters.get("hostname");
         if (hostname != null && !hostname.isEmpty())

From 025e831b3db8281241dbca407bacd8bfc0bea2e2 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 1 Jul 2022 21:57:47 +0000
Subject: [PATCH 029/289] GUACAMOLE-1372: Add configuration properties for
 setting private key and cert.

---
 .../auth/saml/conf/ConfigurationService.java  | 112 ++++++++++++++++++
 1 file changed, 112 insertions(+)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
index 048773729..026f17363 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
@@ -24,7 +24,12 @@ import com.onelogin.saml2.settings.IdPMetadataParser;
 import com.onelogin.saml2.settings.Saml2Settings;
 import com.onelogin.saml2.settings.SettingsBuilder;
 import com.onelogin.saml2.util.Constants;
+
+import java.io.File;
+import java.io.IOException;
 import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
 import java.util.HashMap;
 import java.util.Map;
 import javax.ws.rs.core.UriBuilder;
@@ -32,9 +37,12 @@ import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.properties.BooleanGuacamoleProperty;
+import org.apache.guacamole.properties.FileGuacamoleProperty;
 import org.apache.guacamole.properties.IntegerGuacamoleProperty;
 import org.apache.guacamole.properties.StringGuacamoleProperty;
 import org.apache.guacamole.properties.URIGuacamoleProperty;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * Service for retrieving configuration information regarding the SAML
@@ -42,6 +50,11 @@ import org.apache.guacamole.properties.URIGuacamoleProperty;
  */
 public class ConfigurationService {
 
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(ConfigurationService.class);
+
     /**
      * The URI of the file containing the XML Metadata associated with the
      * SAML IdP.
@@ -161,6 +174,30 @@ public class ConfigurationService {
                 
     };
 
+    /**
+     * The file containing the X.509 cert to use when signing or encrypting
+     * requests to the SAML IdP.
+     */
+    private static final FileGuacamoleProperty SAML_X509_CERT_PATH =
+            new FileGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "saml-x509-cert-path"; }
+
+    };
+
+    /**
+     * The file containing the private key to use when signing or encrypting
+     * requests to the SAML IdP.
+     */
+    private static final FileGuacamoleProperty SAML_PRIVATE_KEY_PATH =
+            new FileGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "saml-private-key-path"; }
+
+    };
+
     /**
      * The Guacamole server environment.
      */
@@ -329,6 +366,69 @@ public class ConfigurationService {
         return environment.getProperty(SAML_AUTH_TIMEOUT, 5);
     }
 
+    /**
+     * Returns the file containing the X.509 certificate to use when signing
+     * requests to the SAML IdP. If the property is not set, null will be
+     * returned.
+     *
+     * @return
+     *     The file containing the X.509 certificate to use when signing
+     *     requests to the SAML IdP, or null if not defined.
+     *
+     * @throws GuacamoleException
+     *     If the X.509 certificate cannot be parsed.
+     */
+    public File getCertificateFile() throws GuacamoleException {
+        return environment.getProperty(SAML_X509_CERT_PATH);
+    }
+
+    /**
+     * Returns the file containing the private key to use when signing
+     * requests to the SAML IdP. If the property is not set, null will be
+     * returned.
+     *
+     * @return
+     *     The file containing the private key to use when signing
+     *     requests to the SAML IdP, or null if not defined.
+     *
+     * @throws GuacamoleException
+     *     If the private key file cannot be parsed.
+     */
+    public File getPrivateKeyFile() throws GuacamoleException {
+        return environment.getProperty(SAML_PRIVATE_KEY_PATH);
+    }
+
+    /**
+     * Returns the contents of a small file, such as a private key or certificate into
+     * a String. If the file does not exist, or cannot be read for any reason, a warning
+     * will be logged and null will be returned.
+     *
+     * @param file
+     *     The file to read into a string.
+     *
+     * @param name
+     *     A human-readable name for the file, to be used when formatting log messages.
+     *
+     * @return
+     *     The contents of the file having the given path, or null if the file does not
+     *     exist or cannot be read.
+     */
+    private String readFileContentsIntoString(File file, String name) {
+
+        // Attempt to read the file directly into a String
+        try {
+            return new String(Files.readAllBytes(file.toPath()), StandardCharsets.UTF_8);
+        }
+
+        // If the file cannot be read, log a warning and treat it as if it does not exist
+        catch (IOException e) {
+            logger.warn("{} \"{}\" could not be read: {}.", name, file, e.getMessage());
+            logger.debug("{} \"{}\" could not be read.", name, file, e);
+            return null;
+        }
+
+    }
+
     /**
      * Returns the collection of SAML settings used to initialize the client.
      *
@@ -380,6 +480,18 @@ public class ConfigurationService {
                     UriBuilder.fromUri(getCallbackUrl()).path("api/ext/saml/callback").build().toString());
         }
 
+        // If a private key file is set, load the value into the builder now
+        File privateKeyFile = getPrivateKeyFile();
+        if (privateKeyFile != null)
+            samlMap.put(SettingsBuilder.SP_PRIVATEKEY_PROPERTY_KEY,
+                    readFileContentsIntoString(privateKeyFile, "Private Key"));
+
+        // If a certificate file is set, load the value into the builder now
+        File certificateFile = getCertificateFile();
+        if (certificateFile != null)
+            samlMap.put(SettingsBuilder.SP_X509CERT_PROPERTY_KEY,
+                    readFileContentsIntoString(certificateFile, "X.509 Certificate"));
+
         SettingsBuilder samlBuilder = new SettingsBuilder();
         Saml2Settings samlSettings = samlBuilder.fromValues(samlMap).build();
         samlSettings.setStrict(getStrict());

From 616cb3968270be4fc6cc96c72ed967e27872fcfb Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 5 Jul 2022 20:37:05 +0000
Subject: [PATCH 030/289] GUACAMOLE-1372: Throw fatal exception if files are
 specified but unreadable.

---
 .../auth/saml/conf/ConfigurationService.java  | 24 +++++++------------
 1 file changed, 9 insertions(+), 15 deletions(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
index 026f17363..95862bd34 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
@@ -41,8 +41,6 @@ import org.apache.guacamole.properties.FileGuacamoleProperty;
 import org.apache.guacamole.properties.IntegerGuacamoleProperty;
 import org.apache.guacamole.properties.StringGuacamoleProperty;
 import org.apache.guacamole.properties.URIGuacamoleProperty;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Service for retrieving configuration information regarding the SAML
@@ -50,11 +48,6 @@ import org.slf4j.LoggerFactory;
  */
 public class ConfigurationService {
 
-    /**
-     * Logger for this class.
-     */
-    private static final Logger logger = LoggerFactory.getLogger(ConfigurationService.class);
-
     /**
      * The URI of the file containing the XML Metadata associated with the
      * SAML IdP.
@@ -400,8 +393,8 @@ public class ConfigurationService {
 
     /**
      * Returns the contents of a small file, such as a private key or certificate into
-     * a String. If the file does not exist, or cannot be read for any reason, a warning
-     * will be logged and null will be returned.
+     * a String. If the file does not exist, or cannot be read for any reason, an exception
+     * will be thrown with the details of the failure.
      *
      * @param file
      *     The file to read into a string.
@@ -410,10 +403,12 @@ public class ConfigurationService {
      *     A human-readable name for the file, to be used when formatting log messages.
      *
      * @return
-     *     The contents of the file having the given path, or null if the file does not
-     *     exist or cannot be read.
+     *     The contents of the file having the given path.
+     *
+     * @throws GuacamoleException
+     *     If the provided file does not exist, or cannot be read for any reason.
      */
-    private String readFileContentsIntoString(File file, String name) {
+    private String readFileContentsIntoString(File file, String name) throws GuacamoleException {
 
         // Attempt to read the file directly into a String
         try {
@@ -422,9 +417,8 @@ public class ConfigurationService {
 
         // If the file cannot be read, log a warning and treat it as if it does not exist
         catch (IOException e) {
-            logger.warn("{} \"{}\" could not be read: {}.", name, file, e.getMessage());
-            logger.debug("{} \"{}\" could not be read.", name, file, e);
-            return null;
+            throw new GuacamoleServerException(
+                    name + " at \"" + file.getAbsolutePath() + "\" could not be read.", e);
         }
 
     }

From 5b69bf405d034258e1dd8ce34819add0dc2992ae Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 5 Jul 2022 17:59:44 +0000
Subject: [PATCH 031/289] GUACAMOLE-1629: Use TextField for KSM configuration
 since it's always one line.

---
 .../guacamole/vault/ksm/conf/KsmAttributeService.java  |  4 ++--
 .../apache/guacamole/vault/ksm/secret/KsmClient.java   |  4 ++--
 .../guacamole/vault/ksm/secret/KsmSecretService.java   | 10 ++++------
 3 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
index ade0f97e9..83ab9c4a3 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
@@ -24,7 +24,7 @@ import java.util.Collection;
 import java.util.Collections;
 
 import org.apache.guacamole.form.Form;
-import org.apache.guacamole.form.MultilineField;
+import org.apache.guacamole.form.TextField;
 import org.apache.guacamole.vault.conf.VaultAttributeService;
 
 import com.google.inject.Singleton;
@@ -47,7 +47,7 @@ public class KsmAttributeService implements VaultAttributeService {
      * per-connection-group basis.
      */
     public static final Form KSM_CONFIGURATION_FORM = new Form("ksm-config",
-            Arrays.asList(new MultilineField(KSM_CONFIGURATION_ATTRIBUTE)));
+            Arrays.asList(new TextField(KSM_CONFIGURATION_ATTRIBUTE)));
 
     /**
      * All KSM-specific connection group attributes, organized by form.
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index be514ddfe..5572ef71d 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -215,7 +215,7 @@ public class KsmClient {
         cacheLock.writeLock().lock();
         try {
 
-            // Client may have been updated since the read-only check. Re-verify
+            // Cache may have been updated since the read-only check. Re-verify
             // that the cache has expired before continuing with a full refresh
             if (currentTime - cacheTimestamp < CACHE_INTERVAL)
                 return;
@@ -258,7 +258,7 @@ public class KsmClient {
 
             });
 
-            // Client has been refreshed
+            // Cache has been refreshed
             this.cacheTimestamp = System.currentTimeMillis();
 
         }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index 6e2c8f201..bea98d934 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -84,14 +84,12 @@ public class KsmSecretService implements VaultSecretService {
 
     /**
      * A map of base-64 encoded JSON KSM config blobs to associated KSM client instances.
-     * The `null` entry in this Map is associated with the KSM configuration parsed
-     * from the guacamole.properties config file. A distinct KSM client will exist for
-     * every KSM config.
+     * A distinct KSM client will exist for every KSM config.
      */
     private final ConcurrentMap<String, KsmClient> ksmClientMap = new ConcurrentHashMap<>();
 
     /**
-     * Create and return a KSM cache for the provided KSM config if not already
+     * Create and return a KSM client for the provided KSM config if not already
      * present in the cache map, otherwise return the existing cache entry.
      *
      * @param ksmConfig
@@ -100,11 +98,11 @@ public class KsmSecretService implements VaultSecretService {
      *     this configuration.
      *
      * @return
-     *     A KSM cache for the provided KSM config if not already present in the
+     *     A KSM client for the provided KSM config if not already present in the
      *     cache map, otherwise the existing cache entry.
      *
      * @throws GuacamoleException
-     *     If an error occurs while creating the KSM cache.
+     *     If an error occurs while creating the KSM client.
      */
     private KsmClient getClient(@Nonnull String ksmConfig)
             throws GuacamoleException {

From 374f1b5e494c968166fe3eb9a66b6f7769981400 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 6 Jul 2022 17:55:28 +0000
Subject: [PATCH 032/289] GUACAMOLE-1629: Always include any pre-existing
 connection group attributes when exposing new ones.

---
 .../guacamole/vault/conf/VaultAttributeService.java    |  7 +++++--
 .../apache/guacamole/vault/user/VaultUserContext.java  | 10 +++++++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
index b77601621..f4129bb95 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
@@ -31,10 +31,13 @@ import org.apache.guacamole.form.Form;
 public interface VaultAttributeService {
 
     /**
-     * Return all connection group attributes to be exposed through the admin UI.
+     * Return all custom connection group attributes to be exposed through the
+     * admin UI for the current vault implementation.
      *
      * @return
-     *     All connection group attributes to be exposed through the admin UI.
+     *     All custom connection group attributes to be exposed through the
+     *     admin UI for the current vault implementation.
+     *
      */
     public Collection<Form> getConnectionGroupAttributes();
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
index 876d7d186..06ee8aaac 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
@@ -28,6 +28,9 @@ import java.util.HashMap;
 import java.util.Map;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.Future;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.form.Form;
@@ -425,7 +428,12 @@ public class VaultUserContext extends TokenInjectingUserContext {
 
     @Override
     public Collection<Form> getConnectionGroupAttributes() {
-        return attributeService.getConnectionGroupAttributes();
+
+        // Add any custom attributes to any previously defined attributes
+        return Stream.concat(
+                super.getConnectionGroupAttributes().stream(),
+                attributeService.getConnectionGroupAttributes().stream()
+        ).collect(Collectors.toUnmodifiableList());
     }
 
 }

From 0585ab5e5bc505d1338a419a19ea1b5484792738 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 6 Jul 2022 19:01:33 +0000
Subject: [PATCH 033/289] GUACAMOLE-1629: Fix client/cache confusion in
 comments.

---
 .../guacamole/vault/conf/VaultAttributeService.java  |  1 -
 .../guacamole/vault/ksm/secret/KsmSecretService.java | 12 ++++++------
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
index f4129bb95..2bd08cde6 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
@@ -37,7 +37,6 @@ public interface VaultAttributeService {
      * @return
      *     All custom connection group attributes to be exposed through the
      *     admin UI for the current vault implementation.
-     *
      */
     public Collection<Form> getConnectionGroupAttributes();
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index bea98d934..2436a4e62 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -90,16 +90,16 @@ public class KsmSecretService implements VaultSecretService {
 
     /**
      * Create and return a KSM client for the provided KSM config if not already
-     * present in the cache map, otherwise return the existing cache entry.
+     * present in the client map, otherwise return the existing client entry.
      *
      * @param ksmConfig
-     *     The base-64 encoded JSON KSM config blob associated with the cache entry.
+     *     The base-64 encoded JSON KSM config blob associated with the client entry.
      *     If an associated entry does not already exist, it will be created using
      *     this configuration.
      *
      * @return
      *     A KSM client for the provided KSM config if not already present in the
-     *     cache map, otherwise the existing cache entry.
+     *     client map, otherwise the existing client entry.
      *
      * @throws GuacamoleException
      *     If an error occurs while creating the KSM client.
@@ -107,17 +107,17 @@ public class KsmSecretService implements VaultSecretService {
     private KsmClient getClient(@Nonnull String ksmConfig)
             throws GuacamoleException {
 
-        // If a cache already exists for the provided config, use it
+        // If a client already exists for the provided config, use it
         KsmClient ksmClient = ksmClientMap.get(ksmConfig);
         if (ksmClient != null)
             return ksmClient;
 
-        // Create and store a new KSM cache instance for the provided KSM config blob
+        // Create and store a new KSM client instance for the provided KSM config blob
         SecretsManagerOptions options = confService.getSecretsManagerOptions(ksmConfig);
         ksmClient = ksmClientFactory.create(options);
         KsmClient prevClient = ksmClientMap.putIfAbsent(ksmConfig, ksmClient);
 
-        // If the cache was already set before this thread got there, use the existing one
+        // If the client was already set before this thread got there, use the existing one
         return prevClient != null ? prevClient : ksmClient;
     }
 

From 12832bed88caff888e1193d109d58ca1d7e9905e Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 6 Jul 2022 19:06:42 +0000
Subject: [PATCH 034/289] GUACAMOLE-1629: Use Java 8 compatible collector to
 append connection group attributes.

---
 .../org/apache/guacamole/vault/user/VaultUserContext.java   | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
index 06ee8aaac..dbfbbb9cb 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
@@ -24,6 +24,7 @@ import com.google.inject.assistedinject.Assisted;
 import com.google.inject.assistedinject.AssistedInject;
 
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.concurrent.ExecutionException;
@@ -430,10 +431,11 @@ public class VaultUserContext extends TokenInjectingUserContext {
     public Collection<Form> getConnectionGroupAttributes() {
 
         // Add any custom attributes to any previously defined attributes
-        return Stream.concat(
+        return Collections.unmodifiableCollection(Stream.concat(
                 super.getConnectionGroupAttributes().stream(),
                 attributeService.getConnectionGroupAttributes().stream()
-        ).collect(Collectors.toUnmodifiableList());
+        ).collect(Collectors.toList()));
+
     }
 
 }

From b8058e7561d16f061ab025fbb973e7ad560b058d Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 20 Jul 2022 00:18:26 +0000
Subject: [PATCH 035/289] GUACAMOLE-1643: Validate/translate KSM configs and
 one-time tokens on connection group save.

---
 .../vault/user/VaultDirectoryService.java     | 140 ++++++++++
 .../vault/user/VaultUserContext.java          |  54 ++++
 .../ksm/KsmAuthenticationProviderModule.java  |   3 +
 .../vault/ksm/user/KsmDirectoryService.java   | 253 ++++++++++++++++++
 .../src/main/resources/translations/en.json   |   5 +-
 5 files changed, 454 insertions(+), 1 deletion(-)
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultDirectoryService.java
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultDirectoryService.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultDirectoryService.java
new file mode 100644
index 000000000..700d9d3be
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultDirectoryService.java
@@ -0,0 +1,140 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.user;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.ActiveConnection;
+import org.apache.guacamole.net.auth.Connection;
+import org.apache.guacamole.net.auth.ConnectionGroup;
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.SharingProfile;
+import org.apache.guacamole.net.auth.User;
+import org.apache.guacamole.net.auth.UserGroup;
+
+/**
+ * A service that allows a vault implementation to override the directory
+ * for any entity that a user context may return.
+ */
+public abstract class VaultDirectoryService {
+
+    /**
+     * Given an existing User Directory, return a new Directory for
+     * this vault implementation.
+     *
+     * @return
+     *     A new User Directory based on the provided Directory.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while creating the Directory.
+     */
+    public Directory<User> getUserDirectory(
+            Directory<User> underlyingDirectory) throws GuacamoleException {
+
+        // By default, the provided directly will be returned unchanged
+        return underlyingDirectory;
+    }
+
+    /**
+     * Given an existing UserGroup Directory, return a new Directory for
+     * this vault implementation.
+     *
+     * @return
+     *     A new UserGroup Directory based on the provided Directory.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while creating the Directory.
+     */
+    public Directory<UserGroup> getUserGroupDirectory(
+            Directory<UserGroup> underlyingDirectory) throws GuacamoleException {
+
+        // Unless overriden in the vault implementation, the underlying directory
+        // will be returned directly
+        return underlyingDirectory;
+    }
+
+    /**
+     * Given an existing Connection Directory, return a new Directory for
+     * this vault implementation.
+     *
+     * @return
+     *     A new Connection Directory based on the provided Directory.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while creating the Directory.
+     */
+    public Directory<Connection> getConnectionDirectory(
+            Directory<Connection> underlyingDirectory) throws GuacamoleException {
+
+        // By default, the provided directly will be returned unchanged
+        return underlyingDirectory;
+    }
+
+    /**
+     * Given an existing ConnectionGroup Directory, return a new Directory for
+     * this vault implementation.
+     *
+     * @return
+     *     A new ConnectionGroup Directory based on the provided Directory.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while creating the Directory.
+     */
+    public Directory<ConnectionGroup> getConnectionGroupDirectory(
+            Directory<ConnectionGroup> underlyingDirectory) throws GuacamoleException {
+
+        // By default, the provided directly will be returned unchanged
+        return underlyingDirectory;
+    }
+
+    /**
+     * Given an existing ActiveConnection Directory, return a new Directory for
+     * this vault implementation.
+     *
+     * @return
+     *     A new ActiveConnection Directory based on the provided Directory.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while creating the Directory.
+     */
+    public Directory<ActiveConnection> getActiveConnectionDirectory(
+            Directory<ActiveConnection> underlyingDirectory) throws GuacamoleException {
+
+        // By default, the provided directly will be returned unchanged
+        return underlyingDirectory;
+    }
+
+    /**
+     * Given an existing SharingProfile Directory, return a new Directory for
+     * this vault implementation.
+     *
+     * @return
+     *     A new SharingProfile Directory based on the provided Directory.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while creating the Directory.
+     */
+    public Directory<SharingProfile> getSharingProfileDirectory(
+            Directory<SharingProfile> underlyingDirectory) throws GuacamoleException {
+
+        // By default, the provided directly will be returned unchanged
+        return underlyingDirectory;
+    }
+
+}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
index dbfbbb9cb..8e8f66853 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
@@ -35,11 +35,16 @@ import java.util.stream.Stream;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.form.Form;
+import org.apache.guacamole.net.auth.ActiveConnection;
 import org.apache.guacamole.net.auth.Connectable;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.ConnectionGroup;
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.SharingProfile;
 import org.apache.guacamole.net.auth.TokenInjectingUserContext;
+import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.net.auth.UserContext;
+import org.apache.guacamole.net.auth.UserGroup;
 import org.apache.guacamole.protocol.GuacamoleConfiguration;
 import org.apache.guacamole.token.GuacamoleTokenUndefinedException;
 import org.apache.guacamole.token.TokenFilter;
@@ -137,6 +142,13 @@ public class VaultUserContext extends TokenInjectingUserContext {
     @Inject
     private VaultAttributeService attributeService;
 
+    /**
+     * Service for modifying any underlying directories for the current
+     * vault implementation.
+     */
+    @Inject
+    private VaultDirectoryService directoryService;
+
     /**
      * Creates a new VaultUserContext which automatically injects tokens
      * containing values of secrets retrieved from a vault. The given
@@ -438,4 +450,46 @@ public class VaultUserContext extends TokenInjectingUserContext {
 
     }
 
+    @Override
+    public Directory<User> getUserDirectory() throws GuacamoleException {
+
+        // Defer to the vault-specific directory service
+        return directoryService.getUserDirectory(super.getUserDirectory());
+    }
+
+    @Override
+    public Directory<UserGroup> getUserGroupDirectory() throws GuacamoleException {
+
+        // Defer to the vault-specific directory service
+        return directoryService.getUserGroupDirectory(super.getUserGroupDirectory());
+    }
+
+    @Override
+    public Directory<Connection> getConnectionDirectory() throws GuacamoleException {
+
+        // Defer to the vault-specific directory service
+        return directoryService.getConnectionDirectory(super.getConnectionDirectory());
+    }
+
+    @Override
+    public Directory<ConnectionGroup> getConnectionGroupDirectory() throws GuacamoleException {
+
+        // Defer to the vault-specific directory service
+        return directoryService.getConnectionGroupDirectory(super.getConnectionGroupDirectory());
+    }
+
+    @Override
+    public Directory<ActiveConnection> getActiveConnectionDirectory() throws GuacamoleException {
+
+        // Defer to the vault-specific directory service
+        return directoryService.getActiveConnectionDirectory(super.getActiveConnectionDirectory());
+    }
+
+    @Override
+    public Directory<SharingProfile> getSharingProfileDirectory() throws GuacamoleException {
+
+        // Defer to the vault-specific directory service
+        return directoryService.getSharingProfileDirectory(super.getSharingProfileDirectory());
+    }
+
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
index 6a7a70c83..3c28553e0 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
@@ -24,12 +24,14 @@ import org.apache.guacamole.vault.VaultAuthenticationProviderModule;
 import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
 import org.apache.guacamole.vault.ksm.secret.KsmSecretService;
+import org.apache.guacamole.vault.ksm.user.KsmDirectoryService;
 import org.apache.guacamole.vault.conf.VaultAttributeService;
 import org.apache.guacamole.vault.conf.VaultConfigurationService;
 import org.apache.guacamole.vault.ksm.secret.KsmClient;
 import org.apache.guacamole.vault.ksm.secret.KsmClientFactory;
 import org.apache.guacamole.vault.ksm.secret.KsmRecordService;
 import org.apache.guacamole.vault.secret.VaultSecretService;
+import org.apache.guacamole.vault.user.VaultDirectoryService;
 
 import com.google.inject.assistedinject.FactoryModuleBuilder;
 
@@ -58,6 +60,7 @@ public class KsmAuthenticationProviderModule
         bind(VaultAttributeService.class).to(KsmAttributeService.class);
         bind(VaultConfigurationService.class).to(KsmConfigurationService.class);
         bind(VaultSecretService.class).to(KsmSecretService.class);
+        bind(VaultDirectoryService.class).to(KsmDirectoryService.class);
 
         // Bind factory for creating KSM Clients
         install(new FactoryModuleBuilder()
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
new file mode 100644
index 000000000..fc4a96213
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
@@ -0,0 +1,253 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.user;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.language.TranslatableGuacamoleClientException;
+import org.apache.guacamole.net.auth.Attributes;
+import org.apache.guacamole.net.auth.ConnectionGroup;
+import org.apache.guacamole.net.auth.DelegatingDirectory;
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
+import org.apache.guacamole.vault.ksm.conf.KsmConfig;
+import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
+import org.apache.guacamole.vault.user.VaultDirectoryService;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.inject.Inject;
+import com.keepersecurity.secretsManager.core.InMemoryStorage;
+import com.keepersecurity.secretsManager.core.SecretsManager;
+import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
+
+/**
+ * A KSM-specific vault directory service that wraps the connection group directory
+ * to enable automatic translation of KSM one-time tokens into base64-encoded JSON
+ * config bundles.
+ */
+public class KsmDirectoryService extends VaultDirectoryService {
+
+    /**
+     * Service for retrieving KSM configuration details.
+     */
+    @Inject
+    private KsmConfigurationService configurationService;
+
+    /**
+     * A singleton ObjectMapper for converting a Map to a JSON string when
+     * generating a base64-encoded JSON KSM config blob.
+     */
+    private static final ObjectMapper objectMapper = new ObjectMapper();
+
+    /**
+     * All expected fields in the KSM configuration JSON blob.
+     */
+    private static final List<String> EXPECTED_KSM_FIELDS = (
+            Collections.unmodifiableList(Arrays.asList(
+                    SecretsManager.KEY_HOSTNAME,
+                    SecretsManager.KEY_CLIENT_ID,
+                    SecretsManager.KEY_PRIVATE_KEY,
+                    SecretsManager.KEY_CLIENT_KEY,
+                    SecretsManager.KEY_APP_KEY,
+                    SecretsManager.KEY_OWNER_PUBLIC_KEY,
+                    SecretsManager.KEY_SERVER_PUBIC_KEY_ID
+    )));
+
+    /**
+     * Return true if the provided input is a valid base64-encoded string,
+     * false otherwise.
+     *
+     * @param input
+     *     The string to check if base-64 encoded.
+     *
+     * @return
+     *     true if the provided input is a valid base64-encoded string,
+     *     false otherwise.
+     */
+    private static boolean isBase64(String input) {
+
+        try {
+            Base64.getDecoder().decode(input);
+            return true;
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+    }
+
+    /**
+     * Given an attributes-enabled entity, check for the presence of the
+     * KSM_CONFIGURATION_ATTRIBUTE attribute. If it's set, check if it's a valid
+     * KSM one-time token. If so, attempt to translate it to a base-64-encoded
+     * json KSM config blob, and set it back to the provided entity.
+     * If it's already a KSM config blob, validate it as config blob. If either
+     * validation fails, a GuacamoleException will be thrown.
+     *
+     * @param entity
+     *     The attributes-enabled entity for which the KSM configuration
+     *     attribute parsing/validation should be performed.
+     *
+     * @throws GuacamoleException
+     *     If the KSM_CONFIGURATION_ATTRIBUTE is set, but fails to validate as
+     *     either a KSM one-time-token, or a KSM base64-encoded JSON config blob.
+     */
+    public void processAttributes(Attributes entity) throws GuacamoleException {
+
+        // By default, if the KSM config attribute isn't being set, pass the
+        // provided attributes through without any changes
+        Map<String, String> attributes = entity.getAttributes();
+
+        // Get the value of the KSM config attribute in the provided map
+        String ksmConfigValue = attributes.get(
+                KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
+
+        // Check if the attribute is set to a non-empty value
+        if (ksmConfigValue != null && !ksmConfigValue.trim().isEmpty()) {
+
+            // If it's already base64-encoded, it's a KSM configuration blob,
+            // so validate it immediately
+            if (isBase64(ksmConfigValue)) {
+
+                // Attempt to validate the config as a base64-econded KSM config blob
+                try {
+                    KsmConfig.parseKsmConfig(ksmConfigValue);
+
+                    // If it validates, the entity can be left alone - it's already valid
+                    return;
+                }
+
+                catch (GuacamoleException exception) {
+
+                    // If the parsing attempt fails, throw a translatable error for display
+                    // on the frontend
+                    throw new TranslatableGuacamoleClientException(
+                            "Invalid base64-encoded JSON KSM config provided for "
+                            + KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE + " attribute",
+                            "CONNECTION_GROUP_ATTRIBUTES.ERROR_INVALID_KSM_CONFIG_BLOB",
+                            exception);
+                }
+            }
+
+            // It wasn't a valid base64-encoded string, it should be a one-time token, so
+            // attempt to validat it as such, and if valid, update the attribute to the
+            // base64 config blob generated by the token
+            try {
+
+                // Create an initially empty storage to be populated using the one-time token
+                InMemoryStorage storage = new InMemoryStorage();
+
+                // Populate the in-memory storage using the one-time-token
+                SecretsManager.initializeStorage(storage, ksmConfigValue, null);
+
+                // Create an options object using the values we extracted from the one-time token
+                SecretsManagerOptions options = new SecretsManagerOptions(
+                    storage, null,
+                    configurationService.getAllowUnverifiedCertificate());
+
+                // Attempt to fetch secrets using the options we created. This will both validate
+                // that the configuration works, and potentially populate missing fields that the
+                // initializeStorage() call did not set.
+                SecretsManager.getSecrets(options);
+
+                // Create a map to store the extracted values from the KSM storage
+                Map<String, String> configMap = new HashMap<>();
+
+                // Go through all the expected fields, extract from the KSM storage,
+                // and write to the newly created map
+                EXPECTED_KSM_FIELDS.forEach(configKey -> {
+
+                    // Only write the value into the new map if non-null
+                    String value = storage.getString(configKey);
+                    if (value != null)
+                        configMap.put(configKey, value);
+
+                });
+
+                // JSON-encode the value, and then base64 encode that to get the format
+                // that KSM would expect
+                String jsonString = objectMapper.writeValueAsString(configMap);
+                String base64EncodedJson = Base64.getEncoder().encodeToString(
+                        jsonString.getBytes(StandardCharsets.UTF_8));
+
+                // Finally, try to parse the newly generated token as a KSM config. If this
+                // works, the config should be fully functional
+                KsmConfig.parseKsmConfig(base64EncodedJson);
+
+                // Make a copy of the existing attributes, modifying just the value for
+                // KSM_CONFIGURATION_ATTRIBUTE
+                attributes = new HashMap<>(attributes);
+                attributes.put(
+                        KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, base64EncodedJson);
+
+                // Set the newly updated attributes back to the original object
+                entity.setAttributes(attributes);
+
+            }
+
+            // The KSM SDK only throws raw Exceptions, so we can't be more specific
+            catch (Exception exception) {
+
+                // If the parsing attempt fails, throw a translatable error for display
+                // on the frontend
+                throw new TranslatableGuacamoleClientException(
+                        "Invalid one-time KSM token provided for "
+                        + KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE + " attribute",
+                        "CONNECTION_GROUP_ATTRIBUTES.ERROR_INVALID_KSM_ONE_TIME_TOKEN",
+                        exception);
+            }
+        }
+
+    }
+
+    @Override
+    public Directory<ConnectionGroup> getConnectionGroupDirectory(
+            Directory<ConnectionGroup> underlyingDirectory) throws GuacamoleException {
+
+        // A ConnectionGroup directory that will intercept add and update calls to
+        // validate KSM configurations, and translate one-time-tokens, if possible
+        return new DelegatingDirectory<ConnectionGroup>(underlyingDirectory) {
+
+            @Override
+            public void add(ConnectionGroup connectionGroup) throws GuacamoleException {
+
+                // Check for the KSM config attribute and translate the one-time token
+                // if possible before adding
+                processAttributes(connectionGroup);
+                super.add(connectionGroup);
+            }
+
+            @Override
+            public void update(ConnectionGroup connectionGroup) throws GuacamoleException {
+
+                // Check for the KSM config attribute and translate the one-time token
+                // if possible before updating
+                processAttributes(connectionGroup);
+                super.update(connectionGroup);
+            }
+
+        };
+    }
+}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json
index abda16cef..4601a13f1 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json
@@ -6,7 +6,10 @@
 
     "CONNECTION_GROUP_ATTRIBUTES" : {
         "SECTION_HEADER_KSM_CONFIG" : "Keeper Secrets Manager",
-        "FIELD_HEADER_KSM_CONFIG"   : "KSM Service Configuration "
+        "FIELD_HEADER_KSM_CONFIG"   : "KSM Service Configuration ",
+
+        "ERROR_INVALID_KSM_CONFIG_BLOB"    : "The provided base64-encoded KSM configuration blob is not valid. Please ensure that you have copied the entire blob.",
+        "ERROR_INVALID_KSM_ONE_TIME_TOKEN" : "The provided configuration is not a valid KSM one-time token or base64-encoded configuration blob. Please ensure that you have copied the entire token value."
     }
 
 }

From 492dbf48d609a7ff270d33a196a07fa2e3af0406 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 21 Jul 2022 23:25:25 +0000
Subject: [PATCH 036/289] GUACAMOLE-1643: Ensure connection groups with an
 empty KSM config attribute fall back to the global config.

---
 .../apache/guacamole/vault/ksm/secret/KsmSecretService.java | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index 2436a4e62..3d0d65bd4 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -276,9 +276,10 @@ public class KsmSecretService implements VaultSecretService {
             if (group == null)
                 break;
 
-            // If the current connection group has the KSM configuration attribute, return immediately
+            // If the current connection group has the KSM configuration attribute
+            // set to a non-empty value, return immediately
             String ksmConfig = group.getAttributes().get(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
-            if (ksmConfig != null)
+            if (ksmConfig != null && !ksmConfig.trim().isEmpty())
                 return ksmConfig;
 
             // Otherwise, keep searching up the tree until an appropriate configuration is found
@@ -287,6 +288,7 @@ public class KsmSecretService implements VaultSecretService {
 
         // If no KSM configuration was ever found, use the default value
         return confService.getKsmConfig();
+
     }
 
     @Override

From d599ad317ce1d55db1a0a7ca78594a04ea3281c1 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 21 Jul 2022 23:26:25 +0000
Subject: [PATCH 037/289] GUACAMOLE-1643: Ensure that the KSM config attribute
 is always visible for connection groups.

---
 .../vault/ksm/user/KsmConnectionGroup.java    | 78 +++++++++++++++++++
 .../vault/ksm/user/KsmDirectoryService.java   | 25 +++++-
 2 files changed, 100 insertions(+), 3 deletions(-)
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java
new file mode 100644
index 000000000..397c42f11
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.user;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.guacamole.net.auth.ConnectionGroup;
+import org.apache.guacamole.net.auth.DelegatingConnectionGroup;
+import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
+
+ /**
+  * A KSM-specific connection group implementation that always exposes
+  * the KSM_CONFIGURATION_ATTRIBUTE attribute, even when no value is set.
+  * This ensures that the attribute will always show up in the UI, even
+  * for connection groups that don't already have it set.
+  */
+ public class KsmConnectionGroup extends DelegatingConnectionGroup {
+
+    /**
+     * Create a new KsmConnectionGroup instance, wrapping the provided
+     * ConnectionGroup.
+     *
+     * @param connectionGroup
+     *     The ConnectionGroup instance to wrap.
+     */
+    public KsmConnectionGroup(ConnectionGroup connectionGroup) {
+
+        // Wrap the provided connection group
+        super(connectionGroup);
+    }
+
+    @Override
+    public Map<String, String> getAttributes() {
+
+        // All attributes defined on the underlying connection group
+        Map<String, String> attributes = super.getAttributes();
+
+        // If the attribute is already present, there's no need to add it - return
+        // the existing attributes as they are
+        if (attributes.containsKey(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE))
+            return attributes;
+
+        // Make a copy of the existing attributes and add KSM_CONFIGURATION_ATTRIBUTE
+        attributes = new HashMap<>(attributes);
+        attributes.put(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, null);
+        return attributes;
+
+    }
+
+    /**
+     * Return the underlying ConnectionGroup that's wrapped by this KsmConnectionGroup.
+     *
+     * @return
+     *     The underlying ConnectionGroup that's wrapped by this KsmConnectionGroup.
+     */
+    ConnectionGroup getUnderlyConnectionGroup() {
+        return getDelegateConnectionGroup();
+    }
+
+ }
\ No newline at end of file
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
index fc4a96213..b924bc524 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
@@ -31,7 +31,7 @@ import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.language.TranslatableGuacamoleClientException;
 import org.apache.guacamole.net.auth.Attributes;
 import org.apache.guacamole.net.auth.ConnectionGroup;
-import org.apache.guacamole.net.auth.DelegatingDirectory;
+import org.apache.guacamole.net.auth.DecoratingDirectory;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 import org.apache.guacamole.vault.ksm.conf.KsmConfig;
@@ -227,8 +227,10 @@ public class KsmDirectoryService extends VaultDirectoryService {
             Directory<ConnectionGroup> underlyingDirectory) throws GuacamoleException {
 
         // A ConnectionGroup directory that will intercept add and update calls to
-        // validate KSM configurations, and translate one-time-tokens, if possible
-        return new DelegatingDirectory<ConnectionGroup>(underlyingDirectory) {
+        // validate KSM configurations, and translate one-time-tokens, if possible,
+        // as well as ensuring that all ConnectionGroups returned include the
+        // KSM_CONFIGURATION_ATTRIBUTE attribute, so it will be available in the UI.
+        return new DecoratingDirectory<ConnectionGroup>(underlyingDirectory) {
 
             @Override
             public void add(ConnectionGroup connectionGroup) throws GuacamoleException {
@@ -248,6 +250,23 @@ public class KsmDirectoryService extends VaultDirectoryService {
                 super.update(connectionGroup);
             }
 
+            @Override
+            protected ConnectionGroup decorate(ConnectionGroup connectionGroup) throws GuacamoleException {
+
+                // Wrap the existing connection group in a KsmConnection to ensure the presence of the
+                // KSM_CONFIGURATION_ATTRIBUTE attribute
+                return new KsmConnectionGroup(connectionGroup);
+
+            }
+
+            @Override
+            protected ConnectionGroup undecorate(ConnectionGroup connectionGroup) throws GuacamoleException {
+
+                // Return the underlying connection group that the KsmConnectionGroup wraps
+                return ((KsmConnectionGroup) connectionGroup).getUnderlyConnectionGroup();
+
+            }
+
         };
     }
 }

From 67b5db77e1684c0a70ceed795cc5f3d79eaa94c8 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 26 Jul 2022 21:39:07 +0000
Subject: [PATCH 038/289] GUACAMOLE-1629: Keep track of iterated identifiers
 when recursing connection group tree looking for KSM attribute to ensure no
 infinite loop.

---
 .../vault/ksm/secret/KsmSecretService.java          | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index 3d0d65bd4..d8168dc8f 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -27,7 +27,9 @@ import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
 import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.Map;
+import java.util.Set;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
@@ -268,6 +270,12 @@ public class KsmSecretService implements VaultSecretService {
                 ? ((Connection) connectable).getParentIdentifier()
                 : ((ConnectionGroup) connectable).getIdentifier();
 
+        // Keep track of all group identifiers seen while recursing up the tree
+        // in case there's a cycle - if the same identifier is ever seen twice,
+        // the search is over.
+        Set<String> observedIdentifiers = new HashSet<>();
+        observedIdentifiers.add(parentIdentifier);
+
         Directory<ConnectionGroup> connectionGroupDirectory = userContext.getConnectionGroupDirectory();
         while (true) {
 
@@ -284,6 +292,11 @@ public class KsmSecretService implements VaultSecretService {
 
             // Otherwise, keep searching up the tree until an appropriate configuration is found
             parentIdentifier = group.getParentIdentifier();
+
+            // If the parent is a group that's already been seen, this is a cycle, so there's no
+            // need to search any further
+            if (!observedIdentifiers.add(parentIdentifier))
+                break;
         }
 
         // If no KSM configuration was ever found, use the default value

From c9a2fc249e7ef4993d2cab3831fe07a9dc6a3c19 Mon Sep 17 00:00:00 2001
From: elijahnicpon <elijah@nicpon.com>
Date: Mon, 25 Jul 2022 19:03:27 -0400
Subject: [PATCH 039/289] GUACAMOLE-1320: Provide chunked file upload mechanism

---
 .../src/app/rest/services/tunnelService.js    | 127 +++++++++++++-----
 .../tunnel/InputStreamInterceptingFilter.java |   8 +-
 2 files changed, 95 insertions(+), 40 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js b/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
index 5f9a21a7c..c5a10d6e4 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
@@ -54,6 +54,15 @@ angular.module('rest').factory('tunnelService', ['$injector',
      */
     var DOWNLOAD_CLEANUP_WAIT = 5000;
 
+    /**
+     * The maximum size a chunk may be during uploadToStream() in bytes.
+     * 
+     * @private
+     * @constant
+     * @type Number
+     */
+    const CHUNK_SIZE = 1024 * 1024 * 4;
+
     /**
      * Makes a request to the REST API to get the list of all tunnels
      * associated with in-progress connections, returning a promise that
@@ -301,51 +310,99 @@ angular.module('rest').factory('tunnelService', ['$injector',
                 + '/' + encodeURIComponent(sanitizeFilename(file.name))
                 + '?token=' + encodeURIComponent(authenticationService.getCurrentToken());
 
-        var xhr = new XMLHttpRequest();
+        /**
+         * Creates a chunk of the inputted file to be uploaded.
+         * 
+         * @param {Number} offset
+         *      The byte at which to begin the chunk. 
+         * 
+         * @return {File}
+         *      The file chunk created by this function.
+         */
+        const createChunk = (offset) => {
+            var chunkEnd = Math.min(offset + CHUNK_SIZE, file.size);
+            const chunk = file.slice(offset, chunkEnd);
+            return chunk;
+        };
 
-        // Invoke provided callback if upload tracking is supported
-        if (progressCallback && xhr.upload) {
-            xhr.upload.addEventListener('progress', function updateProgress(e) {
-                progressCallback(e.loaded);
-            });
-        }
+        /**
+         * POSTs the inputted chunks and recursively calls uploadHandler()
+         * until the upload is complete.
+         * 
+         * @param {File} chunk
+         *      The chunk to be uploaded to the stream.
+         * 
+         * @param {Number} offset
+         *      The byte at which the inputted chunk begins.
+         */ 
+        const uploadChunk = (chunk, offset) => {
+            var xhr = new XMLHttpRequest();
+            xhr.open('POST', url, true);
 
-        // Resolve/reject promise once upload has stopped
-        xhr.onreadystatechange = function uploadStatusChanged() {
+            // Invoke provided callback if upload tracking is supported.
+            if (progressCallback && xhr.upload) {
+                xhr.upload.addEventListener('progress', function updateProgress(e) {
+                    progressCallback(e.loaded + offset);
+                });
+            };
 
-            // Ignore state changes prior to completion
-            if (xhr.readyState !== 4)
-                return;
+            // Continue to next chunk, resolve, or reject promise as appropriate
+            // once upload has stopped
+            xhr.onreadystatechange = function uploadStatusChanged() {
 
-            // Resolve if HTTP status code indicates success
-            if (xhr.status >= 200 && xhr.status < 300)
-                deferred.resolve();
+                // Ignore state changes prior to completion.
+                if (xhr.readyState !== 4)
+                    return;
 
-            // Parse and reject with resulting JSON error
-            else if (xhr.getResponseHeader('Content-Type') === 'application/json')
-                deferred.reject(new Error(angular.fromJson(xhr.responseText)));
+                // Resolve if last chunk or begin next chunk if HTTP status
+                // code indicates success.
+                if (xhr.status >= 200 && xhr.status < 300) {
+                    offset += CHUNK_SIZE;
 
-            // Warn of lack of permission of a proxy rejects the upload
-            else if (xhr.status >= 400 && xhr.status < 500)
-                deferred.reject(new Error({
-                    'type'       : Error.Type.STREAM_ERROR,
-                    'statusCode' : Guacamole.Status.Code.CLIENT_FORBIDDEN,
-                    'message'    : 'HTTP ' + xhr.status
-                }));
+                    if (offset < file.size)
+                        uploadHandler(offset);
+                    else
+                        deferred.resolve();
+                }
 
-            // Assume internal error for all other cases
-            else
-                deferred.reject(new Error({
-                    'type'       : Error.Type.STREAM_ERROR,
-                    'statusCode' : Guacamole.Status.Code.INTERNAL_ERROR,
-                    'message'    : 'HTTP ' + xhr.status
-                }));
+                // Parse and reject with resulting JSON error
+                else if (xhr.getResponseHeader('Content-Type') === 'application/json')
+                    deferred.reject(new Error(angular.fromJson(xhr.responseText)));
+
+                // Warn of lack of permission of a proxy rejects the upload
+                else if (xhr.status >= 400 && xhr.status < 500)
+                    deferred.reject(new Error({
+                        'type': Error.Type.STREAM_ERROR,
+                        'statusCode': Guacamole.Status.Code.CLIENT_FORBIDDEN,
+                        'message': 'HTTP ' + xhr.status
+                    }));
+
+                // Assume internal error for all other cases
+                else
+                    deferred.reject(new Error({
+                        'type': Error.Type.STREAM_ERROR,
+                        'statusCode': Guacamole.Status.Code.INTERNAL_ERROR,
+                        'message': 'HTTP ' + xhr.status
+                    }));
+
+            };
+
+            // Perform upload
+            xhr.send(chunk);
 
         };
 
-        // Perform upload
-        xhr.open('POST', url, true);
-        xhr.send(file);
+        /**
+         * Handler for the upload process. 
+         * 
+         * @param {Number} offset
+         *      The byte at which to begin the chunk.
+         */
+        const uploadHandler = (offset) => {
+            uploadChunk(createChunk(offset), offset);
+        };
+
+        uploadHandler(0);
 
         return deferred.promise;
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/tunnel/InputStreamInterceptingFilter.java b/guacamole/src/main/java/org/apache/guacamole/tunnel/InputStreamInterceptingFilter.java
index f8e033416..6f725bfc1 100644
--- a/guacamole/src/main/java/org/apache/guacamole/tunnel/InputStreamInterceptingFilter.java
+++ b/guacamole/src/main/java/org/apache/guacamole/tunnel/InputStreamInterceptingFilter.java
@@ -94,8 +94,7 @@ public class InputStreamInterceptingFilter
     /**
      * Reads the next chunk of data from the InputStream associated with an
      * intercepted stream, sending that data as a "blob" instruction over the
-     * GuacamoleTunnel associated with this filter. If the end of the
-     * InputStream is reached, an "end" instruction will automatically be sent.
+     * GuacamoleTunnel associated with this filter.
      *
      * @param stream
      *     The stream from which the next chunk of data should be read.
@@ -112,9 +111,8 @@ public class InputStreamInterceptingFilter
             // End stream if no more data
             if (length == -1) {
 
-                // Close stream, send end if the stream is still valid
-                if (closeInterceptedStream(stream))
-                    sendEnd(stream.getIndex());
+                // Close stream
+                closeInterceptedStream(stream);
 
                 return;
 

From 003f7e945a8f14982e088aeb3c2b4df506ebd1a8 Mon Sep 17 00:00:00 2001
From: elijahnicpon <elijah@nicpon.com>
Date: Wed, 27 Jul 2022 20:26:17 -0400
Subject: [PATCH 040/289] GUACAMOLE-1320: Provide chunked file upload mechanism
 - add sendEnd()

---
 .../frontend/src/app/client/types/ManagedFileUpload.js | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/client/types/ManagedFileUpload.js b/guacamole/src/main/frontend/src/app/client/types/ManagedFileUpload.js
index 56587fcd0..95eef0c61 100644
--- a/guacamole/src/main/frontend/src/app/client/types/ManagedFileUpload.js
+++ b/guacamole/src/main/frontend/src/app/client/types/ManagedFileUpload.js
@@ -163,17 +163,19 @@ angular.module('client').factory('ManagedFileUpload', ['$rootScope', '$injector'
 
                 // Upload complete
                 managedFileUpload.progress = file.size;
+
+                // Close the stream
+                stream.sendEnd();
                 ManagedFileTransferState.setStreamState(managedFileUpload.transferState,
                     ManagedFileTransferState.StreamState.CLOSED);
 
                 // Notify of upload completion
                 $rootScope.$broadcast('guacUploadComplete', file.name);
-
             },
 
             // Notify if upload fails
             requestService.createErrorCallback(function uploadFailed(error) {
-
+                
                 // Use provide status code if the error is coming from the stream
                 if (error.type === Error.Type.STREAM_ERROR)
                     ManagedFileTransferState.setStreamState(managedFileUpload.transferState,
@@ -185,11 +187,15 @@ angular.module('client').factory('ManagedFileUpload', ['$rootScope', '$injector'
                     ManagedFileTransferState.setStreamState(managedFileUpload.transferState,
                         ManagedFileTransferState.StreamState.ERROR,
                         Guacamole.Status.Code.INTERNAL_ERROR);
+                
+                // Close the stream
+                stream.sendEnd();
 
             }));
 
             // Ignore all further acks
             stream.onack = null;
+    
 
         };
 

From b35b4d509f4f2087cef55b9ddce930df0f87c2f0 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 28 Jul 2022 00:44:34 +0000
Subject: [PATCH 041/289] GUACAMOLE-1372: Modify usage of SAML library to allow
 signed requests.

---
 .../acs/AuthenticationSessionManager.java     | 23 ++++++++++
 .../guacamole/auth/saml/acs/SAMLService.java  | 45 ++++++++++++++-----
 .../auth/saml/conf/ConfigurationService.java  | 10 ++++-
 3 files changed, 66 insertions(+), 12 deletions(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AuthenticationSessionManager.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AuthenticationSessionManager.java
index 198347cda..2e55d2cfc 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AuthenticationSessionManager.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AuthenticationSessionManager.java
@@ -126,6 +126,8 @@ public class AuthenticationSessionManager {
      * call to resume(). If authentication is never resumed, the session will
      * automatically be cleaned up after it ceases to be valid.
      *
+     * This method will automatically generate a new identifier.
+     *
      * @param session
      *     The {@link AuthenticationSession} representing the in-progress SAML
      *     authentication attempt.
@@ -140,6 +142,27 @@ public class AuthenticationSessionManager {
         return identifier;
     }
 
+    /**
+     * Defers the Guacamole side of authentication for the user having the
+     * given authentication session such that it may be later resumed through a
+     * call to resume(). If authentication is never resumed, the session will
+     * automatically be cleaned up after it ceases to be valid.
+     *
+     * This method accepts an externally generated ID, which should be a UUID
+     * or similar unique identifier.
+     *
+     * @param session
+     *     The {@link AuthenticationSession} representing the in-progress SAML
+     *     authentication attempt.
+     *
+     * @param identifier
+     *     A unique and unpredictable string that may be used to represent the
+     *     given session when calling resume().
+     */
+    public void defer(AuthenticationSession session, String identifier) {
+        sessions.put(identifier, session);
+    }
+
     /**
      * Shuts down the executor service that periodically removes all invalid
      * authentication sessions. This must be invoked when the SAML extension is
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java
index bd945203e..c3357eefb 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java
@@ -21,7 +21,9 @@ package org.apache.guacamole.auth.saml.acs;
 
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
+import com.onelogin.saml2.Auth;
 import com.onelogin.saml2.authn.AuthnRequest;
+import com.onelogin.saml2.authn.AuthnRequestParams;
 import com.onelogin.saml2.authn.SamlResponse;
 import com.onelogin.saml2.exception.SettingsException;
 import com.onelogin.saml2.exception.ValidationError;
@@ -29,7 +31,6 @@ import com.onelogin.saml2.settings.Saml2Settings;
 import java.io.IOException;
 import java.net.URI;
 import java.net.URISyntaxException;
-import javax.ws.rs.core.UriBuilder;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.xpath.XPathExpressionException;
 import org.apache.guacamole.GuacamoleException;
@@ -57,6 +58,12 @@ public class SAMLService {
     @Inject
     private AuthenticationSessionManager sessionManager;
 
+    /**
+     * Generator of arbitrary, unique, unpredictable identifiers.
+     */
+    @Inject
+    private IdentifierGenerator idGenerator;
+
     /**
      * Creates a new SAML request, beginning the overall authentication flow
      * that will ultimately result in an asserted user identity if the user is
@@ -75,20 +82,31 @@ public class SAMLService {
     public URI createRequest() throws GuacamoleException {
 
         Saml2Settings samlSettings = confService.getSamlSettings();
-        AuthnRequest samlReq = new AuthnRequest(samlSettings);
-
-        // Create a new authentication session to represent this attempt while
-        // it is in progress
-        AuthenticationSession session = new AuthenticationSession(samlReq.getId(),
-                confService.getAuthenticationTimeout() * 60000L);
 
         // Produce redirect for continuing the authentication process with
         // the SAML IdP
         try {
-            return UriBuilder.fromUri(samlSettings.getIdpSingleSignOnServiceUrl().toURI())
-                    .queryParam("SAMLRequest", samlReq.getEncodedAuthnRequest())
-                    .queryParam("RelayState", sessionManager.defer(session))
-                    .build();
+            Auth auth = new Auth(samlSettings, null, null);
+
+            // Generate a unique ID to use for the relay state
+            String identifier = idGenerator.generateIdentifier();
+
+            // Create the request URL for the SAML IdP
+            String requestUrl = auth.login(
+                    identifier,
+                    new AuthnRequestParams(false, false, true),
+                    true);
+
+            // Create a new authentication session to represent this attempt while
+            // it is in progress, using the request ID that was just issued
+            AuthenticationSession session = new AuthenticationSession(
+                    auth.getLastRequestId(),
+                    confService.getAuthenticationTimeout() * 60000L);
+
+            // Save the session with the unique relay state ID
+            sessionManager.defer(session, identifier);
+
+            return new URI(requestUrl);
         }
         catch (IOException e) {
             throw new GuacamoleServerException("SAML authentication request "
@@ -99,6 +117,11 @@ public class SAMLService {
                     + "be generated due to an error in the URI syntax: "
                     + e.getMessage());
         }
+        catch (SettingsException e) {
+            throw new GuacamoleServerException("Error while attempting to sign "
+                    + "request using provided private key / certificate: "
+                    + e.getMessage(), e);
+        }
 
     }
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
index 95862bd34..d2a73c46a 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
@@ -492,7 +492,15 @@ public class ConfigurationService {
         samlSettings.setDebug(getDebug());
         samlSettings.setCompressRequest(getCompressRequest());
         samlSettings.setCompressResponse(getCompressResponse());
-    
+
+        // Request that the SAML library sign everything that it can, if
+        // both private key and certificate are specified
+        if (privateKeyFile != null && certificateFile != null) {
+            samlSettings.setAuthnRequestsSigned(true);
+            samlSettings.setLogoutRequestSigned(true);
+            samlSettings.setLogoutResponseSigned(true);
+        }
+
         return samlSettings;
     }
 

From a116208a6da0a3d3a6aa92352f5c33f3ac336e73 Mon Sep 17 00:00:00 2001
From: elijahnicpon <elijah@nicpon.com>
Date: Thu, 28 Jul 2022 19:17:05 -0400
Subject: [PATCH 042/289] GUACAMOLE-1320: Provide chunked file upload mechanism
 - update uploadHandler documentation

---
 .../main/frontend/src/app/rest/services/tunnelService.js    | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js b/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
index c5a10d6e4..5cc547b40 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
@@ -393,7 +393,11 @@ angular.module('rest').factory('tunnelService', ['$injector',
         };
 
         /**
-         * Handler for the upload process. 
+         * Handles the recursive upload process. Each time it is called, a 
+         * chunk is made with createChunk(), starting at the offset parameter.
+         * The chunk is then sent by uploadChunk(), which recursively calls 
+         * this handler until the upload process is either completed and the 
+         * promise is resolved, or fails and the promise is rejected.
          * 
          * @param {Number} offset
          *      The byte at which to begin the chunk.

From a4713ca53b8554d320fbfe170ddfb487fd7b20f8 Mon Sep 17 00:00:00 2001
From: Niubbo75 <a.sironi@soluzioni-informatiche.org>
Date: Mon, 8 Aug 2022 14:17:45 +0200
Subject: [PATCH 043/289] GUACAMOLE-1612: Fix/Add italian translations

---
 .../src/main/resources/translations/it.json   |  13 ++
 .../src/main/resources/translations/it.json   | 113 ++++++++++++++++++
 .../src/main/resources/translations/it.json   |  18 +++
 .../src/main/resources/translations/it.json   |  26 ++++
 .../src/main/resources/translations/it.json   |  43 +++++++
 .../src/main/resources/translations/it.json   |  14 +++
 6 files changed, 227 insertions(+)
 create mode 100644 extensions/guacamole-auth-duo/src/main/resources/translations/it.json
 create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/it.json
 create mode 100644 extensions/guacamole-auth-quickconnect/src/main/resources/translations/it.json
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/it.json
 create mode 100644 extensions/guacamole-auth-totp/src/main/resources/translations/it.json
 create mode 100644 extensions/guacamole-history-recording-storage/src/main/resources/translations/it.json

diff --git a/extensions/guacamole-auth-duo/src/main/resources/translations/it.json b/extensions/guacamole-auth-duo/src/main/resources/translations/it.json
new file mode 100644
index 000000000..a16710c7c
--- /dev/null
+++ b/extensions/guacamole-auth-duo/src/main/resources/translations/it.json
@@ -0,0 +1,13 @@
+{
+
+    "DATA_SOURCE_DUO" : {
+        "NAME" : "Duo TFA Backend"
+    },
+
+    "LOGIN" : {
+        "FIELD_HEADER_GUAC_DUO_SIGNED_RESPONSE" : "",
+        "INFO_DUO_VALIDATION_CODE_INCORRECT"    : "Codice di convalida Duo errato.",
+        "INFO_DUO_AUTH_REQUIRED"                : "Si prega di autenticarsi con Duo per continuare."
+    }
+
+}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/it.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/it.json
new file mode 100644
index 000000000..c4a4e0305
--- /dev/null
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/it.json
@@ -0,0 +1,113 @@
+{
+
+    "LOGIN" : {
+
+        "ERROR_PASSWORD_BLANK"    : "@:APP.ERROR_PASSWORD_BLANK",
+        "ERROR_PASSWORD_SAME"     : "La nuova password deve essere diversa dalla password scaduta.",
+        "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
+        "ERROR_NOT_VALID"         : "Questo account utente non è attualmente valido.",
+        "ERROR_NOT_ACCESSIBLE"    : "L'accesso a questo account non è attualmente consentito. Per favore riprova più tardi.",
+
+        "INFO_PASSWORD_EXPIRED" : "La tua password è scaduta e deve essere reimpostata. Inserisci una nuova password per continuare.",
+
+        "FIELD_HEADER_NEW_PASSWORD"         : "Nuova password",
+        "FIELD_HEADER_CONFIRM_NEW_PASSWORD" : "Conferma la nuova password"
+
+    },
+
+    "CONNECTION_ATTRIBUTES" : {
+
+        "FIELD_HEADER_MAX_CONNECTIONS"          : "Numero massimo di connessioni:",
+        "FIELD_HEADER_MAX_CONNECTIONS_PER_USER" : "Numero massimo di connessioni per utente:",
+
+        "FIELD_HEADER_FAILOVER_ONLY"            : "Utilizzare solo per il failover:",
+        "FIELD_HEADER_WEIGHT"                   : "Peso della connessione:",
+
+        "FIELD_HEADER_GUACD_HOSTNAME"   : "Nome host:",
+        "FIELD_HEADER_GUACD_ENCRYPTION" : "Crittografia:",
+        "FIELD_HEADER_GUACD_PORT"       : "Porta:",
+
+        "FIELD_OPTION_GUACD_ENCRYPTION_EMPTY" : "",
+        "FIELD_OPTION_GUACD_ENCRYPTION_NONE"  : "Nessuno (non crittografato)",
+        "FIELD_OPTION_GUACD_ENCRYPTION_SSL"   : "SSL / TLS",
+
+        "SECTION_HEADER_CONCURRENCY"    : "Limiti di concorrenza",
+        "SECTION_HEADER_LOAD_BALANCING" : "Load Balancing",
+        "SECTION_HEADER_GUACD"          : "Guacamole Proxy Parameters (guacd)"
+
+    },
+
+    "CONNECTION_GROUP_ATTRIBUTES" : {
+
+        "FIELD_HEADER_ENABLE_SESSION_AFFINITY"  : "Abilita affinità di sessione:",
+        "FIELD_HEADER_MAX_CONNECTIONS"          : "Numero massimo di connessioni:",
+        "FIELD_HEADER_MAX_CONNECTIONS_PER_USER" : "Numero massimo di connessioni per utente:",
+
+        "SECTION_HEADER_CONCURRENCY" : "Limiti di concorrenza (gruppi di bilanciamento)"
+
+    },
+
+    "DATA_SOURCE_MYSQL" : {
+        "NAME" : "MySQL"
+    },
+
+    "DATA_SOURCE_MYSQL_SHARED" : {
+        "NAME" : "Connessioni condivise (MySQL)"
+    },
+
+    "DATA_SOURCE_POSTGRESQL" : {
+        "NAME" : "PostgreSQL"
+    },
+
+    "DATA_SOURCE_POSTGRESQL_SHARED" : {
+        "NAME" : "Connessioni condivise (PostgreSQL)"
+    },
+
+    "DATA_SOURCE_SQLSERVER" : {
+        "NAME" : "SQL Server"
+    },
+
+    "DATA_SOURCE_SQLSERVER_SHARED" : {
+        "NAME" : "Connessioni condivise (SQL Server)"
+    },
+
+    "HOME" : {
+        "INFO_SHARED_BY" : "Condiviso da {USERNAME}"
+    },
+
+    "PASSWORD_POLICY" : {
+
+        "ERROR_CONTAINS_USERNAME"      : "Le password non devono contenere il nome utente",
+        "ERROR_REQUIRES_DIGIT"         : "Le password devono contenere almeno una cifra.",
+        "ERROR_REQUIRES_MULTIPLE_CASE" : "Le password devono contenere sia caratteri maiuscoli che minuscoli.",
+        "ERROR_REQUIRES_NON_ALNUM"     : "Le password devono contenere almeno un simbolo.",
+        "ERROR_REUSED"                 : "Questa password è già stata utilizzata. Si prega di non riutilizzare nessuna delle precedenti {HISTORY_SIZE} {HISTORY_SIZE, plural, one{password} other{passwords}}.",
+        "ERROR_TOO_SHORT"              : "Le password devono essere almeno {LENGTH} {LENGTH, plural, one{carattere} other{caratteri}} di lunghezza.",
+        "ERROR_TOO_YOUNG"              : "La password per questo account è già stata reimpostata. Per favore aspetta almeno {WAIT} altri {WAIT, plural, one{giorno} other{giorni}} prima di modificare nuovamente la password."
+
+    },
+
+    "USER_ATTRIBUTES" : {
+
+        "FIELD_HEADER_DISABLED"            : "Accesso disabilitato:",
+        "FIELD_HEADER_EXPIRED"             : "Password scaduta:",
+        "FIELD_HEADER_ACCESS_WINDOW_END"   : "Non consentire l'accesso dopo:",
+        "FIELD_HEADER_ACCESS_WINDOW_START" : "Consenti l'accesso dopo:",
+        "FIELD_HEADER_TIMEZONE"            : "Fuso orario utente:",
+        "FIELD_HEADER_VALID_FROM"          : "Abilita account dopo:",
+        "FIELD_HEADER_VALID_UNTIL"         : "Disattiva account dopo:",
+
+        "SECTION_HEADER_RESTRICTIONS" : "Restrizioni dell'account",
+        "SECTION_HEADER_PROFILE"      : "Profilo"
+
+    },
+
+    "USER_GROUP_ATTRIBUTES" : {
+
+        "FIELD_HEADER_DISABLED" : "Disabilitato:",
+
+        "SECTION_HEADER_RESTRICTIONS" : "Restrizioni di gruppo"
+
+    }
+
+}
diff --git a/extensions/guacamole-auth-quickconnect/src/main/resources/translations/it.json b/extensions/guacamole-auth-quickconnect/src/main/resources/translations/it.json
new file mode 100644
index 000000000..bb99a7730
--- /dev/null
+++ b/extensions/guacamole-auth-quickconnect/src/main/resources/translations/it.json
@@ -0,0 +1,18 @@
+{
+
+    "DATA_SOURCE_QUICKCONNECT" : {
+        "NAME" : "QuickConnect"
+    },
+
+    "QUICKCONNECT" : {
+        "ACTION_CONNECT"        : "Collegare",
+        
+        "ERROR_INVALID_URI"      : "URI specificato non valido",
+        "ERROR_NO_HOST"          : "Nessun host specificato",
+        "ERROR_NO_PROTOCOL"      : "Nessun protocollo specificato",
+        "ERROR_NOT_ABSOLUTE_URI" : "L'URI non è assoluto",
+        
+        "FIELD_PLACEHOLDER_URI" : "Immettere l'URI di connessione"
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/it.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/it.json
new file mode 100644
index 000000000..246029367
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/it.json
@@ -0,0 +1,26 @@
+{
+
+    "DATA_SOURCE_CAS" : {
+        "NAME" : "CAS SSO Backend"
+    },
+
+    "DATA_SOURCE_OPENID" : {
+        "NAME" : "OpenID SSO Backend"
+    },
+
+    "DATA_SOURCE_SAML" : {
+        "NAME" : "SAML SSO Backend"
+    },
+
+    "LOGIN" : {
+        "FIELD_HEADER_ID_TOKEN"      : "",
+        "FIELD_HEADER_STATE"         : "",
+        "FIELD_HEADER_TICKET"        : "",
+        "INFO_IDP_REDIRECT_PENDING"  : "Attendi, reindirizzamento al provider di identità...",
+        "NAME_IDP_CAS"               : "CAS",
+        "NAME_IDP_OPENID"            : "OpenID",
+        "NAME_IDP_SAML"              : "SAML",
+        "SECTION_HEADER_SSO_OPTIONS" : "Accedi con:"
+    }
+
+}
diff --git a/extensions/guacamole-auth-totp/src/main/resources/translations/it.json b/extensions/guacamole-auth-totp/src/main/resources/translations/it.json
new file mode 100644
index 000000000..97b30f469
--- /dev/null
+++ b/extensions/guacamole-auth-totp/src/main/resources/translations/it.json
@@ -0,0 +1,43 @@
+{
+
+    "DATA_SOURCE_TOTP" : {
+        "NAME" : "TOTP TFA Backend"
+    },
+
+    "LOGIN" : {
+        "FIELD_HEADER_GUAC_TOTP" : ""
+    },
+
+    "TOTP" : {
+
+        "ACTION_HIDE_DETAILS" : "Nascondere",
+        "ACTION_SHOW_DETAILS" : "Mostrare",
+
+        "FIELD_HEADER_ALGORITHM"  : "Algoritmo:",
+        "FIELD_HEADER_DIGITS"     : "Cifre:",
+        "FIELD_HEADER_INTERVAL"   : "Intervallo:",
+        "FIELD_HEADER_SECRET_KEY" : "Chiave segreta:",
+
+        "FIELD_PLACEHOLDER_CODE" : "Codice di Autenticazione",
+
+        "INFO_CODE_REQUIRED"       : "Inserisci il tuo codice di autenticazione per verificare la tua identità.",
+        "INFO_ENROLL_REQUIRED"     : "L'autenticazione a più fattori è stata abilitata sul tuo account.",
+        "INFO_VERIFICATION_FAILED" : "Verifica fallita. Per favore riprova.",
+
+        "HELP_ENROLL_BARCODE" : "Per completare il processo di registrazione, scansiona il codice a barre qui sotto con l'app di autenticazione a due fattori sul tuo telefono o dispositivo.",
+        "HELP_ENROLL_VERIFY"  : "Dopo aver scansionato il codice a barre, inserire il codice di autenticazione a {DIGITS}-cifre visualizzato per verificare che la registrazione sia andata a buon fine.",
+
+        "SECTION_HEADER_DETAILS" : "Dettagli:"
+
+    },
+    
+    "USER_ATTRIBUTES" : {
+        
+        "FIELD_HEADER_GUAC_TOTP_KEY_GENERATED" : "Chiave segreta generata:",
+        "FIELD_HEADER_GUAC_TOTP_KEY_CONFIRMED" : "Dispositivo di autenticazione confermato:",
+        
+        "SECTION_HEADER_TOTP_ENROLLMENT_STATUS" : "Stato di iscrizione TOTP"
+        
+    }
+
+}
diff --git a/extensions/guacamole-history-recording-storage/src/main/resources/translations/it.json b/extensions/guacamole-history-recording-storage/src/main/resources/translations/it.json
new file mode 100644
index 000000000..bec1fc261
--- /dev/null
+++ b/extensions/guacamole-history-recording-storage/src/main/resources/translations/it.json
@@ -0,0 +1,14 @@
+{
+
+    "DATA_SOURCE_RECORDING_STORAGE" : {
+        "NAME" : "Archiviazione della registrazione della sessione"
+    },
+
+    "RECORDING_STORAGE" : {
+        "INFO_GUACAMOLE_SESSION_RECORDING" :  "Registrazione grafica della sessione desktop remoto",
+        "INFO_SERVER_LOG" :  "Server/system log",
+        "INFO_TYPESCRIPT" :  "Registrazione del testo della sessione del terminale",
+        "INFO_TYPESCRIPT_TIMING" :  "Informazioni sull'orario per la registrazione del testo della sessione del terminale"
+    }
+
+}

From 4fca3127fbd3c75377aed908f0c9c34a56d63a2d Mon Sep 17 00:00:00 2001
From: Jean-Benoit PAUX <9682558+jbpaux@users.noreply.github.com>
Date: Mon, 11 Apr 2022 15:05:51 +0200
Subject: [PATCH 044/289] GUACAMOLE-1572: match PostgreSQL environment
 variables with guacamole.properties variables

---
 guacamole-docker/README.md    | 30 +++++------
 guacamole-docker/bin/start.sh | 94 +++++++++++++++++------------------
 2 files changed, 62 insertions(+), 62 deletions(-)

diff --git a/guacamole-docker/README.md b/guacamole-docker/README.md
index 0f6200f89..e800345eb 100644
--- a/guacamole-docker/README.md
+++ b/guacamole-docker/README.md
@@ -55,31 +55,31 @@ Deploying Guacamole with PostgreSQL authentication
 --------------------------------------------------
 
     docker run --name some-guacamole --link some-guacd:guacd \
-        --link some-postgres:postgres      \
-        -e POSTGRES_DATABASE=guacamole_db  \
-        -e POSTGRES_USER=guacamole_user    \
-        -e POSTGRES_PASSWORD=some_password \
-        -e POSTGRES_DATABASE_FILE=/run/secrets/<secret_name> \
-        -e POSTGRES_USER_FILE=/run/secrets/<secret_name> \
-        -e POSTGRES_PASSWORD_FILE=/run/secrets/<secret_name> \
+        --link some-postgresql:postgresql      \
+        -e POSTGRESQL_DATABASE=guacamole_db  \
+        -e POSTGRESQL_USER=guacamole_user    \
+        -e POSTGRESQL_PASSWORD=some_password \
+        -e POSTGRESQL_DATABASE_FILE=/run/secrets/<secret_name> \
+        -e POSTGRESQL_USER_FILE=/run/secrets/<secret_name> \
+        -e POSTGRESQL_PASSWORD_FILE=/run/secrets/<secret_name> \
         -d -p 8080:8080 guacamole/guacamole
 
 Linking Guacamole to PostgreSQL requires three environment variables. If any of
 these environment variables are omitted, you will receive an error message, and
 the image will stop:
 
-1. `POSTGRES_DATABASE` - The name of the database to use for Guacamole
+1. `POSTGRESQL_DATABASE` - The name of the database to use for Guacamole
    authentication.
-2. `POSTGRES_USER` - The user that Guacamole will use to connect to PostgreSQL.
-3. `POSTGRES_PASSWORD` - The password that Guacamole will provide when
-   connecting to PostgreSQL as `POSTGRES_USER`.
-4. `POSTGRES_DATABASE_FILE` - The path of the docker secret containing the name
+2. `POSTGRESQL_USER` - The user that Guacamole will use to connect to PostgreSQL.
+3. `POSTGRESQL_PASSWORD` - The password that Guacamole will provide when
+   connecting to PostgreSQL as `POSTGRESQL_USER`.
+4. `POSTGRESQL_DATABASE_FILE` - The path of the docker secret containing the name
    of database to use for Guacamole authentication.
-5. `POSTGRES_USER_FILE` - The path of the docker secret containing the name of
+5. `POSTGRESQL_USER_FILE` - The path of the docker secret containing the name of
    the user that Guacamole will use to connect to PostgreSQL.
-6. `POSTGRES_PASSWORD_FILE` - The path of the docker secret containing the
+6. `POSTGRESQL_PASSWORD_FILE` - The path of the docker secret containing the
    password that Guacamole will provide when connecting to PostgreSQL as
-   `POSTGRES_USER.
+   `POSTGRESQL_USER.
 
 ### Initializing the PostgreSQL database
 
diff --git a/guacamole-docker/bin/start.sh b/guacamole-docker/bin/start.sh
index c9d205b58..4557576e0 100755
--- a/guacamole-docker/bin/start.sh
+++ b/guacamole-docker/bin/start.sh
@@ -242,7 +242,7 @@ END
 }
 
 # Print error message regarding missing required variables for PostgreSQL authentication
-postgres_missing_vars() {
+postgresql_missing_vars() {
     cat <<END
 FATAL: Missing required environment variables
 -------------------------------------------------------------------------------
@@ -251,13 +251,13 @@ environment variables or their corresponding Docker secrets by appending _FILE
 to the environment variable, and setting the value to the path of the
 corresponding secret:
 
-    POSTGRES_USER      The user to authenticate as when connecting to
+    POSTGRESQL_USER      The user to authenticate as when connecting to
                        PostgreSQL.
 
-    POSTGRES_PASSWORD  The password to use when authenticating with PostgreSQL
-                       as POSTGRES_USER.
+    POSTGRESQL_PASSWORD  The password to use when authenticating with PostgreSQL
+                       as POSTGRESQL_USER.
 
-    POSTGRES_DATABASE  The name of the PostgreSQL database to use for Guacamole
+    POSTGRESQL_DATABASE  The name of the PostgreSQL database to use for Guacamole
                        authentication.
 END
     exit 1;
@@ -267,38 +267,38 @@ END
 ## Adds properties to guacamole.properties which select the PostgreSQL
 ## authentication provider, and configure it to connect to the linked
 ## PostgreSQL container. If a PostgreSQL database is explicitly specified using
-## the POSTGRES_HOSTNAME and POSTGRES_PORT environment variables, that will be
+## the POSTGRESQL_HOSTNAME and POSTGRESQL_PORT environment variables, that will be
 ## used instead of a linked container.
 ##
 associate_postgresql() {
 
     # Use linked container if specified
-    if [ -n "$POSTGRES_NAME" ]; then
-        POSTGRES_HOSTNAME="$POSTGRES_PORT_5432_TCP_ADDR"
-        POSTGRES_PORT="$POSTGRES_PORT_5432_TCP_PORT"
+    if [ -n "$POSTGRESQL_NAME" ]; then
+        POSTGRESQL_HOSTNAME="$POSTGRESQL_PORT_5432_TCP_ADDR"
+        POSTGRESQL_PORT="$POSTGRESQL_PORT_5432_TCP_PORT"
     fi
 
     # Use default port if none specified
-    POSTGRES_PORT="${POSTGRES_PORT-5432}"
+    POSTGRESQL_PORT="${POSTGRESQL_PORT-5432}"
 
     # Verify required connection information is present
-    if [ -z "$POSTGRES_HOSTNAME" -o -z "$POSTGRES_PORT" ]; then
+    if [ -z "$POSTGRESQL_HOSTNAME" -o -z "$POSTGRESQL_PORT" ]; then
         cat <<END
-FATAL: Missing POSTGRES_HOSTNAME or "postgres" link.
+FATAL: Missing POSTGRESQL_HOSTNAME or "postgresql" link.
 -------------------------------------------------------------------------------
 If using a PostgreSQL database, you must either:
 
-(a) Explicitly link that container with the link named "postgres".
+(a) Explicitly link that container with the link named "postgresql".
 
 (b) If not using a Docker container for PostgreSQL, explicitly specify the TCP
     connection to your database using the following environment variables:
 
-    POSTGRES_HOSTNAME  The hostname or IP address of the PostgreSQL server. If
+    POSTGRESQL_HOSTNAME  The hostname or IP address of the PostgreSQL server. If
                        not using a PostgreSQL Docker container and
                        corresponding link, this environment variable is
                        *REQUIRED*.
 
-    POSTGRES_PORT      The port on which the PostgreSQL server is listening for
+    POSTGRESQL_PORT      The port on which the PostgreSQL server is listening for
                        TCP connections. This environment variable is option. If
                        omitted, the standard PostgreSQL port of 5432 will be
                        used.
@@ -307,68 +307,68 @@ END
     fi
 
     # Verify that the required Docker secrets are present, else, default to their normal environment variables
-    if [ -n "$POSTGRES_USER_FILE" ]; then
-        set_property "postgresql-username" "`cat "$POSTGRES_USER_FILE"`"
-    elif [ -n "$POSTGRES_USER" ]; then
-        set_property "postgresql-username" "$POSTGRES_USER"
+    if [ -n "$POSTGRESQL_USER_FILE" ]; then
+        set_property "postgresql-username" "`cat "$POSTGRESQL_USER_FILE"`"
+    elif [ -n "$POSTGRESQL_USER" ]; then
+        set_property "postgresql-username" "$POSTGRESQL_USER"
     else
-        postgres_missing_vars
+        postgresql_missing_vars
         exit 1;
     fi
 
-    if [ -n "$POSTGRES_PASSWORD_FILE" ]; then
-        set_property "postgresql-password" "`cat "$POSTGRES_PASSWORD_FILE"`"
-    elif [ -n "$POSTGRES_PASSWORD" ]; then
-        set_property "postgresql-password" "$POSTGRES_PASSWORD"
+    if [ -n "$POSTGRESQL_PASSWORD_FILE" ]; then
+        set_property "postgresql-password" "`cat "$POSTGRESQL_PASSWORD_FILE"`"
+    elif [ -n "$POSTGRESQL_PASSWORD" ]; then
+        set_property "postgresql-password" "$POSTGRESQL_PASSWORD"
     else
-        postgres_missing_vars
+        postgresql_missing_vars
         exit 1;
     fi
 
-    if [ -n "$POSTGRES_DATABASE_FILE" ]; then
-        set_property "postgresql-database" "`cat "$POSTGRES_DATABASE_FILE"`"
-    elif [ -n "$POSTGRES_DATABASE" ]; then
-        set_property "postgresql-database" "$POSTGRES_DATABASE"
+    if [ -n "$POSTGRESQL_DATABASE_FILE" ]; then
+        set_property "postgresql-database" "`cat "$POSTGRESQL_DATABASE_FILE"`"
+    elif [ -n "$POSTGRESQL_DATABASE" ]; then
+        set_property "postgresql-database" "$POSTGRESQL_DATABASE"
     else
-        postgres_missing_vars
+        postgresql_missing_vars
         exit 1;
     fi
 
     # Update config file
-    set_property "postgresql-hostname" "$POSTGRES_HOSTNAME"
-    set_property "postgresql-port"     "$POSTGRES_PORT"
+    set_property "postgresql-hostname" "$POSTGRESQL_HOSTNAME"
+    set_property "postgresql-port"     "$POSTGRESQL_PORT"
 
     set_optional_property               \
         "postgresql-absolute-max-connections" \
-        "$POSTGRES_ABSOLUTE_MAX_CONNECTIONS"
+        "$POSTGRESQL_ABSOLUTE_MAX_CONNECTIONS"
 
     set_optional_property                    \
         "postgresql-default-max-connections" \
-        "$POSTGRES_DEFAULT_MAX_CONNECTIONS"
+        "$POSTGRESQL_DEFAULT_MAX_CONNECTIONS"
 
     set_optional_property                          \
         "postgresql-default-max-group-connections" \
-        "$POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS"
+        "$POSTGRESQL_DEFAULT_MAX_GROUP_CONNECTIONS"
 
     set_optional_property                             \
         "postgresql-default-max-connections-per-user" \
-        "$POSTGRES_DEFAULT_MAX_CONNECTIONS_PER_USER"
+        "$POSTGRESQL_DEFAULT_MAX_CONNECTIONS_PER_USER"
 
     set_optional_property                                   \
         "postgresql-default-max-group-connections-per-user" \
-        "$POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER"
+        "$POSTGRESQL_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER"
 
     set_optional_property                      \
         "postgresql-default-statement-timeout" \
-        "$POSTGRES_DEFAULT_STATEMENT_TIMEOUT"
+        "$POSTGRESQL_DEFAULT_STATEMENT_TIMEOUT"
 
     set_optional_property          \
         "postgresql-user-required" \
-        "$POSTGRES_USER_REQUIRED"
+        "$POSTGRESQL_USER_REQUIRED"
 
     set_optional_property           \
         "postgresql-socket-timeout" \
-        "$POSTGRES_SOCKET_TIMEOUT"
+        "$POSTGRESQL_SOCKET_TIMEOUT"
 
     set_optional_property      \
         "postgresql-ssl-mode"  \
@@ -387,10 +387,10 @@ END
         "$POSTGRESQL_SSL_ROOT_CERT_FILE"
 
     # For SSL key password, check secrets, first, then standard env variable
-    if [ -n "$POSTGRES_SSL_KEY_PASSWORD_FILE" ]; then
-        set_property "postgresql-ssl-key-password" "`cat "$POSTGRES_SSL_KEY_PASSWORD_FILE"`"
-    elif [ -n "$POSTGRES_SSL_KEY_PASSWORD" ]; then
-        set_property "postgresql-ssl-key-password" "$POSTGRES_SSL_KEY_PASSWORD"
+    if [ -n "$POSTGRESQL_SSL_KEY_PASSWORD_FILE" ]; then
+        set_property "postgresql-ssl-key-password" "`cat "$POSTGRESQL_SSL_KEY_PASSWORD_FILE"`"
+    elif [ -n "$POSTGRESQL_SSL_KEY_PASSWORD" ]; then
+        set_property "postgresql-ssl-key-password" "$POSTGRESQL_SSL_KEY_PASSWORD"
     fi
 
     set_optional_property                  \
@@ -1073,9 +1073,9 @@ if [ -n "$MYSQL_DATABASE" -o -n "$MYSQL_DATABASE_FILE" ]; then
 fi
 
 # Use PostgreSQL if database specified
-if [ -n "$POSTGRES_DATABASE" -o -n "$POSTGRES_DATABASE_FILE" ]; then
+if [ -n "$POSTGRESQL_DATABASE" -o -n "$POSTGRESQL_DATABASE_FILE" ]; then
     associate_postgresql
-    INSTALLED_AUTH="$INSTALLED_AUTH postgres"
+    INSTALLED_AUTH="$INSTALLED_AUTH postgresql"
 fi
 
 # Use SQLServer if database specified
@@ -1145,7 +1145,7 @@ FATAL: No authentication configured
 The Guacamole Docker container needs at least one authentication mechanism in
 order to function, such as a MySQL database, PostgreSQL database, SQLServer
 database, LDAP directory or RADIUS server. Please specify at least the
-MYSQL_DATABASE or POSTGRES_DATABASE or SQLSERVER_DATABASE environment variables,
+MYSQL_DATABASE or POSTGRESQL_DATABASE or SQLSERVER_DATABASE environment variables,
 or check Guacamole's Docker documentation regarding configuring LDAP and/or
 custom extensions.
 END

From 619f09196de3c80d7f30553ac0d69269b9d856ca Mon Sep 17 00:00:00 2001
From: Jean-Benoit PAUX <9682558+jbpaux@users.noreply.github.com>
Date: Mon, 11 Apr 2022 15:06:59 +0200
Subject: [PATCH 045/289] GUACAMOLE-1572: Update init script to match
 postgresql too

---
 guacamole-docker/README.md     | 2 +-
 guacamole-docker/bin/initdb.sh | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/guacamole-docker/README.md b/guacamole-docker/README.md
index e800345eb..78631e852 100644
--- a/guacamole-docker/README.md
+++ b/guacamole-docker/README.md
@@ -91,7 +91,7 @@ To generate a SQL script which can be used to initialize a fresh PostgreSQL
 database
 [as documented in the Guacamole manual](http://guacamole.apache.org/doc/gug/jdbc-auth.html#jdbc-auth-postgresql):
 
-    docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --postgres > initdb.sql
+    docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --postgresql > initdb.sql
 
 Alternatively, you can use the SQL scripts included with the
 guacamole-auth-jdbc extension from
diff --git a/guacamole-docker/bin/initdb.sh b/guacamole-docker/bin/initdb.sh
index 6031189c9..aa92b66bb 100755
--- a/guacamole-docker/bin/initdb.sh
+++ b/guacamole-docker/bin/initdb.sh
@@ -26,7 +26,7 @@
 ##
 ## @param DATABASE
 ##     The database to generate the SQL script for. This may be either
-##     "--postgres", for PostgreSQL, "--mysql" for MySQL, or "--sqlserver" for Microsoft SQL Server.
+##     "--postgresql", for PostgreSQL, "--mysql" for MySQL, or "--sqlserver" for Microsoft SQL Server.
 ##
 
 DATABASE="$1"
@@ -37,7 +37,7 @@ DATABASE="$1"
 ##
 incorrect_usage() {
     cat <<END
-USAGE: /opt/guacamole/bin/initdb.sh [--postgres | --mysql | --sqlserver]
+USAGE: /opt/guacamole/bin/initdb.sh [--postgresql | --mysql | --sqlserver]
 END
     exit 1
 }
@@ -54,7 +54,7 @@ fi
 
 case $DATABASE in
 
-    --postgres)
+    --postgresql)
         cat /opt/guacamole/postgresql/schema/*.sql
         ;;
 

From 1948878ca9f24e23db950750ca8ab2e286aa4c4b Mon Sep 17 00:00:00 2001
From: Jean-Benoit PAUX <9682558+jbpaux@users.noreply.github.com>
Date: Wed, 27 Apr 2022 15:13:41 +0200
Subject: [PATCH 046/289] GUACAMOLE-1572: Revert postgres link name change

---
 guacamole-docker/README.md    |  2 +-
 guacamole-docker/bin/start.sh | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/guacamole-docker/README.md b/guacamole-docker/README.md
index 78631e852..a6e7e1670 100644
--- a/guacamole-docker/README.md
+++ b/guacamole-docker/README.md
@@ -55,7 +55,7 @@ Deploying Guacamole with PostgreSQL authentication
 --------------------------------------------------
 
     docker run --name some-guacamole --link some-guacd:guacd \
-        --link some-postgresql:postgresql      \
+        --link some-postgres:postgres        \
         -e POSTGRESQL_DATABASE=guacamole_db  \
         -e POSTGRESQL_USER=guacamole_user    \
         -e POSTGRESQL_PASSWORD=some_password \
diff --git a/guacamole-docker/bin/start.sh b/guacamole-docker/bin/start.sh
index 4557576e0..f57e5feba 100755
--- a/guacamole-docker/bin/start.sh
+++ b/guacamole-docker/bin/start.sh
@@ -273,9 +273,9 @@ END
 associate_postgresql() {
 
     # Use linked container if specified
-    if [ -n "$POSTGRESQL_NAME" ]; then
-        POSTGRESQL_HOSTNAME="$POSTGRESQL_PORT_5432_TCP_ADDR"
-        POSTGRESQL_PORT="$POSTGRESQL_PORT_5432_TCP_PORT"
+    if [ -n "$POSTGRES_NAME" ]; then
+        POSTGRESQL_HOSTNAME="$POSTGRES_PORT_5432_TCP_ADDR"
+        POSTGRESQL_PORT="$POSTGRES_PORT_5432_TCP_PORT"
     fi
 
     # Use default port if none specified
@@ -284,11 +284,11 @@ associate_postgresql() {
     # Verify required connection information is present
     if [ -z "$POSTGRESQL_HOSTNAME" -o -z "$POSTGRESQL_PORT" ]; then
         cat <<END
-FATAL: Missing POSTGRESQL_HOSTNAME or "postgresql" link.
+FATAL: Missing POSTGRESQL_HOSTNAME or "postgres" link.
 -------------------------------------------------------------------------------
 If using a PostgreSQL database, you must either:
 
-(a) Explicitly link that container with the link named "postgresql".
+(a) Explicitly link that container with the link named "postgres".
 
 (b) If not using a Docker container for PostgreSQL, explicitly specify the TCP
     connection to your database using the following environment variables:

From 7ce2938b14e8d92ff53227dbe25ace6f3d70b0c2 Mon Sep 17 00:00:00 2001
From: Jean-Benoit PAUX <9682558+jbpaux@users.noreply.github.com>
Date: Wed, 27 Apr 2022 15:52:50 +0200
Subject: [PATCH 047/289] GUACAMOLE-1572: Add compatibility mechanism for
 POSTGRES variables

---
 guacamole-docker/bin/start.sh | 71 +++++++++++++++++++++++++++++++----
 1 file changed, 64 insertions(+), 7 deletions(-)

diff --git a/guacamole-docker/bin/start.sh b/guacamole-docker/bin/start.sh
index f57e5feba..ef55d5737 100755
--- a/guacamole-docker/bin/start.sh
+++ b/guacamole-docker/bin/start.sh
@@ -263,6 +263,63 @@ END
     exit 1;
 }
 
+## Provide backward compatibility on POSTGRES_* environment variables
+## In case of new deployment, please use POSTGRESQL_* equivalent variables.
+if [ -n "$POSTGRES_HOSTNAME" ]; then
+    POSTGRESQL_HOSTNAME=$POSTGRES_HOSTNAME;
+fi
+if [ -n "$POSTGRES_PORT" ]; then
+    POSTGRESQL_PORT=$POSTGRES_PORT;
+fi
+if [ -n "$POSTGRES_DATABASE" ]; then
+    POSTGRESQL_DATABASE=$POSTGRES_DATABASE;
+fi
+if [ -n "$POSTGRES_DATABASE_FILE" ]; then
+    POSTGRESQL_DATABASE=$POSTGRES_DATABASE_FILE;
+fi
+if [ -n "$POSTGRES_USER_FILE" ]; then
+    POSTGRESQL_USER_FILE=$POSTGRES_USER_FILE;
+fi
+if [ -n "$POSTGRES_USER" ]; then
+    POSTGRESQL_USER=$POSTGRES_USER;
+fi
+if [ -n "$POSTGRES_PASSWORD_FILE" ]; then
+    POSTGRESQL_PASSWORD_FILE=$POSTGRES_PASSWORD_FILE;
+fi
+if [ -n "$POSTGRES_PASSWORD" ]; then
+    POSTGRESQL_PASSWORD=$POSTGRES_PASSWORD;
+fi
+if [ -n "$POSTGRES_ABSOLUTE_MAX_CONNECTIONS" ]; then
+    POSTGRESQL_ABSOLUTE_MAX_CONNECTIONS=$POSTGRES_ABSOLUTE_MAX_CONNECTIONS;
+fi
+if [ -n "$POSTGRES_DEFAULT_MAX_CONNECTIONS" ]; then
+    POSTGRESQL_DEFAULT_MAX_CONNECTIONS=$POSTGRES_DEFAULT_MAX_CONNECTIONS;
+fi
+if [ -n "$POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS" ]; then
+    POSTGRESQL_DEFAULT_MAX_GROUP_CONNECTIONS=$POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS;
+fi
+if [ -n "$POSTGRES_DEFAULT_MAX_CONNECTIONS_PER_USER" ]; then
+    POSTGRESQL_DEFAULT_MAX_CONNECTIONS_PER_USER=$POSTGRES_DEFAULT_MAX_CONNECTIONS_PER_USER;
+fi
+if [ -n "$POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER" ]; then
+    POSTGRESQL_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER=$POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER;
+fi
+if [ -n "$POSTGRES_DEFAULT_STATEMENT_TIMEOUT" ]; then
+    POSTGRESQL_DEFAULT_STATEMENT_TIMEOUT=$POSTGRES_DEFAULT_STATEMENT_TIMEOUT;
+fi
+if [ -n "$POSTGRES_USER_REQUIRED" ]; then
+    POSTGRESQL_USER_REQUIRED=$POSTGRES_USER_REQUIRED;
+fi
+if [ -n "$POSTGRES_SOCKET_TIMEOUT" ]; then
+    POSTGRESQL_SOCKET_TIMEOUT=$POSTGRES_SOCKET_TIMEOUT;
+fi
+if [ -n "$POSTGRES_SSL_KEY_PASSWORD_FILE" ]; then
+    POSTGRESQL_SSL_KEY_PASSWORD_FILE=$POSTGRES_SSL_KEY_PASSWORD_FILE;
+fi
+if [ -n "$POSTGRES_SSL_KEY_PASSWORD" ]; then
+    POSTGRESQL_SSL_KEY_PASSWORD=$POSTGRES_SSL_KEY_PASSWORD;
+fi
+
 ##
 ## Adds properties to guacamole.properties which select the PostgreSQL
 ## authentication provider, and configure it to connect to the linked
@@ -294,14 +351,14 @@ If using a PostgreSQL database, you must either:
     connection to your database using the following environment variables:
 
     POSTGRESQL_HOSTNAME  The hostname or IP address of the PostgreSQL server. If
-                       not using a PostgreSQL Docker container and
-                       corresponding link, this environment variable is
-                       *REQUIRED*.
+                         not using a PostgreSQL Docker container and
+                         corresponding link, this environment variable is
+                         *REQUIRED*.
 
     POSTGRESQL_PORT      The port on which the PostgreSQL server is listening for
-                       TCP connections. This environment variable is option. If
-                       omitted, the standard PostgreSQL port of 5432 will be
-                       used.
+                         TCP connections. This environment variable is option. If
+                         omitted, the standard PostgreSQL port of 5432 will be
+                         used.
 END
         exit 1;
     fi
@@ -430,7 +487,7 @@ set the path of the corresponding secrets in the following three variables:
                               the user that Guacamole will use to connect to SQLServer.
 
     SQLSERVER_PASSWORD_FILE   The path of the docker secret containing the
-                              password that Guacamole will provide when connecting to 
+                              password that Guacamole will provide when connecting to
                               SQLServer as SQLSERVER_USER.
 
 END

From 89b3b138b6d728ee904eaeaf5c0cd1e317c34c69 Mon Sep 17 00:00:00 2001
From: jbpaux <9682558+jbpaux@users.noreply.github.com>
Date: Tue, 9 Aug 2022 15:27:10 +0200
Subject: [PATCH 048/289] GUACAMOLE-1572: Make POSTGRESQL env variable backward
 comp dynamic

---
 guacamole-docker/bin/start.sh | 76 ++++++++++-------------------------
 1 file changed, 21 insertions(+), 55 deletions(-)

diff --git a/guacamole-docker/bin/start.sh b/guacamole-docker/bin/start.sh
index ef55d5737..ff0762d04 100755
--- a/guacamole-docker/bin/start.sh
+++ b/guacamole-docker/bin/start.sh
@@ -1,4 +1,4 @@
-#!/bin/sh -e
+#!/bin/bash -e
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -265,60 +265,26 @@ END
 
 ## Provide backward compatibility on POSTGRES_* environment variables
 ## In case of new deployment, please use POSTGRESQL_* equivalent variables.
-if [ -n "$POSTGRES_HOSTNAME" ]; then
-    POSTGRESQL_HOSTNAME=$POSTGRES_HOSTNAME;
-fi
-if [ -n "$POSTGRES_PORT" ]; then
-    POSTGRESQL_PORT=$POSTGRES_PORT;
-fi
-if [ -n "$POSTGRES_DATABASE" ]; then
-    POSTGRESQL_DATABASE=$POSTGRES_DATABASE;
-fi
-if [ -n "$POSTGRES_DATABASE_FILE" ]; then
-    POSTGRESQL_DATABASE=$POSTGRES_DATABASE_FILE;
-fi
-if [ -n "$POSTGRES_USER_FILE" ]; then
-    POSTGRESQL_USER_FILE=$POSTGRES_USER_FILE;
-fi
-if [ -n "$POSTGRES_USER" ]; then
-    POSTGRESQL_USER=$POSTGRES_USER;
-fi
-if [ -n "$POSTGRES_PASSWORD_FILE" ]; then
-    POSTGRESQL_PASSWORD_FILE=$POSTGRES_PASSWORD_FILE;
-fi
-if [ -n "$POSTGRES_PASSWORD" ]; then
-    POSTGRESQL_PASSWORD=$POSTGRES_PASSWORD;
-fi
-if [ -n "$POSTGRES_ABSOLUTE_MAX_CONNECTIONS" ]; then
-    POSTGRESQL_ABSOLUTE_MAX_CONNECTIONS=$POSTGRES_ABSOLUTE_MAX_CONNECTIONS;
-fi
-if [ -n "$POSTGRES_DEFAULT_MAX_CONNECTIONS" ]; then
-    POSTGRESQL_DEFAULT_MAX_CONNECTIONS=$POSTGRES_DEFAULT_MAX_CONNECTIONS;
-fi
-if [ -n "$POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS" ]; then
-    POSTGRESQL_DEFAULT_MAX_GROUP_CONNECTIONS=$POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS;
-fi
-if [ -n "$POSTGRES_DEFAULT_MAX_CONNECTIONS_PER_USER" ]; then
-    POSTGRESQL_DEFAULT_MAX_CONNECTIONS_PER_USER=$POSTGRES_DEFAULT_MAX_CONNECTIONS_PER_USER;
-fi
-if [ -n "$POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER" ]; then
-    POSTGRESQL_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER=$POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER;
-fi
-if [ -n "$POSTGRES_DEFAULT_STATEMENT_TIMEOUT" ]; then
-    POSTGRESQL_DEFAULT_STATEMENT_TIMEOUT=$POSTGRES_DEFAULT_STATEMENT_TIMEOUT;
-fi
-if [ -n "$POSTGRES_USER_REQUIRED" ]; then
-    POSTGRESQL_USER_REQUIRED=$POSTGRES_USER_REQUIRED;
-fi
-if [ -n "$POSTGRES_SOCKET_TIMEOUT" ]; then
-    POSTGRESQL_SOCKET_TIMEOUT=$POSTGRES_SOCKET_TIMEOUT;
-fi
-if [ -n "$POSTGRES_SSL_KEY_PASSWORD_FILE" ]; then
-    POSTGRESQL_SSL_KEY_PASSWORD_FILE=$POSTGRES_SSL_KEY_PASSWORD_FILE;
-fi
-if [ -n "$POSTGRES_SSL_KEY_PASSWORD" ]; then
-    POSTGRESQL_SSL_KEY_PASSWORD=$POSTGRES_SSL_KEY_PASSWORD;
-fi
+for VAR_BASE in \
+    HOSTNAME PORT \
+    DATABASE USER PASSWORD \
+    DATABASE_FILE USER_FILE PASSWORD_FILE \
+    ABSOLUTE_MAX_CONNECTIONS DEFAULT_MAX_CONNECTIONS \
+    DEFAULT_MAX_GROUP_CONNECTIONS DEFAULT_MAX_CONNECTIONS_PER_USER \
+    DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER \
+    DEFAULT_STATEMENT_TIMEOUT SOCKET_TIMEOUT \
+    USER_REQUIRED \
+    SSL_KEY_PASSWORD_FILE SSL_KEY_PASSWORD; do
+
+        OLD_VAR="POSTGRES_$VAR_BASE"
+        NEW_VAR="POSTGRESQL_$VAR_BASE"
+
+        if [ -n "${!OLD_VAR}" ]; then
+            printf -v "$NEW_VAR" "%s" "${!OLD_VAR}"
+            echo "WARNING: ${OLD_VAR} detected, please use ${NEW_VAR} for further deployments."
+        fi
+
+done
 
 ##
 ## Adds properties to guacamole.properties which select the PostgreSQL

From f3d43c1f050d697cebec90ea4da9f8638b930d82 Mon Sep 17 00:00:00 2001
From: jbpaux <9682558+jbpaux@users.noreply.github.com>
Date: Tue, 9 Aug 2022 19:03:41 +0200
Subject: [PATCH 049/289] GUACAMOLE-1572: Add space indentation on error
 message

---
 guacamole-docker/bin/start.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/guacamole-docker/bin/start.sh b/guacamole-docker/bin/start.sh
index ff0762d04..d7cab4264 100755
--- a/guacamole-docker/bin/start.sh
+++ b/guacamole-docker/bin/start.sh
@@ -252,13 +252,13 @@ to the environment variable, and setting the value to the path of the
 corresponding secret:
 
     POSTGRESQL_USER      The user to authenticate as when connecting to
-                       PostgreSQL.
+                         PostgreSQL.
 
     POSTGRESQL_PASSWORD  The password to use when authenticating with PostgreSQL
-                       as POSTGRESQL_USER.
+                         as POSTGRESQL_USER.
 
     POSTGRESQL_DATABASE  The name of the PostgreSQL database to use for Guacamole
-                       authentication.
+                         authentication.
 END
     exit 1;
 }

From aa06c81f2985a387c80ffda19991cf6fb8ea27ac Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 8 Aug 2022 23:10:41 +0000
Subject: [PATCH 050/289] GUACAMOLE-1661: Add domain search support for KSM
 vault extension.

---
 .../guacamole/vault/ksm/secret/KsmClient.java | 134 +++++++++++++++++-
 .../vault/ksm/secret/KsmSecretService.java    |  12 ++
 2 files changed, 141 insertions(+), 5 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index 5572ef71d..c854fbd3b 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -34,6 +34,7 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -45,6 +46,8 @@ import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
+import org.apache.guacamole.vault.secret.WindowsUsername;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -63,6 +66,12 @@ public class KsmClient {
      */
     private static final Logger logger = LoggerFactory.getLogger(KsmClient.class);
 
+    /**
+     * Service for retrieving configuration information.
+     */
+    @Inject
+    private KsmConfigurationService confService;
+
     /**
      * Service for retrieving data from records.
      */
@@ -179,6 +188,30 @@ public class KsmClient {
      */
     private final Set<String> cachedAmbiguousUsernames = new HashSet<>();
 
+    /**
+     * All records retrieved from Keeper Secrets Manager, where each key is the
+     * domain of the corresponding record. The domain of a record is
+     * determined by {@link Login} fields, thus a record may be associated with
+     * multiple domains. If a record is associated with multiple domains, there
+     * will be multiple references to that record within this Map. The contents
+     * of this Map are automatically updated if {@link #validateCache()}
+     * refreshes the cache. This Map must not be accessed without
+     * {@link #cacheLock} acquired appropriately. Before using a value from
+     * this Map, {@link #cachedAmbiguousDomains} must first be checked to
+     * verify that there is indeed only one record associated with that domain.
+     */
+    private final Map<String, KeeperRecord> cachedRecordsByDomain = new HashMap<>();
+
+    /**
+     * The set of all domains that are associated with multiple records, and
+     * thus cannot uniquely identify a record. The contents of this Set are
+     * automatically updated if {@link #validateCache()} refreshes the cache.
+     * This Set must not be accessed without {@link #cacheLock} acquired
+     * appropriately. This Set must be checked before using a value retrieved
+     * from {@link #cachedRecordsByDomain}.
+     */
+    private final Set<String> cachedAmbiguousDomains = new HashSet<>();
+
     /**
      * Create a new KSM client based around the provided KSM configuration.
      *
@@ -239,9 +272,17 @@ public class KsmClient {
             cachedAmbiguousUsernames.clear();
             cachedRecordsByUsername.clear();
 
-            // Store all records, sorting each into host-based and login-based
-            // buckets
-            records.forEach(record -> {
+            // Clear cache of domain-based records
+            cachedAmbiguousDomains.clear();
+            cachedRecordsByDomain.clear();
+
+            // Store all records, sorting each into host-based, login-based,
+            // and domain-based buckets
+            Iterator<KeeperRecord> recordIterator = records.iterator();
+            while(recordIterator.hasNext()) {
+
+                // Go through records one at a time
+                KeeperRecord record = recordIterator.next();
 
                 // Store based on UID ...
                 cachedRecordsByUid.put(record.getRecordUid(), record);
@@ -250,13 +291,38 @@ public class KsmClient {
                 String hostname = recordService.getHostname(record);
                 addRecordForHost(record, hostname);
 
+                // ... and domain
+                String domain = recordService.getDomain(record);
+                addRecordForDomain(record, domain);
+
+                // Fetch the username
+                String username = recordService.getUsername(record);
+
+                // If domains should be split out from usernames
+                if (username != null && confService.getSplitWindowsUsernames()) {
+
+                    // Attempt to split the domain of the username
+                    WindowsUsername usernameAndDomain = (
+                            WindowsUsername.splitWindowsUsernameFromDomain(username));
+
+                    if (usernameAndDomain.hasDomain()) {
+
+                        // Update the username if a domain has been stripped off
+                        username = usernameAndDomain.getUsername();
+
+                        // Use the username-split domain if not already set explicitly
+                        if (domain == null)
+                            addRecordForDomain(record, usernameAndDomain.getDomain());
+                    }
+                }
+
                 // Store based on username ONLY if no hostname (will otherwise
                 // result in ambiguous entries for servers tied to identical
                 // accounts)
                 if (hostname == null)
-                    addRecordForLogin(record, recordService.getUsername(record));
+                    addRecordForLogin(record, username);
 
-            });
+            }
 
             // Cache has been refreshed
             this.cacheTimestamp = System.currentTimeMillis();
@@ -268,6 +334,30 @@ public class KsmClient {
 
     }
 
+    /**
+     * Associates the given record with the given domain. The domain may be
+     * null. Both {@link #cachedRecordsByDomain} and {@link #cachedAmbiguousDomains}
+     * are updated appropriately. The write lock of {@link #cacheLock} must
+     * already be acquired before invoking this function.
+     *
+     * @param record
+     *     The record to associate with the domains in the given field.
+     *
+     * @param domain
+     *     The domain that the given record should be associated with.
+     *     This may be null.
+     */
+    private void addRecordForDomain(KeeperRecord record, String domain) {
+
+        if (domain == null)
+            return;
+
+        KeeperRecord existing = cachedRecordsByDomain.putIfAbsent(domain, record);
+        if (existing != null && record != existing)
+            cachedAmbiguousDomains.add(domain);
+
+    }
+
     /**
      * Associates the given record with the given hostname. The hostname may be
      * null. Both {@link #cachedRecordsByHost} and {@link #cachedAmbiguousHosts}
@@ -432,6 +522,40 @@ public class KsmClient {
         }
     }
 
+    /**
+     * Returns the record associated with the given domain. If no such record
+     * exists, or there are multiple such records, null is returned.
+     *
+     * @param domain
+     *     The domain of the record to return.
+     *
+     * @return
+     *     The record associated with the given domain, or null if there is
+     *     no such record or multiple such records.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs that prevents the record from being retrieved.
+     */
+    public KeeperRecord getRecordByDomain(String domain) throws GuacamoleException {
+        validateCache();
+        cacheLock.readLock().lock();
+        try {
+
+            if (cachedAmbiguousDomains.contains(domain)) {
+                logger.debug("The domain \"{}\" is referenced by multiple "
+                        + "Keeper records and cannot be used to locate "
+                        + "individual secrets.", domain);
+                return null;
+            }
+
+            return cachedRecordsByDomain.get(domain);
+
+        }
+        finally {
+            cacheLock.readLock().unlock();
+        }
+    }
+
     /**
      * Returns the value of the secret stored within Keeper Secrets Manager and
      * represented by the given Keeper notation. Keeper notation locates the
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index d8168dc8f..604ae2865 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -344,6 +344,18 @@ public class KsmSecretService implements VaultSecretService {
                 addRecordTokens(tokens, "KEEPER_GATEWAY_USER_",
                         ksm.getRecordByLogin(filter.filter(gatewayUsername)));
 
+            // Retrieve and define domain tokens, if any
+            String domain = parameters.get("domain");
+            if (domain != null && !domain.isEmpty())
+                addRecordTokens(tokens, "KEEPER_DOMAIN_",
+                        ksm.getRecordByDomain(filter.filter(domain)));
+
+            // Retrieve and define gateway domain tokens, if any
+            String gatewayDomain = parameters.get("gateway-domain");
+            if (gatewayDomain != null && !gatewayDomain.isEmpty())
+                addRecordTokens(tokens, "KEEPER_GATEWAY_DOMAIN_",
+                        ksm.getRecordByDomain(filter.filter(gatewayDomain)));
+
         }
 
         return tokens;

From 593cfaaffede48f09f72f5b72f9455ef3e56d477 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 10 Aug 2022 23:49:59 +0000
Subject: [PATCH 051/289] GUACAMOLE-1661: Match by both user and domain when
 using KEEPER_USER_ tokens.

---
 .../vault/conf/VaultConfigurationService.java |  17 +++
 .../ksm/conf/KsmConfigurationService.java     |  18 +++
 .../guacamole/vault/ksm/secret/KsmClient.java | 121 +++++++++-------
 .../vault/ksm/secret/KsmSecretService.java    |  63 ++++++---
 .../vault/ksm/secret/UserDomain.java          | 129 ++++++++++++++++++
 5 files changed, 278 insertions(+), 70 deletions(-)
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/UserDomain.java

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultConfigurationService.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultConfigurationService.java
index 490da6816..3a3189ba5 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultConfigurationService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultConfigurationService.java
@@ -206,4 +206,21 @@ public abstract class VaultConfigurationService {
      */
     public abstract boolean getSplitWindowsUsernames() throws GuacamoleException;
 
+    /**
+     * Return whether domains should be considered when matching user records
+     * that are fetched from the vault.
+     *
+     * If set to true, the username and domain must both match when matching
+     * records from the vault. If false, only the username will be considered.
+     *
+     * @return
+     *     true if both the username and domain should be considered when
+     *     matching user records from the vault.
+     *
+     * @throws GuacamoleException
+     *     If the value specified within guacamole.properties cannot be
+     *     parsed.
+     */
+    public abstract boolean getMatchUserRecordsByDomain() throws GuacamoleException;
+
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
index 3ef02b8b9..c9a9536ea 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
@@ -96,6 +96,19 @@ public class KsmConfigurationService extends VaultConfigurationService {
         }
     };
 
+    /**
+     * Whether domains should be considered when matching login records in the KSM vault.
+     * If true, both the domain and username must match for a record to match when using
+     * tokens like "KEEPER_USER_*". If false, only the username must match.
+     */
+    private static final BooleanGuacamoleProperty MATCH_USER_DOMAINS = new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() {
+            return "ksm-match-domains-for-users";
+        }
+    };
+
     /**
      * Creates a new KsmConfigurationService which reads the configuration
      * from "ksm-token-mapping.yml" and properties from
@@ -130,6 +143,11 @@ public class KsmConfigurationService extends VaultConfigurationService {
         return environment.getProperty(STRIP_WINDOWS_DOMAINS, false);
     }
 
+    @Override
+    public boolean getMatchUserRecordsByDomain() throws GuacamoleException {
+        return environment.getProperty(MATCH_USER_DOMAINS, false);
+    }
+
 
     /**
      * Return the globally-defined base-64-encoded JSON KSM configuration blob
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index c854fbd3b..34f350234 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -46,6 +46,7 @@ import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
 import org.apache.guacamole.vault.secret.WindowsUsername;
 import org.slf4j.Logger;
@@ -166,27 +167,27 @@ public class KsmClient {
 
     /**
      * All records retrieved from Keeper Secrets Manager, where each key is the
-     * username of the corresponding record. The username of a record is
-     * determined by {@link Login} fields, thus a record may be associated with
-     * multiple users. If a record is associated with multiple users, there
-     * will be multiple references to that record within this Map. The contents
-     * of this Map are automatically updated if {@link #validateCache()}
-     * refreshes the cache. This Map must not be accessed without
-     * {@link #cacheLock} acquired appropriately. Before using a value from
-     * this Map, {@link #cachedAmbiguousUsernames} must first be checked to
+     * username/domain of the corresponding record. The username of a record is
+     * determined by {@link Login} and "domain" fields, thus a record may be
+     * associated with multiple users. If a record is associated with multiple
+     * users, there will be multiple references to that record within this Map.
+     * The contents  of this Map are automatically updated if
+     * {@link #validateCache()} refreshes the cache. This Map must not be accessed
+     * without {@link #cacheLock} acquired appropriately. Before using a value from
+     * this Map, {@link #cachedAmbiguousUsers} must first be checked to
      * verify that there is indeed only one record associated with that user.
      */
-    private final Map<String, KeeperRecord> cachedRecordsByUsername = new HashMap<>();
+    private final Map<UserDomain, KeeperRecord> cachedRecordsByUser = new HashMap<>();
 
     /**
-     * The set of all usernames that are associated with multiple records, and
-     * thus cannot uniquely identify a record. The contents of this Set are
-     * automatically updated if {@link #validateCache()} refreshes the cache.
-     * This Set must not be accessed without {@link #cacheLock} acquired
-     * appropriately.This Set must be checked before using a value retrieved
-     * from {@link #cachedRecordsByUsername}.
+     * The set of all username/domain combos that are associated with multiple
+     * records, and thus cannot uniquely identify a record. The contents of
+     * this Set are automatically updated if {@link #validateCache()} refreshes
+     * the cache. This Set must not be accessed without {@link #cacheLock}
+     * acquired appropriately. This Set must be checked before using a value
+     * retrieved from {@link #cachedRecordsByUser}.
      */
-    private final Set<String> cachedAmbiguousUsernames = new HashSet<>();
+    private final Set<UserDomain> cachedAmbiguousUsers = new HashSet<>();
 
     /**
      * All records retrieved from Keeper Secrets Manager, where each key is the
@@ -269,8 +270,8 @@ public class KsmClient {
             cachedRecordsByHost.clear();
 
             // Clear cache of login-based records
-            cachedAmbiguousUsernames.clear();
-            cachedRecordsByUsername.clear();
+            cachedAmbiguousUsers.clear();
+            cachedRecordsByUser.clear();
 
             // Clear cache of domain-based records
             cachedAmbiguousDomains.clear();
@@ -295,32 +296,32 @@ public class KsmClient {
                 String domain = recordService.getDomain(record);
                 addRecordForDomain(record, domain);
 
-                // Fetch the username
+                // Get the username off of the record
                 String username = recordService.getUsername(record);
 
-                // If domains should be split out from usernames
-                if (username != null && confService.getSplitWindowsUsernames()) {
+                // If we have a username, and there isn't already a domain explicitly defined
+                if (username != null && domain == null
+                        && confService.getSplitWindowsUsernames()) {
 
-                    // Attempt to split the domain of the username
+                    // Attempt to split out the domain of the username
                     WindowsUsername usernameAndDomain = (
                             WindowsUsername.splitWindowsUsernameFromDomain(username));
 
-                    if (usernameAndDomain.hasDomain()) {
+                    // Use the username-split domain if not already set explicitly
+                    if (usernameAndDomain.hasDomain())
+                        domain = usernameAndDomain.getDomain();
+                        addRecordForDomain(record, domain);
 
-                        // Update the username if a domain has been stripped off
-                        username = usernameAndDomain.getUsername();
-
-                        // Use the username-split domain if not already set explicitly
-                        if (domain == null)
-                            addRecordForDomain(record, usernameAndDomain.getDomain());
-                    }
                 }
 
-                // Store based on username ONLY if no hostname (will otherwise
-                // result in ambiguous entries for servers tied to identical
-                // accounts)
-                if (hostname == null)
-                    addRecordForLogin(record, username);
+                // If domain matching is not enabled for user records,
+                // explicitly set all domains to null to allow matching
+                // on username only
+                if (!confService.getMatchUserRecordsByDomain())
+                    domain = null;
+
+                // Store the login by username and domain
+                addRecordForLogin(record, username, domain);
 
             }
 
@@ -383,27 +384,34 @@ public class KsmClient {
     }
 
     /**
-     * Associates the given record with the given username. The given username
-     * may be null. Both {@link #cachedRecordsByUsername} and
-     * {@link #cachedAmbiguousUsernames} are updated appropriately. The write
+     * Associates the given record with the given user, and optional domain.
+     * The given username or domain may be null. Both {@link #cachedRecordsByUser}
+     * and {@link #cachedAmbiguousUsers} are updated appropriately. The write
      * lock of {@link #cacheLock} must already be acquired before invoking this
      * function.
      *
      * @param record
-     *     The record to associate with the given username.
+     *     The record to associate with the given user.
      *
      * @param username
      *     The username that the given record should be associated with. This
      *     may be null.
+     *
+     * @param domain
+     *     The domain that the given record should be associated with. This
+     *     may be null.
      */
-    private void addRecordForLogin(KeeperRecord record, String username) {
+    private void addRecordForLogin(
+            KeeperRecord record, String username, String domain) {
 
         if (username == null)
             return;
 
-        KeeperRecord existing = cachedRecordsByUsername.putIfAbsent(username, record);
+        UserDomain userDomain = new UserDomain(username, domain);
+        KeeperRecord existing = cachedRecordsByUser.putIfAbsent(
+                userDomain, record);
         if (existing != null && record != existing)
-            cachedAmbiguousUsernames.add(username);
+            cachedAmbiguousUsers.add(userDomain);
 
     }
 
@@ -489,32 +497,41 @@ public class KsmClient {
     }
 
     /**
-     * Returns the record associated with the given username. If no such record
-     * exists, or there are multiple such records, null is returned.
+     * Returns the record associated with the given username and domain. If no
+     * such record exists, or there are multiple such records, null is returned.
      *
      * @param username
      *     The username of the record to return.
      *
+     * @param domain
+     *     The domain of the record to return.
+     *
      * @return
-     *     The record associated with the given username, or null if there is
-     *     no such record or multiple such records.
+     *     The record associated with the given username and domain, or null
+     *     if there is no such record or multiple such records.
      *
      * @throws GuacamoleException
      *     If an error occurs that prevents the record from being retrieved.
      */
-    public KeeperRecord getRecordByLogin(String username) throws GuacamoleException {
+    public KeeperRecord getRecordByLogin(
+            String username, String domain) throws GuacamoleException {
+
         validateCache();
         cacheLock.readLock().lock();
+
+        UserDomain userDomain = new UserDomain(username, domain);
+
         try {
 
-            if (cachedAmbiguousUsernames.contains(username)) {
-                logger.debug("The username \"{}\" is referenced by multiple "
-                        + "Keeper records and cannot be used to locate "
-                        + "individual secrets.", username);
+            if (cachedAmbiguousUsers.contains(userDomain)) {
+                logger.debug("The username \"{}\" with domain \"{}\" is "
+                        + "referenced by multiple Keeper records and "
+                        + "cannot be used to locate individual secrets.",
+                        username, domain);
                 return null;
             }
 
-            return cachedRecordsByUsername.get(username);
+            return cachedRecordsByUser.get(userDomain);
 
         }
         finally {
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index 604ae2865..3b8a6dc0d 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -323,12 +323,6 @@ public class KsmSecretService implements VaultSecretService {
             addRecordTokens(tokens, "KEEPER_SERVER_",
                     ksm.getRecordByHost(filter.filter(hostname)));
 
-        // Retrieve and define user-specific tokens, if any
-        String username = parameters.get("username");
-        if (username != null && !username.isEmpty())
-            addRecordTokens(tokens, "KEEPER_USER_",
-                    ksm.getRecordByLogin(filter.filter(username)));
-
         // Tokens specific to RDP
         if ("rdp".equals(config.getProtocol())) {
 
@@ -338,24 +332,57 @@ public class KsmSecretService implements VaultSecretService {
                 addRecordTokens(tokens, "KEEPER_GATEWAY_",
                         ksm.getRecordByHost(filter.filter(gatewayHostname)));
 
+            // Retrieve and define domain tokens, if any
+            String domain = parameters.get("domain");
+            String filteredDomain = null;
+            if (domain != null && !domain.isEmpty()) {
+                filteredDomain = filter.filter(domain);
+                addRecordTokens(tokens, "KEEPER_DOMAIN_",
+                        ksm.getRecordByDomain(filteredDomain));
+            }
+
+            // Retrieve and define gateway domain tokens, if any
+            String gatewayDomain = parameters.get("gateway-domain");
+            String filteredGatewayDomain = null;
+            if (gatewayDomain != null && !gatewayDomain.isEmpty()) {
+                filteredGatewayDomain = filter.filter(gatewayDomain);
+                addRecordTokens(tokens, "KEEPER_GATEWAY_DOMAIN_",
+                        ksm.getRecordByDomain(filteredGatewayDomain));
+            }
+
+            // If domain matching is disabled for user records,
+            // explicitly set the domains to null when storing
+            // user records to enable username-only matching
+            if (!confService.getMatchUserRecordsByDomain()) {
+                filteredDomain = null;
+                filteredGatewayDomain = null;
+            }
+
+            // Retrieve and define user-specific tokens, if any
+            String username = parameters.get("username");
+            if (username != null && !username.isEmpty())
+                addRecordTokens(tokens, "KEEPER_USER_",
+                        ksm.getRecordByLogin(filter.filter(username),
+                        filteredDomain));
+
             // Retrieve and define gateway user-specific tokens, if any
             String gatewayUsername = parameters.get("gateway-username");
             if (gatewayUsername != null && !gatewayUsername.isEmpty())
                 addRecordTokens(tokens, "KEEPER_GATEWAY_USER_",
-                        ksm.getRecordByLogin(filter.filter(gatewayUsername)));
+                        ksm.getRecordByLogin(
+                            filter.filter(gatewayUsername),
+                            filteredGatewayDomain));
 
-            // Retrieve and define domain tokens, if any
-            String domain = parameters.get("domain");
-            if (domain != null && !domain.isEmpty())
-                addRecordTokens(tokens, "KEEPER_DOMAIN_",
-                        ksm.getRecordByDomain(filter.filter(domain)));
-
-            // Retrieve and define gateway domain tokens, if any
-            String gatewayDomain = parameters.get("gateway-domain");
-            if (gatewayDomain != null && !gatewayDomain.isEmpty())
-                addRecordTokens(tokens, "KEEPER_GATEWAY_DOMAIN_",
-                        ksm.getRecordByDomain(filter.filter(gatewayDomain)));
+        } else {
 
+            // Retrieve and define user-specific tokens, if any
+            // NOTE that non-RDP connections do not have a domain
+            // field in the connection parameters, so the domain
+            // will always be null
+            String username = parameters.get("username");
+            if (username != null && !username.isEmpty())
+                addRecordTokens(tokens, "KEEPER_USER_",
+                        ksm.getRecordByLogin(filter.filter(username), null));
         }
 
         return tokens;
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/UserDomain.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/UserDomain.java
new file mode 100644
index 000000000..bb2c2309d
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/UserDomain.java
@@ -0,0 +1,129 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.secret;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+/**
+ * A class intended for use as a key in KSM user record client cache. This
+ * class contains both a username and a password. When identifying a KSM
+ * record using token syntax like "KEEPER_USER_*", the user record will
+ * actually be identified by both the user and domain, if the appropriate
+ * settings are enabled.
+ */
+class UserDomain {
+
+    /**
+     * The username associated with the user record.
+     * This field should never be null.
+     */
+    private final String username;
+
+    /**
+     * The domain associated with the user record.
+     * This field can be null.
+     */
+    private final String domain;
+
+    /**
+     * Create a new UserDomain instance with the provided username and
+     * domain. The domain may be null, but the username should never be.
+     *
+     * @param username
+     *    The username to create the UserDomain instance with. This should
+     *    never be null.
+     *
+     * @param domain
+     *    The domain to create the UserDomain instance with. This can be null.
+     */
+    UserDomain(@Nonnull String username, @Nullable String domain) {
+        this.username = username;
+        this.domain = domain;
+    }
+
+    @Override
+    public int hashCode() {
+
+        final int prime = 31;
+
+        int result = 1;
+        result = prime * result + ((domain == null) ? 0 : domain.hashCode());
+        result = prime * result + ((username == null) ? 0 : username.hashCode());
+
+        return result;
+
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+
+        // Check if the other object is this exact object
+        if (this == obj)
+            return true;
+
+        // Check if the other object is null
+        if (obj == null)
+            return false;
+
+        // Check if the other object is also a UserDomain
+        if (getClass() != obj.getClass())
+            return false;
+
+        // If it is a UserDomain, it must have the same username...
+        UserDomain other = (UserDomain) obj;
+        if (username == null) {
+            if (other.username != null)
+                return false;
+        } else if (!username.equals(other.username))
+            return false;
+
+        // .. and the same domain
+        if (domain == null) {
+            if (other.domain != null)
+                return false;
+        } else if (!domain.equals(other.domain))
+            return false;
+
+        return true;
+    }
+
+    /**
+     * Get the username associated with this UserDomain.
+     *
+     * @return
+     *     The username associated with this UserDomain.
+     */
+    public String getUsername() {
+        return username;
+    }
+
+
+    /**
+     * Get the domain associated with this UserDomain.
+     *
+     * @return
+     *     The domain associated with this UserDomain.
+     */
+    public String getDomain() {
+        return domain;
+    }
+
+}
\ No newline at end of file

From d72acf6f29bc09238101a5546499d030aa1d12b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CVict0rC=E2=80=9D?= <“victor.cleaner@gmail.com”>
Date: Fri, 12 Aug 2022 13:06:11 +0200
Subject: [PATCH 052/289] GUACAMOLE-1664: Completed Czech translation, minor
 corrections. Indentation of the text adjusted exactly according to the
 en.json file.

---
 .../main/frontend/src/translations/cs.json    | 402 ++++++++++--------
 1 file changed, 220 insertions(+), 182 deletions(-)

diff --git a/guacamole/src/main/frontend/src/translations/cs.json b/guacamole/src/main/frontend/src/translations/cs.json
index 04c7a3a4b..c02e13c69 100644
--- a/guacamole/src/main/frontend/src/translations/cs.json
+++ b/guacamole/src/main/frontend/src/translations/cs.json
@@ -13,6 +13,7 @@
         "ACTION_DELETE_SESSIONS"    : "Ukončit sezení",
         "ACTION_DOWNLOAD"           : "Stáhnout",
         "ACTION_LOGIN"              : "Přihlásit",
+        "ACTION_LOGIN_AGAIN"        : "Znovu přihlásit",
         "ACTION_LOGOUT"             : "Odhlásit",
         "ACTION_MANAGE_CONNECTIONS" : "Připojení",
         "ACTION_MANAGE_PREFERENCES" : "Vlastnosti",
@@ -22,11 +23,14 @@
         "ACTION_MANAGE_USER_GROUPS" : "Skupiny",
         "ACTION_NAVIGATE_BACK"      : "Zpět",
         "ACTION_NAVIGATE_HOME"      : "Domů",
+        "ACTION_PAUSE"              : "Pozastavit",
+        "ACTION_PLAY"               : "Přehrát",
         "ACTION_SAVE"               : "Uložit",
         "ACTION_SEARCH"             : "Hledat",
         "ACTION_SHARE"              : "Sdílet",
         "ACTION_UPDATE_PASSWORD"    : "Změnit heslo",
         "ACTION_VIEW_HISTORY"       : "Historie",
+        "ACTION_VIEW_RECORDING"     : "Zobrazit",
 
         "DIALOG_HEADER_ERROR" : "Chyba",
 
@@ -42,6 +46,7 @@
         "FORMAT_DATE_TIME_PRECISE" : "yyyy-MM-dd HH:mm:ss",
 
         "INFO_ACTIVE_USER_COUNT" : "V současné době používá {USERS} {USERS, plural, one{uživatel} other{uživatelů}}.",
+        "INFO_LOGGED_OUT"        : "Byli jste odhlášeni.",
 
         "TEXT_ANONYMOUS_USER"   : "Neznámý uživatel",
         "TEXT_HISTORY_DURATION" : "{VALUE} {UNIT, select, second{{VALUE, plural, one{sekundu} other{sekund}}} minute{{VALUE, plural, one{minutu} other{minut}}} hour{{VALUE, plural, one{hodinu} other{hodin}}} day{{VALUE, plural, one{den} other{dnů}}} other{}}",
@@ -52,7 +57,9 @@
     "CLIENT" : {
 
         "ACTION_ACKNOWLEDGE"               : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CANCEL"                    : "@:APP.ACTION_CANCEL",
         "ACTION_CLEAR_COMPLETED_TRANSFERS" : "Vyčistit",
+        "ACTION_CONTINUE"                  : "@:APP.ACTION_CONTINUE",
         "ACTION_DISCONNECT"                : "Odpojit",
         "ACTION_LOGOUT"                    : "@:APP.ACTION_LOGOUT",
         "ACTION_NAVIGATE_BACK"             : "@:APP.ACTION_NAVIGATE_BACK",
@@ -380,33 +387,45 @@
 
     },
 
+    "PLAYER" : {
+
+        "ACTION_CANCEL" : "@:APP.ACTION_CANCEL",
+        "ACTION_PAUSE"  : "@:APP.ACTION_PAUSE",
+        "ACTION_PLAY"   : "@:APP.ACTION_PLAY",
+
+        "INFO_LOADING_RECORDING" : "Vaše nahrávka se nyní načítá. Čekejte prosím...",
+        "INFO_SEEK_IN_PROGRESS"  : "Hledání požadované pozice. Čekejte prosím..."
+
+    },
+
     "PROTOCOL_KUBERNETES" : {
 
-        "FIELD_HEADER_BACKSPACE"                : "Klávesa Zpět odešle:",
-        "FIELD_HEADER_CA_CERT"                  : "Certifikát certifikační autority:",
-        "FIELD_HEADER_CLIENT_CERT"              : "Klientský certifikát:",
-        "FIELD_HEADER_CLIENT_KEY"               : "Klientský klíč:",
-        "FIELD_HEADER_COLOR_SCHEME"             : "Barevné schéma:",
-        "FIELD_HEADER_CONTAINER"                : "Jméno kontejneru:",
-        "FIELD_HEADER_CREATE_RECORDING_PATH"    : "Automaticky vytvořit cestu k záznamu:",
-        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH"   : "Automaticky vytvořit cestu ke strojopisu:",
-        "FIELD_HEADER_FONT_NAME"                : "Jméno fontu:",
-        "FIELD_HEADER_FONT_SIZE"                : "Velikost fontu:",
-        "FIELD_HEADER_HOSTNAME"                 : "Jméno hostitele:",
-        "FIELD_HEADER_IGNORE_CERT"              : "Ignorovat serverový certifikát:",
-        "FIELD_HEADER_NAMESPACE"                : "Obor názvů:",
-        "FIELD_HEADER_POD"                      : "Jméno podu:",
-        "FIELD_HEADER_PORT"                     : "Port:",
-        "FIELD_HEADER_READ_ONLY"                : "Pouze ke čtení:",
+        "FIELD_HEADER_BACKSPACE"       : "Klávesa Zpět odešle:",
+        "FIELD_HEADER_CA_CERT"         : "Certifikát certifikační autority:",
+        "FIELD_HEADER_CLIENT_CERT"     : "Klientský certifikát:",
+        "FIELD_HEADER_CLIENT_KEY"      : "Klientský klíč:",
+        "FIELD_HEADER_COLOR_SCHEME"    : "Barevné schéma:",
+        "FIELD_HEADER_CONTAINER"       : "Jméno kontejneru:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH"  : "Automaticky vytvořit cestu k záznamu:",
+        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "Automaticky vytvořit cestu ke strojopisu:",
+        "FIELD_HEADER_EXEC_COMMAND"    : "Příkaz (exec):",
+        "FIELD_HEADER_FONT_NAME"       : "Jméno fontu:",
+        "FIELD_HEADER_FONT_SIZE"       : "Velikost fontu:",
+        "FIELD_HEADER_HOSTNAME"        : "Jméno hostitele:",
+        "FIELD_HEADER_IGNORE_CERT"     : "Ignorovat serverový certifikát:",
+        "FIELD_HEADER_NAMESPACE"       : "Obor názvů:",
+        "FIELD_HEADER_POD"             : "Jméno podu:",
+        "FIELD_HEADER_PORT"            : "Port:",
+        "FIELD_HEADER_READ_ONLY"       : "Pouze ke čtení:",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Vyloučit myš:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Vyloučit grafiku/streamování:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Zahrnout události kláves:",
-        "FIELD_HEADER_RECORDING_NAME"           : "Jméno záznamu:",
-        "FIELD_HEADER_RECORDING_PATH"           : "Cesta k záznamu:",
-        "FIELD_HEADER_SCROLLBACK"               : "Maximální délka historie:",
-        "FIELD_HEADER_TYPESCRIPT_NAME"          : "Jméno strojopisu:",
-        "FIELD_HEADER_TYPESCRIPT_PATH"          : "Cesta ke strojopisu:",
-        "FIELD_HEADER_USE_SSL"                  : "Použít SSL/TLS",
+        "FIELD_HEADER_RECORDING_NAME"  : "Jméno záznamu:",
+        "FIELD_HEADER_RECORDING_PATH"  : "Cesta k záznamu:",
+        "FIELD_HEADER_SCROLLBACK"      : "Maximální délka historie:",
+        "FIELD_HEADER_TYPESCRIPT_NAME" : "Jméno strojopisu:",
+        "FIELD_HEADER_TYPESCRIPT_PATH" : "Cesta ke strojopisu:",
+        "FIELD_HEADER_USE_SSL"         : "Použít SSL/TLS",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
         "FIELD_OPTION_BACKSPACE_8"     : "Zpět (Ctrl-H)",
@@ -448,22 +467,22 @@
 
     "PROTOCOL_RDP" : {
 
-        "FIELD_HEADER_CLIENT_NAME"                : "Jméno klienta:",
-        "FIELD_HEADER_COLOR_DEPTH"                : "Barevná hloubka:",
-        "FIELD_HEADER_CONSOLE"                    : "Konzola pro správu:",
-        "FIELD_HEADER_CONSOLE_AUDIO"              : "Podpora zvuku v konzole:",
-        "FIELD_HEADER_CREATE_DRIVE_PATH"          : "Automaticky vytvořit disk:",
-        "FIELD_HEADER_CREATE_RECORDING_PATH"      : "Automaticky vytvořit cestu k záznamu:",
-        "FIELD_HEADER_DISABLE_AUDIO"              : "Zakázat zvuk:",
-        "FIELD_HEADER_DISABLE_AUTH"               : "Zakázat ověřování:",
-        "FIELD_HEADER_DISABLE_COPY"               : "Zakázat kopírování ze vzdálené plochy:",
-        "FIELD_HEADER_DISABLE_DOWNLOAD"           : "Zakázat stahování souborů:",
-        "FIELD_HEADER_DISABLE_PASTE"              : "Zakázat vkládání z klienta:",
-        "FIELD_HEADER_DISABLE_UPLOAD"             : "Zakázat nahrávání souborů:",
-        "FIELD_HEADER_DOMAIN"                     : "Doména:",
-        "FIELD_HEADER_DPI"                        : "Rozlišení (DPI):",
-        "FIELD_HEADER_DRIVE_NAME"                 : "Název jednotky:",
-        "FIELD_HEADER_DRIVE_PATH"                 : "Cesta na disku:",
+        "FIELD_HEADER_CLIENT_NAME"     : "Jméno klienta:",
+        "FIELD_HEADER_COLOR_DEPTH"     : "Barevná hloubka:",
+        "FIELD_HEADER_CONSOLE"         : "Konzola pro správu:",
+        "FIELD_HEADER_CONSOLE_AUDIO"   : "Podpora zvuku v konzole:",
+        "FIELD_HEADER_CREATE_DRIVE_PATH" : "Automaticky vytvořit disk:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH" : "Automaticky vytvořit cestu k záznamu:",
+        "FIELD_HEADER_DISABLE_AUDIO"   : "Zakázat zvuk:",
+        "FIELD_HEADER_DISABLE_AUTH"    : "Zakázat ověřování:",
+        "FIELD_HEADER_DISABLE_COPY"    : "Zakázat kopírování ze vzdálené plochy:",
+        "FIELD_HEADER_DISABLE_DOWNLOAD" : "Zakázat stahování souborů:",
+        "FIELD_HEADER_DISABLE_PASTE"   : "Zakázat vkládání z klienta:",
+        "FIELD_HEADER_DISABLE_UPLOAD"   : "Zakázat nahrávání souborů:",
+        "FIELD_HEADER_DOMAIN"          : "Doména:",
+        "FIELD_HEADER_DPI"             : "Rozlišení (DPI):",
+        "FIELD_HEADER_DRIVE_NAME"       : "Název jednotky:",
+        "FIELD_HEADER_DRIVE_PATH"       : "Cesta na disku:",
         "FIELD_HEADER_ENABLE_AUDIO_INPUT"         : "Povolit zvukový vstup (mikrofon):",
         "FIELD_HEADER_ENABLE_DESKTOP_COMPOSITION" : "Povolit kompozici pracovní plochy (Aero):",
         "FIELD_HEADER_ENABLE_DRIVE"               : "Povolit jednotku:",
@@ -473,42 +492,47 @@
         "FIELD_HEADER_DISABLE_BITMAP_CACHING"     : "Zakázat ukládání do mezipaměti bitmap:",
         "FIELD_HEADER_DISABLE_OFFSCREEN_CACHING"  : "Zakázat ukládání do mezipaměti mimo obrazovku:",
         "FIELD_HEADER_DISABLE_GLYPH_CACHING"      : "Zakázat ukládání do mezipaměti glyfů:",
+        "FIELD_HEADER_DISABLE_GFX"                : "Zakázat rozšíření Graphics Pipeline:",
         "FIELD_HEADER_ENABLE_PRINTING"            : "Povolit tisk:",
-        "FIELD_HEADER_ENABLE_SFTP"                : "Povolit SFTP:",
+        "FIELD_HEADER_ENABLE_SFTP"     : "Povolit SFTP:",
         "FIELD_HEADER_ENABLE_THEMING"             : "Povolit motivy:",
+        "FIELD_HEADER_ENABLE_TOUCH"               : "Povolit vícedotykové ovládání:",
         "FIELD_HEADER_ENABLE_WALLPAPER"           : "Povolit tapetu:",
-        "FIELD_HEADER_GATEWAY_DOMAIN"             : "Doména:",
-        "FIELD_HEADER_GATEWAY_HOSTNAME"           : "Jméno hostitele:",
-        "FIELD_HEADER_GATEWAY_PASSWORD"           : "Heslo:",
-        "FIELD_HEADER_GATEWAY_PORT"               : "Port:",
-        "FIELD_HEADER_GATEWAY_USERNAME"           : "Uživatelské jméno:",
-        "FIELD_HEADER_HEIGHT"                     : "Výška:",
-        "FIELD_HEADER_HOSTNAME"                   : "Jméno hostitele:",
-        "FIELD_HEADER_IGNORE_CERT"                : "Ignorovat serverový certifikát:",
-        "FIELD_HEADER_INITIAL_PROGRAM"            : "Úvodní program:",
-        "FIELD_HEADER_LOAD_BALANCE_INFO"          : "Vyvážení zátěže info/cookie:",
-        "FIELD_HEADER_PASSWORD"                   : "Heslo:",
-        "FIELD_HEADER_PORT"                       : "Port:",
-        "FIELD_HEADER_PRINTER_NAME"               : "Název přesměrované tiskárny:",
-        "FIELD_HEADER_PRECONNECTION_BLOB"         : "Preconnection BLOB (VM ID):",
-        "FIELD_HEADER_PRECONNECTION_ID"           : "Zdrojové ID RDP:",
-        "FIELD_HEADER_READ_ONLY"                  : "Pouze ke čtení:",
-        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"    : "Vyloučit myš:",
-        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT"   : "Vyloučit grafiku/strímování:",
-        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"     : "Zahrnout klíčové události:",
-        "FIELD_HEADER_RECORDING_NAME"             : "Název záznamu:",
-        "FIELD_HEADER_RECORDING_PATH"             : "Cesta pro záznam:",
-        "FIELD_HEADER_RESIZE_METHOD"              : "Metoda změny velikosti:",
-        "FIELD_HEADER_REMOTE_APP_ARGS"            : "Parametry:",
-        "FIELD_HEADER_REMOTE_APP_DIR"             : "Pracovní adresář:",
-        "FIELD_HEADER_REMOTE_APP"                 : "Program:",
-        "FIELD_HEADER_SECURITY"                   : "Bezpečnostní mód:",
-        "FIELD_HEADER_SERVER_LAYOUT"              : "Rozložení klávesnice:",
+        "FIELD_HEADER_FORCE_LOSSLESS"             : "Vynutit bezeztrátovou kompresi:",
+        "FIELD_HEADER_GATEWAY_DOMAIN"   : "Doména:",
+        "FIELD_HEADER_GATEWAY_HOSTNAME" : "Jméno hostitele:",
+        "FIELD_HEADER_GATEWAY_PASSWORD" : "Heslo:",
+        "FIELD_HEADER_GATEWAY_PORT"     : "Port:",
+        "FIELD_HEADER_GATEWAY_USERNAME" : "Uživatelské jméno:",
+        "FIELD_HEADER_HEIGHT"          : "Výška:",
+        "FIELD_HEADER_HOSTNAME"        : "Jméno hostitele:",
+        "FIELD_HEADER_IGNORE_CERT"     : "Ignorovat serverový certifikát:",
+        "FIELD_HEADER_INITIAL_PROGRAM" : "Úvodní program:",
+        "FIELD_HEADER_LOAD_BALANCE_INFO" : "Vyvážení zátěže info/cookie:",
+        "FIELD_HEADER_NORMALIZE_CLIPBOARD" : "Konce řádků:",
+        "FIELD_HEADER_PASSWORD"        : "Heslo:",
+        "FIELD_HEADER_PORT"            : "Port:",
+        "FIELD_HEADER_PRINTER_NAME"    : "Název přesměrované tiskárny:",
+        "FIELD_HEADER_PRECONNECTION_BLOB" : "Preconnection BLOB (VM ID):",
+        "FIELD_HEADER_PRECONNECTION_ID"   : "Zdrojové ID RDP:",
+        "FIELD_HEADER_READ_ONLY"      : "Pouze ke čtení:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Vyloučit myš:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Vyloučit grafiku/strímování:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_TOUCH"  : "Vyloučit dotykové události:",
+        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Zahrnout klíčové události:",
+        "FIELD_HEADER_RECORDING_NAME" : "Název záznamu:",
+        "FIELD_HEADER_RECORDING_PATH" : "Cesta pro záznam:",
+        "FIELD_HEADER_RESIZE_METHOD" : "Metoda změny velikosti:",
+        "FIELD_HEADER_REMOTE_APP_ARGS" : "Parametry:",
+        "FIELD_HEADER_REMOTE_APP_DIR"  : "Pracovní adresář:",
+        "FIELD_HEADER_REMOTE_APP"      : "Program:",
+        "FIELD_HEADER_SECURITY"        : "Bezpečnostní mód:",
+        "FIELD_HEADER_SERVER_LAYOUT"   : "Rozložení klávesnice:",
         "FIELD_HEADER_SFTP_DIRECTORY"             : "Výchozí složka pro uložení záznamu:",
         "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "Zakázat stahování souborů:",
         "FIELD_HEADER_SFTP_HOST_KEY"              : "Veřejný klíč hosta (Base64):",
         "FIELD_HEADER_SFTP_HOSTNAME"              : "Jméno hostitele:",
-        "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "SFTP keepalive interval:",
+        "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "Interval udržování SFTP:",
         "FIELD_HEADER_SFTP_PASSPHRASE"            : "Přístupová fráze:",
         "FIELD_HEADER_SFTP_PASSWORD"              : "Heslo:",
         "FIELD_HEADER_SFTP_PORT"                  : "Port:",
@@ -516,14 +540,20 @@
         "FIELD_HEADER_SFTP_ROOT_DIRECTORY"        : "Souborový prohlížeč kořenové složky:",
         "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "Zakázat nahrávání souborů:",
         "FIELD_HEADER_SFTP_USERNAME"              : "Uživatelské jméno:",
-        "FIELD_HEADER_STATIC_CHANNELS"            : "Názvy statických kanálů:",
-        "FIELD_HEADER_TIMEZONE"                   : "Časová zóna:",
-        "FIELD_HEADER_USERNAME"                   : "Uživatelské jméno:",
-        "FIELD_HEADER_WIDTH"                      : "Šířka:",
-        "FIELD_HEADER_WOL_BROADCAST_ADDR"         : "Vysílací adresa pro paket WoL:",
-        "FIELD_HEADER_WOL_MAC_ADDR"               : "MAC adresa vzdáleného hosta:",
-        "FIELD_HEADER_WOL_SEND_PACKET"            : "Odeslat paket WoL:",
-        "FIELD_HEADER_WOL_WAIT_TIME"              : "Čekací doba potřebná pro spuštení hosta:",
+        "FIELD_HEADER_STATIC_CHANNELS" : "Názvy statických kanálů:",
+        "FIELD_HEADER_TIMEZONE"        : "Časová zóna:",
+        "FIELD_HEADER_USERNAME"        : "Uživatelské jméno:",
+        "FIELD_HEADER_WIDTH"           : "Šířka:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Vysílací adresa pro paket WoL:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "MAC adresa vzdáleného hosta:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "Odeslat paket WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "UDP port pro paket WoL: ",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Doba čekání na spuštění hostitele:",
+
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_EMPTY"    : "",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_PRESERVE" : "Zachovat tak, jak je",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_UNIX"     : "Linux/Mac/Unix (LF)",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_WINDOWS"  : "Windows (CRLF)",
 
         "FIELD_OPTION_COLOR_DEPTH_16"    : "Nízké barvy (16-bitů)",
         "FIELD_OPTION_COLOR_DEPTH_24"    : "Opravdové barvy (24-bitů)",
@@ -542,25 +572,27 @@
         "FIELD_OPTION_SECURITY_TLS"       : "Šifrování TLS",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
-        "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ"    : "Švícarská Němčina (Qwertz)",
-        "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ"    : "Němčina (Qwertz)",
-        "FIELD_OPTION_SERVER_LAYOUT_EMPTY"           : "",
-        "FIELD_OPTION_SERVER_LAYOUT_EN_GB_QWERTY"    : "UK Angličtina (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_EN_US_QWERTY"    : "US Angličtina (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_ES_ES_QWERTY"    : "Španělština (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Švícarská Němčina (Qwertz)",
+        "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "Němčina (Qwertz)",
+        "FIELD_OPTION_SERVER_LAYOUT_EMPTY"        : "",
+        "FIELD_OPTION_SERVER_LAYOUT_EN_GB_QWERTY" : "UK Angličtina (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_EN_US_QWERTY" : "US Angličtina (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_ES_ES_QWERTY" : "Španělština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_ES_LATAM_QWERTY" : "Standardní Angličtina (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_FAILSAFE"        : "Unicode",
-        "FIELD_OPTION_SERVER_LAYOUT_FR_BE_AZERTY"    : "Belgická Francouzština (Azerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_FR_CH_QWERTZ"    : "Švícarská Francouzština (Qwertz)",
-        "FIELD_OPTION_SERVER_LAYOUT_FR_FR_AZERTY"    : "Francouzština (Azerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_HU_HU_QWERTZ"    : "Maďarština (Qwertz)",
-        "FIELD_OPTION_SERVER_LAYOUT_IT_IT_QWERTY"    : "Italština (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY"    : "Japonština (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY"    : "Polské (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY"    : "Portugalská Brazilština (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY"    : "Švédština (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY"    : "Dánština (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY"    : "Turečtina (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_FAILSAFE"     : "Unicode",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_BE_AZERTY" : "Belgická Francouzština (Azerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_CA_QWERTY" : "Kanadská francouzština (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_CH_QWERTZ" : "Švícarská Francouzština (Qwertz)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_FR_AZERTY" : "Francouzština (Azerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_HU_HU_QWERTZ" : "Maďarština (Qwertz)",
+        "FIELD_OPTION_SERVER_LAYOUT_IT_IT_QWERTY" : "Italština (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japonština (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_NO_NO_QWERTY" : "Norština (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polské (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portugalská Brazilština (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Švédština (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dánština (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turečtina (Qwerty)",
 
         "NAME" : "RDP",
 
@@ -583,43 +615,44 @@
 
     "PROTOCOL_SSH" : {
 
-        "FIELD_HEADER_BACKSPACE"                : "Klávesa Zpět odešle:",
-        "FIELD_HEADER_COLOR_SCHEME"             : "Barva:",
-        "FIELD_HEADER_COMMAND"                  : "Provést příkaz:",
-        "FIELD_HEADER_CREATE_RECORDING_PATH"    : "Automaticky vytvořit cestu pro uložení záznamu:",
-        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH"   : "Automaticky vytvořit cestu ke strojopisu:",
-        "FIELD_HEADER_DISABLE_COPY"             : "Zakázat kopírování ze vzdáleného terminálu:",
-        "FIELD_HEADER_DISABLE_PASTE"            : "Zakázat vkládání z klienta:",
-        "FIELD_HEADER_FONT_NAME"                : "Typ fontu:",
-        "FIELD_HEADER_FONT_SIZE"                : "Velikost písma:",
-        "FIELD_HEADER_ENABLE_SFTP"              : "Povolit SFTP:",
-        "FIELD_HEADER_HOST_KEY"                 : "Veřejný klíč hosta (Base64):",
-        "FIELD_HEADER_HOSTNAME"                 : "Jméno hostitele:",
-        "FIELD_HEADER_LOCALE"                   : "Jazyk/Lokalizace ($LANG):",
-        "FIELD_HEADER_USERNAME"                 : "Uživatelské jméno:",
-        "FIELD_HEADER_PASSWORD"                 : "Heslo:",
-        "FIELD_HEADER_PASSPHRASE"               : "Přístupová fráze:",
-        "FIELD_HEADER_PORT"                     : "Port:",
-        "FIELD_HEADER_PRIVATE_KEY"              : "Privátní klíč:",
-        "FIELD_HEADER_SCROLLBACK"               : "Maximální délka historie:",
-        "FIELD_HEADER_READ_ONLY"                : "Pouze ke čtení:",
+        "FIELD_HEADER_BACKSPACE"    : "Klávesa Zpět odešle:",
+        "FIELD_HEADER_COLOR_SCHEME" : "Barva:",
+        "FIELD_HEADER_COMMAND"      : "Provést příkaz:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH" : "Automaticky vytvořit cestu pro uložení záznamu:",
+        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "Automaticky vytvořit cestu ke strojopisu:",
+        "FIELD_HEADER_DISABLE_COPY"  : "Zakázat kopírování ze vzdáleného terminálu:",
+        "FIELD_HEADER_DISABLE_PASTE" : "Zakázat vkládání z klienta:",
+        "FIELD_HEADER_FONT_NAME"     : "Typ fontu:",
+        "FIELD_HEADER_FONT_SIZE"     : "Velikost písma:",
+        "FIELD_HEADER_ENABLE_SFTP"   : "Povolit SFTP:",
+        "FIELD_HEADER_HOST_KEY"      : "Veřejný klíč hosta (Base64):",
+        "FIELD_HEADER_HOSTNAME"      : "Jméno hostitele:",
+        "FIELD_HEADER_LOCALE"        : "Jazyk/Lokalizace ($LANG):",
+        "FIELD_HEADER_USERNAME"      : "Uživatelské jméno:",
+        "FIELD_HEADER_PASSWORD"      : "Heslo:",
+        "FIELD_HEADER_PASSPHRASE"    : "Přístupová fráze:",
+        "FIELD_HEADER_PORT"          : "Port:",
+        "FIELD_HEADER_PRIVATE_KEY"   : "Privátní klíč:",
+        "FIELD_HEADER_SCROLLBACK"    : "Maximální délka historie:",
+        "FIELD_HEADER_READ_ONLY"     : "Pouze ke čtení:",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Vynechat myš:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Vynechat grafiku/streamování:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Zahrnout události kláves:",
-        "FIELD_HEADER_RECORDING_NAME"           : "Název záznamu:",
-        "FIELD_HEADER_RECORDING_PATH"           : "Cesta pro záznam:",
-        "FIELD_HEADER_SERVER_ALIVE_INTERVAL"    : "Serverový keepalive interval:",
-        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"    : "Zakázat stahování souborů:",
-        "FIELD_HEADER_SFTP_ROOT_DIRECTORY"      : "Souborový prohlížeč kořenové složky:",
-        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"      : "Zakázat nahrávání souborů:",
-        "FIELD_HEADER_TERMINAL_TYPE"            : "Typ terminálu:",
-        "FIELD_HEADER_TIMEZONE"                 : "Časová zóna ($TZ):",
-        "FIELD_HEADER_TYPESCRIPT_NAME"          : "Jméno strojopisu:",
-        "FIELD_HEADER_TYPESCRIPT_PATH"          : "Cesta ke strojopisu:",
-        "FIELD_HEADER_WOL_BROADCAST_ADDR"       : "Vysílací adresa pro paket WoL:",
-        "FIELD_HEADER_WOL_MAC_ADDR"             : "MAC adresa vzdáleného hosta:",
-        "FIELD_HEADER_WOL_SEND_PACKET"          : "Odeslat paket WoL:",
-        "FIELD_HEADER_WOL_WAIT_TIME"            : "Čekací doba potřebná pro spuštení hosta:",
+        "FIELD_HEADER_RECORDING_NAME" : "Název záznamu:",
+        "FIELD_HEADER_RECORDING_PATH" : "Cesta pro záznam:",
+        "FIELD_HEADER_SERVER_ALIVE_INTERVAL" : "Serverový keepalive interval:",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD" : "Zakázat stahování souborů:",
+        "FIELD_HEADER_SFTP_ROOT_DIRECTORY"   : "Souborový prohlížeč kořenové složky:",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"   : "Zakázat nahrávání souborů:",
+        "FIELD_HEADER_TERMINAL_TYPE"   : "Typ terminálu:",
+        "FIELD_HEADER_TIMEZONE"        : "Časová zóna ($TZ):",
+        "FIELD_HEADER_TYPESCRIPT_NAME" : "Jméno strojopisu:",
+        "FIELD_HEADER_TYPESCRIPT_PATH" : "Cesta ke strojopisu:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Vysílací adresa pro paket WoL:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "MAC adresa vzdáleného hosta:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "Odeslat paket WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "UDP port pro paket WoL:",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Doba čekání na spuštění hostitele:",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
         "FIELD_OPTION_BACKSPACE_8"     : "Zpět (Ctrl-H)",
@@ -672,36 +705,37 @@
 
     "PROTOCOL_TELNET" : {
 
-        "FIELD_HEADER_BACKSPACE"                : "Klávesa Zpět odešle:",
-        "FIELD_HEADER_COLOR_SCHEME"             : "Barevné schéma:",
-        "FIELD_HEADER_CREATE_RECORDING_PATH"    : "Automaticky vytvořit cestu pro uložení záznamu:",
-        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH"   : "Automaticky vytvořit cestu ke strojopisu:",
-        "FIELD_HEADER_DISABLE_COPY"             : "Zakázat kopírování z terminálu:",
-        "FIELD_HEADER_DISABLE_PASTE"            : "Zakázat vkládání z klienta:",
-        "FIELD_HEADER_FONT_NAME"                : "Jméno fontu:",
-        "FIELD_HEADER_FONT_SIZE"                : "Velikost fontu:",
-        "FIELD_HEADER_HOSTNAME"                 : "Jméno hostitele:",
-        "FIELD_HEADER_LOGIN_FAILURE_REGEX"      : "Selhání přihlášení regulární výraz:",
-        "FIELD_HEADER_LOGIN_SUCCESS_REGEX"      : "Úspěch přihlášení regulární výraz:",
-        "FIELD_HEADER_USERNAME"                 : "Uživatelské jméno:",
-        "FIELD_HEADER_USERNAME_REGEX"           : "Uživatelské jméno regulární výraz:",
-        "FIELD_HEADER_PASSWORD"                 : "Heslo:",
-        "FIELD_HEADER_PASSWORD_REGEX"           : "Heslo regulární výraz:",
-        "FIELD_HEADER_PORT"                     : "Port:",
-        "FIELD_HEADER_READ_ONLY"                : "Pouze ke čtení:",
+        "FIELD_HEADER_BACKSPACE"      : "Klávesa Zpět odešle:",
+        "FIELD_HEADER_COLOR_SCHEME"   : "Barevné schéma:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH" : "Automaticky vytvořit cestu pro uložení záznamu:",
+        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "Automaticky vytvořit cestu ke strojopisu:",
+        "FIELD_HEADER_DISABLE_COPY"   : "Zakázat kopírování z terminálu:",
+        "FIELD_HEADER_DISABLE_PASTE"  : "Zakázat vkládání z klienta:",
+        "FIELD_HEADER_FONT_NAME"      : "Jméno fontu:",
+        "FIELD_HEADER_FONT_SIZE"      : "Velikost fontu:",
+        "FIELD_HEADER_HOSTNAME"       : "Jméno hostitele:",
+        "FIELD_HEADER_LOGIN_FAILURE_REGEX" : "Přihlášení se nezdařilo regulární výraz:",
+        "FIELD_HEADER_LOGIN_SUCCESS_REGEX" : "Přihlášení bylo úspěšné regulární výraz:",
+        "FIELD_HEADER_USERNAME"       : "Uživatelské jméno:",
+        "FIELD_HEADER_USERNAME_REGEX" : "Uživatelské jméno regulární výraz:",
+        "FIELD_HEADER_PASSWORD"       : "Heslo:",
+        "FIELD_HEADER_PASSWORD_REGEX" : "Heslo regulární výraz:",
+        "FIELD_HEADER_PORT"           : "Port:",
+        "FIELD_HEADER_READ_ONLY"      : "Pouze ke čtení:",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Vyloučit myš:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Vyloučit grafiku/streamování:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Zahrnout klíčové události:",
-        "FIELD_HEADER_RECORDING_NAME"           : "Název záznamu:",
-        "FIELD_HEADER_RECORDING_PATH"           : "Cesta pro záznam:",
-        "FIELD_HEADER_SCROLLBACK"               : "Maximální délka historie:",
-        "FIELD_HEADER_TERMINAL_TYPE"            : "Typ terminálu:",
-        "FIELD_HEADER_TYPESCRIPT_NAME"          : "Jméno strojopisu:",
-        "FIELD_HEADER_TYPESCRIPT_PATH"          : "Cesta ke strojopisu:",
-        "FIELD_HEADER_WOL_BROADCAST_ADDR"       : "Vysílací adresa pro paket WoL:",
-        "FIELD_HEADER_WOL_MAC_ADDR"             : "MAC adresa vzdáleného hosta:",
-        "FIELD_HEADER_WOL_SEND_PACKET"          : "Odeslat paket WoL:",
-        "FIELD_HEADER_WOL_WAIT_TIME"            : "Čekací doba potřebná pro spuštení hosta:",
+        "FIELD_HEADER_RECORDING_NAME" : "Název záznamu:",
+        "FIELD_HEADER_RECORDING_PATH" : "Cesta pro záznam:",
+        "FIELD_HEADER_SCROLLBACK"     : "Maximální délka historie:",
+        "FIELD_HEADER_TERMINAL_TYPE"   : "Typ terminálu:",
+        "FIELD_HEADER_TYPESCRIPT_NAME" : "Jméno strojopisu:",
+        "FIELD_HEADER_TYPESCRIPT_PATH" : "Cesta ke strojopisu:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Vysílací adresa pro paket WoL:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "MAC adresa vzdáleného hosta:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "Odeslat paket WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "UDP port pro paket WoL:",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Doba čekání na spuštění hostitele:",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
         "FIELD_OPTION_BACKSPACE_8"     : "Zpět (Ctrl-H)",
@@ -752,32 +786,33 @@
 
     "PROTOCOL_VNC" : {
 
-        "FIELD_HEADER_AUDIO_SERVERNAME"           : "Název zvukového serveru:",
-        "FIELD_HEADER_CLIPBOARD_ENCODING"         : "Kódovávání:",
-        "FIELD_HEADER_COLOR_DEPTH"                : "Hloubka barev:",
-        "FIELD_HEADER_CREATE_RECORDING_PATH"      : "Automaticky vytvořit cestu pro uložení záznamu:",
-        "FIELD_HEADER_CURSOR"                     : "Kurzor:",
-        "FIELD_HEADER_DEST_HOST"                  : "Cílový host:",
-        "FIELD_HEADER_DEST_PORT"                  : "Vzdálený port:",
-        "FIELD_HEADER_DISABLE_COPY"               : "Zakázat kopírování ze vzdálené plochy:",
-        "FIELD_HEADER_DISABLE_PASTE"              : "Zakázat vkládání z klienta:",
-        "FIELD_HEADER_ENABLE_AUDIO"               : "Zapnout audio:",
-        "FIELD_HEADER_ENABLE_SFTP"                : "Povolit SFTP:",
-        "FIELD_HEADER_HOSTNAME"                   : "Jméno hostitele:",
-        "FIELD_HEADER_USERNAME"                   : "Uživatelské jméno:",
-        "FIELD_HEADER_PASSWORD"                   : "Heslo:",
-        "FIELD_HEADER_PORT"                       : "Port:",
-        "FIELD_HEADER_READ_ONLY"                  : "Pouze čtení:",
-        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"    : "Vynechat myš:",
-        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT"   : "Vynechat grafiku/stremování:",
-        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"     : "Zahrnout události kláves:",
-        "FIELD_HEADER_RECORDING_NAME"             : "Název záznamu:",
-        "FIELD_HEADER_RECORDING_PATH"             : "Cesta pro záznam:",
+        "FIELD_HEADER_AUDIO_SERVERNAME" : "Název zvukového serveru:",
+        "FIELD_HEADER_CLIPBOARD_ENCODING" : "Kódovávání:",
+        "FIELD_HEADER_COLOR_DEPTH"      : "Hloubka barev:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH" : "Automaticky vytvořit cestu pro uložení záznamu:",
+        "FIELD_HEADER_CURSOR"           : "Kurzor:",
+        "FIELD_HEADER_DEST_HOST"        : "Cílový host:",
+        "FIELD_HEADER_DEST_PORT"        : "Vzdálený port:",
+        "FIELD_HEADER_DISABLE_COPY"     : "Zakázat kopírování ze vzdálené plochy:",
+        "FIELD_HEADER_DISABLE_PASTE"    : "Zakázat vkládání z klienta:",
+        "FIELD_HEADER_ENABLE_AUDIO"     : "Zapnout audio:",
+        "FIELD_HEADER_ENABLE_SFTP"      : "Povolit SFTP:",
+        "FIELD_HEADER_FORCE_LOSSLESS"   : "Vynutit bezeztrátovou kompresi:",
+        "FIELD_HEADER_HOSTNAME"         : "Jméno hostitele:",
+        "FIELD_HEADER_USERNAME"         : "Uživatelské jméno:",
+        "FIELD_HEADER_PASSWORD"         : "Heslo:",
+        "FIELD_HEADER_PORT"             : "Port:",
+        "FIELD_HEADER_READ_ONLY"        : "Pouze čtení:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Vynechat myš:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Vynechat grafiku/stremování:",
+        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Zahrnout události kláves:",
+        "FIELD_HEADER_RECORDING_NAME" : "Název záznamu:",
+        "FIELD_HEADER_RECORDING_PATH" : "Cesta pro záznam:",
         "FIELD_HEADER_SFTP_DIRECTORY"             : "Výchozí složka pro uložení záznamu:",
         "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "Zakázat stahování souborů:",
         "FIELD_HEADER_SFTP_HOST_KEY"              : "Veřejný klíč hosta (Base64):",
         "FIELD_HEADER_SFTP_HOSTNAME"              : "Jméno hostitele:",
-        "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "SFTP keepalive interval:",
+        "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "Interval udržování SFTP:",
         "FIELD_HEADER_SFTP_PASSPHRASE"            : "Přístupová fráze:",
         "FIELD_HEADER_SFTP_PASSWORD"              : "Heslo:",
         "FIELD_HEADER_SFTP_PORT"                  : "Port:",
@@ -785,11 +820,12 @@
         "FIELD_HEADER_SFTP_ROOT_DIRECTORY"        : "Souborový prohlížeč kořenové složky:",
         "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "Zakázat nahrávání souborů:",
         "FIELD_HEADER_SFTP_USERNAME"              : "Uživatelské jméno:",
-        "FIELD_HEADER_SWAP_RED_BLUE"              : "Přehodit červené/modré komponenty:",
-        "FIELD_HEADER_WOL_BROADCAST_ADDR"         : "Vysílací adresa pro paket WoL:",
-        "FIELD_HEADER_WOL_MAC_ADDR"               : "MAC adresa vzdáleného hosta:",
-        "FIELD_HEADER_WOL_SEND_PACKET"            : "Odeslat paket WoL:",
-        "FIELD_HEADER_WOL_WAIT_TIME"              : "Čekací doba potřebná pro spuštení hosta:",
+        "FIELD_HEADER_SWAP_RED_BLUE"    : "Přehodit červené/modré komponenty:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Vysílací adresa pro paket WoL:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "MAC adresa vzdáleného hosta:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "Odeslat paket WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "UDP port pro paket WoL:",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Doba čekání na spuštění hostitele:",
 
         "FIELD_OPTION_COLOR_DEPTH_8"     : "256 barev",
         "FIELD_OPTION_COLOR_DEPTH_16"    : "Nízké barvy (16-bitů)",
@@ -831,6 +867,7 @@
 
         "ACTION_DOWNLOAD" : "@:APP.ACTION_DOWNLOAD",
         "ACTION_SEARCH"   : "@:APP.ACTION_SEARCH",
+        "ACTION_VIEW_RECORDING" : "@:APP.ACTION_VIEW_RECORDING",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
@@ -845,8 +882,9 @@
 
         "TABLE_HEADER_SESSION_CONNECTION_NAME" : "Název připojení",
         "TABLE_HEADER_SESSION_DURATION"        : "Doba trvání",
+        "TABLE_HEADER_SESSION_LOGS"            : "Protokoly",
         "TABLE_HEADER_SESSION_REMOTEHOST"      : "Vzdálený host",
-        "TABLE_HEADER_SESSION_STARTDATE"       : "Počáteční čas",
+        "TABLE_HEADER_SESSION_STARTDATE"       : "Doba spuštění",
         "TABLE_HEADER_SESSION_USERNAME"        : "Uživatelské jméno",
 
         "TEXT_HISTORY_DURATION" : "@:APP.TEXT_HISTORY_DURATION"

From 0e5a3cb74f275ba1477bd13f6b1af27d30426aa0 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 18 Aug 2022 12:26:55 -0700
Subject: [PATCH 053/289] GUACAMOLE-990: The UserContext passed to redecorate()
 should NOT be the internal DecoratedUserContext wrapper.

---
 .../org/apache/guacamole/rest/auth/DecoratedUserContext.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecoratedUserContext.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecoratedUserContext.java
index d773068f3..9aa26fafc 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecoratedUserContext.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecoratedUserContext.java
@@ -145,7 +145,7 @@ public class DecoratedUserContext extends DelegatingUserContext {
         if (authProvider != userContext.getAuthenticationProvider()) {
 
             // Apply next layer of wrapping around UserContext
-            UserContext redecorated = authProvider.redecorate(decorated,
+            UserContext redecorated = authProvider.redecorate(decorated.getDelegateUserContext(),
                     userContext, authenticatedUser, credentials);
 
             // Do not allow misbehaving extensions to wipe out the

From e6a61b72237f38cb52f2def3e0911b0d9c3027f2 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 18 Aug 2022 12:20:32 -0700
Subject: [PATCH 054/289] GUACAMOLE-990: Fire auth success/failure events only
 after authentication has absolutely succeeded or failed, including the
 details of any failure.

Previously, these events were fired only after the user's identity had
been determined (or failed to be determined). If we don't wait until
after the user contexts have also been successfully obtained (or failed
to be obtained), then things like MFA will not be taken into account
for auth events.
---
 .../net/event/AuthenticationFailureEvent.java | 104 +++++++-
 .../event/AuthenticationProviderEvent.java    |  40 +++
 .../net/event/AuthenticationSuccessEvent.java |  11 +-
 .../guacamole/net/event/FailureEvent.java     |  39 +++
 .../rest/auth/AuthenticationService.java      | 240 +++++++++---------
 .../rest/auth/DecoratedUserContext.java       |  48 ++--
 .../rest/auth/DecorationService.java          |   9 +-
 ...acamoleAuthenticationProcessException.java | 164 ++++++++++++
 8 files changed, 509 insertions(+), 146 deletions(-)
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationProviderEvent.java
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/event/FailureEvent.java
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/rest/auth/GuacamoleAuthenticationProcessException.java

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationFailureEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationFailureEvent.java
index 9808e7047..870590076 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationFailureEvent.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationFailureEvent.java
@@ -19,28 +19,91 @@
 
 package org.apache.guacamole.net.event;
 
+import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Credentials;
+import org.apache.guacamole.net.event.listener.Listener;
 
 /**
  * An event which is triggered whenever a user's credentials fail to be
  * authenticated. The credentials that failed to be authenticated are included
  * within this event, and can be retrieved using getCredentials().
  */
-public class AuthenticationFailureEvent implements CredentialEvent {
+public class AuthenticationFailureEvent implements AuthenticationProviderEvent,
+        CredentialEvent, FailureEvent {
 
     /**
      * The credentials which failed authentication.
      */
-    private Credentials credentials;
+    private final Credentials credentials;
 
     /**
-     * Creates a new AuthenticationFailureEvent which represents the failure
-     * to authenticate the given credentials.
+     * The AuthenticationProvider that encountered the failure. This may be
+     * null if the AuthenticationProvider is not known, such as if the failure
+     * is caused by every AuthenticationProvider passively refusing to
+     * authenticate the user but without explicitly rejecting the user
+     * (returning null for calls to {@link AuthenticationProvider#authenticateUser(org.apache.guacamole.net.auth.Credentials)}),
+     * or if the failure is external to any installed AuthenticationProvider
+     * (such as within a {@link Listener}.
+     */
+    private final AuthenticationProvider authProvider;
+
+    /**
+     * The Throwable that was thrown resulting in the failure, if any. This
+     * may be null if authentication failed without a known error, such as if
+     * the failure is caused by every AuthenticationProvider passively refusing
+     * to authenticate the user but without explicitly rejecting the user
+     * (returning null for calls to {@link AuthenticationProvider#authenticateUser(org.apache.guacamole.net.auth.Credentials)}).
+     */
+    private final Throwable failure;
+
+    /**
+     * Creates a new AuthenticationFailureEvent which represents a failure
+     * to authenticate the given credentials where there is no specific
+     * AuthenticationProvider nor Throwable associated with the failure.
      *
-     * @param credentials The credentials which failed authentication.
+     * @param credentials
+     *     The credentials which failed authentication.
      */
     public AuthenticationFailureEvent(Credentials credentials) {
+        this(credentials, null);
+    }
+
+    /**
+     * Creates a new AuthenticationFailureEvent which represents a failure
+     * to authenticate the given credentials where there is no specific
+     * AuthenticationProvider causing the failure.
+     *
+     * @param credentials
+     *     The credentials which failed authentication.
+     *
+     * @param failure
+     *     The Throwable that was thrown resulting in the failure, or null if
+     *     there is no such Throwable.
+     */
+    public AuthenticationFailureEvent(Credentials credentials, Throwable failure) {
+        this(credentials, null, failure);
+    }
+
+    /**
+     * Creates a new AuthenticationFailureEvent which represents a failure
+     * to authenticate the given credentials.
+     *
+     * @param credentials
+     *     The credentials which failed authentication.
+     *
+     * @param authProvider
+     *     The AuthenticationProvider that caused the failure, or null if there
+     *     is no such AuthenticationProvider.
+     *
+     * @param failure
+     *     The Throwable that was thrown resulting in the failure, or null if
+     *     there is no such Throwable.
+     */
+    public AuthenticationFailureEvent(Credentials credentials,
+            AuthenticationProvider authProvider, Throwable failure) {
         this.credentials = credentials;
+        this.authProvider = authProvider;
+        this.failure = failure;
     }
 
     @Override
@@ -48,4 +111,35 @@ public class AuthenticationFailureEvent implements CredentialEvent {
         return credentials;
     }
 
+    /**
+     * {@inheritDoc}
+     *
+     * <p>NOTE: In the case of an authentication failure, cases where this may
+     * be null include if authentication failed without a definite single
+     * AuthenticationProvider causing that failure, such as if the failure is
+     * caused by every AuthenticationProvider passively refusing to
+     * authenticate the user but without explicitly rejecting the user
+     * (returning null for calls to {@link AuthenticationProvider#authenticateUser(org.apache.guacamole.net.auth.Credentials)}),
+     * or if the failure is external to any installed AuthenticationProvider
+     * (such as within a {@link Listener}.
+     */
+    @Override
+    public AuthenticationProvider getAuthenticationProvider() {
+        return authProvider;
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>NOTE: In the case of an authentication failure, cases where this may
+     * be null include if authentication failed without a known error, such as
+     * if the failure is caused by every AuthenticationProvider passively
+     * refusing to authenticate the user but without explicitly rejecting the
+     * user (returning null for calls to {@link AuthenticationProvider#authenticateUser(org.apache.guacamole.net.auth.Credentials)}).
+     */
+    @Override
+    public Throwable getFailure() {
+        return failure;
+    }
+
 }
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationProviderEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationProviderEvent.java
new file mode 100644
index 000000000..7faa87697
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationProviderEvent.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.event;
+
+import org.apache.guacamole.net.auth.AuthenticationProvider;
+
+/**
+ * An event which may be dispatched due to a specific AuthenticationProvider.
+ */
+public interface AuthenticationProviderEvent {
+
+    /**
+     * Returns the AuthenticationProvider that resulted in the event, if any.
+     * If the event occurred without any definite causing
+     * AuthenticationProvider, this may be null.
+     *
+     * @return
+     *     The AuthenticationProvider that resulted in the event, or null if no
+     *     such AuthenticationProvider is known.
+     */
+    AuthenticationProvider getAuthenticationProvider();
+
+}
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationSuccessEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationSuccessEvent.java
index 8b63bcf0e..a9b21dce8 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationSuccessEvent.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationSuccessEvent.java
@@ -20,6 +20,7 @@
 package org.apache.guacamole.net.event;
 
 import org.apache.guacamole.net.auth.AuthenticatedUser;
+import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Credentials;
 
 /**
@@ -32,7 +33,8 @@ import org.apache.guacamole.net.auth.Credentials;
  * is effectively <em>vetoed</em> and will be subsequently processed as though the
  * authentication failed.
  */
-public class AuthenticationSuccessEvent implements UserEvent, CredentialEvent {
+public class AuthenticationSuccessEvent implements UserEvent, CredentialEvent,
+        AuthenticationProviderEvent {
 
     /**
      * The AuthenticatedUser identifying the user that successfully
@@ -60,7 +62,12 @@ public class AuthenticationSuccessEvent implements UserEvent, CredentialEvent {
 
     @Override
     public Credentials getCredentials() {
-        return authenticatedUser.getCredentials();
+        return getAuthenticatedUser().getCredentials();
+    }
+
+    @Override
+    public AuthenticationProvider getAuthenticationProvider() {
+        return getAuthenticatedUser().getAuthenticationProvider();
     }
 
 }
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/FailureEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/FailureEvent.java
new file mode 100644
index 000000000..dfc337594
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/FailureEvent.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.event;
+
+/**
+ * An event which represents failure of an operation, where that failure may
+ * be associated with a particular Throwable.
+ */
+public interface FailureEvent {
+
+    /**
+     * Returns the Throwable that represents the failure that occurred, if any.
+     * If the failure was recognized but without a definite known error, this
+     * may be null.
+     *
+     * @return
+     *     The Throwable that represents the failure that occurred, or null if
+     *     no such Throwable is known.
+     */
+    Throwable getFailure();
+
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
index ce8a9fb0c..8ed76c6a6 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
@@ -34,7 +34,6 @@ import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.UserContext;
-import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
 import org.apache.guacamole.net.auth.credentials.GuacamoleCredentialsException;
 import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
 import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
@@ -169,14 +168,15 @@ public class AuthenticationService {
      *     The AuthenticatedUser given by the highest-priority
      *     AuthenticationProvider for which the given credentials are valid.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If the given credentials are not valid for any
      *     AuthenticationProvider, or if an error occurs while authenticating
      *     the user.
      */
     private AuthenticatedUser authenticateUser(Credentials credentials)
-        throws GuacamoleException {
+        throws GuacamoleAuthenticationProcessException {
 
+        AuthenticationProvider failedAuthProvider = null;
         GuacamoleCredentialsException authFailure = null;
 
         // Attempt authentication against each AuthenticationProvider
@@ -191,27 +191,29 @@ public class AuthenticationService {
 
             // Insufficient credentials should take precedence
             catch (GuacamoleInsufficientCredentialsException e) {
-                if (authFailure == null || authFailure instanceof GuacamoleInvalidCredentialsException)
+                if (authFailure == null || authFailure instanceof GuacamoleInvalidCredentialsException) {
+                    failedAuthProvider = authProvider;
                     authFailure = e;
+                }
             }
-            
+
             // Catch other credentials exceptions and assign the first one
             catch (GuacamoleCredentialsException e) {
-                if (authFailure == null)
+                if (authFailure == null) {
+                    failedAuthProvider = authProvider;
                     authFailure = e;
+                }
+            }
+
+            catch (GuacamoleException | RuntimeException | Error e) {
+                throw new GuacamoleAuthenticationProcessException("User "
+                        + "authentication was aborted.", authProvider, e);
             }
 
         }
 
-        // If a specific failure occured, rethrow that
-        if (authFailure != null)
-            throw authFailure;
-
-        // Otherwise, request standard username/password
-        throw new GuacamoleInvalidCredentialsException(
-            "Permission Denied.",
-            CredentialsInfo.USERNAME_PASSWORD
-        );
+        throw new GuacamoleAuthenticationProcessException("User authentication "
+                + "failed.", failedAuthProvider, authFailure);
 
     }
 
@@ -230,51 +232,29 @@ public class AuthenticationService {
      *     A AuthenticatedUser which may have been updated due to re-
      *     authentication.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If an error prevents the user from being re-authenticated.
      */
     private AuthenticatedUser updateAuthenticatedUser(AuthenticatedUser authenticatedUser,
-            Credentials credentials) throws GuacamoleException {
+            Credentials credentials) throws GuacamoleAuthenticationProcessException {
 
         // Get original AuthenticationProvider
         AuthenticationProvider authProvider = authenticatedUser.getAuthenticationProvider();
 
-        // Re-authenticate the AuthenticatedUser against the original AuthenticationProvider only
-        authenticatedUser = authProvider.updateAuthenticatedUser(authenticatedUser, credentials);
-        if (authenticatedUser == null)
-            throw new GuacamoleSecurityException("User re-authentication failed.");
+        try {
 
-        return authenticatedUser;
+            // Re-authenticate the AuthenticatedUser against the original AuthenticationProvider only
+            authenticatedUser = authProvider.updateAuthenticatedUser(authenticatedUser, credentials);
+            if (authenticatedUser == null)
+                throw new GuacamoleSecurityException("User re-authentication failed.");
 
-    }
+            return authenticatedUser;
 
-    /**
-     * Notify all bound listeners that a successful authentication
-     * has occurred.
-     *
-     * @param authenticatedUser
-     *      The user that was successfully authenticated.
-     *
-     * @throws GuacamoleException
-     *      If thrown by a listener.
-     */
-    private void fireAuthenticationSuccessEvent(AuthenticatedUser authenticatedUser)
-            throws GuacamoleException {
-        listenerService.handleEvent(new AuthenticationSuccessEvent(authenticatedUser));
-    }
+        }
+        catch (GuacamoleException | RuntimeException | Error e) {
+            throw new GuacamoleAuthenticationProcessException("User re-authentication failed.", authProvider, e);
+        }
 
-    /**
-     * Notify all bound listeners that an authentication attempt has failed.
-     *
-     * @param credentials
-     *      The credentials that failed to authenticate.
-     *
-     * @throws GuacamoleException
-     *      If thrown by a listener.
-     */
-    private void fireAuthenticationFailedEvent(Credentials credentials)
-            throws GuacamoleException {
-        listenerService.handleEvent(new AuthenticationFailureEvent(credentials));
     }
 
     /**
@@ -292,61 +272,23 @@ public class AuthenticationService {
      *     The AuthenticatedUser associated with the given session and
      *     credentials.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If an error occurs while authenticating or re-authenticating the
      *     user.
      */
     private AuthenticatedUser getAuthenticatedUser(GuacamoleSession existingSession,
-            Credentials credentials) throws GuacamoleException {
-
-        try {
-
-            // Re-authenticate user if session exists
-            if (existingSession != null) {
-                AuthenticatedUser updatedUser = updateAuthenticatedUser(
-                        existingSession.getAuthenticatedUser(), credentials);
-                fireAuthenticationSuccessEvent(updatedUser);
-                return updatedUser;
-            }
-
-            // Otherwise, attempt authentication as a new user
-            AuthenticatedUser authenticatedUser = AuthenticationService.this.authenticateUser(credentials);
-            fireAuthenticationSuccessEvent(authenticatedUser);
-
-            if (logger.isInfoEnabled())
-                logger.info("User \"{}\" successfully authenticated from {}.",
-                        authenticatedUser.getIdentifier(),
-                        getLoggableAddress(credentials.getRequest()));
-
-            return authenticatedUser;
+            Credentials credentials) throws GuacamoleAuthenticationProcessException {
 
+        // Re-authenticate user if session exists
+        if (existingSession != null) {
+            AuthenticatedUser updatedUser = updateAuthenticatedUser(
+                    existingSession.getAuthenticatedUser(), credentials);
+            return updatedUser;
         }
 
-        // Log and rethrow any authentication errors
-        catch (GuacamoleException e) {
-
-            fireAuthenticationFailedEvent(credentials);
-
-            // Get request and username for sake of logging
-            HttpServletRequest request = credentials.getRequest();
-            String username = credentials.getUsername();
-
-            // Log authentication failures with associated usernames
-            if (username != null) {
-                if (logger.isWarnEnabled())
-                    logger.warn("Authentication attempt from {} for user \"{}\" failed.",
-                            getLoggableAddress(request), username);
-            }
-
-            // Log anonymous authentication failures
-            else if (logger.isDebugEnabled())
-                logger.debug("Anonymous authentication attempt from {} failed.",
-                        getLoggableAddress(request));
-
-            // Rethrow exception
-            throw e;
-
-        }
+        // Otherwise, attempt authentication as a new user
+        AuthenticatedUser authenticatedUser = AuthenticationService.this.authenticateUser(credentials);
+        return authenticatedUser;
 
     }
 
@@ -371,15 +313,14 @@ public class AuthenticationService {
      *     A List of all UserContexts associated with the given
      *     AuthenticatedUser.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If an error occurs while creating or updating any UserContext.
      */
     private List<DecoratedUserContext> getUserContexts(GuacamoleSession existingSession,
             AuthenticatedUser authenticatedUser, Credentials credentials)
-            throws GuacamoleException {
+            throws GuacamoleAuthenticationProcessException {
 
-        List<DecoratedUserContext> userContexts =
-                new ArrayList<DecoratedUserContext>(authProviders.size());
+        List<DecoratedUserContext> userContexts = new ArrayList<>(authProviders.size());
 
         // If UserContexts already exist, update them and add to the list
         if (existingSession != null) {
@@ -392,7 +333,15 @@ public class AuthenticationService {
 
                 // Update existing UserContext
                 AuthenticationProvider authProvider = oldUserContext.getAuthenticationProvider();
-                UserContext updatedUserContext = authProvider.updateUserContext(oldUserContext, authenticatedUser, credentials);
+                UserContext updatedUserContext;
+                try {
+                    updatedUserContext = authProvider.updateUserContext(oldUserContext, authenticatedUser, credentials);
+                }
+                catch (GuacamoleException | RuntimeException | Error e) {
+                    throw new GuacamoleAuthenticationProcessException("User "
+                            + "authentication aborted during UserContext update.",
+                            authProvider, e);
+                }
 
                 // Add to available data, if successful
                 if (updatedUserContext != null)
@@ -415,7 +364,15 @@ public class AuthenticationService {
             for (AuthenticationProvider authProvider : authProviders) {
 
                 // Generate new UserContext
-                UserContext userContext = authProvider.getUserContext(authenticatedUser);
+                UserContext userContext;
+                try {
+                    userContext = authProvider.getUserContext(authenticatedUser);
+                }
+                catch (GuacamoleException | RuntimeException | Error e) {
+                    throw new GuacamoleAuthenticationProcessException("User "
+                            + "authentication aborted during initial "
+                            + "UserContext creation.", authProvider, e);
+                }
 
                 // Add to available data, if successful
                 if (userContext != null)
@@ -453,7 +410,7 @@ public class AuthenticationService {
      *     If the authentication or re-authentication attempt fails.
      */
     public String authenticate(Credentials credentials, String token)
-        throws GuacamoleException {
+            throws GuacamoleException {
 
         // Pull existing session if token provided
         GuacamoleSession existingSession;
@@ -462,25 +419,72 @@ public class AuthenticationService {
         else
             existingSession = null;
 
-        // Get up-to-date AuthenticatedUser and associated UserContexts
-        AuthenticatedUser authenticatedUser = getAuthenticatedUser(existingSession, credentials);
-        List<DecoratedUserContext> userContexts = getUserContexts(existingSession, authenticatedUser, credentials);
-
-        // Update existing session, if it exists
+        AuthenticatedUser authenticatedUser;
         String authToken;
-        if (existingSession != null) {
-            authToken = token;
-            existingSession.setAuthenticatedUser(authenticatedUser);
-            existingSession.setUserContexts(userContexts);
+
+        try {
+
+            // Get up-to-date AuthenticatedUser and associated UserContexts
+            authenticatedUser = getAuthenticatedUser(existingSession, credentials);
+            List<DecoratedUserContext> userContexts = getUserContexts(existingSession, authenticatedUser, credentials);
+
+            // Update existing session, if it exists
+            if (existingSession != null) {
+                authToken = token;
+                existingSession.setAuthenticatedUser(authenticatedUser);
+                existingSession.setUserContexts(userContexts);
+            }
+
+            // If no existing session, generate a new token/session pair
+            else {
+                authToken = authTokenGenerator.getToken();
+                tokenSessionMap.put(authToken, new GuacamoleSession(environment, authenticatedUser, userContexts));
+                logger.debug("Login was successful for user \"{}\".", authenticatedUser.getIdentifier());
+            }
+
+            // Report authentication success
+            try {
+                listenerService.handleEvent(new AuthenticationSuccessEvent(authenticatedUser));
+            }
+            catch (GuacamoleException e) {
+                throw new GuacamoleAuthenticationProcessException("User "
+                        + "authentication aborted by event listener.", null, e);
+            }
+
         }
 
-        // If no existing session, generate a new token/session pair
-        else {
-            authToken = authTokenGenerator.getToken();
-            tokenSessionMap.put(authToken, new GuacamoleSession(environment, authenticatedUser, userContexts));
-            logger.debug("Login was successful for user \"{}\".", authenticatedUser.getIdentifier());
+        // Log and rethrow any authentication errors
+        catch (GuacamoleAuthenticationProcessException e) {
+
+            // Get request and username for sake of logging
+            HttpServletRequest request = credentials.getRequest();
+            String username = credentials.getUsername();
+
+            listenerService.handleEvent(new AuthenticationFailureEvent(credentials,
+                    e.getAuthenticationProvider(), e.getCause()));
+
+            // Log authentication failures with associated usernames
+            if (username != null) {
+                if (logger.isWarnEnabled())
+                    logger.warn("Authentication attempt from {} for user \"{}\" failed.",
+                            getLoggableAddress(request), username);
+            }
+
+            // Log anonymous authentication failures
+            else if (logger.isDebugEnabled())
+                logger.debug("Anonymous authentication attempt from {} failed.",
+                        getLoggableAddress(request));
+
+            // Rethrow exception
+            throw e.getCauseAsGuacamoleException();
+
         }
 
+        if (logger.isInfoEnabled())
+            logger.info("User \"{}\" successfully authenticated from {}.",
+                    authenticatedUser.getIdentifier(),
+                    getLoggableAddress(credentials.getRequest()));
+
         return authToken;
 
     }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecoratedUserContext.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecoratedUserContext.java
index 9aa26fafc..2be283ac2 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecoratedUserContext.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecoratedUserContext.java
@@ -76,21 +76,29 @@ public class DecoratedUserContext extends DelegatingUserContext {
      *     given AuthenticationProvider, or the original UserContext if the
      *     given AuthenticationProvider originated the UserContext.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If the given AuthenticationProvider fails while decorating the
      *     UserContext.
      */
     private static UserContext decorate(AuthenticationProvider authProvider,
             UserContext userContext, AuthenticatedUser authenticatedUser,
-            Credentials credentials) throws GuacamoleException {
+            Credentials credentials) throws GuacamoleAuthenticationProcessException {
 
         // Skip the AuthenticationProvider which produced the UserContext
         // being decorated
         if (authProvider != userContext.getAuthenticationProvider()) {
 
             // Apply layer of wrapping around UserContext
-            UserContext decorated = authProvider.decorate(userContext,
-                    authenticatedUser, credentials);
+            UserContext decorated;
+            try {
+                decorated = authProvider.decorate(userContext,
+                        authenticatedUser, credentials);
+            }
+            catch (GuacamoleException | RuntimeException | Error e) {
+                throw new GuacamoleAuthenticationProcessException("User "
+                        + "authentication aborted by decorating UserContext.",
+                        authProvider, e);
+            }
 
             // Do not allow misbehaving extensions to wipe out the
             // UserContext entirely
@@ -130,13 +138,13 @@ public class DecoratedUserContext extends DelegatingUserContext {
      *     given AuthenticationProvider, or the original UserContext if the
      *     given AuthenticationProvider originated the UserContext.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If the given AuthenticationProvider fails while decorating the
      *     UserContext.
      */
     private static UserContext redecorate(DecoratedUserContext decorated,
             UserContext userContext, AuthenticatedUser authenticatedUser,
-            Credentials credentials) throws GuacamoleException {
+            Credentials credentials) throws GuacamoleAuthenticationProcessException {
 
         AuthenticationProvider authProvider = decorated.getDecoratingAuthenticationProvider();
 
@@ -145,8 +153,16 @@ public class DecoratedUserContext extends DelegatingUserContext {
         if (authProvider != userContext.getAuthenticationProvider()) {
 
             // Apply next layer of wrapping around UserContext
-            UserContext redecorated = authProvider.redecorate(decorated.getDelegateUserContext(),
-                    userContext, authenticatedUser, credentials);
+            UserContext redecorated;
+            try {
+                redecorated = authProvider.redecorate(decorated.getDelegateUserContext(),
+                        userContext, authenticatedUser, credentials);
+            }
+            catch (GuacamoleException | RuntimeException | Error e) {
+                throw new GuacamoleAuthenticationProcessException("User "
+                        + "authentication aborted by redecorating UserContext.",
+                        authProvider, e);
+            }
 
             // Do not allow misbehaving extensions to wipe out the
             // UserContext entirely
@@ -181,13 +197,13 @@ public class DecoratedUserContext extends DelegatingUserContext {
      *     The credentials associated with the request which produced the given
      *     UserContext.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If any of the given AuthenticationProviders fails while decorating
      *     the UserContext.
      */
     public DecoratedUserContext(AuthenticationProvider authProvider,
             UserContext userContext, AuthenticatedUser authenticatedUser,
-            Credentials credentials) throws GuacamoleException {
+            Credentials credentials) throws GuacamoleAuthenticationProcessException {
 
         // Wrap the result of invoking decorate() on the given AuthenticationProvider
         super(decorate(authProvider, userContext, authenticatedUser, credentials));
@@ -221,13 +237,13 @@ public class DecoratedUserContext extends DelegatingUserContext {
      *     The credentials associated with the request which produced the given
      *     UserContext.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If any of the given AuthenticationProviders fails while decorating
      *     the UserContext.
      */
     public DecoratedUserContext(AuthenticationProvider authProvider,
             DecoratedUserContext userContext, AuthenticatedUser authenticatedUser,
-            Credentials credentials) throws GuacamoleException {
+            Credentials credentials) throws GuacamoleAuthenticationProcessException {
 
         // Wrap the result of invoking decorate() on the given AuthenticationProvider
         super(decorate(authProvider, userContext, authenticatedUser, credentials));
@@ -261,13 +277,13 @@ public class DecoratedUserContext extends DelegatingUserContext {
      *     The credentials associated with the request which produced the given
      *     UserContext.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If any of the given AuthenticationProviders fails while decorating
      *     the UserContext.
      */
     public DecoratedUserContext(DecoratedUserContext decorated,
             UserContext userContext, AuthenticatedUser authenticatedUser,
-            Credentials credentials) throws GuacamoleException {
+            Credentials credentials) throws GuacamoleAuthenticationProcessException {
 
         // Wrap the result of invoking redecorate() on the given AuthenticationProvider
         super(redecorate(decorated, userContext, authenticatedUser, credentials));
@@ -303,13 +319,13 @@ public class DecoratedUserContext extends DelegatingUserContext {
      *     The credentials associated with the request which produced the given
      *     UserContext.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If any of the given AuthenticationProviders fails while decorating
      *     the UserContext.
      */
     public DecoratedUserContext(DecoratedUserContext decorated,
             DecoratedUserContext userContext, AuthenticatedUser authenticatedUser,
-            Credentials credentials) throws GuacamoleException {
+            Credentials credentials) throws GuacamoleAuthenticationProcessException {
 
         // Wrap the result of invoking redecorate() on the given AuthenticationProvider
         super(redecorate(decorated, userContext, authenticatedUser, credentials));
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecorationService.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecorationService.java
index b28dc03af..0b7fc1264 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecorationService.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/DecorationService.java
@@ -23,7 +23,6 @@ import java.util.Iterator;
 import java.util.List;
 import javax.inject.Inject;
 
-import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Credentials;
@@ -65,12 +64,12 @@ public class DecorationService {
      *     A new DecoratedUserContext which has been decorated by all
      *     AuthenticationProviders.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If any AuthenticationProvider fails while decorating the UserContext.
      */
     public DecoratedUserContext decorate(UserContext userContext,
             AuthenticatedUser authenticatedUser, Credentials credentials)
-            throws GuacamoleException {
+            throws GuacamoleAuthenticationProcessException {
 
         // Get first AuthenticationProvider in list
         Iterator<AuthenticationProvider> current = authProviders.iterator();
@@ -119,12 +118,12 @@ public class DecorationService {
      *     A new DecoratedUserContext which has been decorated by all
      *     AuthenticationProviders.
      *
-     * @throws GuacamoleException
+     * @throws GuacamoleAuthenticationProcessException
      *     If any AuthenticationProvider fails while decorating the UserContext.
      */
     public DecoratedUserContext redecorate(DecoratedUserContext decorated,
             UserContext userContext, AuthenticatedUser authenticatedUser,
-            Credentials credentials) throws GuacamoleException {
+            Credentials credentials) throws GuacamoleAuthenticationProcessException {
 
         // If the given DecoratedUserContext contains further decorated layers,
         // redecorate those first
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/GuacamoleAuthenticationProcessException.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/GuacamoleAuthenticationProcessException.java
new file mode 100644
index 000000000..ba1d72a50
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/GuacamoleAuthenticationProcessException.java
@@ -0,0 +1,164 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.rest.auth;
+
+import java.io.Serializable;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.net.auth.AuthenticationProvider;
+import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
+import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
+import org.apache.guacamole.protocol.GuacamoleStatus;
+
+/**
+ * An exception that occurs during Guacamole's authentication and authorization
+ * process, possibly associated with a specific AuthenticationProvider.
+ */
+public class GuacamoleAuthenticationProcessException extends GuacamoleException {
+
+    /**
+     * Internal identifier unique to this version of
+     * GuacamoleAuthenticationProcessException, as required by Java's
+     * {@link Serializable} interface.
+     */
+    private static final long serialVersionUID = 1L;
+
+    /**
+     * The AuthenticationProvider that caused the failure, or null if there is
+     * no such specific AuthenticationProvider involved in this failure.
+     */
+    private final transient AuthenticationProvider authProvider;
+
+    /**
+     * A GuacamoleException representation of the failure that occurred. If
+     * the cause provided when this GuacamoleAuthenticationProcessException
+     * was created was a GuacamoleException, this will just be that exception.
+     * Otherwise, this will be a GuacamoleServerException wrapping the cause
+     * or a generic GuacamoleInvalidCredentialsException requesting a
+     * username/password if there is no specific cause at all.
+     */
+    private final GuacamoleException guacCause;
+
+    /**
+     * Converts the given Throwable to a GuacamoleException representing the
+     * failure that occurred. If the Throwable already is a GuacamoleException,
+     * this will just be that Throwable. For all other cases, a new
+     * GuacamoleException will be created that best represents the provided
+     * failure. If no failure is provided at all, a generic
+     * GuacamoleInvalidCredentialsException requesting a username/password is
+     * created.
+     *
+     * @param message
+     *     A human-readable message describing the failure that occurred.
+     *
+     * @param cause
+     *     The Throwable cause of the failure that occurred, if any, or null if
+     *     the cause is not known to be a specific Throwable.
+     *
+     * @return
+     *     A GuacamoleException representation of the message and cause
+     *     provided.
+     */
+    private static GuacamoleException toGuacamoleException(String message,
+            Throwable cause) {
+
+        // Create generic invalid username/password exception if we have no
+        // specific cause
+        if (cause == null)
+            return new GuacamoleInvalidCredentialsException(
+                "Permission Denied.",
+                CredentialsInfo.USERNAME_PASSWORD
+            );
+
+        // If the specific cause is already a GuacamoleException, there's
+        // nothing for us to do here
+        if (cause instanceof GuacamoleException)
+            return (GuacamoleException) cause;
+
+        // Wrap all other Throwables as generic internal errors
+        return new GuacamoleServerException(message, cause);
+
+    }
+
+    /**
+     * Creates a new GuacamoleAuthenticationProcessException with the given
+     * message, associated AuthenticationProvider, and cause.
+     *
+     * @param message
+     *     A human readable description of the exception that occurred.
+     *
+     * @param authProvider
+     *     The AuthenticationProvider that caused the failure, or null if there
+     *     is no such specific AuthenticationProvider involved in this failure.
+     *
+     * @param cause
+     *     The cause of this exception, or null if the cause is unknown or
+     *     there is no such cause.
+     */
+    public GuacamoleAuthenticationProcessException(String message,
+            AuthenticationProvider authProvider, Throwable cause) {
+        super(message, cause);
+        this.authProvider = authProvider;
+        this.guacCause = toGuacamoleException(message, cause);
+    }
+
+    /**
+     * Returns the AuthenticationProvider that caused the failure, if any. If
+     * there is no specific AuthenticationProvider involved in this failure,
+     * including if the failure is due to multiple AuthenticationProviders,
+     * this will be null.
+     *
+     * @return
+     *     The AuthenticationProvider that caused the failure, or null if there
+     *     is no such specific AuthenticationProvider involved in this failure.
+     */
+    public AuthenticationProvider getAuthenticationProvider() {
+        return authProvider;
+    }
+
+    /**
+     * Returns a GuacamoleException that represents the user-facing cause of
+     * this exception. A GuacamoleException will be returned by this function
+     * in all cases, including if no specific cause was given.
+     *
+     * @return
+     *     A GuacamoleException that represents the user-facing cause of this
+     *     exception.
+     */
+    public GuacamoleException getCauseAsGuacamoleException() {
+        return guacCause;
+    }
+
+    @Override
+    public GuacamoleStatus getStatus() {
+        return getCauseAsGuacamoleException().getStatus();
+    }
+
+    @Override
+    public int getHttpStatusCode() {
+        return getCauseAsGuacamoleException().getHttpStatusCode();
+    }
+
+    @Override
+    public int getWebSocketCode() {
+        return getCauseAsGuacamoleException().getWebSocketCode();
+    }
+
+}

From 275b5bee134f8035acf0e00b2579d05c7405eb66 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 5 Jan 2022 15:08:54 -0800
Subject: [PATCH 055/289] GUACAMOLE-990: Add extension for automatically
 blocking brute-force auth attempts.

---
 extensions/guacamole-auth-ban/.ratignore      |   0
 extensions/guacamole-auth-ban/pom.xml         |  60 ++++
 .../src/main/assembly/dist.xml                |  54 ++++
 .../auth/ban/AuthenticationFailureStatus.java | 123 ++++++++
 .../ban/AuthenticationFailureTracker.java     | 278 ++++++++++++++++++
 .../ban/BanningAuthenticationListener.java    |  81 +++++
 .../ban/BanningAuthenticationProvider.java    | 121 ++++++++
 .../src/main/resources/guac-manifest.json     |  16 +
 extensions/pom.xml                            |   1 +
 9 files changed, 734 insertions(+)
 create mode 100644 extensions/guacamole-auth-ban/.ratignore
 create mode 100644 extensions/guacamole-auth-ban/pom.xml
 create mode 100644 extensions/guacamole-auth-ban/src/main/assembly/dist.xml
 create mode 100644 extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureStatus.java
 create mode 100644 extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
 create mode 100644 extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java
 create mode 100644 extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
 create mode 100644 extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json

diff --git a/extensions/guacamole-auth-ban/.ratignore b/extensions/guacamole-auth-ban/.ratignore
new file mode 100644
index 000000000..e69de29bb
diff --git a/extensions/guacamole-auth-ban/pom.xml b/extensions/guacamole-auth-ban/pom.xml
new file mode 100644
index 000000000..2be082fc2
--- /dev/null
+++ b/extensions/guacamole-auth-ban/pom.xml
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
+                        http://maven.apache.org/maven-v4_0_0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.apache.guacamole</groupId>
+    <artifactId>guacamole-auth-ban</artifactId>
+    <packaging>jar</packaging>
+    <version>1.4.0</version>
+    <name>guacamole-auth-ban</name>
+    <url>http://guacamole.apache.org/</url>
+
+    <parent>
+        <groupId>org.apache.guacamole</groupId>
+        <artifactId>extensions</artifactId>
+        <version>1.4.0</version>
+        <relativePath>../</relativePath>
+    </parent>
+
+    <dependencies>
+
+        <!-- Java servlet API -->
+        <dependency>
+            <groupId>javax.servlet</groupId>
+            <artifactId>servlet-api</artifactId>
+            <version>2.5</version>
+            <scope>provided</scope>
+        </dependency>
+
+        <!-- Guacamole Extension API -->
+        <dependency>
+            <groupId>org.apache.guacamole</groupId>
+            <artifactId>guacamole-ext</artifactId>
+            <version>1.4.0</version>
+            <scope>provided</scope>
+        </dependency>
+
+    </dependencies>
+
+</project>
diff --git a/extensions/guacamole-auth-ban/src/main/assembly/dist.xml b/extensions/guacamole-auth-ban/src/main/assembly/dist.xml
new file mode 100644
index 000000000..d046ae699
--- /dev/null
+++ b/extensions/guacamole-auth-ban/src/main/assembly/dist.xml
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<assembly
+    xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0
+                        http://maven.apache.org/xsd/assembly-1.1.0.xsd">
+    
+    <id>dist</id>
+    <baseDirectory>${project.artifactId}-${project.version}</baseDirectory>
+
+    <!-- Output tar.gz -->
+    <formats>
+        <format>tar.gz</format>
+    </formats>
+
+    <!-- Include licenses and extension .jar -->
+    <fileSets>
+
+        <!-- Include licenses -->
+        <fileSet>
+            <outputDirectory></outputDirectory>
+            <directory>target/licenses</directory>
+        </fileSet>
+
+        <!-- Include extension .jar -->
+        <fileSet>
+            <directory>target</directory>
+            <outputDirectory></outputDirectory>
+            <includes>
+                <include>*.jar</include>
+            </includes>
+        </fileSet>
+
+    </fileSets>
+
+</assembly>
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureStatus.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureStatus.java
new file mode 100644
index 000000000..87bdc5515
--- /dev/null
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureStatus.java
@@ -0,0 +1,123 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ban;
+
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+
+/**
+ * The current status of an authentication failure, including the number of
+ * times the failure has occurred.
+ */
+public class AuthenticationFailureStatus {
+
+    /**
+     * The timestamp of the last authentication failure, as returned by
+     * System.nanoTime().
+     */
+    private long lastFailure;
+
+    /**
+     * The number of failures that have occurred.
+     */
+    private final AtomicInteger failureCount;
+
+    /**
+     * The maximum number of failures that may occur before the user/address
+     * causing the failures is blocked.
+     */
+    private final int maxAttempts;
+
+    /**
+     * The amount of time that a user/address must remain blocked after they
+     * have reached the maximum number of failures. Unlike the value provided
+     * at construction time, this value is maintained in nanoseconds.
+     */
+    private final long duration;
+
+    /**
+     * Creates an AuthenticationFailureStatus that represents a single failure
+     * and is subject to the given restrictions. Additional failures may be
+     * flagged after creation with {@link #notifyFailed()}.
+     *
+     * @param maxAttempts
+     *     The maximum number of failures that may occur before the
+     *     user/address causing the failures is blocked.
+     *     
+     * @param duration
+     *     The amount of time, in seconds, that a user/address must remain
+     *     blocked after they have reached the maximum number of failures.
+     */
+    public AuthenticationFailureStatus(int maxAttempts, int duration) {
+        this.lastFailure = System.nanoTime();
+        this.failureCount = new AtomicInteger(1);
+        this.maxAttempts = maxAttempts;
+        this.duration = TimeUnit.SECONDS.toNanos(duration);
+    }
+
+    /**
+     * Updates this authentication failure, noting that the failure it
+     * represents has recurred.
+     */
+    public void notifyFailed() {
+        lastFailure = System.nanoTime();
+        failureCount.incrementAndGet();
+    }
+
+    /**
+     * Returns whether this authentication failure is recent enough that it
+     * should still be tracked. This function will return false for
+     * authentication failures that have not recurred for at least the duration
+     * provided at construction time.
+     *
+     * @return
+     *     true if this authentication failure is recent enough that it should
+     *     still be tracked, false otherwise.
+     */
+    public boolean isValid() {
+        return System.nanoTime() - lastFailure <= duration;
+    }
+
+    /**
+     * Returns whether the user/address causing this authentication failure
+     * should be blocked based on the restrictions provided at construction
+     * time.
+     *
+     * @return
+     *     true if the user/address causing this failure should be blocked,
+     *     false otherwise.
+     */
+    public boolean isBlocked() {
+        return isValid() && failureCount.get() >= maxAttempts;
+    }
+
+    /**
+     * Returns the total number of authentication failures that have been
+     * recorded through creating this object and invoking
+     * {@link #notifyFailed()}.
+     *
+     * @return
+     *     The total number of failures that have occurred.
+     */
+    public int getFailures() {
+        return failureCount.get();
+    }
+
+}
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
new file mode 100644
index 000000000..4f77875fc
--- /dev/null
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
@@ -0,0 +1,278 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ban;
+
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.guacamole.GuacamoleClientTooManyException;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.net.auth.Credentials;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Provides automated tracking and blocking of IP addresses that repeatedly
+ * fail authentication.
+ */
+public class AuthenticationFailureTracker {
+
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(AuthenticationFailureTracker.class);
+
+    /**
+     * All authentication failures currently being tracked, stored by the
+     * associated IP address.
+     */
+    private final ConcurrentMap<String, AuthenticationFailureStatus> failures =
+            new ConcurrentHashMap<>();
+
+    /**
+     * The maximum number of failed authentication attempts allowed before an
+     * address is temporarily banned.
+     */
+    private final int maxAttempts;
+
+    /**
+     * The length of time that each address should be banned after reaching the
+     * maximum number of failed authentication attempts, in seconds.
+     */
+    private final int banDuration;
+
+    /**
+     * Creates a new AuthenticationFailureTracker that automatically blocks
+     * authentication attempts based on the provided blocking criteria.
+     *
+     * @param maxAttempts
+     *     The maximum number of failed authentication attempts allowed before
+     *     an address is temporarily banned.
+     *
+     * @param banDuration
+     *     The length of time that each address should be banned after reaching
+     *     the maximum number of failed authentication attempts, in seconds.
+     */
+    public AuthenticationFailureTracker(int maxAttempts, int banDuration) {
+        this.maxAttempts = maxAttempts;
+        this.banDuration = banDuration;
+
+        // Inform administrator of configured behavior
+        if (maxAttempts <= 0) {
+            logger.info("Maximum failed authentication attempts has been set "
+                    + "to {}. Automatic banning of brute-force authentication "
+                    + "attempts will be disabled.", maxAttempts);
+        }
+        else if (banDuration <= 0) {
+            logger.info("Ban duration for addresses that repeatedly fail "
+                    + "authentication has been set to {}. Automatic banning "
+                    + "of brute-force authentication attempts will be "
+                    + "disabled.", banDuration);
+        }
+        else {
+            logger.info("Addresses will be automatically banned for {} "
+                    + "seconds after {} failed authentication attempts.",
+                    banDuration, maxAttempts);
+        }
+
+    }
+
+    /**
+     * Returns whether the given Credentials do not contain any specific
+     * authentication parameters, including HTTP parameters. An authentication
+     * request that contains no parameters whatsoever will tend to be the
+     * first, anonymous, credential-less authentication attempt that results in
+     * the initial login screen rendering.
+     *
+     * @param credentials
+     *     The Credentials object to test.
+     *
+     * @return
+     *     true if the given Credentials contain no authentication parameters
+     *     whatsoever, false otherwise.
+     */
+    private boolean isEmpty(Credentials credentials) {
+
+        // An authentication request that contains an explicit username or
+        // password (even if blank) is non-empty, regardless of how the values
+        // were passed
+        if (credentials.getUsername() != null || credentials.getPassword() != null)
+            return false;
+
+        // All further tests depend on HTTP request details
+        HttpServletRequest request = credentials.getRequest();
+        if (request == null)
+            return true;
+
+        // An authentication request is non-empty if it contains any HTTP
+        // parameters at all or contains an authentication token
+        return !request.getParameterNames().hasMoreElements()
+                && request.getHeader("Guacamole-Token") == null;
+
+    }
+
+    /**
+     * Reports that the given address has just failed to authenticate and
+     * returns the AuthenticationFailureStatus that represents that failure. If
+     * the address isn't already being tracked, it will begin being tracked as
+     * of this call. If the address is already tracked, the returned
+     * AuthenticationFailureStatus will represent past authentication failures,
+     * as well.
+     *
+     * @param address
+     *     The address that has failed to authenticate.
+     *
+     * @return
+     *     An AuthenticationFailureStatus that represents this latest
+     *     authentication failure for the given address, as well as any past
+     *     failures.
+     */
+    private AuthenticationFailureStatus getAuthenticationFailure(String address) {
+
+        AuthenticationFailureStatus newFailure = new AuthenticationFailureStatus(maxAttempts, banDuration);
+        AuthenticationFailureStatus status = failures.putIfAbsent(address, newFailure);
+        if (status == null)
+            return newFailure;
+
+        status.notifyFailed();
+        return status;
+
+    }
+
+    /**
+     * Reports that an authentication request has been received, as well as
+     * whether that request is known to have failed. If the associated address
+     * is currently being blocked, an exception will be thrown.
+     *
+     * @param credentials
+     *     The credentials associated with the authentication request.
+     *
+     * @param failed
+     *     Whether the request is known to have failed. If the status of the
+     *     request is not yet known, this should be false.
+     *
+     * @throws GuacamoleException
+     *     If the authentication request is being blocked due to brute force
+     *     prevention rules.
+     */
+    private void notifyAuthenticationStatus(Credentials credentials,
+            boolean failed) throws GuacamoleException {
+
+        // Do not track/ban if tracking or banning are disabled
+        if (maxAttempts <= 0 || banDuration <= 0)
+            return;
+
+        // Ignore requests that do not contain explicit parameters of any kind
+        if (isEmpty(credentials))
+            return;
+
+        // Determine originating address of the authentication request
+        String address = credentials.getRemoteAddress();
+        if (address == null)
+            throw new GuacamoleServerException("Source address cannot be determined.");
+
+        // Get current failure status for the address associated with the
+        // authentication request, adding/updating that status if the request
+        // was itself a failure
+        AuthenticationFailureStatus status;
+        if (failed) {
+            status = getAuthenticationFailure(address);
+            logger.debug("Authentication has failed for address \"{}\" (current total failures: {}/{}).",
+                    address, status.getFailures(), maxAttempts);
+        }
+        else
+            status = failures.get(address);
+
+        if (status != null) {
+
+            // Explicitly block further processing of authentication/authorization
+            // if too many failures have occurred
+            if (status.isBlocked()) {
+                logger.debug("Blocking authentication attempt from address \"{}\" due to number of authentication failures.", address);
+                throw new GuacamoleClientTooManyException("Too many failed "
+                        + "authentication attempts. Please try again later.");
+            }
+
+            // Clean up tracking of failures if the address is no longer
+            // relevant (all failures are sufficiently old)
+            else if (!status.isValid()) {
+                logger.debug("Removing address \"{}\" from tracking as there are no recent authentication failures.", address);
+                failures.remove(address);
+            }
+
+        }
+
+    }
+
+    /**
+     * Reports that an authentication request has been received, but it is
+     * either not yet known whether the request has succeeded or failed. If the
+     * associated address is currently being blocked, an exception will be
+     * thrown.
+     *
+     * @param credentials
+     *     The credentials associated with the authentication request.
+     *
+     * @throws GuacamoleException
+     *     If the authentication request is being blocked due to brute force
+     *     prevention rules.
+     */
+    public void notifyAuthenticationRequestReceived(Credentials credentials)
+            throws GuacamoleException {
+        notifyAuthenticationStatus(credentials, false);
+    }
+
+    /**
+     * Reports that an authentication request has been received and has
+     * succeeded. If the associated address is currently being blocked, an
+     * exception will be thrown.
+     *
+     * @param credentials
+     *     The credentials associated with the successful authentication
+     *     request.
+     *
+     * @throws GuacamoleException
+     *     If the authentication request is being blocked due to brute force
+     *     prevention rules.
+     */
+    public void notifyAuthenticationSuccess(Credentials credentials)
+            throws GuacamoleException {
+        notifyAuthenticationStatus(credentials, false);
+    }
+
+    /**
+     * Reports that an authentication request has been received and has
+     * failed. If the associated address is currently being blocked, an
+     * exception will be thrown.
+     *
+     * @param credentials
+     *     The credentials associated with the failed authentication request.
+     *
+     * @throws GuacamoleException
+     *     If the authentication request is being blocked due to brute force
+     *     prevention rules.
+     */
+    public void notifyAuthenticationFailed(Credentials credentials)
+            throws GuacamoleException {
+        notifyAuthenticationStatus(credentials, true);
+    }
+
+}
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java
new file mode 100644
index 000000000..38fd575fd
--- /dev/null
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ban;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
+import org.apache.guacamole.net.event.AuthenticationFailureEvent;
+import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
+import org.apache.guacamole.net.event.listener.Listener;
+
+/**
+ * Listener implementation which automatically tracks authentication failures
+ * such that further authentication attempts may be automatically blocked by
+ * {@link BanningAuthenticationProvider} if they match configured criteria.
+ */
+public class BanningAuthenticationListener implements Listener {
+
+    /**
+     * Shared tracker of addresses that have repeatedly failed authentication.
+     */
+    private static AuthenticationFailureTracker tracker;
+
+    /**
+     * Assigns the shared tracker instance used by both the {@link BanningAuthenticationProvider}
+     * and this listener. This function MUST be invoked with the tracker
+     * created for BanningAuthenticationProvider as soon as possible (during
+     * construction of BanningAuthenticationProvider), or processing of
+     * received events will fail internally.
+     *
+     * @param tracker
+     *     The tracker instance to use for received authentication events.
+     */
+    public static void setAuthenticationFailureTracker(AuthenticationFailureTracker tracker) {
+        BanningAuthenticationListener.tracker = tracker;
+    }
+
+    @Override
+    public void handleEvent(Object event) throws GuacamoleException {
+
+        if (event instanceof AuthenticationFailureEvent) {
+
+            AuthenticationFailureEvent failure = (AuthenticationFailureEvent) event;
+
+            // Requests for additional credentials are not failures per se,
+            // but continuations of a multi-request authentication attempt that
+            // has not yet succeeded OR failed
+            if (failure.getFailure() instanceof GuacamoleInsufficientCredentialsException) {
+                tracker.notifyAuthenticationRequestReceived(failure.getCredentials());
+                return;
+            }
+
+            // Consider all other errors to be failed auth attempts
+            tracker.notifyAuthenticationFailed(failure.getCredentials());
+
+        }
+
+        else if (event instanceof AuthenticationSuccessEvent) {
+            AuthenticationSuccessEvent success = (AuthenticationSuccessEvent) event;
+            tracker.notifyAuthenticationSuccess(success.getCredentials());
+        }
+
+    }
+
+}
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
new file mode 100644
index 000000000..12195f5e4
--- /dev/null
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
@@ -0,0 +1,121 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ban;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.environment.Environment;
+import org.apache.guacamole.environment.LocalEnvironment;
+import org.apache.guacamole.net.auth.AbstractAuthenticationProvider;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
+import org.apache.guacamole.net.auth.Credentials;
+import org.apache.guacamole.net.auth.UserContext;
+import org.apache.guacamole.properties.IntegerGuacamoleProperty;
+
+/**
+ * AuthenticationProvider implementation that blocks further authentication
+ * attempts that are related to past authentication failures flagged by
+ * {@link BanningAuthenticationListener}.
+ */
+public class BanningAuthenticationProvider extends AbstractAuthenticationProvider {
+
+    /**
+     * The maximum number of failed authentication attempts allowed before an
+     * address is temporarily banned.
+     */
+    private static final IntegerGuacamoleProperty MAX_ATTEMPTS = new IntegerGuacamoleProperty() {
+
+        @Override
+        public String getName() {
+            return "ban-max-invalid-attempts";
+        }
+
+    };
+
+    /**
+     * The length of time that each address should be banned after reaching the
+     * maximum number of failed authentication attempts, in seconds.
+     */
+    private static final IntegerGuacamoleProperty IP_BAN_DURATION = new IntegerGuacamoleProperty() {
+
+        @Override
+        public String getName() {
+            return "ban-address-duration";
+        }
+
+    };
+
+    /**
+     * The default maximum number of failed authentication attempts allowed
+     * before an address is temporarily banned.
+     */
+    private static final int DEFAULT_MAX_ATTEMPTS = 5;
+
+    /**
+     * The default length of time that each address should be banned after
+     * reaching the maximum number of failed authentication attempts, in
+     * seconds.
+     */
+    private static final int DEFAULT_IP_BAN_DURATION = 300;
+
+    /**
+     * Shared tracker of addresses that have repeatedly failed authentication.
+     */
+    private final AuthenticationFailureTracker tracker;
+
+    /**
+     * Creates a new BanningAuthenticationProvider which automatically bans
+     * further authentication attempts from addresses that have repeatedly
+     * failed to authenticate. The ban duration and maximum number of failed
+     * attempts allowed before banning are configured within
+     * guacamole.properties.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs parsing the configuration properties used by this
+     *     extension.
+     */
+    public BanningAuthenticationProvider() throws GuacamoleException {
+
+        Environment environment = LocalEnvironment.getInstance();
+        int maxAttempts = environment.getProperty(MAX_ATTEMPTS, DEFAULT_MAX_ATTEMPTS);
+        int banDuration = environment.getProperty(IP_BAN_DURATION, DEFAULT_IP_BAN_DURATION);
+
+        tracker = new AuthenticationFailureTracker(maxAttempts, banDuration);
+        BanningAuthenticationListener.setAuthenticationFailureTracker(tracker);
+
+    }
+
+    @Override
+    public String getIdentifier() {
+        return "ban";
+    }
+
+    @Override
+    public AuthenticatedUser authenticateUser(Credentials credentials) throws GuacamoleException {
+        tracker.notifyAuthenticationRequestReceived(credentials);
+        return null;
+    }
+
+    @Override
+    public UserContext getUserContext(AuthenticatedUser authenticatedUser) throws GuacamoleException {
+        tracker.notifyAuthenticationRequestReceived(authenticatedUser.getCredentials());
+        return null;
+    }
+
+}
diff --git a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
new file mode 100644
index 000000000..87f75ea61
--- /dev/null
+++ b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
@@ -0,0 +1,16 @@
+{
+
+    "guacamoleVersion" : "1.4.0",
+
+    "name"      : "Brute-force Authentication Detection/Prevention",
+    "namespace" : "ban",
+
+    "authProviders" : [
+        "org.apache.guacamole.auth.ban.BanningAuthenticationProvider"
+    ],
+
+    "listeners" : [
+        "org.apache.guacamole.auth.ban.BanningAuthenticationListener"
+    ]
+
+}
diff --git a/extensions/pom.xml b/extensions/pom.xml
index 3bab33257..b16b3ed53 100644
--- a/extensions/pom.xml
+++ b/extensions/pom.xml
@@ -40,6 +40,7 @@
     <modules>
 
         <!-- Authentication extensions -->
+        <module>guacamole-auth-ban</module>
         <module>guacamole-auth-duo</module>
         <module>guacamole-auth-header</module>
         <module>guacamole-auth-jdbc</module>

From ffb023c6c3c387b8dd1489bf72917b63fc64d3b1 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 22 Aug 2022 10:14:55 -0700
Subject: [PATCH 056/289] GUACAMOLE-1614: Include chromium-driver in Docker
 build for sake of JS unit tests.

---
 Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 5af326bb3..5bafc1972 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,6 +30,9 @@ ARG TOMCAT_JRE=jdk8
 # Use official maven image for the build
 FROM maven:3-jdk-8 AS builder
 
+# Install chromium-driver for sake of JavaScript unit tests
+RUN apt-get update && apt-get install -y chromium-driver
+
 # Use args to build radius auth extension such as
 # `--build-arg BUILD_PROFILE=lgpl-extensions`
 ARG BUILD_PROFILE

From f9d8abcfdeb50c8e8630aafb3fc19ff95be42670 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 22 Aug 2022 09:17:29 -0700
Subject: [PATCH 057/289] GUACAMOLE-990: Clear out any previous authentication
 token that is known to be invalid.

---
 .../src/app/auth/service/authenticationService.js         | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
index 944fd4a9a..199d6cb2e 100644
--- a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
+++ b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
@@ -198,12 +198,16 @@ angular.module('auth').factory('authenticationService', ['$injector',
         ['catch'](requestService.createErrorCallback(function authenticationFailed(error) {
 
             // Request credentials if provided credentials were invalid
-            if (error.type === Error.Type.INVALID_CREDENTIALS)
+            if (error.type === Error.Type.INVALID_CREDENTIALS) {
                 $rootScope.$broadcast('guacInvalidCredentials', parameters, error);
+                clearAuthenticationResult();
+            }
 
             // Request more credentials if provided credentials were not enough 
-            else if (error.type === Error.Type.INSUFFICIENT_CREDENTIALS)
+            else if (error.type === Error.Type.INSUFFICIENT_CREDENTIALS) {
                 $rootScope.$broadcast('guacInsufficientCredentials', parameters, error);
+                clearAuthenticationResult();
+            }
 
             // Abort rendering of page if an internal error occurs
             else if (error.type === Error.Type.INTERNAL_ERROR)

From 2b19bc95daeead7127ddcc9b65260c2794d18fc6 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 22 Aug 2022 09:40:10 -0700
Subject: [PATCH 058/289] GUACAMOLE-990: Use translation string for "too many
 failed attempts" error.

---
 .../guacamole/auth/ban/AuthenticationFailureTracker.java   | 7 ++++---
 .../src/main/resources/guac-manifest.json                  | 4 ++++
 .../src/main/resources/translations/en.json                | 5 +++++
 3 files changed, 13 insertions(+), 3 deletions(-)
 create mode 100644 extensions/guacamole-auth-ban/src/main/resources/translations/en.json

diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
index 4f77875fc..d30f522bd 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
@@ -22,9 +22,9 @@ package org.apache.guacamole.auth.ban;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import javax.servlet.http.HttpServletRequest;
-import org.apache.guacamole.GuacamoleClientTooManyException;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.language.TranslatableGuacamoleClientTooManyException;
 import org.apache.guacamole.net.auth.Credentials;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -207,8 +207,9 @@ public class AuthenticationFailureTracker {
             // if too many failures have occurred
             if (status.isBlocked()) {
                 logger.debug("Blocking authentication attempt from address \"{}\" due to number of authentication failures.", address);
-                throw new GuacamoleClientTooManyException("Too many failed "
-                        + "authentication attempts. Please try again later.");
+                throw new TranslatableGuacamoleClientTooManyException("Too "
+                        + "many failed authentication attempts.",
+                        "LOGIN.ERROR_TOO_MANY_ATTEMPTS");
             }
 
             // Clean up tracking of failures if the address is no longer
diff --git a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
index 87f75ea61..1e6beac22 100644
--- a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
@@ -11,6 +11,10 @@
 
     "listeners" : [
         "org.apache.guacamole.auth.ban.BanningAuthenticationListener"
+    ],
+
+    "translations" : [
+        "translations/en.json"
     ]
 
 }
diff --git a/extensions/guacamole-auth-ban/src/main/resources/translations/en.json b/extensions/guacamole-auth-ban/src/main/resources/translations/en.json
new file mode 100644
index 000000000..2ef8a37d7
--- /dev/null
+++ b/extensions/guacamole-auth-ban/src/main/resources/translations/en.json
@@ -0,0 +1,5 @@
+{
+    "LOGIN": {
+        "ERROR_TOO_MANY_ATTEMPTS" : "Too many failed authentication attempts. Please try again later."
+    }
+}

From 43f65357c8b0de44db925c66716ff0ad668c3af8 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 22 Aug 2022 10:40:52 -0700
Subject: [PATCH 059/289] GUACAMOLE-990: Limit maximum number of tracked
 addresses.

---
 doc/licenses/caffeine-2.9.3/README            |  8 +++++
 .../caffeine-2.9.3/dep-coordinates.txt        |  1 +
 doc/licenses/checker-qual-3.19.0/LICENSE.txt  | 22 +++++++++++++
 doc/licenses/checker-qual-3.19.0/README       |  8 +++++
 .../checker-qual-3.19.0/dep-coordinates.txt   |  1 +
 doc/licenses/error-prone-2.10.0/README        |  8 +++++
 .../error-prone-2.10.0/dep-coordinates.txt    |  1 +
 extensions/guacamole-auth-ban/pom.xml         | 21 ++++++++++++
 .../auth/ban/AuthenticationFailureStatus.java |  8 ++---
 .../ban/AuthenticationFailureTracker.java     | 33 ++++++++++++-------
 .../ban/BanningAuthenticationProvider.java    | 32 +++++++++++++++++-
 11 files changed, 127 insertions(+), 16 deletions(-)
 create mode 100644 doc/licenses/caffeine-2.9.3/README
 create mode 100644 doc/licenses/caffeine-2.9.3/dep-coordinates.txt
 create mode 100644 doc/licenses/checker-qual-3.19.0/LICENSE.txt
 create mode 100644 doc/licenses/checker-qual-3.19.0/README
 create mode 100644 doc/licenses/checker-qual-3.19.0/dep-coordinates.txt
 create mode 100644 doc/licenses/error-prone-2.10.0/README
 create mode 100644 doc/licenses/error-prone-2.10.0/dep-coordinates.txt

diff --git a/doc/licenses/caffeine-2.9.3/README b/doc/licenses/caffeine-2.9.3/README
new file mode 100644
index 000000000..c51ba745c
--- /dev/null
+++ b/doc/licenses/caffeine-2.9.3/README
@@ -0,0 +1,8 @@
+Caffeine (https://github.com/ben-manes/caffeine)
+------------------------------------------------
+
+    Version: 2.9.3
+    From: 'Ben Manes' (https://github.com/ben-manes)
+    License(s):
+        Apache v2.0
+
diff --git a/doc/licenses/caffeine-2.9.3/dep-coordinates.txt b/doc/licenses/caffeine-2.9.3/dep-coordinates.txt
new file mode 100644
index 000000000..feda8aa63
--- /dev/null
+++ b/doc/licenses/caffeine-2.9.3/dep-coordinates.txt
@@ -0,0 +1 @@
+com.github.ben-manes.caffeine:caffeine:jar:2.9.3
diff --git a/doc/licenses/checker-qual-3.19.0/LICENSE.txt b/doc/licenses/checker-qual-3.19.0/LICENSE.txt
new file mode 100644
index 000000000..9837c6b69
--- /dev/null
+++ b/doc/licenses/checker-qual-3.19.0/LICENSE.txt
@@ -0,0 +1,22 @@
+Checker Framework qualifiers
+Copyright 2004-present by the Checker Framework developers
+
+MIT License:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/doc/licenses/checker-qual-3.19.0/README b/doc/licenses/checker-qual-3.19.0/README
new file mode 100644
index 000000000..4a00db7a7
--- /dev/null
+++ b/doc/licenses/checker-qual-3.19.0/README
@@ -0,0 +1,8 @@
+Checker Framework qualifiers (https://checkerframework.org/)
+------------------------------------------------------------
+
+    Version: 3.19.0
+    From: 'Checker Framework developers' (https://checkerframework.org/)
+    License(s):
+        MIT (bundled/checker-qual-3.19.0/LICENSE.txt)
+
diff --git a/doc/licenses/checker-qual-3.19.0/dep-coordinates.txt b/doc/licenses/checker-qual-3.19.0/dep-coordinates.txt
new file mode 100644
index 000000000..322f3959d
--- /dev/null
+++ b/doc/licenses/checker-qual-3.19.0/dep-coordinates.txt
@@ -0,0 +1 @@
+org.checkerframework:checker-qual:jar:3.19.0
diff --git a/doc/licenses/error-prone-2.10.0/README b/doc/licenses/error-prone-2.10.0/README
new file mode 100644
index 000000000..f286aed3b
--- /dev/null
+++ b/doc/licenses/error-prone-2.10.0/README
@@ -0,0 +1,8 @@
+Error Prone (https://errorprone.info/)
+--------------------------------------
+
+    Version: 2.10.0
+    From: 'Google Inc.' (http://www.google.com/)
+    License(s):
+        Apache v2.0
+
diff --git a/doc/licenses/error-prone-2.10.0/dep-coordinates.txt b/doc/licenses/error-prone-2.10.0/dep-coordinates.txt
new file mode 100644
index 000000000..9473dfcab
--- /dev/null
+++ b/doc/licenses/error-prone-2.10.0/dep-coordinates.txt
@@ -0,0 +1 @@
+com.google.errorprone:error_prone_annotations:jar:2.10.0
diff --git a/extensions/guacamole-auth-ban/pom.xml b/extensions/guacamole-auth-ban/pom.xml
index 2be082fc2..68b8d6f90 100644
--- a/extensions/guacamole-auth-ban/pom.xml
+++ b/extensions/guacamole-auth-ban/pom.xml
@@ -53,6 +53,27 @@
             <artifactId>guacamole-ext</artifactId>
             <version>1.4.0</version>
             <scope>provided</scope>
+
+            <!-- Exclude transitive dependencies that will be overridden by
+                newer versions required by Caffeine -->
+            <exclusions>
+                <exclusion>
+                    <groupId>org.checkerframework</groupId>
+                    <artifactId>checker-qual</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>com.google.errorprone</groupId>
+                    <artifactId>error_prone_annotations</artifactId>
+                </exclusion>
+            </exclusions>
+
+        </dependency>
+
+        <!-- Guava Base Libraries -->
+        <dependency>
+            <groupId>com.github.ben-manes.caffeine</groupId>
+            <artifactId>caffeine</artifactId>
+            <version>2.9.3</version>
         </dependency>
 
     </dependencies>
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureStatus.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureStatus.java
index 87bdc5515..ac4f1efc1 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureStatus.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureStatus.java
@@ -53,9 +53,9 @@ public class AuthenticationFailureStatus {
     private final long duration;
 
     /**
-     * Creates an AuthenticationFailureStatus that represents a single failure
-     * and is subject to the given restrictions. Additional failures may be
-     * flagged after creation with {@link #notifyFailed()}.
+     * Creates an AuthenticationFailureStatus that is initialized to zero
+     * failures and is subject to the given restrictions. Additional failures
+     * may be flagged after creation with {@link #notifyFailed()}.
      *
      * @param maxAttempts
      *     The maximum number of failures that may occur before the
@@ -67,7 +67,7 @@ public class AuthenticationFailureStatus {
      */
     public AuthenticationFailureStatus(int maxAttempts, int duration) {
         this.lastFailure = System.nanoTime();
-        this.failureCount = new AtomicInteger(1);
+        this.failureCount = new AtomicInteger(0);
         this.maxAttempts = maxAttempts;
         this.duration = TimeUnit.SECONDS.toNanos(duration);
     }
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
index d30f522bd..85f5cc09c 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
@@ -19,8 +19,8 @@
 
 package org.apache.guacamole.auth.ban;
 
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
 import javax.servlet.http.HttpServletRequest;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
@@ -44,8 +44,7 @@ public class AuthenticationFailureTracker {
      * All authentication failures currently being tracked, stored by the
      * associated IP address.
      */
-    private final ConcurrentMap<String, AuthenticationFailureStatus> failures =
-            new ConcurrentHashMap<>();
+    private final Cache<String, AuthenticationFailureStatus> failures;
 
     /**
      * The maximum number of failed authentication attempts allowed before an
@@ -70,8 +69,14 @@ public class AuthenticationFailureTracker {
      * @param banDuration
      *     The length of time that each address should be banned after reaching
      *     the maximum number of failed authentication attempts, in seconds.
+     *
+     * @param maxAddresses
+     *     The maximum number of unique IP addresses that should be tracked
+     *     before discarding older tracked failures.
      */
-    public AuthenticationFailureTracker(int maxAttempts, int banDuration) {
+    public AuthenticationFailureTracker(int maxAttempts, int banDuration,
+            long maxAddresses) {
+
         this.maxAttempts = maxAttempts;
         this.banDuration = banDuration;
 
@@ -93,6 +98,14 @@ public class AuthenticationFailureTracker {
                     banDuration, maxAttempts);
         }
 
+        // Limit maximum number of tracked addresses to configured upper bound
+        this.failures = Caffeine.newBuilder()
+                .maximumSize(maxAddresses)
+                .build();
+
+        logger.info("Up to {} unique addresses will be tracked/banned at any "
+                + " given time.", maxAddresses);
+
     }
 
     /**
@@ -147,10 +160,8 @@ public class AuthenticationFailureTracker {
      */
     private AuthenticationFailureStatus getAuthenticationFailure(String address) {
 
-        AuthenticationFailureStatus newFailure = new AuthenticationFailureStatus(maxAttempts, banDuration);
-        AuthenticationFailureStatus status = failures.putIfAbsent(address, newFailure);
-        if (status == null)
-            return newFailure;
+        AuthenticationFailureStatus status = failures.get(address,
+                (addr) -> new AuthenticationFailureStatus(maxAttempts, banDuration));
 
         status.notifyFailed();
         return status;
@@ -199,7 +210,7 @@ public class AuthenticationFailureTracker {
                     address, status.getFailures(), maxAttempts);
         }
         else
-            status = failures.get(address);
+            status = failures.getIfPresent(address);
 
         if (status != null) {
 
@@ -216,7 +227,7 @@ public class AuthenticationFailureTracker {
             // relevant (all failures are sufficiently old)
             else if (!status.isValid()) {
                 logger.debug("Removing address \"{}\" from tracking as there are no recent authentication failures.", address);
-                failures.remove(address);
+                failures.invalidate(address);
             }
 
         }
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
index 12195f5e4..adf54ff0c 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
@@ -20,6 +20,7 @@
 package org.apache.guacamole.auth.ban;
 
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.environment.LocalEnvironment;
 import org.apache.guacamole.net.auth.AbstractAuthenticationProvider;
@@ -27,6 +28,7 @@ import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.UserContext;
 import org.apache.guacamole.properties.IntegerGuacamoleProperty;
+import org.apache.guacamole.properties.LongGuacamoleProperty;
 
 /**
  * AuthenticationProvider implementation that blocks further authentication
@@ -61,6 +63,20 @@ public class BanningAuthenticationProvider extends AbstractAuthenticationProvide
 
     };
 
+    /**
+     * The maximum number of failed authentication attempts tracked at any
+     * given time. Once this number of addresses is exceeded, the oldest
+     * authentication attempts are rotated off on an LRU basis.
+     */
+    private static final LongGuacamoleProperty MAX_ADDRESSES = new LongGuacamoleProperty() {
+
+        @Override
+        public String getName() {
+            return "ban-max-addresses";
+        }
+
+    };
+
     /**
      * The default maximum number of failed authentication attempts allowed
      * before an address is temporarily banned.
@@ -74,6 +90,13 @@ public class BanningAuthenticationProvider extends AbstractAuthenticationProvide
      */
     private static final int DEFAULT_IP_BAN_DURATION = 300;
 
+    /**
+     * The maximum number of failed authentication attempts tracked at any
+     * given time. Once this number of addresses is exceeded, the oldest
+     * authentication attempts are rotated off on an LRU basis.
+     */
+    private static final long DEFAULT_MAX_ADDRESSES = 10485760;
+
     /**
      * Shared tracker of addresses that have repeatedly failed authentication.
      */
@@ -95,8 +118,15 @@ public class BanningAuthenticationProvider extends AbstractAuthenticationProvide
         Environment environment = LocalEnvironment.getInstance();
         int maxAttempts = environment.getProperty(MAX_ATTEMPTS, DEFAULT_MAX_ATTEMPTS);
         int banDuration = environment.getProperty(IP_BAN_DURATION, DEFAULT_IP_BAN_DURATION);
+        long maxAddresses = environment.getProperty(MAX_ADDRESSES, DEFAULT_MAX_ADDRESSES);
 
-        tracker = new AuthenticationFailureTracker(maxAttempts, banDuration);
+        if (maxAddresses <= 0)
+            throw new GuacamoleServerException("The maximum number of "
+                    + "addresses tracked, as specified by the "
+                    + "\"" +  MAX_ADDRESSES.getName() + "\" property, must be "
+                    + "greater than zero.");
+
+        tracker = new AuthenticationFailureTracker(maxAttempts, banDuration, maxAddresses);
         BanningAuthenticationListener.setAuthenticationFailureTracker(tracker);
 
     }

From 8b981d92135253626239dd957192747eb6532c0f Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 22 Aug 2022 12:13:19 -0700
Subject: [PATCH 060/289] GUACAMOLE-990: Add Docker image support for
 guacamole-auth-ban.

---
 guacamole-docker/bin/build-guacamole.sh | 10 ++++++++++
 guacamole-docker/bin/start.sh           | 12 ++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/guacamole-docker/bin/build-guacamole.sh b/guacamole-docker/bin/build-guacamole.sh
index 9f1773d83..6ffc86611 100755
--- a/guacamole-docker/bin/build-guacamole.sh
+++ b/guacamole-docker/bin/build-guacamole.sh
@@ -198,3 +198,13 @@ if [ -f extensions/guacamole-auth-json/target/guacamole-auth-json*.jar ]; then
     mkdir -p "$DESTINATION/json"
     cp extensions/guacamole-auth-json/target/guacamole-auth-json*.jar "$DESTINATION/json"
 fi
+
+#
+# Copy automatic brute-force banning auth extension if it was built
+#
+
+if [ -f extensions/guacamole-auth-ban/target/guacamole-auth-ban*.jar ]; then
+    mkdir -p "$DESTINATION/ban"
+    cp extensions/guacamole-auth-ban/target/guacamole-auth-ban*.jar "$DESTINATION/ban"
+fi
+
diff --git a/guacamole-docker/bin/start.sh b/guacamole-docker/bin/start.sh
index c9d205b58..632c3d03a 100755
--- a/guacamole-docker/bin/start.sh
+++ b/guacamole-docker/bin/start.sh
@@ -1160,6 +1160,18 @@ if [ -n "$API_SESSION_TIMEOUT" ]; then
     associate_apisessiontimeout
 fi
 
+# Apply any overrides for default address ban behavior
+set_optional_property "ban-address-duration" "$BAN_ADDRESS_DURATION"
+set_optional_property "ban-max-addresses" "$BAN_MAX_ADDRESSES"
+set_optional_property "ban-max-invalid-attempts" "$BAN_MAX_INVALID_ATTEMPTS"
+
+# Ensure guacamole-auth-ban always loads before other extensions unless
+# explicitly overridden via naming or EXTENSION_PRIORITY (allowing other
+# extensions to attempt authentication before guacamole-auth-ban has a chance
+# to enforce any bans could allow credentials to continue to be guessed even
+# after the address has been blocked via timing attacks)
+ln -s /opt/guacamole/ban/guacamole-auth-*.jar "$GUACAMOLE_EXT/_guacamole-auth-ban.jar"
+
 # Set logback level if specified
 if [ -n "$LOGBACK_LEVEL" ]; then
     unzip -o -j /opt/guacamole/guacamole.war WEB-INF/classes/logback.xml -d $GUACAMOLE_HOME

From a9ed4c298206fb14503811151fab0d03ad1d570e Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 22 Aug 2022 12:19:52 -0700
Subject: [PATCH 061/289] GUACAMOLE-990: Revise guacamole-auth-ban log levels
 to generally always notify of problematic addresses.

---
 .../guacamole/auth/ban/AuthenticationFailureTracker.java      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
index 85f5cc09c..72b4fc8dd 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
@@ -206,7 +206,7 @@ public class AuthenticationFailureTracker {
         AuthenticationFailureStatus status;
         if (failed) {
             status = getAuthenticationFailure(address);
-            logger.debug("Authentication has failed for address \"{}\" (current total failures: {}/{}).",
+            logger.info("Authentication has failed for address \"{}\" (current total failures: {}/{}).",
                     address, status.getFailures(), maxAttempts);
         }
         else
@@ -217,7 +217,7 @@ public class AuthenticationFailureTracker {
             // Explicitly block further processing of authentication/authorization
             // if too many failures have occurred
             if (status.isBlocked()) {
-                logger.debug("Blocking authentication attempt from address \"{}\" due to number of authentication failures.", address);
+                logger.warn("Blocking authentication attempt from address \"{}\" due to number of authentication failures.", address);
                 throw new TranslatableGuacamoleClientTooManyException("Too "
                         + "many failed authentication attempts.",
                         "LOGIN.ERROR_TOO_MANY_ATTEMPTS");

From 584db45a4fdbb950ec4e793e5ee958f9d3fcff36 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 22 Aug 2022 15:08:42 -0700
Subject: [PATCH 062/289] GUACAMOLE-990: Enabled/disable auth failure tracking
 via implementations of a common interface.

---
 .../ban/BanningAuthenticationListener.java    |  1 +
 .../ban/BanningAuthenticationProvider.java    | 34 +++++++-
 .../AuthenticationFailureStatus.java          |  2 +-
 .../status/AuthenticationFailureTracker.java  | 78 ++++++++++++++++++
 ...InMemoryAuthenticationFailureTracker.java} | 79 +++----------------
 .../NullAuthenticationFailureTracker.java     | 49 ++++++++++++
 6 files changed, 172 insertions(+), 71 deletions(-)
 rename extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/{ => status}/AuthenticationFailureStatus.java (98%)
 create mode 100644 extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/AuthenticationFailureTracker.java
 rename extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/{AuthenticationFailureTracker.java => status/InMemoryAuthenticationFailureTracker.java} (74%)
 create mode 100644 extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/NullAuthenticationFailureTracker.java

diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java
index 38fd575fd..4d8a3bbad 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java
@@ -19,6 +19,7 @@
 
 package org.apache.guacamole.auth.ban;
 
+import org.apache.guacamole.auth.ban.status.AuthenticationFailureTracker;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
 import org.apache.guacamole.net.event.AuthenticationFailureEvent;
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
index adf54ff0c..a6df43a30 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
@@ -19,8 +19,11 @@
 
 package org.apache.guacamole.auth.ban;
 
+import org.apache.guacamole.auth.ban.status.InMemoryAuthenticationFailureTracker;
+import org.apache.guacamole.auth.ban.status.AuthenticationFailureTracker;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.auth.ban.status.NullAuthenticationFailureTracker;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.environment.LocalEnvironment;
 import org.apache.guacamole.net.auth.AbstractAuthenticationProvider;
@@ -29,6 +32,8 @@ import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.UserContext;
 import org.apache.guacamole.properties.IntegerGuacamoleProperty;
 import org.apache.guacamole.properties.LongGuacamoleProperty;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * AuthenticationProvider implementation that blocks further authentication
@@ -37,6 +42,11 @@ import org.apache.guacamole.properties.LongGuacamoleProperty;
  */
 public class BanningAuthenticationProvider extends AbstractAuthenticationProvider {
 
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(BanningAuthenticationProvider.class);
+
     /**
      * The maximum number of failed authentication attempts allowed before an
      * address is temporarily banned.
@@ -126,7 +136,29 @@ public class BanningAuthenticationProvider extends AbstractAuthenticationProvide
                     + "\"" +  MAX_ADDRESSES.getName() + "\" property, must be "
                     + "greater than zero.");
 
-        tracker = new AuthenticationFailureTracker(maxAttempts, banDuration, maxAddresses);
+        // Configure auth failure tracking behavior and inform administrator of
+        // ultimate result
+        if (maxAttempts <= 0) {
+            this.tracker = new NullAuthenticationFailureTracker();
+            logger.info("Maximum failed authentication attempts has been set "
+                    + "to {}. Automatic banning of brute-force authentication "
+                    + "attempts will be disabled.", maxAttempts);
+        }
+        else if (banDuration <= 0) {
+            this.tracker = new NullAuthenticationFailureTracker();
+            logger.info("Ban duration for addresses that repeatedly fail "
+                    + "authentication has been set to {}. Automatic banning "
+                    + "of brute-force authentication attempts will be "
+                    + "disabled.", banDuration);
+        }
+        else {
+            this.tracker = new InMemoryAuthenticationFailureTracker(maxAttempts, banDuration, maxAddresses);
+            logger.info("Addresses will be automatically banned for {} "
+                    + "seconds after {} failed authentication attempts. Up "
+                    + "to {} unique addresses will be tracked/banned at any "
+                    + "given time.", banDuration, maxAttempts, maxAddresses);
+        }
+
         BanningAuthenticationListener.setAuthenticationFailureTracker(tracker);
 
     }
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureStatus.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/AuthenticationFailureStatus.java
similarity index 98%
rename from extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureStatus.java
rename to extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/AuthenticationFailureStatus.java
index ac4f1efc1..3292d1179 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureStatus.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/AuthenticationFailureStatus.java
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-package org.apache.guacamole.auth.ban;
+package org.apache.guacamole.auth.ban.status;
 
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/AuthenticationFailureTracker.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/AuthenticationFailureTracker.java
new file mode 100644
index 000000000..9ea7f2c9e
--- /dev/null
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/AuthenticationFailureTracker.java
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ban.status;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.Credentials;
+
+/**
+ * Tracks past authentication results, automatically blocking the IP addresses
+ * of machines that repeatedly fail to authenticate.
+ */
+public interface AuthenticationFailureTracker {
+
+    /**
+     * Reports that an authentication request has been received, but it is
+     * either not yet known whether the request has succeeded or failed. If the
+     * associated address is currently being blocked, an exception will be
+     * thrown.
+     *
+     * @param credentials
+     *     The credentials associated with the authentication request.
+     *
+     * @throws GuacamoleException
+     *     If the authentication request is being blocked due to brute force
+     *     prevention rules.
+     */
+    void notifyAuthenticationRequestReceived(Credentials credentials)
+            throws GuacamoleException;
+
+    /**
+     * Reports that an authentication request has been received and has
+     * succeeded. If the associated address is currently being blocked, an
+     * exception will be thrown.
+     *
+     * @param credentials
+     *     The credentials associated with the successful authentication
+     *     request.
+     *
+     * @throws GuacamoleException
+     *     If the authentication request is being blocked due to brute force
+     *     prevention rules.
+     */
+    void notifyAuthenticationSuccess(Credentials credentials)
+            throws GuacamoleException;
+
+    /**
+     * Reports that an authentication request has been received and has
+     * failed. If the associated address is currently being blocked, an
+     * exception will be thrown.
+     *
+     * @param credentials
+     *     The credentials associated with the failed authentication request.
+     *
+     * @throws GuacamoleException
+     *     If the authentication request is being blocked due to brute force
+     *     prevention rules.
+     */
+    void notifyAuthenticationFailed(Credentials credentials)
+            throws GuacamoleException;
+
+}
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/InMemoryAuthenticationFailureTracker.java
similarity index 74%
rename from extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
rename to extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/InMemoryAuthenticationFailureTracker.java
index 72b4fc8dd..b655168e1 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/AuthenticationFailureTracker.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/InMemoryAuthenticationFailureTracker.java
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-package org.apache.guacamole.auth.ban;
+package org.apache.guacamole.auth.ban.status;
 
 import com.github.benmanes.caffeine.cache.Cache;
 import com.github.benmanes.caffeine.cache.Caffeine;
@@ -30,15 +30,16 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
- * Provides automated tracking and blocking of IP addresses that repeatedly
- * fail authentication.
+ * AuthenticationFailureTracker implementation that tracks the failure status
+ * of each IP address in memory. The maximum amount of memory consumed is
+ * bounded by the configured maximum number of addresses tracked.
  */
-public class AuthenticationFailureTracker {
+public class InMemoryAuthenticationFailureTracker implements AuthenticationFailureTracker {
 
     /**
      * Logger for this class.
      */
-    private static final Logger logger = LoggerFactory.getLogger(AuthenticationFailureTracker.class);
+    private static final Logger logger = LoggerFactory.getLogger(InMemoryAuthenticationFailureTracker.class);
 
     /**
      * All authentication failures currently being tracked, stored by the
@@ -74,38 +75,17 @@ public class AuthenticationFailureTracker {
      *     The maximum number of unique IP addresses that should be tracked
      *     before discarding older tracked failures.
      */
-    public AuthenticationFailureTracker(int maxAttempts, int banDuration,
+    public InMemoryAuthenticationFailureTracker(int maxAttempts, int banDuration,
             long maxAddresses) {
 
         this.maxAttempts = maxAttempts;
         this.banDuration = banDuration;
 
-        // Inform administrator of configured behavior
-        if (maxAttempts <= 0) {
-            logger.info("Maximum failed authentication attempts has been set "
-                    + "to {}. Automatic banning of brute-force authentication "
-                    + "attempts will be disabled.", maxAttempts);
-        }
-        else if (banDuration <= 0) {
-            logger.info("Ban duration for addresses that repeatedly fail "
-                    + "authentication has been set to {}. Automatic banning "
-                    + "of brute-force authentication attempts will be "
-                    + "disabled.", banDuration);
-        }
-        else {
-            logger.info("Addresses will be automatically banned for {} "
-                    + "seconds after {} failed authentication attempts.",
-                    banDuration, maxAttempts);
-        }
-
         // Limit maximum number of tracked addresses to configured upper bound
         this.failures = Caffeine.newBuilder()
                 .maximumSize(maxAddresses)
                 .build();
 
-        logger.info("Up to {} unique addresses will be tracked/banned at any "
-                + " given time.", maxAddresses);
-
     }
 
     /**
@@ -187,10 +167,6 @@ public class AuthenticationFailureTracker {
     private void notifyAuthenticationStatus(Credentials credentials,
             boolean failed) throws GuacamoleException {
 
-        // Do not track/ban if tracking or banning are disabled
-        if (maxAttempts <= 0 || banDuration <= 0)
-            return;
-
         // Ignore requests that do not contain explicit parameters of any kind
         if (isEmpty(credentials))
             return;
@@ -234,54 +210,19 @@ public class AuthenticationFailureTracker {
 
     }
 
-    /**
-     * Reports that an authentication request has been received, but it is
-     * either not yet known whether the request has succeeded or failed. If the
-     * associated address is currently being blocked, an exception will be
-     * thrown.
-     *
-     * @param credentials
-     *     The credentials associated with the authentication request.
-     *
-     * @throws GuacamoleException
-     *     If the authentication request is being blocked due to brute force
-     *     prevention rules.
-     */
+    @Override
     public void notifyAuthenticationRequestReceived(Credentials credentials)
             throws GuacamoleException {
         notifyAuthenticationStatus(credentials, false);
     }
 
-    /**
-     * Reports that an authentication request has been received and has
-     * succeeded. If the associated address is currently being blocked, an
-     * exception will be thrown.
-     *
-     * @param credentials
-     *     The credentials associated with the successful authentication
-     *     request.
-     *
-     * @throws GuacamoleException
-     *     If the authentication request is being blocked due to brute force
-     *     prevention rules.
-     */
+    @Override
     public void notifyAuthenticationSuccess(Credentials credentials)
             throws GuacamoleException {
         notifyAuthenticationStatus(credentials, false);
     }
 
-    /**
-     * Reports that an authentication request has been received and has
-     * failed. If the associated address is currently being blocked, an
-     * exception will be thrown.
-     *
-     * @param credentials
-     *     The credentials associated with the failed authentication request.
-     *
-     * @throws GuacamoleException
-     *     If the authentication request is being blocked due to brute force
-     *     prevention rules.
-     */
+    @Override
     public void notifyAuthenticationFailed(Credentials credentials)
             throws GuacamoleException {
         notifyAuthenticationStatus(credentials, true);
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/NullAuthenticationFailureTracker.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/NullAuthenticationFailureTracker.java
new file mode 100644
index 000000000..9b50a3022
--- /dev/null
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/NullAuthenticationFailureTracker.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ban.status;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.Credentials;
+
+/**
+ * AuthenticationFailureTracker implementation that does nothing. All requests
+ * are ignored, regardless of status, and no tracking is performed.
+ */
+public class NullAuthenticationFailureTracker implements AuthenticationFailureTracker {
+
+    @Override
+    public void notifyAuthenticationRequestReceived(Credentials credentials)
+            throws GuacamoleException {
+        // Do nothing
+    }
+
+    @Override
+    public void notifyAuthenticationSuccess(Credentials credentials)
+            throws GuacamoleException {
+        // Do nothing
+    }
+
+    @Override
+    public void notifyAuthenticationFailed(Credentials credentials)
+            throws GuacamoleException {
+        // Do nothing
+    }
+
+}

From 2e5d3f4fafcfe475cd8c7bccaba4d5eae94ca560 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 22 Aug 2022 15:12:01 -0700
Subject: [PATCH 063/289] GUACAMOLE-990: Disable tracking if max addresses is
 not a positive integer.

---
 .../auth/ban/BanningAuthenticationProvider.java     | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
index a6df43a30..1d115d39d 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
@@ -22,7 +22,6 @@ package org.apache.guacamole.auth.ban;
 import org.apache.guacamole.auth.ban.status.InMemoryAuthenticationFailureTracker;
 import org.apache.guacamole.auth.ban.status.AuthenticationFailureTracker;
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.auth.ban.status.NullAuthenticationFailureTracker;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.environment.LocalEnvironment;
@@ -130,12 +129,6 @@ public class BanningAuthenticationProvider extends AbstractAuthenticationProvide
         int banDuration = environment.getProperty(IP_BAN_DURATION, DEFAULT_IP_BAN_DURATION);
         long maxAddresses = environment.getProperty(MAX_ADDRESSES, DEFAULT_MAX_ADDRESSES);
 
-        if (maxAddresses <= 0)
-            throw new GuacamoleServerException("The maximum number of "
-                    + "addresses tracked, as specified by the "
-                    + "\"" +  MAX_ADDRESSES.getName() + "\" property, must be "
-                    + "greater than zero.");
-
         // Configure auth failure tracking behavior and inform administrator of
         // ultimate result
         if (maxAttempts <= 0) {
@@ -151,6 +144,12 @@ public class BanningAuthenticationProvider extends AbstractAuthenticationProvide
                     + "of brute-force authentication attempts will be "
                     + "disabled.", banDuration);
         }
+        else if (maxAddresses <= 0) {
+            this.tracker = new NullAuthenticationFailureTracker();
+            logger.info("Maximum number of tracked addresses has been set to "
+                    + "{}. Automatic banning of brute-force authentication "
+                    + "attempts will be disabled.", maxAddresses);
+        }
         else {
             this.tracker = new InMemoryAuthenticationFailureTracker(maxAttempts, banDuration, maxAddresses);
             logger.info("Addresses will be automatically banned for {} "

From e0a9364dde890bff48481ad9e95affa38a77abb4 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 17 Aug 2022 18:05:41 +0000
Subject: [PATCH 064/289] GUACAMOLE-1661: Simplify and clarify KSM domain
 search code.

---
 .../guacamole/vault/ksm/secret/KsmClient.java | 16 +++---
 .../vault/ksm/secret/KsmSecretService.java    |  4 +-
 .../{UserDomain.java => UserLogin.java}       | 50 +++++++------------
 3 files changed, 30 insertions(+), 40 deletions(-)
 rename extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/{UserDomain.java => UserLogin.java} (63%)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index 34f350234..a573259b5 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -177,7 +177,7 @@ public class KsmClient {
      * this Map, {@link #cachedAmbiguousUsers} must first be checked to
      * verify that there is indeed only one record associated with that user.
      */
-    private final Map<UserDomain, KeeperRecord> cachedRecordsByUser = new HashMap<>();
+    private final Map<UserLogin, KeeperRecord> cachedRecordsByUser = new HashMap<>();
 
     /**
      * The set of all username/domain combos that are associated with multiple
@@ -187,7 +187,7 @@ public class KsmClient {
      * acquired appropriately. This Set must be checked before using a value
      * retrieved from {@link #cachedRecordsByUser}.
      */
-    private final Set<UserDomain> cachedAmbiguousUsers = new HashSet<>();
+    private final Set<UserLogin> cachedAmbiguousUsers = new HashSet<>();
 
     /**
      * All records retrieved from Keeper Secrets Manager, where each key is the
@@ -307,10 +307,12 @@ public class KsmClient {
                     WindowsUsername usernameAndDomain = (
                             WindowsUsername.splitWindowsUsernameFromDomain(username));
 
-                    // Use the username-split domain if not already set explicitly
-                    if (usernameAndDomain.hasDomain())
+                    // Use the username-split domain if available
+                    if (usernameAndDomain.hasDomain()) {
                         domain = usernameAndDomain.getDomain();
+                        username = usernameAndDomain.getUsername();
                         addRecordForDomain(record, domain);
+                    }
 
                 }
 
@@ -407,7 +409,7 @@ public class KsmClient {
         if (username == null)
             return;
 
-        UserDomain userDomain = new UserDomain(username, domain);
+        UserLogin userDomain = new UserLogin(username, domain);
         KeeperRecord existing = cachedRecordsByUser.putIfAbsent(
                 userDomain, record);
         if (existing != null && record != existing)
@@ -504,7 +506,7 @@ public class KsmClient {
      *     The username of the record to return.
      *
      * @param domain
-     *     The domain of the record to return.
+     *     The domain of the record to return, or null if no domain exists.
      *
      * @return
      *     The record associated with the given username and domain, or null
@@ -519,7 +521,7 @@ public class KsmClient {
         validateCache();
         cacheLock.readLock().lock();
 
-        UserDomain userDomain = new UserDomain(username, domain);
+        UserLogin userDomain = new UserLogin(username, domain);
 
         try {
 
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index 3b8a6dc0d..cb5868cfa 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -373,7 +373,9 @@ public class KsmSecretService implements VaultSecretService {
                             filter.filter(gatewayUsername),
                             filteredGatewayDomain));
 
-        } else {
+        }
+
+        else {
 
             // Retrieve and define user-specific tokens, if any
             // NOTE that non-RDP connections do not have a domain
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/UserDomain.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/UserLogin.java
similarity index 63%
rename from extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/UserDomain.java
rename to extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/UserLogin.java
index bb2c2309d..5cd50ee6c 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/UserDomain.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/UserLogin.java
@@ -19,6 +19,8 @@
 
 package org.apache.guacamole.vault.ksm.secret;
 
+import java.util.Objects;
+
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
@@ -29,7 +31,7 @@ import javax.annotation.Nullable;
  * actually be identified by both the user and domain, if the appropriate
  * settings are enabled.
  */
-class UserDomain {
+class UserLogin {
 
     /**
      * The username associated with the user record.
@@ -44,17 +46,17 @@ class UserDomain {
     private final String domain;
 
     /**
-     * Create a new UserDomain instance with the provided username and
+     * Create a new UserLogin instance with the provided username and
      * domain. The domain may be null, but the username should never be.
      *
      * @param username
-     *    The username to create the UserDomain instance with. This should
+     *    The username to create the UserLogin instance with. This should
      *    never be null.
      *
      * @param domain
-     *    The domain to create the UserDomain instance with. This can be null.
+     *    The domain to create the UserLogin instance with. This can be null.
      */
-    UserDomain(@Nonnull String username, @Nullable String domain) {
+    UserLogin(@Nonnull String username, @Nullable String domain) {
         this.username = username;
         this.domain = domain;
     }
@@ -62,13 +64,7 @@ class UserDomain {
     @Override
     public int hashCode() {
 
-        final int prime = 31;
-
-        int result = 1;
-        result = prime * result + ((domain == null) ? 0 : domain.hashCode());
-        result = prime * result + ((username == null) ? 0 : username.hashCode());
-
-        return result;
+        return Objects.hash(domain, username);
 
     }
 
@@ -83,33 +79,23 @@ class UserDomain {
         if (obj == null)
             return false;
 
-        // Check if the other object is also a UserDomain
+        // Check if the other object is also a UserLogin
         if (getClass() != obj.getClass())
             return false;
 
-        // If it is a UserDomain, it must have the same username...
-        UserDomain other = (UserDomain) obj;
-        if (username == null) {
-            if (other.username != null)
-                return false;
-        } else if (!username.equals(other.username))
-            return false;
+        // If the other object is also a UserLogin, it must
+        // have the same username and domain
+        UserLogin other = (UserLogin) obj;
+        return Objects.equals(username, other.username)
+                && Objects.equals(domain, other.domain);
 
-        // .. and the same domain
-        if (domain == null) {
-            if (other.domain != null)
-                return false;
-        } else if (!domain.equals(other.domain))
-            return false;
-
-        return true;
     }
 
     /**
-     * Get the username associated with this UserDomain.
+     * Get the username associated with this UserLogin.
      *
      * @return
-     *     The username associated with this UserDomain.
+     *     The username associated with this UserLogin.
      */
     public String getUsername() {
         return username;
@@ -117,10 +103,10 @@ class UserDomain {
 
 
     /**
-     * Get the domain associated with this UserDomain.
+     * Get the domain associated with this UserLogin.
      *
      * @return
-     *     The domain associated with this UserDomain.
+     *     The domain associated with this UserLogin.
      */
     public String getDomain() {
         return domain;

From 2b997a9992cb246ae9e6aecbb52e9daed2680d91 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 24 Aug 2022 19:03:16 +0000
Subject: [PATCH 065/289] GUACAMOLE-1661: Restore logic to not index records by
 login if hostname is already defined.

---
 .../org/apache/guacamole/vault/ksm/secret/KsmClient.java   | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index a573259b5..fd339dac5 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -322,8 +322,11 @@ public class KsmClient {
                 if (!confService.getMatchUserRecordsByDomain())
                     domain = null;
 
-                // Store the login by username and domain
-                addRecordForLogin(record, username, domain);
+                // Store based on login ONLY if no hostname (will otherwise
+                // result in ambiguous entries for servers tied to identical
+                // accounts)
+                if (hostname == null)
+                    addRecordForLogin(record, username, domain);
 
             }
 

From c7bb1cb50c6dae7efd8f85f39ef5320d787a6696 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 25 Aug 2022 00:03:18 +0000
Subject: [PATCH 066/289] GUACAMOLE-1661: Parse config only once when iterating
 records.

---
 .../guacamole/vault/ksm/secret/KsmClient.java   | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index fd339dac5..6e0bdf177 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -277,13 +277,13 @@ public class KsmClient {
             cachedAmbiguousDomains.clear();
             cachedRecordsByDomain.clear();
 
+            // Parse configuration
+            final boolean shouldSplitUsernames = confService.getSplitWindowsUsernames();
+            final boolean shouldMatchByDomain = confService.getMatchUserRecordsByDomain();
+
             // Store all records, sorting each into host-based, login-based,
             // and domain-based buckets
-            Iterator<KeeperRecord> recordIterator = records.iterator();
-            while(recordIterator.hasNext()) {
-
-                // Go through records one at a time
-                KeeperRecord record = recordIterator.next();
+            records.forEach(record -> {
 
                 // Store based on UID ...
                 cachedRecordsByUid.put(record.getRecordUid(), record);
@@ -300,8 +300,7 @@ public class KsmClient {
                 String username = recordService.getUsername(record);
 
                 // If we have a username, and there isn't already a domain explicitly defined
-                if (username != null && domain == null
-                        && confService.getSplitWindowsUsernames()) {
+                if (username != null && domain == null && shouldSplitUsernames) {
 
                     // Attempt to split out the domain of the username
                     WindowsUsername usernameAndDomain = (
@@ -319,7 +318,7 @@ public class KsmClient {
                 // If domain matching is not enabled for user records,
                 // explicitly set all domains to null to allow matching
                 // on username only
-                if (!confService.getMatchUserRecordsByDomain())
+                if (!shouldMatchByDomain)
                     domain = null;
 
                 // Store based on login ONLY if no hostname (will otherwise
@@ -328,7 +327,7 @@ public class KsmClient {
                 if (hostname == null)
                     addRecordForLogin(record, username, domain);
 
-            }
+            });
 
             // Cache has been refreshed
             this.cacheTimestamp = System.currentTimeMillis();

From e4c65cba19fadc87ff61500d2065766472398ad2 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 19 Jul 2022 18:31:40 +0000
Subject: [PATCH 067/289] GUACAMOLE-1656: Add per-user KSM vault functionality.

---
 .../vault/conf/VaultAttributeService.java     |  30 +++
 .../vault/user/VaultUserContext.java          |  59 ++++--
 .../ksm/KsmAuthenticationProviderModule.java  |   1 +
 .../vault/ksm/conf/KsmAttributeService.java   |  66 ++++++-
 .../ksm/conf/KsmConfigurationService.java     |  26 +++
 .../vault/ksm/secret/KsmSecretService.java    | 177 +++++++++++-------
 .../vault/ksm/user/KsmConnection.java         |  82 ++++++++
 .../vault/ksm/user/KsmDirectoryService.java   |  87 +++++++++
 .../guacamole/vault/ksm/user/KsmUser.java     |  82 ++++++++
 .../src/main/resources/translations/en.json   |  10 +
 .../net/auth/DelegatingUserContext.java       |   5 +
 .../guacamole/net/auth/UserContext.java       |  17 ++
 .../controllers/manageUserController.js       |   2 +
 .../src/app/rest/services/schemaService.js    |  28 +++
 .../directives/guacSettingsPreferences.js     | 124 +++++++++++-
 .../templates/settingsPreferences.html        |  10 +
 .../main/frontend/src/translations/en.json    |   3 +
 guacamole/src/main/frontend/webpack.config.js |  12 --
 .../guacamole/rest/schema/SchemaResource.java |  20 ++
 .../guacamole/rest/user/UserResource.java     |  53 +++++-
 20 files changed, 785 insertions(+), 109 deletions(-)
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
index 2bd08cde6..bccf08e03 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/conf/VaultAttributeService.java
@@ -30,6 +30,16 @@ import org.apache.guacamole.form.Form;
  */
 public interface VaultAttributeService {
 
+    /**
+     * Return all custom connection attributes to be exposed through the
+     * admin UI for the current vault implementation.
+     *
+     * @return
+     *     All custom connection attributes to be exposed through the
+     *     admin UI for the current vault implementation.
+     */
+    public Collection<Form> getConnectionAttributes();
+
     /**
      * Return all custom connection group attributes to be exposed through the
      * admin UI for the current vault implementation.
@@ -39,4 +49,24 @@ public interface VaultAttributeService {
      *     admin UI for the current vault implementation.
      */
     public Collection<Form> getConnectionGroupAttributes();
+
+    /**
+     * Return all custom user attributes to be exposed through the admin UI for
+     * the current vault implementation.
+     *
+     * @return
+     *     All custom user attributes to be exposed through the admin UI for
+     *     the current vault implementation.
+     */
+    public Collection<Form> getUserAttributes();
+
+    /**
+     * Return all user preference attributes to be exposed through the user
+     * preferences UI for the current vault implementation.
+     *
+     * @return
+     *     All user preference attributes to be exposed through the user
+     *     preferences UI for the current vault implementation.
+     */
+    public Collection<Form> getUserPreferenceAttributes();
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
index 8e8f66853..748237dd2 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
@@ -241,7 +241,7 @@ public class VaultUserContext extends TokenInjectingUserContext {
      *
      * @throws GuacamoleException
      *     If the value for any applicable secret cannot be retrieved from the
-     *     vault due to an error.
+     *     vault due to an error.1
      */
     private Map<String, Future<String>> getTokens(
             Connectable connectable, Map<String, String> tokenMapping,
@@ -407,7 +407,6 @@ public class VaultUserContext extends TokenInjectingUserContext {
         TokenFilter filter = createFilter();
         filter.setToken(CONNECTION_NAME_TOKEN, connection.getName());
         filter.setToken(CONNECTION_IDENTIFIER_TOKEN, identifier);
-
         // Add hostname and username tokens if available (implementations are
         // not required to expose connection configuration details)
 
@@ -439,17 +438,6 @@ public class VaultUserContext extends TokenInjectingUserContext {
 
     }
 
-    @Override
-    public Collection<Form> getConnectionGroupAttributes() {
-
-        // Add any custom attributes to any previously defined attributes
-        return Collections.unmodifiableCollection(Stream.concat(
-                super.getConnectionGroupAttributes().stream(),
-                attributeService.getConnectionGroupAttributes().stream()
-        ).collect(Collectors.toList()));
-
-    }
-
     @Override
     public Directory<User> getUserDirectory() throws GuacamoleException {
 
@@ -490,6 +478,51 @@ public class VaultUserContext extends TokenInjectingUserContext {
 
         // Defer to the vault-specific directory service
         return directoryService.getSharingProfileDirectory(super.getSharingProfileDirectory());
+
+    }
+
+    @Override
+    public Collection<Form> getUserAttributes() {
+
+        // Add any custom attributes to any previously defined attributes
+        return Collections.unmodifiableCollection(Stream.concat(
+                super.getUserAttributes().stream(),
+                attributeService.getUserAttributes().stream()
+        ).collect(Collectors.toList()));
+
+    }
+
+    @Override
+    public Collection<Form> getUserPreferenceAttributes() {
+
+        // Add any custom preference attributes to any previously defined attributes
+        return Collections.unmodifiableCollection(Stream.concat(
+                super.getUserPreferenceAttributes().stream(),
+                attributeService.getUserPreferenceAttributes().stream()
+        ).collect(Collectors.toList()));
+
+    }
+
+    @Override
+    public Collection<Form> getConnectionAttributes() {
+
+        // Add any custom attributes to any previously defined attributes
+        return Collections.unmodifiableCollection(Stream.concat(
+                super.getConnectionAttributes().stream(),
+                attributeService.getConnectionAttributes().stream()
+        ).collect(Collectors.toList()));
+
+    }
+
+    @Override
+    public Collection<Form> getConnectionGroupAttributes() {
+
+        // Add any custom attributes to any previously defined attributes
+        return Collections.unmodifiableCollection(Stream.concat(
+                super.getConnectionGroupAttributes().stream(),
+                attributeService.getConnectionGroupAttributes().stream()
+        ).collect(Collectors.toList()));
+
     }
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
index 3c28553e0..faf22aa4e 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
@@ -57,6 +57,7 @@ public class KsmAuthenticationProviderModule
 
         // Bind services specific to Keeper Secrets Manager
         bind(KsmRecordService.class);
+        bind(KsmAttributeService.class);
         bind(VaultAttributeService.class).to(KsmAttributeService.class);
         bind(VaultConfigurationService.class).to(KsmConfigurationService.class);
         bind(VaultSecretService.class).to(KsmSecretService.class);
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
index 83ab9c4a3..bdceb4c21 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
@@ -23,10 +23,13 @@ import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.form.BooleanField;
 import org.apache.guacamole.form.Form;
 import org.apache.guacamole.form.TextField;
 import org.apache.guacamole.vault.conf.VaultAttributeService;
 
+import com.google.inject.Inject;
 import com.google.inject.Singleton;
 
 /**
@@ -36,28 +39,81 @@ import com.google.inject.Singleton;
 @Singleton
 public class KsmAttributeService implements VaultAttributeService {
 
+
+    @Inject
+    private KsmConfigurationService configurationService;
+
     /**
      * The name of the attribute which can contain a KSM configuration blob
-     * associated with a connection group.
+     * associated with either a connection group or user.
      */
     public static final String KSM_CONFIGURATION_ATTRIBUTE = "ksm-config";
 
     /**
      * All attributes related to configuring the KSM vault on a
-     * per-connection-group basis.
+     * per-connection-group or per-user basis.
      */
     public static final Form KSM_CONFIGURATION_FORM = new Form("ksm-config",
             Arrays.asList(new TextField(KSM_CONFIGURATION_ATTRIBUTE)));
 
     /**
-     * All KSM-specific connection group attributes, organized by form.
+     * All KSM-specific attributes for users or connection groups, organized by form.
      */
-    public static final Collection<Form> KSM_CONNECTION_GROUP_ATTRIBUTES =
+    public static final Collection<Form> KSM_ATTRIBUTES =
             Collections.unmodifiableCollection(Arrays.asList(KSM_CONFIGURATION_FORM));
 
+    /**
+     * The name of the attribute which can controls whether a KSM user configuration
+     * is enabled on a connection-by-connection basis.
+     */
+    public static final String KSM_USER_CONFIG_ENABLED_ATTRIBUTE = "ksm-user-config-enabled";
+
+    /**
+     * The string value used by KSM attributes to represent the boolean value "true".
+     */
+    public static final String TRUTH_VALUE = "true";
+
+    /**
+     * All attributes related to configuring the KSM vault on a per-connection basis.
+     */
+    public static final Form KSM_CONNECTION_FORM = new Form("ksm-config",
+            Arrays.asList(new BooleanField(KSM_USER_CONFIG_ENABLED_ATTRIBUTE, TRUTH_VALUE)));
+
+    /**
+     * All KSM-specific attributes for connections, organized by form.
+     */
+    public static final Collection<Form> KSM_CONNECTION_ATTRIBUTES =
+            Collections.unmodifiableCollection(Arrays.asList(KSM_CONNECTION_FORM));
+
+    @Override
+    public Collection<Form> getConnectionAttributes() {
+        return KSM_CONNECTION_ATTRIBUTES;
+    }
+
     @Override
     public Collection<Form> getConnectionGroupAttributes() {
-        return KSM_CONNECTION_GROUP_ATTRIBUTES;
+        return KSM_ATTRIBUTES;
     }
 
+    @Override
+    public Collection<Form> getUserAttributes() {
+        return KSM_ATTRIBUTES;
+    }
+
+    @Override
+    public Collection<Form> getUserPreferenceAttributes() {
+
+        try {
+
+            // Expose the user attributes IFF user-level KSM configuration is enabled
+            return configurationService.getAllowUserConfig() ? KSM_ATTRIBUTES : Collections.emptyList();
+
+        } catch (GuacamoleException e) {
+
+            // If the configuration can't be parsed, default to not exposing the attribute
+            return Collections.emptyList();
+        }
+    }
+
+
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
index c9a9536ea..9d2e4565f 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
@@ -84,6 +84,17 @@ public class KsmConfigurationService extends VaultConfigurationService {
         }
     };
 
+    /**
+     * Whether users should be able to supply their own KSM configurations.
+     */
+    private static final BooleanGuacamoleProperty ALLOW_USER_CONFIG = new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() {
+            return "ksm-allow-user-config";
+        }
+    };
+
     /**
      * Whether windows domains should be stripped off from usernames that are
      * read from the KSM vault.
@@ -138,6 +149,21 @@ public class KsmConfigurationService extends VaultConfigurationService {
         return environment.getProperty(ALLOW_UNVERIFIED_CERT, false);
     }
 
+    /**
+     * Return whether users should be able to provide their own KSM configs.
+     *
+     * @return
+     *     true if users should be able to provide their own KSM configs,
+     *     false otherwise.
+     *
+     * @throws GuacamoleException
+     *     If the value specified within guacamole.properties cannot be
+     *     parsed.
+     */
+    public boolean getAllowUserConfig() throws GuacamoleException {
+        return environment.getProperty(ALLOW_USER_CONFIG, false);
+    }
+
     @Override
     public boolean getSplitWindowsUsernames() throws GuacamoleException {
         return environment.getProperty(STRIP_WINDOWS_DOMAINS, false);
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index cb5868cfa..a3b772256 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -26,8 +26,11 @@ import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
 
 import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
+import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.CompletableFuture;
@@ -304,6 +307,34 @@ public class KsmSecretService implements VaultSecretService {
 
     }
 
+    /**
+     * Returns true if user-level KSM configuration is enabled for the given
+     * Connectable, false otherwise.
+     *
+     * @param connectable
+     *     The connectable to check for whether user-level KSM configs are
+     *     enabled.
+     *
+     * @return
+     *     True if user-level KSM configuration is enabled for the given
+     *     Connectable, false otherwise.
+     */
+    private boolean isKsmUserConfigEnabled(Connectable connectable) {
+
+        // If it's a connection, user-level config is enabled IFF the appropriate
+        // attribute is set to true
+        if (connectable instanceof Connection)
+            return KsmAttributeService.TRUTH_VALUE.equals(((Connection) connectable).getAttributes().get(
+                KsmAttributeService.KSM_USER_CONFIG_ENABLED_ATTRIBUTE));
+
+        // KSM token replacement is not enabled for balancing groups, so for
+        // now, user-level KSM configs will be explicitly disabled.
+        // TODO: If token replacement is implemented for balancing groups,
+        // implement this functionality for them as well.
+        return false;
+
+    }
+
     @Override
     public Map<String, Future<String>> getTokens(UserContext userContext, Connectable connectable,
             GuacamoleConfiguration config, TokenFilter filter) throws GuacamoleException {
@@ -314,78 +345,92 @@ public class KsmSecretService implements VaultSecretService {
         // Attempt to find a KSM config for this connection or group
         String ksmConfig = getConnectionGroupKsmConfig(userContext, connectable);
 
-        // Get a client instance for this KSM config
-        KsmClient ksm = getClient(ksmConfig);
+        // Create a list containing just the global / connection group config
+        List<KsmClient> ksmClients = new ArrayList<>(2);
+        ksmClients.add(getClient(ksmConfig));
 
-        // Retrieve and define server-specific tokens, if any
-        String hostname = parameters.get("hostname");
-        if (hostname != null && !hostname.isEmpty())
-            addRecordTokens(tokens, "KEEPER_SERVER_",
-                    ksm.getRecordByHost(filter.filter(hostname)));
+        // Only use the user-specific KSM config if explicitly enabled in the global
+        // configuration, AND for the specific connectable being connected to
+        if (confService.getAllowUserConfig() && isKsmUserConfigEnabled(connectable)) {
 
-        // Tokens specific to RDP
-        if ("rdp".equals(config.getProtocol())) {
-
-            // Retrieve and define gateway server-specific tokens, if any
-            String gatewayHostname = parameters.get("gateway-hostname");
-            if (gatewayHostname != null && !gatewayHostname.isEmpty())
-                addRecordTokens(tokens, "KEEPER_GATEWAY_",
-                        ksm.getRecordByHost(filter.filter(gatewayHostname)));
-
-            // Retrieve and define domain tokens, if any
-            String domain = parameters.get("domain");
-            String filteredDomain = null;
-            if (domain != null && !domain.isEmpty()) {
-                filteredDomain = filter.filter(domain);
-                addRecordTokens(tokens, "KEEPER_DOMAIN_",
-                        ksm.getRecordByDomain(filteredDomain));
-            }
-
-            // Retrieve and define gateway domain tokens, if any
-            String gatewayDomain = parameters.get("gateway-domain");
-            String filteredGatewayDomain = null;
-            if (gatewayDomain != null && !gatewayDomain.isEmpty()) {
-                filteredGatewayDomain = filter.filter(gatewayDomain);
-                addRecordTokens(tokens, "KEEPER_GATEWAY_DOMAIN_",
-                        ksm.getRecordByDomain(filteredGatewayDomain));
-            }
-
-            // If domain matching is disabled for user records,
-            // explicitly set the domains to null when storing
-            // user records to enable username-only matching
-            if (!confService.getMatchUserRecordsByDomain()) {
-                filteredDomain = null;
-                filteredGatewayDomain = null;
-            }
-
-            // Retrieve and define user-specific tokens, if any
-            String username = parameters.get("username");
-            if (username != null && !username.isEmpty())
-                addRecordTokens(tokens, "KEEPER_USER_",
-                        ksm.getRecordByLogin(filter.filter(username),
-                        filteredDomain));
-
-            // Retrieve and define gateway user-specific tokens, if any
-            String gatewayUsername = parameters.get("gateway-username");
-            if (gatewayUsername != null && !gatewayUsername.isEmpty())
-                addRecordTokens(tokens, "KEEPER_GATEWAY_USER_",
-                        ksm.getRecordByLogin(
-                            filter.filter(gatewayUsername),
-                            filteredGatewayDomain));
+            // Find a user-specific KSM config, if one exists
+            String userKsmConfig = userContext.self().getAttributes().get(
+                    KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
 
+            // If a user-specific config exsts, process it first
+            if (userKsmConfig != null && !userKsmConfig.trim().isEmpty())
+                ksmClients.add(0, getClient(userKsmConfig));
         }
 
-        else {
+        // Iterate through the KSM clients, processing using the user-specific
+        // config first (if it exists), to ensure that any admin-defined values
+        // will override the user-speicifc values
+        Iterator<KsmClient> ksmIterator = ksmClients.iterator();
+        while (ksmIterator.hasNext()) {
 
-            // Retrieve and define user-specific tokens, if any
-            // NOTE that non-RDP connections do not have a domain
-            // field in the connection parameters, so the domain
-            // will always be null
-            String username = parameters.get("username");
-            if (username != null && !username.isEmpty())
-                addRecordTokens(tokens, "KEEPER_USER_",
-                        ksm.getRecordByLogin(filter.filter(username), null));
-        }
+            KsmClient ksm = ksmIterator.next();
+
+            // Retrieve and define server-specific tokens, if any
+            String hostname = parameters.get("hostname");
+            if (hostname != null && !hostname.isEmpty())
+                addRecordTokens(tokens, "KEEPER_SERVER_",
+                        ksm.getRecordByHost(filter.filter(hostname)));
+
+            // Tokens specific to RDP
+            if ("rdp".equals(config.getProtocol())) {
+                // Retrieve and define domain tokens, if any
+                String domain = parameters.get("domain");
+                String filteredDomain = null;
+                if (domain != null && !domain.isEmpty()) {
+                    filteredDomain = filter.filter(domain);
+                    addRecordTokens(tokens, "KEEPER_DOMAIN_",
+                            ksm.getRecordByDomain(filteredDomain));
+                }
+
+                // Retrieve and define gateway domain tokens, if any
+                String gatewayDomain = parameters.get("gateway-domain");
+                String filteredGatewayDomain = null;
+                if (gatewayDomain != null && !gatewayDomain.isEmpty()) {
+                    filteredGatewayDomain = filter.filter(gatewayDomain);
+                    addRecordTokens(tokens, "KEEPER_GATEWAY_DOMAIN_",
+                            ksm.getRecordByDomain(filteredGatewayDomain));
+                }
+
+                // If domain matching is disabled for user records,
+                // explicitly set the domains to null when storing
+                // user records to enable username-only matching
+                if (!confService.getMatchUserRecordsByDomain()) {
+                    filteredDomain = null;
+                    filteredGatewayDomain = null;
+                }
+
+                // Retrieve and define user-specific tokens, if any
+                String username = parameters.get("username");
+                if (username != null && !username.isEmpty())
+                    addRecordTokens(tokens, "KEEPER_USER_",
+                            ksm.getRecordByLogin(filter.filter(username),
+                            filteredDomain));
+
+                // Retrieve and define gateway user-specific tokens, if any
+                String gatewayUsername = parameters.get("gateway-username");
+                if (gatewayUsername != null && !gatewayUsername.isEmpty())
+                    addRecordTokens(tokens, "KEEPER_GATEWAY_USER_",
+                            ksm.getRecordByLogin(
+                                filter.filter(gatewayUsername),
+                                filteredGatewayDomain));
+            }
+
+            else {
+
+                // Retrieve and define user-specific tokens, if any
+                // NOTE that non-RDP connections do not have a domain
+                // field in the connection parameters, so the domain
+                // will always be null
+                String username = parameters.get("username");
+                if (username != null && !username.isEmpty())
+                    addRecordTokens(tokens, "KEEPER_USER_",
+                            ksm.getRecordByLogin(filter.filter(username), null));
+            }
 
         return tokens;
 
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java
new file mode 100644
index 000000000..da2866202
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.user;
+
+import java.util.List;
+import java.util.Map;
+
+import org.apache.guacamole.net.auth.DelegatingConnection;
+import org.apache.guacamole.net.auth.Connection;
+
+import com.google.common.collect.Maps;
+
+/**
+ * A Connection that explicitly adds a blank entry for any defined
+ * KSM connection attributes.
+ */
+public class KsmConnection extends DelegatingConnection {
+
+    /**
+     * The names of all connection attributes defined for the vault.
+     */
+    private List<String> connectionAttributeNames;
+
+    /**
+     * Create a new Vault connection wrapping the provided Connection record. Any
+     * attributes defined in the provided connection attribute forms will have empty
+     * values automatically populated when getAttributes() is called.
+     *
+     * @param connection
+     *     The connection record to wrap.
+     *
+     * @param connectionAttributeNames
+     *     The names of all connection attributes to automatically expose.
+     */
+    KsmConnection(Connection connection, List<String> connectionAttributeNames) {
+
+        super(connection);
+        this.connectionAttributeNames = connectionAttributeNames;
+
+    }
+
+    /**
+     * Return the underlying wrapped connection record.
+     *
+     * @return
+     *     The wrapped connection record.
+     */
+    Connection getUnderlyingConnection() {
+        return getDelegateConnection();
+    }
+
+    @Override
+    public Map<String, String> getAttributes() {
+
+        // Make a copy of the existing map
+        Map<String, String> attributeMap = Maps.newHashMap(super.getAttributes());
+
+        // Add every defined attribute
+        connectionAttributeNames.forEach(
+                attributeName -> attributeMap.putIfAbsent(attributeName, null));
+
+        return attributeMap;
+    }
+
+}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
index b924bc524..3eff928fe 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
@@ -26,13 +26,16 @@ import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.stream.Collectors;
 
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.language.TranslatableGuacamoleClientException;
 import org.apache.guacamole.net.auth.Attributes;
+import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.ConnectionGroup;
 import org.apache.guacamole.net.auth.DecoratingDirectory;
 import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 import org.apache.guacamole.vault.ksm.conf.KsmConfig;
 import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
@@ -57,6 +60,12 @@ public class KsmDirectoryService extends VaultDirectoryService {
     @Inject
     private KsmConfigurationService configurationService;
 
+    /**
+     * Service for retrieving KSM-specific attributes.
+     */
+    @Inject
+    private KsmAttributeService ksmAttributeService;
+
     /**
      * A singleton ObjectMapper for converting a Map to a JSON string when
      * generating a base64-encoded JSON KSM config blob.
@@ -222,6 +231,36 @@ public class KsmDirectoryService extends VaultDirectoryService {
 
     }
 
+    @Override
+    public Directory<Connection> getConnectionDirectory(
+            Directory<Connection> underlyingDirectory) throws GuacamoleException {
+
+        // A Connection directory that will intercept add and update calls to
+        // validate KSM configurations, and translate one-time-tokens, if possible
+        return new DecoratingDirectory<Connection>(underlyingDirectory) {
+
+            @Override
+            protected Connection decorate(Connection connection) throws GuacamoleException {
+
+                // Wrap in a KsmConnection class to ensure that all defined KSM fields will be
+                // present
+                return new KsmConnection(
+                        connection,
+                        ksmAttributeService.getConnectionAttributes().stream().flatMap(
+                                form -> form.getFields().stream().map(field -> field.getName())
+                        ).collect(Collectors.toList()));
+            }
+
+            @Override
+            protected Connection undecorate(Connection connection) throws GuacamoleException {
+
+                // Unwrap the KsmUser
+                return ((KsmConnection) connection).getUnderlyingConnection();
+            }
+
+        };
+    }
+
     @Override
     public Directory<ConnectionGroup> getConnectionGroupDirectory(
             Directory<ConnectionGroup> underlyingDirectory) throws GuacamoleException {
@@ -269,4 +308,52 @@ public class KsmDirectoryService extends VaultDirectoryService {
 
         };
     }
+
+    @Override
+    public Directory<User> getUserDirectory(
+            Directory<User> underlyingDirectory) throws GuacamoleException {
+
+        // A User directory that will intercept add and update calls to
+        // validate KSM configurations, and translate one-time-tokens, if possible
+        return new DecoratingDirectory<User>(underlyingDirectory) {
+
+            @Override
+            public void add(User user) throws GuacamoleException {
+
+                // Check for the KSM config attribute and translate the one-time token
+                // if possible before adding
+                processAttributes(user);
+                super.add(user);
+            }
+
+            @Override
+            public void update(User user) throws GuacamoleException {
+
+                // Check for the KSM config attribute and translate the one-time token
+                // if possible before updating
+                processAttributes(user);
+                super.update(user);
+            }
+
+            @Override
+            protected User decorate(User user) throws GuacamoleException {
+
+                // Wrap in a KsmUser class to ensure that all defined KSM fields will be
+                // present
+                return new KsmUser(
+                        user,
+                        ksmAttributeService.getUserAttributes().stream().flatMap(
+                                form -> form.getFields().stream().map(field -> field.getName())
+                        ).collect(Collectors.toList()));
+            }
+
+            @Override
+            protected User undecorate(User user) throws GuacamoleException {
+
+                // Unwrap the KsmUser
+                return ((KsmUser) user).getUnderlyingUser();
+            }
+
+        };
+    }
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java
new file mode 100644
index 000000000..a846eb0d8
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.user;
+
+import java.util.List;
+import java.util.Map;
+
+import org.apache.guacamole.net.auth.DelegatingUser;
+import org.apache.guacamole.net.auth.User;
+
+import com.google.common.collect.Maps;
+
+/**
+ * A User that explicitly adds a blank entry for any defined
+ * KSM user attributes.
+ */
+public class KsmUser extends DelegatingUser {
+
+    /**
+     * The names of all user attributes defined for the vault.
+     */
+    private List<String> userAttributeNames;
+
+    /**
+     * Create a new Vault user wrapping the provided User record. Any
+     * attributes defined in the provided user attribute forms will have empty
+     * values automatically populated when getAttributes() is called.
+     *
+     * @param user
+     *     The user record to wrap.
+     *
+     * @param userAttributeNames
+     *     The names of all user attributes to automatically expose.
+     */
+    KsmUser(User user, List<String> userAttributeNames) {
+
+        super(user);
+        this.userAttributeNames = userAttributeNames;
+
+    }
+
+    /**
+     * Return the underlying wrapped user record.
+     *
+     * @return
+     *     The wrapped user record.
+     */
+    User getUnderlyingUser() {
+        return getDelegateUser();
+    }
+
+    @Override
+    public Map<String, String> getAttributes() {
+
+        // Make a copy of the existing map
+        Map<String, String> attributeMap = Maps.newHashMap(super.getAttributes());
+
+        // Add every defined attribute
+        userAttributeNames.forEach(
+                attributeName -> attributeMap.putIfAbsent(attributeName, null));
+
+        return attributeMap;
+    }
+
+}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json
index 4601a13f1..034f5f24a 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/resources/translations/en.json
@@ -4,12 +4,22 @@
         "NAME" : "Keeper Secrets Manager"
     },
 
+    "CONNECTION_ATTRIBUTES" : {
+        "SECTION_HEADER_KSM_CONFIG"            : "Keeper Secrets Manager",
+        "FIELD_HEADER_KSM_USER_CONFIG_ENABLED" : "Allow user-provided KSM configuration"
+    },
+
     "CONNECTION_GROUP_ATTRIBUTES" : {
         "SECTION_HEADER_KSM_CONFIG" : "Keeper Secrets Manager",
         "FIELD_HEADER_KSM_CONFIG"   : "KSM Service Configuration ",
 
         "ERROR_INVALID_KSM_CONFIG_BLOB"    : "The provided base64-encoded KSM configuration blob is not valid. Please ensure that you have copied the entire blob.",
         "ERROR_INVALID_KSM_ONE_TIME_TOKEN" : "The provided configuration is not a valid KSM one-time token or base64-encoded configuration blob. Please ensure that you have copied the entire token value."
+    },
+
+    "USER_ATTRIBUTES" : {
+        "SECTION_HEADER_KSM_CONFIG" : "Keeper Secrets Manager",
+        "FIELD_HEADER_KSM_CONFIG"   : "KSM Service Configuration "
     }
 
 }
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserContext.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserContext.java
index 85e025909..4b0343181 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserContext.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserContext.java
@@ -127,6 +127,11 @@ public class DelegatingUserContext implements UserContext {
         return userContext.getUserAttributes();
     }
 
+    @Override
+    public Collection<Form> getUserPreferenceAttributes() {
+        return userContext.getUserPreferenceAttributes();
+    }
+
     @Override
     public Collection<Form> getUserGroupAttributes() {
         return userContext.getUserGroupAttributes();
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserContext.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserContext.java
index ccdcaae09..3f75b899c 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserContext.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserContext.java
@@ -20,6 +20,8 @@
 package org.apache.guacamole.net.auth;
 
 import java.util.Collection;
+import java.util.Collections;
+
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.form.Form;
 
@@ -211,6 +213,21 @@ public interface UserContext {
      */
     Collection<Form> getUserAttributes();
 
+    /**
+     * Retrieves a collection of user attributes, specific to the user preferences
+     * page in the UI. Unlike standard user attributes, these should be self-editable.
+     *
+     * @return
+     *     A collection of form of user attributes, specific to the user preferences
+     *     page in the UI.
+     */
+    default Collection<Form> getUserPreferenceAttributes() {
+
+        // By default, a user context does not expose any preference user attributes
+        return Collections.emptyList();
+
+    }
+
     /**
      * Retrieves a collection of all attributes applicable to user groups. This
      * collection will contain only those attributes which the current user has
diff --git a/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js b/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js
index f7ead136a..94e3d8944 100644
--- a/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js
+++ b/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js
@@ -501,4 +501,6 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
         return userService.deleteUser($scope.dataSource, $scope.user);
     };
 
+    console.log($scope);
+
 }]);
diff --git a/guacamole/src/main/frontend/src/app/rest/services/schemaService.js b/guacamole/src/main/frontend/src/app/rest/services/schemaService.js
index dee10e1bd..d6afa2b75 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/schemaService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/schemaService.js
@@ -58,6 +58,34 @@ angular.module('rest').factory('schemaService', ['$injector',
 
     };
 
+    /**
+     * Makes a request to the REST API to get the list of available user preference
+     * attributes, returning a promise that provides an array of @link{Form} objects
+     * if successful. Each element of the array describes a logical grouping of
+     * possible user preference attributes.
+     *
+     * @param {String} dataSource
+     *     The unique identifier of the data source containing the users whose
+     *     available user preference attributes are to be retrieved. This
+     *     identifier corresponds to an AuthenticationProvider within the
+     *     Guacamole web application.
+     *
+     * @returns {Promise.<Form[]>}
+     *     A promise which will resolve with an array of @link{Form}
+     *     objects, where each @link{Form} describes a logical grouping of
+     *     possible attributes.
+     */
+    service.getUserPreferenceAttributes = function getUserPreferenceAttributes(dataSource) {
+
+        // Retrieve available user attributes
+        return authenticationService.request({
+            cache   : cacheService.schema,
+            method  : 'GET',
+            url     : 'api/session/data/' + encodeURIComponent(dataSource) + '/schema/userPreferenceAttributes'
+        });
+
+    };
+
     /**
      * Makes a request to the REST API to get the list of available attributes
      * for user group objects, returning a promise that provides an array of
diff --git a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
index aad0a2e0e..5824eb194 100644
--- a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
+++ b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
@@ -21,7 +21,7 @@
  * A directive for managing preferences local to the current user.
  */
 angular.module('settings').directive('guacSettingsPreferences', [function guacSettingsPreferences() {
-    
+
     return {
         // Element only
         restrict: 'E',
@@ -33,16 +33,18 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
         controller: ['$scope', '$injector', function settingsPreferencesController($scope, $injector) {
 
             // Get required types
-            var PermissionSet = $injector.get('PermissionSet');
+            const Form          = $injector.get('Form');
+            const PermissionSet = $injector.get('PermissionSet');
 
             // Required services
-            var $translate            = $injector.get('$translate');
-            var authenticationService = $injector.get('authenticationService');
-            var guacNotification      = $injector.get('guacNotification');
-            var permissionService     = $injector.get('permissionService');
-            var preferenceService     = $injector.get('preferenceService');
-            var requestService        = $injector.get('requestService');
-            var userService           = $injector.get('userService');
+            const $translate            = $injector.get('$translate');
+            const authenticationService = $injector.get('authenticationService');
+            const guacNotification      = $injector.get('guacNotification');
+            const permissionService     = $injector.get('permissionService');
+            const preferenceService     = $injector.get('preferenceService');
+            const requestService        = $injector.get('requestService');
+            const schemaService         = $injector.get('schemaService');
+            const userService           = $injector.get('userService');
 
             /**
              * An action to be provided along with the object sent to
@@ -56,6 +58,13 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
                 }
             };
 
+            /**
+             * The user being modified.
+             *
+             * @type User
+             */
+            $scope.user = null;
+
             /**
              * The username of the current user.
              *
@@ -78,6 +87,26 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
              */
             $scope.preferences = preferenceService.preferences;
 
+            /**
+             * All available user attributes, as a mapping of form name to form
+             * object. The form object contains a name, as well as a Map of fields.
+             *
+             * The Map type is used here to maintain form/name uniqueness, as well as
+             * insertion order, to ensure a consistent UI experience.
+             *
+             * @type Map<String, Object>
+             */
+            $scope.attributeMap = new Map();
+
+            /**
+             * All available user attributes. This is only the set of attribute
+             * definitions, organized as logical groupings of attributes, not attribute
+             * values.
+             *
+             * @type Form[]
+             */
+            $scope.attributes = null;
+
             /**
              * The fields which should be displayed for choosing locale
              * preferences. Each field name must be a property on
@@ -197,7 +226,82 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
 
             };
 
+
+            /**
+             * Saves the current user, displaying an acknowledgement message if
+             * saving was successful, or an error if the save failed.
+             */
+            $scope.saveUser = function saveUser() {
+                return userService.saveUser(dataSource, $scope.user)
+                    .then(() =>  guacNotification.showStatus({
+                        text    : {
+                            key : 'SETTINGS_PREFERENCES.INFO_PREFERENCE_ATTRIBUTES_CHANGED'
+                        },
+                        actions : [ ACKNOWLEDGE_ACTION ]
+                    }),
+                    guacNotification.SHOW_REQUEST_ERROR);
+            };
+
+            // Fetch the user record
+            userService.getUser(dataSource, username).then(function saveUserData(user) {
+                $scope.user = user;
+            })
+
+            // Get all datasources that are available for this user
+            authenticationService.getAvailableDataSources().forEach(function loadAttributesForDataSource(dataSource) {
+
+                // Fetch all user attribute forms defined for the datasource
+                schemaService.getUserPreferenceAttributes(dataSource).then(function saveAttributes(attributes) {
+
+                    // Iterate through all attribute forms
+                    attributes.forEach(function addAttribute(attributeForm) {
+
+                        // If the form with the retrieved name already exists
+                        if ($scope.attributeMap.has(attributeForm.name)) {
+                            const existingFields = $scope.attributeMap.get(attributeForm.name).fields;
+
+                            // Add each field to the existing list for this form
+                            attributeForm.fields.forEach(function addAllFieldsToExistingMap(field) {
+                                existingFields.set(field.name, field);
+                            })
+                        }
+
+                        else {
+
+                            // Create a new entry for the form
+                            $scope.attributeMap.set(attributeForm.name, {
+                                name: attributeForm.name,
+
+                                // With the field array from the API converted into a Map
+                                fields: attributeForm.fields.reduce(
+                                    function addFieldToMap(currentFieldMap, field) {
+                                        currentFieldMap.set(field.name, field);
+                                        return currentFieldMap;
+                                    }, new Map()
+                                )
+
+                            })
+                        }
+
+                    });
+
+                    // Re-generate the attributes array every time
+                    $scope.attributes = Array.of(...$scope.attributeMap.values()).map(function convertFieldsToArray(formObject) {
+
+                        // Convert each temporary form object to a Form type
+                        return new Form({
+                            name: formObject.name,
+
+                            // Convert the field map to a simple array of fields
+                            fields: Array.of(...formObject.fields.values())
+                        })
+                    });
+
+                });
+
+            });
+
         }]
     };
-    
+
 }]);
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
index cabd2ae9f..ac5cc4f59 100644
--- a/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
@@ -89,4 +89,14 @@
         </div>
     </div>
 
+    <!-- User attributes section -->
+    <h2 class="header" ng-show="attributes.length">{{'SETTINGS_PREFERENCES.SECTION_HEADER_UPDATE_ATTRIBUTES' | translate}}</h2>
+    <div class="attributes" ng-show="attributes.length">
+        <guac-form namespace="'USER_ATTRIBUTES'" content="attributes"
+                   model="user.attributes"></guac-form>
+
+        <!-- User attributes save button -->
+        <button ng-show="attributes.length" ng-click="saveUser()" class="save">{{'SETTINGS_PREFERENCES.ACTION_SAVE' | translate}}</button>
+    </div>
+
 </div>
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 05a9fa279..7f52fea11 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -916,6 +916,7 @@
 
         "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
         "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
+        "ACTION_SAVE"               : "@:APP.ACTION_SAVE",
         "ACTION_UPDATE_PASSWORD"    : "@:APP.ACTION_UPDATE_PASSWORD",
 
         "DIALOG_HEADER_ERROR"    : "@:APP.DIALOG_HEADER_ERROR",
@@ -942,6 +943,7 @@
         "HELP_UPDATE_PASSWORD"      : "If you wish to change your password, enter your current password and the desired new password below, and click \"Update Password\". The change will take effect immediately.",
 
         "INFO_PASSWORD_CHANGED" : "Password changed.",
+        "INFO_PREFERENCE_ATTRIBUTES_CHANGED" : "User attributes saved.",
 
         "NAME_INPUT_METHOD_NONE" : "@:CLIENT.NAME_INPUT_METHOD_NONE",
         "NAME_INPUT_METHOD_OSK"  : "@:CLIENT.NAME_INPUT_METHOD_OSK",
@@ -949,6 +951,7 @@
 
         "SECTION_HEADER_DEFAULT_INPUT_METHOD" : "Default Input Method",
         "SECTION_HEADER_DEFAULT_MOUSE_MODE"   : "Default Mouse Emulation Mode",
+        "SECTION_HEADER_UPDATE_ATTRIBUTES"    : "User Attributes",
         "SECTION_HEADER_UPDATE_PASSWORD"      : "Change Password"
 
     },
diff --git a/guacamole/src/main/frontend/webpack.config.js b/guacamole/src/main/frontend/webpack.config.js
index 29bb8ddd5..3f1574fa1 100644
--- a/guacamole/src/main/frontend/webpack.config.js
+++ b/guacamole/src/main/frontend/webpack.config.js
@@ -77,18 +77,6 @@ module.exports = {
         ]
     },
     optimization: {
-        minimizer: [
-
-            // Minify using Google Closure Compiler
-            new ClosureWebpackPlugin({ mode: 'STANDARD' }, {
-                languageIn: 'ECMASCRIPT_2020',
-                languageOut: 'ECMASCRIPT5',
-                compilationLevel: 'SIMPLE'
-            }),
-
-            new CssMinimizerPlugin()
-
-        ],
         splitChunks: {
             cacheGroups: {
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/schema/SchemaResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/schema/SchemaResource.java
index 9086ac93e..edc125127 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/schema/SchemaResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/schema/SchemaResource.java
@@ -77,6 +77,26 @@ public class SchemaResource {
 
     }
 
+    /**
+     * Retrieves the possible user preference attributes of a user object.
+     *
+     * @return
+     *     A collection of forms which describe the possible preference attributes of a
+     *     user object.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while retrieving the possible attributes.
+     */
+    @GET
+    @Path("userPreferenceAttributes")
+    public Collection<Form> getUserAttrigetUserPreferenceAttributesbutes()
+            throws GuacamoleException {
+
+        // Retrieve all possible user preference attributes
+        return userContext.getUserPreferenceAttributes();
+
+    }
+
     /**
      * Retrieves the possible attributes of a user group object.
      *
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
index f31ce5dc8..5d4be4ffc 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
@@ -21,6 +21,11 @@ package org.apache.guacamole.rest.user;
 
 import com.google.inject.assistedinject.Assisted;
 import com.google.inject.assistedinject.AssistedInject;
+
+import java.util.Iterator;
+import java.util.Set;
+import java.util.stream.Collectors;
+
 import javax.servlet.http.HttpServletRequest;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.GET;
@@ -145,9 +150,51 @@ public class UserResource
     @Override
     public void updateObject(APIUser modifiedObject) throws GuacamoleException {
 
-        // A user may not use this endpoint to modify himself
-        if (userContext.self().getIdentifier().equals(modifiedObject.getUsername()))
-            throw new GuacamoleSecurityException("Permission denied.");
+        User currentUser = userContext.self();
+
+        // A user may not use this endpoint to modify themself, except in the case
+        // that they are modifying one of the user attributes explicitly exposed
+        // in the user preferences form
+        if (currentUser.getIdentifier().equals(modifiedObject.getUsername())) {
+
+            // A user may not use this endpoint to update their password
+            if (currentUser.getPassword() != null)
+                throw new GuacamoleSecurityException(
+                        "Permission denied. The password update endpoint must"
+                        + " be used to change the current user's password.");
+
+            // All attributes exposed in the preferences forms
+            Set<String> preferenceAttributes = (
+                    userContext.getUserPreferenceAttributes().stream()
+                    .flatMap(form -> form.getFields().stream().map(
+                            field -> field.getName())))
+                    .collect(Collectors.toSet());
+
+            // Go through every attribute value and check if it's changed
+            Iterator<String> keyIterator = modifiedObject.getAttributes().keySet().iterator();
+            while(keyIterator.hasNext()) {
+
+                String key = keyIterator.next();
+                String newValue = modifiedObject.getAttributes().get(key);
+
+                // If it's not a preference attribute, editing is not allowed
+                if (!preferenceAttributes.contains(key)) {
+
+                    String currentValue = currentUser.getAttributes().get(key);
+
+                    // If the value of the attribute has been modified
+                    if (
+                            !(currentValue == null && newValue == null) && (
+                                (currentValue == null && newValue != null) ||
+                                !currentValue.equals(newValue)
+                            )
+                    )
+                        throw new GuacamoleSecurityException(
+                            "Permission denied. Only user preference attributes"
+                            + " can be modified for the current user.");
+                }
+            }
+        }
 
         super.updateObject(modifiedObject);
 

From 87cd7fbe2281beff0f86e7f210a7b059ebf7d798 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 4 Aug 2022 19:24:49 +0000
Subject: [PATCH 068/289] GUACAMOLE-1656: Remove user attributes header; it
 does not look good.

---
 .../java/org/apache/guacamole/vault/user/VaultUserContext.java  | 2 +-
 .../src/app/settings/templates/settingsPreferences.html         | 1 -
 guacamole/src/main/frontend/src/translations/en.json            | 1 -
 3 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
index 748237dd2..eeddbe8d1 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java
@@ -241,7 +241,7 @@ public class VaultUserContext extends TokenInjectingUserContext {
      *
      * @throws GuacamoleException
      *     If the value for any applicable secret cannot be retrieved from the
-     *     vault due to an error.1
+     *     vault due to an error.
      */
     private Map<String, Future<String>> getTokens(
             Connectable connectable, Map<String, String> tokenMapping,
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
index ac5cc4f59..6ecf6e0e7 100644
--- a/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
@@ -90,7 +90,6 @@
     </div>
 
     <!-- User attributes section -->
-    <h2 class="header" ng-show="attributes.length">{{'SETTINGS_PREFERENCES.SECTION_HEADER_UPDATE_ATTRIBUTES' | translate}}</h2>
     <div class="attributes" ng-show="attributes.length">
         <guac-form namespace="'USER_ATTRIBUTES'" content="attributes"
                    model="user.attributes"></guac-form>
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 7f52fea11..a1c0e0d92 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -951,7 +951,6 @@
 
         "SECTION_HEADER_DEFAULT_INPUT_METHOD" : "Default Input Method",
         "SECTION_HEADER_DEFAULT_MOUSE_MODE"   : "Default Mouse Emulation Mode",
-        "SECTION_HEADER_UPDATE_ATTRIBUTES"    : "User Attributes",
         "SECTION_HEADER_UPDATE_PASSWORD"      : "Change Password"
 
     },

From 33f2b499efeefa09b912393b09364bc010f1b87d Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 5 Aug 2022 00:01:12 +0000
Subject: [PATCH 069/289] GUACAMOLE-1656: Fall back to user KSM config for
 single value fetch.

---
 .../vault/ksm/GuacamoleExceptionSupplier.java | 42 +++++++++++
 .../guacamole/vault/ksm/secret/KsmClient.java | 42 ++++++++++-
 .../vault/ksm/secret/KsmSecretService.java    | 72 ++++++++++++++++---
 3 files changed, 143 insertions(+), 13 deletions(-)
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java
new file mode 100644
index 000000000..d966a7320
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm;
+
+import org.apache.guacamole.GuacamoleException;
+
+/**
+ * A class that is basically equivalent to the standard Supplier class in
+ * Java, except that the get() function can throw GuacamoleException, which
+ * is impossible with any of the standard Java lambda type classes, since
+ * none of them can handle checked exceptions
+ */
+public abstract class GuacamoleExceptionSupplier<T> {
+
+    /**
+     * Returns a value of the declared type.
+     *
+     * @return
+     *    A value of the declared type.
+     *
+     * @throws GuacamoleException
+     *    If an error occurs while attemping to calculate the return value.
+     */
+    public abstract T get() throws GuacamoleException;
+}
\ No newline at end of file
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index 6e0bdf177..74a27e472 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -34,7 +34,6 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
-import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -45,10 +44,12 @@ import java.util.concurrent.locks.ReentrantReadWriteLock;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
+import javax.annotation.Nullable;
+
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
 import org.apache.guacamole.vault.secret.WindowsUsername;
+import org.apache.guacamole.vault.ksm.GuacamoleExceptionSupplier;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -595,6 +596,38 @@ public class KsmClient {
      *     is invalid.
      */
     public Future<String> getSecret(String notation) throws GuacamoleException {
+        return getSecret(notation, null);
+    }
+
+    /**
+     * Returns the value of the secret stored within Keeper Secrets Manager and
+     * represented by the given Keeper notation. Keeper notation locates the
+     * value of a specific field, custom field, or file associated with a
+     * specific record. See: https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation
+     * If a fallbackFunction is provided, it will be invoked to generate
+     * a return value in the case where no secrest is found with the given
+     * keeper notation.
+     *
+     * @param notation
+     *     The Keeper notation of the secret to retrieve.
+     *
+     * @param fallbackFunction
+     *     A function to invoke in order to produce a Future for return,
+     *     if the requested secret is not found. If the provided Function
+     *     is null, it will not be run.
+     *
+     * @return
+     *     A Future which completes with the value of the secret represented by
+     *     the given Keeper notation, or null if there is no such secret.
+     *
+     * @throws GuacamoleException
+     *     If the requested secret cannot be retrieved or the Keeper notation
+     *     is invalid.
+     */
+    public Future<String> getSecret(
+            String notation,
+            @Nullable GuacamoleExceptionSupplier<Future<String>> fallbackFunction)
+            throws GuacamoleException {
         validateCache();
         cacheLock.readLock().lock();
         try {
@@ -614,6 +647,11 @@ public class KsmClient {
         catch (Error e) {
             logger.warn("Record \"{}\" does not exist.", notation);
             logger.debug("Retrieval of record by Keeper notation failed.", e);
+
+            // If the secret is not found, invoke the fallback function
+            if (fallbackFunction != null)
+                return fallbackFunction.get();
+
             return CompletableFuture.completedFuture(null);
         }
 
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index a3b772256..6b8ba92a2 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -48,6 +48,7 @@ import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.UserContext;
 import org.apache.guacamole.protocol.GuacamoleConfiguration;
 import org.apache.guacamole.token.TokenFilter;
+import org.apache.guacamole.vault.ksm.GuacamoleExceptionSupplier;
 import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
 import org.apache.guacamole.vault.secret.VaultSecretService;
@@ -147,7 +148,24 @@ public class KsmSecretService implements VaultSecretService {
         // Attempt to find a KSM config for this connection or group
         String ksmConfig = getConnectionGroupKsmConfig(userContext, connectable);
 
-        return getClient(ksmConfig).getSecret(name);
+        return getClient(ksmConfig).getSecret(name, new GuacamoleExceptionSupplier<Future<String>>() {
+
+            @Override
+            public Future<String> get() throws GuacamoleException {
+
+                // Get the user-supplied KSM config, if allowed by config and
+                // set by the user
+                String userKsmConfig = getUserKSMConfig(userContext, connectable);
+
+                // If the user config happens to be the same as admin-defined one,
+                // don't bother trying again
+                if (userKsmConfig != ksmConfig)
+                    return getClient(userKsmConfig).getSecret(name);
+
+                return CompletableFuture.completedFuture(null);
+            }
+
+        });
     }
 
     @Override
@@ -335,6 +353,44 @@ public class KsmSecretService implements VaultSecretService {
 
     }
 
+    /**
+     * Return the KSM config blob for the current user IFF user KSM configs
+     * are enabled globally, and are enabled for the given connectable. If no
+     * KSM config exists for the given user or KSM configs are not enabled,
+     * null will be returned.
+     *
+     * @param userContext
+     *    The user context from which the current user should be fetched.
+     *
+     * @param connectable
+     *    The connectable to which the connection is being established. This
+     *    is the conneciton which will be checked to see if user KSM configs
+     *    are enabled.
+     *
+     * @return
+     *    The base64 encoded KSM config blob for the current user if one
+     *    exists, and if user KSM configs are enabled globally and for the
+     *    provided connectable.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while attempting to fetch the KSM config.
+     */
+    private String getUserKSMConfig(
+            UserContext userContext, Connectable connectable) throws GuacamoleException {
+
+        // Check if user KSM configs are enabled globally, and for the given connectable
+        if (confService.getAllowUserConfig() && isKsmUserConfigEnabled(connectable))
+
+            // Return the user-specific KSM config, if one exists
+            return userContext.self().getAttributes().get(
+                    KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
+
+
+        // If user-specific KSM config is disabled globally or for the given
+        // connectable, return null to indicate that no user config exists
+        return null;
+    }
+
     @Override
     public Map<String, Future<String>> getTokens(UserContext userContext, Connectable connectable,
             GuacamoleConfiguration config, TokenFilter filter) throws GuacamoleException {
@@ -351,16 +407,9 @@ public class KsmSecretService implements VaultSecretService {
 
         // Only use the user-specific KSM config if explicitly enabled in the global
         // configuration, AND for the specific connectable being connected to
-        if (confService.getAllowUserConfig() && isKsmUserConfigEnabled(connectable)) {
-
-            // Find a user-specific KSM config, if one exists
-            String userKsmConfig = userContext.self().getAttributes().get(
-                    KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
-
-            // If a user-specific config exsts, process it first
-            if (userKsmConfig != null && !userKsmConfig.trim().isEmpty())
-                ksmClients.add(0, getClient(userKsmConfig));
-        }
+        String userKsmConfig = getUserKSMConfig(userContext, connectable);
+        if (userKsmConfig != null && !userKsmConfig.trim().isEmpty())
+            ksmClients.add(0, getClient(userKsmConfig));
 
         // Iterate through the KSM clients, processing using the user-specific
         // config first (if it exists), to ensure that any admin-defined values
@@ -431,6 +480,7 @@ public class KsmSecretService implements VaultSecretService {
                     addRecordTokens(tokens, "KEEPER_USER_",
                             ksm.getRecordByLogin(filter.filter(username), null));
             }
+        }
 
         return tokens;
 

From e882a08486badd527a615ff38fce8bc3520b12de Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 5 Aug 2022 15:56:09 +0000
Subject: [PATCH 070/289] GUACAMOLE-1656: Ensure the preferences page refreshes
 on save in case a one-time-token was updated.

---
 .../directives/guacSettingsPreferences.js      | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
index 5824eb194..199b7ddfa 100644
--- a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
+++ b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
@@ -58,6 +58,20 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
                 }
             };
 
+            /**
+             * An action which closes the current dialog, and refreshes
+             * the user data on dialog close.
+             */
+            const ACKNOWLEDGE_ACTION_RELOAD = {
+                name        : 'SETTINGS_PREFERENCES.ACTION_ACKNOWLEDGE',
+                // Handle action
+                callback    : function acknowledgeCallback() {
+                    userService.getUser(dataSource, username)
+                        .then(user => $scope.user = user)
+                        .then(guacNotification.showStatus(false))
+                }
+            };
+
             /**
              * The user being modified.
              *
@@ -237,7 +251,9 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
                         text    : {
                             key : 'SETTINGS_PREFERENCES.INFO_PREFERENCE_ATTRIBUTES_CHANGED'
                         },
-                        actions : [ ACKNOWLEDGE_ACTION ]
+
+                        // Reload the user on successful save in case any attributes changed
+                        actions : [ ACKNOWLEDGE_ACTION_RELOAD ]
                     }),
                     guacNotification.SHOW_REQUEST_ERROR);
             };

From 3790d76fc9485f5229632d4583976a593679abd3 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 5 Aug 2022 18:30:22 +0000
Subject: [PATCH 071/289] GUACAMOLE-1656: Force refresh the user context on
 updateUserContext to ensure that any modified user attributes are picked up.

---
 .../JDBCAuthenticationProviderService.java    | 45 ++++++++++++++++---
 .../guacamole/auth/jdbc/user/UserService.java | 12 +++--
 .../vault/ksm/GuacamoleExceptionSupplier.java |  1 +
 .../controllers/manageUserController.js       |  2 -
 4 files changed, 48 insertions(+), 12 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java
index d2576ec2b..e276b2766 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java
@@ -89,9 +89,31 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
 
     }
 
-    @Override
-    public ModeledUserContext getUserContext(AuthenticationProvider authenticationProvider,
-            AuthenticatedUser authenticatedUser) throws GuacamoleException {
+    /**
+     * Gets a user context for the given authentication provider and user. If
+     * forceRefresh is set to true, the user record will be re-fetched even if
+     * it has already been loaded from the database. If not, the existing
+     * user will be used.
+     *
+     * @param authenticationProvider
+     *     The authentication provider to use when loading or refreshing the user.
+     *
+     * @param authenticatedUser
+     *     The user for which the user context is being fetched.
+     *
+     * @param forceRefresh
+     *     A flag that, when set to true, will force the authenticated user to
+     *     refreshed from the database. If false, an existing DB user will be
+     *     reused.
+     *
+     * @return
+     *     The fetched user context.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while fetching or refreshing the user context.
+     */
+    private ModeledUserContext getUserContext(AuthenticationProvider authenticationProvider,
+            AuthenticatedUser authenticatedUser, boolean forceRefresh) throws GuacamoleException {
 
         // Always allow but provide no data for users authenticated via our own
         // connection sharing links
@@ -102,8 +124,9 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
         boolean databaseCredentialsUsed = (authenticatedUser instanceof ModeledAuthenticatedUser);
         boolean databaseRestrictionsApplicable = (databaseCredentialsUsed || environment.isUserRequired());
 
-        // Retrieve user account for already-authenticated user
-        ModeledUser user = userService.retrieveUser(authenticationProvider, authenticatedUser);
+        // Retrieve user account for already-authenticated user, forcing a refresh if requested
+        ModeledUser user = userService.retrieveUser(
+                authenticationProvider, authenticatedUser, forceRefresh);
         ModeledUserContext context = userContextProvider.get();
         if (user != null && !user.isDisabled()) {
 
@@ -159,13 +182,21 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
 
     }
 
+    @Override
+    public ModeledUserContext getUserContext(AuthenticationProvider authenticationProvider,
+            AuthenticatedUser authenticatedUser) throws GuacamoleException {
+
+        // Do not force refresh unless updateUserContext is explicitly called
+        return getUserContext(authenticationProvider, authenticatedUser, false);
+    }
+
     @Override
     public UserContext updateUserContext(AuthenticationProvider authenticationProvider,
             UserContext context, AuthenticatedUser authenticatedUser,
             Credentials credentials) throws GuacamoleException {
 
-        // No need to update the context
-        return context;
+        // Force-refresh the user context
+        return getUserContext(authenticationProvider, authenticatedUser, true);
 
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
index c43aa1b01..3d23e64b0 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
@@ -404,6 +404,11 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
      * @param authenticatedUser
      *     The AuthenticatedUser to retrieve the corresponding ModeledUser of.
      *
+     * @param forceRefresh
+     *     Whether the user should be force-refreshed: i.e. re-queried from the
+     *     database. If false, and the user has already been queried, it will
+     *     be returned as-is.
+     *
      * @return
      *     The ModeledUser which corresponds to the given AuthenticatedUser, or
      *     null if no such user exists.
@@ -413,10 +418,11 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
      *     AuthenticatedUser cannot be created.
      */
     public ModeledUser retrieveUser(AuthenticationProvider authenticationProvider,
-            AuthenticatedUser authenticatedUser) throws GuacamoleException {
+            AuthenticatedUser authenticatedUser, boolean forceRefresh) throws GuacamoleException {
 
-        // If we already queried this user, return that rather than querying again
-        if (authenticatedUser instanceof ModeledAuthenticatedUser)
+        // If refresh is not being forced, and we already queried this user,
+        // return that rather than querying again
+        if (!forceRefresh && (authenticatedUser instanceof ModeledAuthenticatedUser))
             return ((ModeledAuthenticatedUser) authenticatedUser).getUser();
 
         // Retrieve corresponding user model, if such a user exists
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java
index d966a7320..ed59f7b68 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java
@@ -39,4 +39,5 @@ public abstract class GuacamoleExceptionSupplier<T> {
      *    If an error occurs while attemping to calculate the return value.
      */
     public abstract T get() throws GuacamoleException;
+
 }
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js b/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js
index 94e3d8944..f7ead136a 100644
--- a/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js
+++ b/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js
@@ -501,6 +501,4 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
         return userService.deleteUser($scope.dataSource, $scope.user);
     };
 
-    console.log($scope);
-
 }]);

From dfc7e6dd90bffacc6f0e52ed818da33bed63dcf2 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 8 Aug 2022 21:38:45 +0000
Subject: [PATCH 072/289] GUACAMOLE-1656: Simplify auto-refresh behavior in
 JDBC auth provider.

---
 .../JDBCAuthenticationProviderService.java    | 45 +++----------------
 .../guacamole/auth/jdbc/user/UserService.java | 12 +----
 2 files changed, 8 insertions(+), 49 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java
index e276b2766..2b130b610 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderService.java
@@ -89,31 +89,9 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
 
     }
 
-    /**
-     * Gets a user context for the given authentication provider and user. If
-     * forceRefresh is set to true, the user record will be re-fetched even if
-     * it has already been loaded from the database. If not, the existing
-     * user will be used.
-     *
-     * @param authenticationProvider
-     *     The authentication provider to use when loading or refreshing the user.
-     *
-     * @param authenticatedUser
-     *     The user for which the user context is being fetched.
-     *
-     * @param forceRefresh
-     *     A flag that, when set to true, will force the authenticated user to
-     *     refreshed from the database. If false, an existing DB user will be
-     *     reused.
-     *
-     * @return
-     *     The fetched user context.
-     *
-     * @throws GuacamoleException
-     *     If an error occurs while fetching or refreshing the user context.
-     */
-    private ModeledUserContext getUserContext(AuthenticationProvider authenticationProvider,
-            AuthenticatedUser authenticatedUser, boolean forceRefresh) throws GuacamoleException {
+    @Override
+    public ModeledUserContext getUserContext(AuthenticationProvider authenticationProvider,
+            AuthenticatedUser authenticatedUser) throws GuacamoleException {
 
         // Always allow but provide no data for users authenticated via our own
         // connection sharing links
@@ -124,9 +102,8 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
         boolean databaseCredentialsUsed = (authenticatedUser instanceof ModeledAuthenticatedUser);
         boolean databaseRestrictionsApplicable = (databaseCredentialsUsed || environment.isUserRequired());
 
-        // Retrieve user account for already-authenticated user, forcing a refresh if requested
-        ModeledUser user = userService.retrieveUser(
-                authenticationProvider, authenticatedUser, forceRefresh);
+        // Retrieve user account for already-authenticated user
+        ModeledUser user = userService.retrieveUser(authenticationProvider, authenticatedUser);
         ModeledUserContext context = userContextProvider.get();
         if (user != null && !user.isDisabled()) {
 
@@ -182,21 +159,13 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
 
     }
 
-    @Override
-    public ModeledUserContext getUserContext(AuthenticationProvider authenticationProvider,
-            AuthenticatedUser authenticatedUser) throws GuacamoleException {
-
-        // Do not force refresh unless updateUserContext is explicitly called
-        return getUserContext(authenticationProvider, authenticatedUser, false);
-    }
-
     @Override
     public UserContext updateUserContext(AuthenticationProvider authenticationProvider,
             UserContext context, AuthenticatedUser authenticatedUser,
             Credentials credentials) throws GuacamoleException {
 
-        // Force-refresh the user context
-        return getUserContext(authenticationProvider, authenticatedUser, true);
+        // Refresh the user context
+        return getUserContext(authenticationProvider, authenticatedUser);
 
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
index 3d23e64b0..161976ce4 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
@@ -404,11 +404,6 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
      * @param authenticatedUser
      *     The AuthenticatedUser to retrieve the corresponding ModeledUser of.
      *
-     * @param forceRefresh
-     *     Whether the user should be force-refreshed: i.e. re-queried from the
-     *     database. If false, and the user has already been queried, it will
-     *     be returned as-is.
-     *
      * @return
      *     The ModeledUser which corresponds to the given AuthenticatedUser, or
      *     null if no such user exists.
@@ -418,12 +413,7 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
      *     AuthenticatedUser cannot be created.
      */
     public ModeledUser retrieveUser(AuthenticationProvider authenticationProvider,
-            AuthenticatedUser authenticatedUser, boolean forceRefresh) throws GuacamoleException {
-
-        // If refresh is not being forced, and we already queried this user,
-        // return that rather than querying again
-        if (!forceRefresh && (authenticatedUser instanceof ModeledAuthenticatedUser))
-            return ((ModeledAuthenticatedUser) authenticatedUser).getUser();
+            AuthenticatedUser authenticatedUser) throws GuacamoleException {
 
         // Retrieve corresponding user model, if such a user exists
         UserModel userModel = userMapper.selectOne(authenticatedUser.getIdentifier());

From 719e957be18ce67c1b6bcdf1c8115d318968313f Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 12 Sep 2022 09:14:12 -0700
Subject: [PATCH 073/289] GUACAMOLE-990: Guarantee auth banning occurs before
 all other auth processing.

---
 .../ban/BanningAuthenticationListener.java    | 148 ++++++++++++--
 .../ban/BanningAuthenticationProvider.java    | 182 ------------------
 .../src/main/resources/guac-manifest.json     |   4 -
 guacamole-docker/bin/start.sh                 |  12 +-
 .../AuthenticationRequestReceivedEvent.java   |  35 ++++
 .../rest/auth/AuthenticationService.java      |   4 +
 6 files changed, 178 insertions(+), 207 deletions(-)
 delete mode 100644 extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationRequestReceivedEvent.java

diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java
index 4d8a3bbad..c1ba8a569 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationListener.java
@@ -21,41 +21,158 @@ package org.apache.guacamole.auth.ban;
 
 import org.apache.guacamole.auth.ban.status.AuthenticationFailureTracker;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.ban.status.InMemoryAuthenticationFailureTracker;
+import org.apache.guacamole.auth.ban.status.NullAuthenticationFailureTracker;
+import org.apache.guacamole.environment.Environment;
+import org.apache.guacamole.environment.LocalEnvironment;
 import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
 import org.apache.guacamole.net.event.AuthenticationFailureEvent;
 import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
 import org.apache.guacamole.net.event.listener.Listener;
+import org.apache.guacamole.net.event.AuthenticationRequestReceivedEvent;
+import org.apache.guacamole.properties.IntegerGuacamoleProperty;
+import org.apache.guacamole.properties.LongGuacamoleProperty;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * Listener implementation which automatically tracks authentication failures
- * such that further authentication attempts may be automatically blocked by
- * {@link BanningAuthenticationProvider} if they match configured criteria.
+ * such that further authentication attempts may be automatically blocked if
+ * they match configured criteria.
  */
 public class BanningAuthenticationListener implements Listener {
 
     /**
-     * Shared tracker of addresses that have repeatedly failed authentication.
+     * Logger for this class.
      */
-    private static AuthenticationFailureTracker tracker;
+    private static final Logger logger = LoggerFactory.getLogger(BanningAuthenticationListener.class);
 
     /**
-     * Assigns the shared tracker instance used by both the {@link BanningAuthenticationProvider}
-     * and this listener. This function MUST be invoked with the tracker
-     * created for BanningAuthenticationProvider as soon as possible (during
-     * construction of BanningAuthenticationProvider), or processing of
-     * received events will fail internally.
-     *
-     * @param tracker
-     *     The tracker instance to use for received authentication events.
+     * The maximum number of failed authentication attempts allowed before an
+     * address is temporarily banned.
      */
-    public static void setAuthenticationFailureTracker(AuthenticationFailureTracker tracker) {
-        BanningAuthenticationListener.tracker = tracker;
+    private static final IntegerGuacamoleProperty MAX_ATTEMPTS = new IntegerGuacamoleProperty() {
+
+        @Override
+        public String getName() {
+            return "ban-max-invalid-attempts";
+        }
+
+    };
+
+    /**
+     * The length of time that each address should be banned after reaching the
+     * maximum number of failed authentication attempts, in seconds.
+     */
+    private static final IntegerGuacamoleProperty IP_BAN_DURATION = new IntegerGuacamoleProperty() {
+
+        @Override
+        public String getName() {
+            return "ban-address-duration";
+        }
+
+    };
+
+    /**
+     * The maximum number of failed authentication attempts tracked at any
+     * given time. Once this number of addresses is exceeded, the oldest
+     * authentication attempts are rotated off on an LRU basis.
+     */
+    private static final LongGuacamoleProperty MAX_ADDRESSES = new LongGuacamoleProperty() {
+
+        @Override
+        public String getName() {
+            return "ban-max-addresses";
+        }
+
+    };
+
+    /**
+     * The default maximum number of failed authentication attempts allowed
+     * before an address is temporarily banned.
+     */
+    private static final int DEFAULT_MAX_ATTEMPTS = 5;
+
+    /**
+     * The default length of time that each address should be banned after
+     * reaching the maximum number of failed authentication attempts, in
+     * seconds.
+     */
+    private static final int DEFAULT_IP_BAN_DURATION = 300;
+
+    /**
+     * The maximum number of failed authentication attempts tracked at any
+     * given time. Once this number of addresses is exceeded, the oldest
+     * authentication attempts are rotated off on an LRU basis.
+     */
+    private static final long DEFAULT_MAX_ADDRESSES = 10485760;
+
+    /**
+     * Tracker of addresses that have repeatedly failed authentication.
+     */
+    private final AuthenticationFailureTracker tracker;
+
+    /**
+     * Creates a new BanningAuthenticationListener which automatically bans
+     * further authentication attempts from addresses that have repeatedly
+     * failed to authenticate. The ban duration and maximum number of failed
+     * attempts allowed before banning are configured within
+     * guacamole.properties.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs parsing the configuration properties used by this
+     *     extension.
+     */
+    public BanningAuthenticationListener() throws GuacamoleException {
+
+        Environment environment = LocalEnvironment.getInstance();
+        int maxAttempts = environment.getProperty(MAX_ATTEMPTS, DEFAULT_MAX_ATTEMPTS);
+        int banDuration = environment.getProperty(IP_BAN_DURATION, DEFAULT_IP_BAN_DURATION);
+        long maxAddresses = environment.getProperty(MAX_ADDRESSES, DEFAULT_MAX_ADDRESSES);
+
+        // Configure auth failure tracking behavior and inform administrator of
+        // ultimate result
+        if (maxAttempts <= 0) {
+            this.tracker = new NullAuthenticationFailureTracker();
+            logger.info("Maximum failed authentication attempts has been set "
+                    + "to {}. Automatic banning of brute-force authentication "
+                    + "attempts will be disabled.", maxAttempts);
+        }
+        else if (banDuration <= 0) {
+            this.tracker = new NullAuthenticationFailureTracker();
+            logger.info("Ban duration for addresses that repeatedly fail "
+                    + "authentication has been set to {}. Automatic banning "
+                    + "of brute-force authentication attempts will be "
+                    + "disabled.", banDuration);
+        }
+        else if (maxAddresses <= 0) {
+            this.tracker = new NullAuthenticationFailureTracker();
+            logger.info("Maximum number of tracked addresses has been set to "
+                    + "{}. Automatic banning of brute-force authentication "
+                    + "attempts will be disabled.", maxAddresses);
+        }
+        else {
+            this.tracker = new InMemoryAuthenticationFailureTracker(maxAttempts, banDuration, maxAddresses);
+            logger.info("Addresses will be automatically banned for {} "
+                    + "seconds after {} failed authentication attempts. Up "
+                    + "to {} unique addresses will be tracked/banned at any "
+                    + "given time.", banDuration, maxAttempts, maxAddresses);
+        }
+
     }
 
     @Override
     public void handleEvent(Object event) throws GuacamoleException {
 
-        if (event instanceof AuthenticationFailureEvent) {
+        // Notify auth tracker of each request received BEFORE the request is
+        // processed ...
+        if (event instanceof AuthenticationRequestReceivedEvent) {
+            AuthenticationRequestReceivedEvent request = (AuthenticationRequestReceivedEvent) event;
+            tracker.notifyAuthenticationRequestReceived(request.getCredentials());
+        }
+
+        // ... as well as every explicit failure ...
+        else if (event instanceof AuthenticationFailureEvent) {
 
             AuthenticationFailureEvent failure = (AuthenticationFailureEvent) event;
 
@@ -72,6 +189,7 @@ public class BanningAuthenticationListener implements Listener {
 
         }
 
+        // ... and explicit success.
         else if (event instanceof AuthenticationSuccessEvent) {
             AuthenticationSuccessEvent success = (AuthenticationSuccessEvent) event;
             tracker.notifyAuthenticationSuccess(success.getCredentials());
diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
deleted file mode 100644
index 1d115d39d..000000000
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/BanningAuthenticationProvider.java
+++ /dev/null
@@ -1,182 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.ban;
-
-import org.apache.guacamole.auth.ban.status.InMemoryAuthenticationFailureTracker;
-import org.apache.guacamole.auth.ban.status.AuthenticationFailureTracker;
-import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.ban.status.NullAuthenticationFailureTracker;
-import org.apache.guacamole.environment.Environment;
-import org.apache.guacamole.environment.LocalEnvironment;
-import org.apache.guacamole.net.auth.AbstractAuthenticationProvider;
-import org.apache.guacamole.net.auth.AuthenticatedUser;
-import org.apache.guacamole.net.auth.Credentials;
-import org.apache.guacamole.net.auth.UserContext;
-import org.apache.guacamole.properties.IntegerGuacamoleProperty;
-import org.apache.guacamole.properties.LongGuacamoleProperty;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * AuthenticationProvider implementation that blocks further authentication
- * attempts that are related to past authentication failures flagged by
- * {@link BanningAuthenticationListener}.
- */
-public class BanningAuthenticationProvider extends AbstractAuthenticationProvider {
-
-    /**
-     * Logger for this class.
-     */
-    private static final Logger logger = LoggerFactory.getLogger(BanningAuthenticationProvider.class);
-
-    /**
-     * The maximum number of failed authentication attempts allowed before an
-     * address is temporarily banned.
-     */
-    private static final IntegerGuacamoleProperty MAX_ATTEMPTS = new IntegerGuacamoleProperty() {
-
-        @Override
-        public String getName() {
-            return "ban-max-invalid-attempts";
-        }
-
-    };
-
-    /**
-     * The length of time that each address should be banned after reaching the
-     * maximum number of failed authentication attempts, in seconds.
-     */
-    private static final IntegerGuacamoleProperty IP_BAN_DURATION = new IntegerGuacamoleProperty() {
-
-        @Override
-        public String getName() {
-            return "ban-address-duration";
-        }
-
-    };
-
-    /**
-     * The maximum number of failed authentication attempts tracked at any
-     * given time. Once this number of addresses is exceeded, the oldest
-     * authentication attempts are rotated off on an LRU basis.
-     */
-    private static final LongGuacamoleProperty MAX_ADDRESSES = new LongGuacamoleProperty() {
-
-        @Override
-        public String getName() {
-            return "ban-max-addresses";
-        }
-
-    };
-
-    /**
-     * The default maximum number of failed authentication attempts allowed
-     * before an address is temporarily banned.
-     */
-    private static final int DEFAULT_MAX_ATTEMPTS = 5;
-
-    /**
-     * The default length of time that each address should be banned after
-     * reaching the maximum number of failed authentication attempts, in
-     * seconds.
-     */
-    private static final int DEFAULT_IP_BAN_DURATION = 300;
-
-    /**
-     * The maximum number of failed authentication attempts tracked at any
-     * given time. Once this number of addresses is exceeded, the oldest
-     * authentication attempts are rotated off on an LRU basis.
-     */
-    private static final long DEFAULT_MAX_ADDRESSES = 10485760;
-
-    /**
-     * Shared tracker of addresses that have repeatedly failed authentication.
-     */
-    private final AuthenticationFailureTracker tracker;
-
-    /**
-     * Creates a new BanningAuthenticationProvider which automatically bans
-     * further authentication attempts from addresses that have repeatedly
-     * failed to authenticate. The ban duration and maximum number of failed
-     * attempts allowed before banning are configured within
-     * guacamole.properties.
-     *
-     * @throws GuacamoleException
-     *     If an error occurs parsing the configuration properties used by this
-     *     extension.
-     */
-    public BanningAuthenticationProvider() throws GuacamoleException {
-
-        Environment environment = LocalEnvironment.getInstance();
-        int maxAttempts = environment.getProperty(MAX_ATTEMPTS, DEFAULT_MAX_ATTEMPTS);
-        int banDuration = environment.getProperty(IP_BAN_DURATION, DEFAULT_IP_BAN_DURATION);
-        long maxAddresses = environment.getProperty(MAX_ADDRESSES, DEFAULT_MAX_ADDRESSES);
-
-        // Configure auth failure tracking behavior and inform administrator of
-        // ultimate result
-        if (maxAttempts <= 0) {
-            this.tracker = new NullAuthenticationFailureTracker();
-            logger.info("Maximum failed authentication attempts has been set "
-                    + "to {}. Automatic banning of brute-force authentication "
-                    + "attempts will be disabled.", maxAttempts);
-        }
-        else if (banDuration <= 0) {
-            this.tracker = new NullAuthenticationFailureTracker();
-            logger.info("Ban duration for addresses that repeatedly fail "
-                    + "authentication has been set to {}. Automatic banning "
-                    + "of brute-force authentication attempts will be "
-                    + "disabled.", banDuration);
-        }
-        else if (maxAddresses <= 0) {
-            this.tracker = new NullAuthenticationFailureTracker();
-            logger.info("Maximum number of tracked addresses has been set to "
-                    + "{}. Automatic banning of brute-force authentication "
-                    + "attempts will be disabled.", maxAddresses);
-        }
-        else {
-            this.tracker = new InMemoryAuthenticationFailureTracker(maxAttempts, banDuration, maxAddresses);
-            logger.info("Addresses will be automatically banned for {} "
-                    + "seconds after {} failed authentication attempts. Up "
-                    + "to {} unique addresses will be tracked/banned at any "
-                    + "given time.", banDuration, maxAttempts, maxAddresses);
-        }
-
-        BanningAuthenticationListener.setAuthenticationFailureTracker(tracker);
-
-    }
-
-    @Override
-    public String getIdentifier() {
-        return "ban";
-    }
-
-    @Override
-    public AuthenticatedUser authenticateUser(Credentials credentials) throws GuacamoleException {
-        tracker.notifyAuthenticationRequestReceived(credentials);
-        return null;
-    }
-
-    @Override
-    public UserContext getUserContext(AuthenticatedUser authenticatedUser) throws GuacamoleException {
-        tracker.notifyAuthenticationRequestReceived(authenticatedUser.getCredentials());
-        return null;
-    }
-
-}
diff --git a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
index 1e6beac22..0133a7364 100644
--- a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
@@ -5,10 +5,6 @@
     "name"      : "Brute-force Authentication Detection/Prevention",
     "namespace" : "ban",
 
-    "authProviders" : [
-        "org.apache.guacamole.auth.ban.BanningAuthenticationProvider"
-    ],
-
     "listeners" : [
         "org.apache.guacamole.auth.ban.BanningAuthenticationListener"
     ],
diff --git a/guacamole-docker/bin/start.sh b/guacamole-docker/bin/start.sh
index 632c3d03a..7ea97bf73 100755
--- a/guacamole-docker/bin/start.sh
+++ b/guacamole-docker/bin/start.sh
@@ -1165,12 +1165,12 @@ set_optional_property "ban-address-duration" "$BAN_ADDRESS_DURATION"
 set_optional_property "ban-max-addresses" "$BAN_MAX_ADDRESSES"
 set_optional_property "ban-max-invalid-attempts" "$BAN_MAX_INVALID_ATTEMPTS"
 
-# Ensure guacamole-auth-ban always loads before other extensions unless
-# explicitly overridden via naming or EXTENSION_PRIORITY (allowing other
-# extensions to attempt authentication before guacamole-auth-ban has a chance
-# to enforce any bans could allow credentials to continue to be guessed even
-# after the address has been blocked via timing attacks)
-ln -s /opt/guacamole/ban/guacamole-auth-*.jar "$GUACAMOLE_EXT/_guacamole-auth-ban.jar"
+# Always load guacamole-auth-ban extension (automatic banning can be disabled
+# through seting BAN_ADDRESS_DURATION to 0). As guacamole-auth-ban performs
+# its banning by handling a pre-authentication event, it is guaranteed to
+# perform its checks before all other auth processing and load order does not
+# matter.
+ln -s /opt/guacamole/ban/guacamole-auth-*.jar "$GUACAMOLE_EXT"
 
 # Set logback level if specified
 if [ -n "$LOGBACK_LEVEL" ]; then
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationRequestReceivedEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationRequestReceivedEvent.java
new file mode 100644
index 000000000..eeefcfc5b
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationRequestReceivedEvent.java
@@ -0,0 +1,35 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.event;
+
+/**
+ * An event which is triggered whenever a user's credentials have been
+ * submitted for authentication, but that latest authentication request has not
+ * yet succeeded or failed. The credentials that were received for
+ * authentication are included within this event, and can be retrieved using
+ * {@link #getCredentials()}.
+ * <p>
+ * If a {@link org.apache.guacamole.net.event.listener.Listener} throws
+ * a GuacamoleException when handling an event of this type, the authentication
+ * request is entirely aborted as if it failed, and will be processed by any
+ * other listener or authentication provider.
+ */
+public interface AuthenticationRequestReceivedEvent extends CredentialEvent {
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
index 8ed76c6a6..e7248ba51 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
@@ -38,6 +38,7 @@ import org.apache.guacamole.net.auth.credentials.GuacamoleCredentialsException;
 import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
 import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
 import org.apache.guacamole.net.event.AuthenticationFailureEvent;
+import org.apache.guacamole.net.event.AuthenticationRequestReceivedEvent;
 import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
 import org.apache.guacamole.rest.event.ListenerService;
 import org.glassfish.jersey.server.ContainerRequest;
@@ -412,6 +413,9 @@ public class AuthenticationService {
     public String authenticate(Credentials credentials, String token)
             throws GuacamoleException {
 
+        // Fire pre-authentication event before ANY authn/authz occurs at all
+        listenerService.handleEvent((AuthenticationRequestReceivedEvent) () -> credentials);
+
         // Pull existing session if token provided
         GuacamoleSession existingSession;
         if (token != null)

From 8a7bde8e9ce4630640ae73cfedb4b9ae61f709e2 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 29 Aug 2022 22:08:31 +0000
Subject: [PATCH 074/289] GUACAMOLE-1656: Simplify, clean up, and improve
 documentation of KSM code.

---
 .../vault/ksm/GuacamoleExceptionSupplier.java |   8 +-
 .../vault/ksm/conf/KsmAttributeService.java   |  22 +-
 .../guacamole/vault/ksm/secret/KsmClient.java |   2 +-
 .../vault/ksm/secret/KsmSecretService.java    | 205 ++++++++++--------
 .../vault/ksm/user/KsmConnection.java         |  29 +--
 .../vault/ksm/user/KsmConnectionGroup.java    |  17 +-
 .../vault/ksm/user/KsmDirectoryService.java   |  29 +--
 .../guacamole/vault/ksm/user/KsmUser.java     |  29 +--
 .../directives/guacSettingsPreferences.js     |  70 +-----
 .../main/frontend/src/translations/en.json    |   2 +-
 guacamole/src/main/frontend/webpack.config.js |  12 +
 .../guacamole/rest/schema/SchemaResource.java |   2 +-
 .../rest/user/UserObjectTranslator.java       |  19 +-
 .../guacamole/rest/user/UserResource.java     |  54 +----
 14 files changed, 216 insertions(+), 284 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java
index ed59f7b68..c99613740 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/GuacamoleExceptionSupplier.java
@@ -26,8 +26,12 @@ import org.apache.guacamole.GuacamoleException;
  * Java, except that the get() function can throw GuacamoleException, which
  * is impossible with any of the standard Java lambda type classes, since
  * none of them can handle checked exceptions
+ *
+ * @param <T>
+ *     The type of object which will be returned as a result of calling
+ *     get().
  */
-public abstract class GuacamoleExceptionSupplier<T> {
+public interface GuacamoleExceptionSupplier<T> {
 
     /**
      * Returns a value of the declared type.
@@ -38,6 +42,6 @@ public abstract class GuacamoleExceptionSupplier<T> {
      * @throws GuacamoleException
      *    If an error occurs while attemping to calculate the return value.
      */
-    public abstract T get() throws GuacamoleException;
+    public T get() throws GuacamoleException;
 
 }
\ No newline at end of file
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
index bdceb4c21..24958208d 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
@@ -28,6 +28,8 @@ import org.apache.guacamole.form.BooleanField;
 import org.apache.guacamole.form.Form;
 import org.apache.guacamole.form.TextField;
 import org.apache.guacamole.vault.conf.VaultAttributeService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
@@ -39,7 +41,14 @@ import com.google.inject.Singleton;
 @Singleton
 public class KsmAttributeService implements VaultAttributeService {
 
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(KsmAttributeService.class);
 
+    /**
+     * Service for retrieving KSM configuration details.
+     */
     @Inject
     private KsmConfigurationService configurationService;
 
@@ -57,7 +66,7 @@ public class KsmAttributeService implements VaultAttributeService {
             Arrays.asList(new TextField(KSM_CONFIGURATION_ATTRIBUTE)));
 
     /**
-     * All KSM-specific attributes for users or connection groups, organized by form.
+     * All KSM-specific attributes for users, connections, or connection groups, organized by form.
      */
     public static final Collection<Form> KSM_ATTRIBUTES =
             Collections.unmodifiableCollection(Arrays.asList(KSM_CONFIGURATION_FORM));
@@ -108,7 +117,16 @@ public class KsmAttributeService implements VaultAttributeService {
             // Expose the user attributes IFF user-level KSM configuration is enabled
             return configurationService.getAllowUserConfig() ? KSM_ATTRIBUTES : Collections.emptyList();
 
-        } catch (GuacamoleException e) {
+        }
+
+        catch (GuacamoleException e) {
+
+            logger.warn(
+                    "Unable to determine if user preference attributes "
+                    + "should be exposed due to config parsing error: {}.", e.getMessage());
+            logger.debug(
+                    "Config parsing error prevented checking user preference configuration",
+                    e);
 
             // If the configuration can't be parsed, default to not exposing the attribute
             return Collections.emptyList();
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index 74a27e472..3aa436f69 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -605,7 +605,7 @@ public class KsmClient {
      * value of a specific field, custom field, or file associated with a
      * specific record. See: https://docs.keeper.io/secrets-manager/secrets-manager/about/keeper-notation
      * If a fallbackFunction is provided, it will be invoked to generate
-     * a return value in the case where no secrest is found with the given
+     * a return value in the case where no secret is found with the given
      * keeper notation.
      *
      * @param notation
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index 6b8ba92a2..59c1450bf 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -19,6 +19,7 @@
 
 package org.apache.guacamole.vault.ksm.secret;
 
+import com.google.common.base.Objects;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import com.keepersecurity.secretsManager.core.KeeperRecord;
@@ -41,6 +42,7 @@ import java.util.concurrent.Future;
 import javax.annotation.Nonnull;
 
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.Attributes;
 import org.apache.guacamole.net.auth.Connectable;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.ConnectionGroup;
@@ -159,7 +161,7 @@ public class KsmSecretService implements VaultSecretService {
 
                 // If the user config happens to be the same as admin-defined one,
                 // don't bother trying again
-                if (userKsmConfig != ksmConfig)
+                if (!Objects.equal(userKsmConfig, ksmConfig))
                     return getClient(userKsmConfig).getSecret(name);
 
                 return CompletableFuture.completedFuture(null);
@@ -339,16 +341,12 @@ public class KsmSecretService implements VaultSecretService {
      */
     private boolean isKsmUserConfigEnabled(Connectable connectable) {
 
-        // If it's a connection, user-level config is enabled IFF the appropriate
-        // attribute is set to true
-        if (connectable instanceof Connection)
-            return KsmAttributeService.TRUTH_VALUE.equals(((Connection) connectable).getAttributes().get(
+        // User-level config is enabled IFF the appropriate attribute is set to true
+        if (connectable instanceof Attributes)
+            return KsmAttributeService.TRUTH_VALUE.equals(((Attributes) connectable).getAttributes().get(
                 KsmAttributeService.KSM_USER_CONFIG_ENABLED_ATTRIBUTE));
 
-        // KSM token replacement is not enabled for balancing groups, so for
-        // now, user-level KSM configs will be explicitly disabled.
-        // TODO: If token replacement is implemented for balancing groups,
-        // implement this functionality for them as well.
+        // If there's no attributes to check, the user config cannot be enabled
         return false;
 
     }
@@ -378,10 +376,10 @@ public class KsmSecretService implements VaultSecretService {
     private String getUserKSMConfig(
             UserContext userContext, Connectable connectable) throws GuacamoleException {
 
-        // Check if user KSM configs are enabled globally, and for the given connectable
+        // If user KSM configs are enabled globally, and for the given connectable,
+        // return the user-specific KSM config, if one exists
         if (confService.getAllowUserConfig() && isKsmUserConfigEnabled(connectable))
 
-            // Return the user-specific KSM config, if one exists
             return userContext.self().getAttributes().get(
                     KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
 
@@ -391,6 +389,106 @@ public class KsmSecretService implements VaultSecretService {
         return null;
     }
 
+    /**
+     * Use the provided KSM client to add parameter tokens tokens to the
+     * provided token map. The supplied filter will be used to replace
+     * existing tokens in the provided connection parameters before KSM
+     * record lookup. The supplied GuacamoleConfiguration instance will
+     * be used to check the protocol, in case RDP-specific behavior is
+     * needed.
+
+     * @param config
+     *    The GuacamoleConfiguration associated with the Connectable for which
+     *    tokens are being added.
+     *
+     * @param ksm
+     *     The KSM client to use when fetching records.
+     *
+     * @param tokens
+     *     The tokens to which any fetched KSM record values should be added.
+     *
+     * @param parameters
+     *     The connection parameters associated with the Connectable for which
+     *     tokens are being added.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while attempting to fetch KSM records or check
+     *     configuration settings.
+     */
+    private void addConnectableTokens(
+            GuacamoleConfiguration config, KsmClient ksm, Map<String, Future<String>> tokens,
+            Map<String, String> parameters, TokenFilter filter) throws GuacamoleException {
+
+        // Retrieve and define server-specific tokens, if any
+        String hostname = parameters.get("hostname");
+        if (hostname != null && !hostname.isEmpty())
+            addRecordTokens(tokens, "KEEPER_SERVER_",
+                    ksm.getRecordByHost(filter.filter(hostname)));
+
+        // Tokens specific to RDP
+        if ("rdp".equals(config.getProtocol())) {
+
+            // Retrieve and define gateway server-specific tokens, if any
+            String gatewayHostname = parameters.get("gateway-hostname");
+            if (gatewayHostname != null && !gatewayHostname.isEmpty())
+                addRecordTokens(tokens, "KEEPER_GATEWAY_",
+                        ksm.getRecordByHost(filter.filter(gatewayHostname)));
+
+            // Retrieve and define domain tokens, if any
+            String domain = parameters.get("domain");
+            String filteredDomain = null;
+            if (domain != null && !domain.isEmpty()) {
+                filteredDomain = filter.filter(domain);
+                addRecordTokens(tokens, "KEEPER_DOMAIN_",
+                        ksm.getRecordByDomain(filteredDomain));
+            }
+
+            // Retrieve and define gateway domain tokens, if any
+            String gatewayDomain = parameters.get("gateway-domain");
+            String filteredGatewayDomain = null;
+            if (gatewayDomain != null && !gatewayDomain.isEmpty()) {
+                filteredGatewayDomain = filter.filter(gatewayDomain);
+                addRecordTokens(tokens, "KEEPER_GATEWAY_DOMAIN_",
+                        ksm.getRecordByDomain(filteredGatewayDomain));
+            }
+
+            // If domain matching is disabled for user records,
+            // explicitly set the domains to null when storing
+            // user records to enable username-only matching
+            if (!confService.getMatchUserRecordsByDomain()) {
+                filteredDomain = null;
+                filteredGatewayDomain = null;
+            }
+
+            // Retrieve and define user-specific tokens, if any
+            String username = parameters.get("username");
+            if (username != null && !username.isEmpty())
+                addRecordTokens(tokens, "KEEPER_USER_",
+                        ksm.getRecordByLogin(filter.filter(username),
+                        filteredDomain));
+
+            // Retrieve and define gateway user-specific tokens, if any
+            String gatewayUsername = parameters.get("gateway-username");
+            if (gatewayUsername != null && !gatewayUsername.isEmpty())
+                addRecordTokens(tokens, "KEEPER_GATEWAY_USER_",
+                        ksm.getRecordByLogin(
+                            filter.filter(gatewayUsername),
+                            filteredGatewayDomain));
+        }
+
+        else {
+
+            // Retrieve and define user-specific tokens, if any
+            // NOTE that non-RDP connections do not have a domain
+            // field in the connection parameters, so the domain
+            // will always be null
+            String username = parameters.get("username");
+            if (username != null && !username.isEmpty())
+                addRecordTokens(tokens, "KEEPER_USER_",
+                        ksm.getRecordByLogin(filter.filter(username), null));
+        }
+    }
+
     @Override
     public Map<String, Future<String>> getTokens(UserContext userContext, Connectable connectable,
             GuacamoleConfiguration config, TokenFilter filter) throws GuacamoleException {
@@ -398,89 +496,18 @@ public class KsmSecretService implements VaultSecretService {
         Map<String, Future<String>> tokens = new HashMap<>();
         Map<String, String> parameters = config.getParameters();
 
-        // Attempt to find a KSM config for this connection or group
-        String ksmConfig = getConnectionGroupKsmConfig(userContext, connectable);
-
-        // Create a list containing just the global / connection group config
-        List<KsmClient> ksmClients = new ArrayList<>(2);
-        ksmClients.add(getClient(ksmConfig));
-
         // Only use the user-specific KSM config if explicitly enabled in the global
         // configuration, AND for the specific connectable being connected to
         String userKsmConfig = getUserKSMConfig(userContext, connectable);
         if (userKsmConfig != null && !userKsmConfig.trim().isEmpty())
-            ksmClients.add(0, getClient(userKsmConfig));
+            addConnectableTokens(
+                    config, getClient(userKsmConfig), tokens, parameters, filter);
 
-        // Iterate through the KSM clients, processing using the user-specific
-        // config first (if it exists), to ensure that any admin-defined values
-        // will override the user-speicifc values
-        Iterator<KsmClient> ksmIterator = ksmClients.iterator();
-        while (ksmIterator.hasNext()) {
-
-            KsmClient ksm = ksmIterator.next();
-
-            // Retrieve and define server-specific tokens, if any
-            String hostname = parameters.get("hostname");
-            if (hostname != null && !hostname.isEmpty())
-                addRecordTokens(tokens, "KEEPER_SERVER_",
-                        ksm.getRecordByHost(filter.filter(hostname)));
-
-            // Tokens specific to RDP
-            if ("rdp".equals(config.getProtocol())) {
-                // Retrieve and define domain tokens, if any
-                String domain = parameters.get("domain");
-                String filteredDomain = null;
-                if (domain != null && !domain.isEmpty()) {
-                    filteredDomain = filter.filter(domain);
-                    addRecordTokens(tokens, "KEEPER_DOMAIN_",
-                            ksm.getRecordByDomain(filteredDomain));
-                }
-
-                // Retrieve and define gateway domain tokens, if any
-                String gatewayDomain = parameters.get("gateway-domain");
-                String filteredGatewayDomain = null;
-                if (gatewayDomain != null && !gatewayDomain.isEmpty()) {
-                    filteredGatewayDomain = filter.filter(gatewayDomain);
-                    addRecordTokens(tokens, "KEEPER_GATEWAY_DOMAIN_",
-                            ksm.getRecordByDomain(filteredGatewayDomain));
-                }
-
-                // If domain matching is disabled for user records,
-                // explicitly set the domains to null when storing
-                // user records to enable username-only matching
-                if (!confService.getMatchUserRecordsByDomain()) {
-                    filteredDomain = null;
-                    filteredGatewayDomain = null;
-                }
-
-                // Retrieve and define user-specific tokens, if any
-                String username = parameters.get("username");
-                if (username != null && !username.isEmpty())
-                    addRecordTokens(tokens, "KEEPER_USER_",
-                            ksm.getRecordByLogin(filter.filter(username),
-                            filteredDomain));
-
-                // Retrieve and define gateway user-specific tokens, if any
-                String gatewayUsername = parameters.get("gateway-username");
-                if (gatewayUsername != null && !gatewayUsername.isEmpty())
-                    addRecordTokens(tokens, "KEEPER_GATEWAY_USER_",
-                            ksm.getRecordByLogin(
-                                filter.filter(gatewayUsername),
-                                filteredGatewayDomain));
-            }
-
-            else {
-
-                // Retrieve and define user-specific tokens, if any
-                // NOTE that non-RDP connections do not have a domain
-                // field in the connection parameters, so the domain
-                // will always be null
-                String username = parameters.get("username");
-                if (username != null && !username.isEmpty())
-                    addRecordTokens(tokens, "KEEPER_USER_",
-                            ksm.getRecordByLogin(filter.filter(username), null));
-            }
-        }
+        // Add connection group or globally defined tokens after the user-specific
+        // ones to ensure that the user config will be overriden on collision
+        String ksmConfig = getConnectionGroupKsmConfig(userContext, connectable);
+        addConnectableTokens(
+            config, getClient(ksmConfig), tokens, parameters, filter);
 
         return tokens;
 
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java
index da2866202..24d7dd062 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java
@@ -19,25 +19,21 @@
 
 package org.apache.guacamole.vault.ksm.user;
 
-import java.util.List;
 import java.util.Map;
 
 import org.apache.guacamole.net.auth.DelegatingConnection;
+import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 import org.apache.guacamole.net.auth.Connection;
 
 import com.google.common.collect.Maps;
 
 /**
- * A Connection that explicitly adds a blank entry for any defined
- * KSM connection attributes.
+ * A Connection that explicitly adds a blank entry for any defined KSM
+ * connection attributes. This ensures that any such field will always
+ * be displayed to the user when editing a connection through the UI.
  */
 public class KsmConnection extends DelegatingConnection {
 
-    /**
-     * The names of all connection attributes defined for the vault.
-     */
-    private List<String> connectionAttributeNames;
-
     /**
      * Create a new Vault connection wrapping the provided Connection record. Any
      * attributes defined in the provided connection attribute forms will have empty
@@ -45,15 +41,9 @@ public class KsmConnection extends DelegatingConnection {
      *
      * @param connection
      *     The connection record to wrap.
-     *
-     * @param connectionAttributeNames
-     *     The names of all connection attributes to automatically expose.
      */
-    KsmConnection(Connection connection, List<String> connectionAttributeNames) {
-
+    KsmConnection(Connection connection) {
         super(connection);
-        this.connectionAttributeNames = connectionAttributeNames;
-
     }
 
     /**
@@ -70,13 +60,12 @@ public class KsmConnection extends DelegatingConnection {
     public Map<String, String> getAttributes() {
 
         // Make a copy of the existing map
-        Map<String, String> attributeMap = Maps.newHashMap(super.getAttributes());
+        Map<String, String> attributes = Maps.newHashMap(super.getAttributes());
 
-        // Add every defined attribute
-        connectionAttributeNames.forEach(
-                attributeName -> attributeMap.putIfAbsent(attributeName, null));
+        // Add the configuration attribute
+        attributes.putIfAbsent(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, null);
+        return attributes;
 
-        return attributeMap;
     }
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java
index 397c42f11..175e4dd5f 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java
@@ -19,13 +19,14 @@
 
 package org.apache.guacamole.vault.ksm.user;
 
-import java.util.HashMap;
 import java.util.Map;
 
 import org.apache.guacamole.net.auth.ConnectionGroup;
 import org.apache.guacamole.net.auth.DelegatingConnectionGroup;
 import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 
+import com.google.common.collect.Maps;
+
  /**
   * A KSM-specific connection group implementation that always exposes
   * the KSM_CONFIGURATION_ATTRIBUTE attribute, even when no value is set.
@@ -50,17 +51,11 @@ import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
     @Override
     public Map<String, String> getAttributes() {
 
-        // All attributes defined on the underlying connection group
-        Map<String, String> attributes = super.getAttributes();
+        // Make a copy of the existing map
+        Map<String, String> attributes = Maps.newHashMap(super.getAttributes());
 
-        // If the attribute is already present, there's no need to add it - return
-        // the existing attributes as they are
-        if (attributes.containsKey(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE))
-            return attributes;
-
-        // Make a copy of the existing attributes and add KSM_CONFIGURATION_ATTRIBUTE
-        attributes = new HashMap<>(attributes);
-        attributes.put(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, null);
+        // Add the configuration attribute
+        attributes.putIfAbsent(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, null);
         return attributes;
 
     }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
index 3eff928fe..6ce734601 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
@@ -26,7 +26,6 @@ import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.stream.Collectors;
 
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.language.TranslatableGuacamoleClientException;
@@ -60,12 +59,6 @@ public class KsmDirectoryService extends VaultDirectoryService {
     @Inject
     private KsmConfigurationService configurationService;
 
-    /**
-     * Service for retrieving KSM-specific attributes.
-     */
-    @Inject
-    private KsmAttributeService ksmAttributeService;
-
     /**
      * A singleton ObjectMapper for converting a Map to a JSON string when
      * generating a base64-encoded JSON KSM config blob.
@@ -235,8 +228,9 @@ public class KsmDirectoryService extends VaultDirectoryService {
     public Directory<Connection> getConnectionDirectory(
             Directory<Connection> underlyingDirectory) throws GuacamoleException {
 
-        // A Connection directory that will intercept add and update calls to
-        // validate KSM configurations, and translate one-time-tokens, if possible
+        // A Connection directory that will decorate all connections with a
+        // KsmConnection wrapper to ensure that all defined KSM fields will
+        // be exposed in the connection group attributes.
         return new DecoratingDirectory<Connection>(underlyingDirectory) {
 
             @Override
@@ -244,17 +238,13 @@ public class KsmDirectoryService extends VaultDirectoryService {
 
                 // Wrap in a KsmConnection class to ensure that all defined KSM fields will be
                 // present
-                return new KsmConnection(
-                        connection,
-                        ksmAttributeService.getConnectionAttributes().stream().flatMap(
-                                form -> form.getFields().stream().map(field -> field.getName())
-                        ).collect(Collectors.toList()));
+                return new KsmConnection(connection);
             }
 
             @Override
             protected Connection undecorate(Connection connection) throws GuacamoleException {
 
-                // Unwrap the KsmUser
+                // Unwrap the KsmConnection
                 return ((KsmConnection) connection).getUnderlyingConnection();
             }
 
@@ -315,6 +305,9 @@ public class KsmDirectoryService extends VaultDirectoryService {
 
         // A User directory that will intercept add and update calls to
         // validate KSM configurations, and translate one-time-tokens, if possible
+        // Additionally, this directory will will decorate all users with a
+        // KsmUser wrapper to ensure that all defined KSM fields will be exposed
+        // in the user attributes.
         return new DecoratingDirectory<User>(underlyingDirectory) {
 
             @Override
@@ -340,11 +333,7 @@ public class KsmDirectoryService extends VaultDirectoryService {
 
                 // Wrap in a KsmUser class to ensure that all defined KSM fields will be
                 // present
-                return new KsmUser(
-                        user,
-                        ksmAttributeService.getUserAttributes().stream().flatMap(
-                                form -> form.getFields().stream().map(field -> field.getName())
-                        ).collect(Collectors.toList()));
+                return new KsmUser(user);
             }
 
             @Override
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java
index a846eb0d8..dc2877564 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java
@@ -19,11 +19,11 @@
 
 package org.apache.guacamole.vault.ksm.user;
 
-import java.util.List;
 import java.util.Map;
 
 import org.apache.guacamole.net.auth.DelegatingUser;
 import org.apache.guacamole.net.auth.User;
+import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 
 import com.google.common.collect.Maps;
 
@@ -33,27 +33,16 @@ import com.google.common.collect.Maps;
  */
 public class KsmUser extends DelegatingUser {
 
-    /**
-     * The names of all user attributes defined for the vault.
-     */
-    private List<String> userAttributeNames;
-
     /**
      * Create a new Vault user wrapping the provided User record. Any
-     * attributes defined in the provided user attribute forms will have empty
-     * values automatically populated when getAttributes() is called.
+     * KSM-specific attribute forms will have empty values automatically
+     * populated when getAttributes() is called.
      *
      * @param user
      *     The user record to wrap.
-     *
-     * @param userAttributeNames
-     *     The names of all user attributes to automatically expose.
      */
-    KsmUser(User user, List<String> userAttributeNames) {
-
+    KsmUser(User user) {
         super(user);
-        this.userAttributeNames = userAttributeNames;
-
     }
 
     /**
@@ -70,13 +59,11 @@ public class KsmUser extends DelegatingUser {
     public Map<String, String> getAttributes() {
 
         // Make a copy of the existing map
-        Map<String, String> attributeMap = Maps.newHashMap(super.getAttributes());
+        Map<String, String> attributes = Maps.newHashMap(super.getAttributes());
 
-        // Add every defined attribute
-        userAttributeNames.forEach(
-                attributeName -> attributeMap.putIfAbsent(attributeName, null));
-
-        return attributeMap;
+        // Add the configuration attribute
+        attributes.putIfAbsent(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, null);
+        return attributes;
     }
 
 }
diff --git a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
index 199b7ddfa..a3f0fd2e5 100644
--- a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
+++ b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
@@ -68,7 +68,7 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
                 callback    : function acknowledgeCallback() {
                     userService.getUser(dataSource, username)
                         .then(user => $scope.user = user)
-                        .then(guacNotification.showStatus(false))
+                        .then(() => guacNotification.showStatus(false));
                 }
             };
 
@@ -101,17 +101,6 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
              */
             $scope.preferences = preferenceService.preferences;
 
-            /**
-             * All available user attributes, as a mapping of form name to form
-             * object. The form object contains a name, as well as a Map of fields.
-             *
-             * The Map type is used here to maintain form/name uniqueness, as well as
-             * insertion order, to ensure a consistent UI experience.
-             *
-             * @type Map<String, Object>
-             */
-            $scope.attributeMap = new Map();
-
             /**
              * All available user attributes. This is only the set of attribute
              * definitions, organized as logical groupings of attributes, not attribute
@@ -263,61 +252,10 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
                 $scope.user = user;
             })
 
-            // Get all datasources that are available for this user
-            authenticationService.getAvailableDataSources().forEach(function loadAttributesForDataSource(dataSource) {
-
-                // Fetch all user attribute forms defined for the datasource
-                schemaService.getUserPreferenceAttributes(dataSource).then(function saveAttributes(attributes) {
-
-                    // Iterate through all attribute forms
-                    attributes.forEach(function addAttribute(attributeForm) {
-
-                        // If the form with the retrieved name already exists
-                        if ($scope.attributeMap.has(attributeForm.name)) {
-                            const existingFields = $scope.attributeMap.get(attributeForm.name).fields;
-
-                            // Add each field to the existing list for this form
-                            attributeForm.fields.forEach(function addAllFieldsToExistingMap(field) {
-                                existingFields.set(field.name, field);
-                            })
-                        }
-
-                        else {
-
-                            // Create a new entry for the form
-                            $scope.attributeMap.set(attributeForm.name, {
-                                name: attributeForm.name,
-
-                                // With the field array from the API converted into a Map
-                                fields: attributeForm.fields.reduce(
-                                    function addFieldToMap(currentFieldMap, field) {
-                                        currentFieldMap.set(field.name, field);
-                                        return currentFieldMap;
-                                    }, new Map()
-                                )
-
-                            })
-                        }
-
-                    });
-
-                    // Re-generate the attributes array every time
-                    $scope.attributes = Array.of(...$scope.attributeMap.values()).map(function convertFieldsToArray(formObject) {
-
-                        // Convert each temporary form object to a Form type
-                        return new Form({
-                            name: formObject.name,
-
-                            // Convert the field map to a simple array of fields
-                            fields: Array.of(...formObject.fields.values())
-                        })
-                    });
-
-                });
-
+            // Fetch all user preference attribute forms defined
+            schemaService.getUserPreferenceAttributes(dataSource).then(function saveAttributes(attributes) {
+                $scope.attributes = attributes;
             });
-
         }]
     };
-
 }]);
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index a1c0e0d92..f2ba0b111 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -943,7 +943,7 @@
         "HELP_UPDATE_PASSWORD"      : "If you wish to change your password, enter your current password and the desired new password below, and click \"Update Password\". The change will take effect immediately.",
 
         "INFO_PASSWORD_CHANGED" : "Password changed.",
-        "INFO_PREFERENCE_ATTRIBUTES_CHANGED" : "User attributes saved.",
+        "INFO_PREFERENCE_ATTRIBUTES_CHANGED" : "User settings saved.",
 
         "NAME_INPUT_METHOD_NONE" : "@:CLIENT.NAME_INPUT_METHOD_NONE",
         "NAME_INPUT_METHOD_OSK"  : "@:CLIENT.NAME_INPUT_METHOD_OSK",
diff --git a/guacamole/src/main/frontend/webpack.config.js b/guacamole/src/main/frontend/webpack.config.js
index 3f1574fa1..29bb8ddd5 100644
--- a/guacamole/src/main/frontend/webpack.config.js
+++ b/guacamole/src/main/frontend/webpack.config.js
@@ -77,6 +77,18 @@ module.exports = {
         ]
     },
     optimization: {
+        minimizer: [
+
+            // Minify using Google Closure Compiler
+            new ClosureWebpackPlugin({ mode: 'STANDARD' }, {
+                languageIn: 'ECMASCRIPT_2020',
+                languageOut: 'ECMASCRIPT5',
+                compilationLevel: 'SIMPLE'
+            }),
+
+            new CssMinimizerPlugin()
+
+        ],
         splitChunks: {
             cacheGroups: {
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/schema/SchemaResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/schema/SchemaResource.java
index edc125127..a7ed08d60 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/schema/SchemaResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/schema/SchemaResource.java
@@ -89,7 +89,7 @@ public class SchemaResource {
      */
     @GET
     @Path("userPreferenceAttributes")
-    public Collection<Form> getUserAttrigetUserPreferenceAttributesbutes()
+    public Collection<Form> getUserPreferenceAttributes()
             throws GuacamoleException {
 
         // Retrieve all possible user preference attributes
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java
index 8536b3507..8c63d7218 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java
@@ -59,9 +59,22 @@ public class UserObjectTranslator
     public void filterExternalObject(UserContext userContext, APIUser object)
             throws GuacamoleException {
 
-        // Filter object attributes by defined schema
-        object.setAttributes(filterAttributes(userContext.getUserAttributes(),
-                object.getAttributes()));
+        // If a user is editing themselves ...
+        if (object.getUsername().equals(userContext.self().getIdentifier())) {
+
+            // ... they may only edit preference attributes
+            object.setAttributes(filterAttributes(userContext.getUserPreferenceAttributes(),
+                    object.getAttributes()));
+
+        }
+
+        else {
+
+            // In all other cases, filter object attributes by defined schema
+            object.setAttributes(filterAttributes(userContext.getUserAttributes(),
+                    object.getAttributes()));
+
+        }
 
     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
index 5d4be4ffc..aa8a3ec7e 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
@@ -22,10 +22,6 @@ package org.apache.guacamole.rest.user;
 import com.google.inject.assistedinject.Assisted;
 import com.google.inject.assistedinject.AssistedInject;
 
-import java.util.Iterator;
-import java.util.Set;
-import java.util.stream.Collectors;
-
 import javax.servlet.http.HttpServletRequest;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.GET;
@@ -150,50 +146,14 @@ public class UserResource
     @Override
     public void updateObject(APIUser modifiedObject) throws GuacamoleException {
 
+        // A user may not use this endpoint to update their password
         User currentUser = userContext.self();
-
-        // A user may not use this endpoint to modify themself, except in the case
-        // that they are modifying one of the user attributes explicitly exposed
-        // in the user preferences form
-        if (currentUser.getIdentifier().equals(modifiedObject.getUsername())) {
-
-            // A user may not use this endpoint to update their password
-            if (currentUser.getPassword() != null)
-                throw new GuacamoleSecurityException(
-                        "Permission denied. The password update endpoint must"
-                        + " be used to change the current user's password.");
-
-            // All attributes exposed in the preferences forms
-            Set<String> preferenceAttributes = (
-                    userContext.getUserPreferenceAttributes().stream()
-                    .flatMap(form -> form.getFields().stream().map(
-                            field -> field.getName())))
-                    .collect(Collectors.toSet());
-
-            // Go through every attribute value and check if it's changed
-            Iterator<String> keyIterator = modifiedObject.getAttributes().keySet().iterator();
-            while(keyIterator.hasNext()) {
-
-                String key = keyIterator.next();
-                String newValue = modifiedObject.getAttributes().get(key);
-
-                // If it's not a preference attribute, editing is not allowed
-                if (!preferenceAttributes.contains(key)) {
-
-                    String currentValue = currentUser.getAttributes().get(key);
-
-                    // If the value of the attribute has been modified
-                    if (
-                            !(currentValue == null && newValue == null) && (
-                                (currentValue == null && newValue != null) ||
-                                !currentValue.equals(newValue)
-                            )
-                    )
-                        throw new GuacamoleSecurityException(
-                            "Permission denied. Only user preference attributes"
-                            + " can be modified for the current user.");
-                }
-            }
+        if (
+                currentUser.getIdentifier().equals(modifiedObject.getUsername())
+                && modifiedObject.getPassword() != null) {
+            throw new GuacamoleSecurityException(
+                    "Permission denied. The password update endpoint must"
+                    + " be used to change the current user's password.");
         }
 
         super.updateObject(modifiedObject);

From b7deee427d60182bb77c930d488f8a63c72b26f4 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 26 Sep 2022 10:32:38 -0700
Subject: [PATCH 075/289] GUACAMOLE-990: Ensure internal errors during auth
 reach global error handling/logging.

---
 .../rest/auth/AuthenticationService.java      | 13 ++++++++
 ...acamoleAuthenticationProcessException.java | 32 +++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
index e7248ba51..705d7a856 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
@@ -27,6 +27,7 @@ import javax.servlet.http.HttpServletRequest;
 
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleSecurityException;
+import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.GuacamoleUnauthorizedException;
 import org.apache.guacamole.GuacamoleSession;
 import org.apache.guacamole.environment.Environment;
@@ -480,6 +481,18 @@ public class AuthenticationService {
                         getLoggableAddress(request));
 
             // Rethrow exception
+            e.rethrowCause();
+
+            // This line SHOULD be unreachable unless a bug causes
+            // rethrowCause() to not actually rethrow the underlying failure
+            Throwable cause = e.getCause();
+            if (cause != null) {
+                logger.warn("An underlying internal error was not correctly rethrown by rethrowCause(): {}", cause.getMessage());
+                logger.debug("Internal error not rethrown by rethrowCause().", cause);
+            }
+            else
+                logger.warn("An underlying internal error was not correctly rethrown by rethrowCause().");
+
             throw e.getCauseAsGuacamoleException();
 
         }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/GuacamoleAuthenticationProcessException.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/GuacamoleAuthenticationProcessException.java
index ba1d72a50..bec73f0be 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/GuacamoleAuthenticationProcessException.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/GuacamoleAuthenticationProcessException.java
@@ -146,6 +146,38 @@ public class GuacamoleAuthenticationProcessException extends GuacamoleException
         return guacCause;
     }
 
+    /**
+     * Rethrows the original GuacamoleException wrapped within this
+     * GuacamoleAuthenticationProcessException. If there is no such exception,
+     * and the cause of this failure is an unchecked RuntimeException or Error,
+     * that unchecked exception/error is rethrown as-is.
+     *
+     * @throws GuacamoleException
+     *     If the underlying cause of this exception is a checked
+     *     GuacamoleException subclass.
+     *
+     * @throws RuntimeException
+     *     If the underlying cause of this exception is an unchecked
+     *     RuntimeException.
+     *
+     * @throws Error
+     *     If the underlying cause of this exception is an unchecked Error.
+     */
+    public void rethrowCause() throws GuacamoleException, RuntimeException, Error {
+
+        // Rethrow any unchecked exceptions/errors as-is
+        Throwable cause = getCause();
+        if (cause instanceof RuntimeException)
+            throw (RuntimeException) cause;
+        if (cause instanceof Error)
+            throw (Error) cause;
+
+        // Pass through all other exceptions as normal GuacamoleException
+        // subclassses
+        throw getCauseAsGuacamoleException();
+
+    }
+
     @Override
     public GuacamoleStatus getStatus() {
         return getCauseAsGuacamoleException().getStatus();

From 3036c96a1f4bd2995d1b53f641cf32883e6796cd Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 27 Sep 2022 16:46:25 -0700
Subject: [PATCH 076/289] GUACAMOLE-1687: Leverage network activity to ensure
 keep-alive pings are sent.

---
 .../src/main/webapp/modules/Client.js         | 94 +++++++++++++++++--
 .../src/main/webapp/modules/Tunnel.js         | 50 +++++++---
 2 files changed, 124 insertions(+), 20 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/Client.js b/guacamole-common-js/src/main/webapp/modules/Client.js
index 2cc9c28b1..2315ac306 100644
--- a/guacamole-common-js/src/main/webapp/modules/Client.js
+++ b/guacamole-common-js/src/main/webapp/modules/Client.js
@@ -42,7 +42,36 @@ Guacamole.Client = function(tunnel) {
     var currentState = STATE_IDLE;
     
     var currentTimestamp = 0;
-    var pingInterval = null;
+
+    /**
+     * The rough number of milliseconds to wait between sending keep-alive
+     * pings. This may vary depending on how frequently the browser allows
+     * timers to run, as well as how frequently the client receives messages
+     * from the server.
+     *
+     * @private
+     * @constant
+     * @type {!number}
+     */
+    var KEEP_ALIVE_FREQUENCY = 5000;
+
+    /**
+     * The current keep-alive ping timeout ID, if any. This will only be set
+     * upon connecting.
+     *
+     * @private
+     * @type {number}
+     */
+    var keepAliveTimeout = null;
+
+    /**
+     * The timestamp of the point in time that the last keep-live ping was
+     * sent, in milliseconds elapsed since midnight of January 1, 1970 UTC.
+     *
+     * @private
+     * @type {!number}
+     */
+    var lastSentKeepAlive = 0;
 
     /**
      * Translation from Guacamole protocol line caps to Layer line caps.
@@ -1649,12 +1678,63 @@ Guacamole.Client = function(tunnel) {
 
     };
 
+    /**
+     * Sends a keep-alive ping to the Guacamole server, advising the server
+     * that the client is still connected and responding. The lastSentKeepAlive
+     * timestamp is automatically updated as a result of calling this function.
+     *
+     * @private
+     */
+    var sendKeepAlive = function sendKeepAlive() {
+        tunnel.sendMessage('nop');
+        lastSentKeepAlive = new Date().getTime();
+    };
+
+    /**
+     * Schedules the next keep-alive ping based on the KEEP_ALIVE_FREQUENCY and
+     * the time that the last ping was sent, if ever. If enough time has
+     * elapsed that a ping should have already been sent, calling this function
+     * will send that ping immediately.
+     *
+     * @private
+     */
+    var scheduleKeepAlive = function scheduleKeepAlive() {
+
+        window.clearTimeout(keepAliveTimeout);
+
+        var currentTime = new Date().getTime();
+        var keepAliveDelay = Math.max(lastSentKeepAlive + KEEP_ALIVE_FREQUENCY - currentTime, 0);
+
+        // Ping server regularly to keep connection alive, but send the ping
+        // immediately if enough time has elapsed that it should have already
+        // been sent
+        if (keepAliveDelay > 0)
+            keepAliveTimeout = window.setTimeout(sendKeepAlive, keepAliveDelay);
+        else
+            sendKeepAlive();
+
+    };
+
+    /**
+     * Stops sending any further keep-alive pings. If a keep-alive ping was
+     * scheduled to be sent, that ping is cancelled.
+     *
+     * @private
+     */
+    var stopKeepAlive = function stopKeepAlive() {
+        window.clearTimeout(keepAliveTimeout);
+    };
+
     tunnel.oninstruction = function(opcode, parameters) {
 
         var handler = instructionHandlers[opcode];
         if (handler)
             handler(parameters);
 
+        // Leverage network activity to ensure the next keep-alive ping is
+        // sent, even if the browser is currently throttling timers
+        scheduleKeepAlive();
+
     };
 
     /**
@@ -1668,9 +1748,8 @@ Guacamole.Client = function(tunnel) {
 
             setState(STATE_DISCONNECTING);
 
-            // Stop ping
-            if (pingInterval)
-                window.clearInterval(pingInterval);
+            // Stop sending keep-alive messages
+            stopKeepAlive();
 
             // Send disconnect message and disconnect
             tunnel.sendMessage("disconnect");
@@ -1704,10 +1783,9 @@ Guacamole.Client = function(tunnel) {
             throw status;
         }
 
-        // Ping every 5 seconds (ensure connection alive)
-        pingInterval = window.setInterval(function() {
-            tunnel.sendMessage("nop");
-        }, 5000);
+        // Regularly send keep-alive ping to ensure the server knows we're
+        // still here, even if not active
+        scheduleKeepAlive();
 
         setState(STATE_WAITING);
     };
diff --git a/guacamole-common-js/src/main/webapp/modules/Tunnel.js b/guacamole-common-js/src/main/webapp/modules/Tunnel.js
index fa886f561..2ff97d60d 100644
--- a/guacamole-common-js/src/main/webapp/modules/Tunnel.js
+++ b/guacamole-common-js/src/main/webapp/modules/Tunnel.js
@@ -844,13 +844,13 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
     var unstableTimeout = null;
 
     /**
-     * The current connection stability test ping interval ID, if any. This
+     * The current connection stability test ping timeout ID, if any. This
      * will only be set upon successful connection.
      *
      * @private
      * @type {number}
      */
-    var pingInterval = null;
+    var pingTimeout = null;
 
     /**
      * The WebSocket protocol corresponding to the protocol used for the current
@@ -874,6 +874,16 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
      */
     var PING_FREQUENCY = 500;
 
+    /**
+     * The timestamp of the point in time that the last connection stability
+     * test ping was sent, in milliseconds elapsed since midnight of January 1,
+     * 1970 UTC.
+     *
+     * @private
+     * @type {!number}
+     */
+    var lastSentPing = 0;
+
     // Transform current URL to WebSocket URL
 
     // If not already a websocket URL
@@ -907,6 +917,20 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
 
     }
 
+    /**
+     * Sends an internal "ping" instruction to the Guacamole WebSocket
+     * endpoint, verifying network connection stability. If the network is
+     * stable, the Guacamole server will receive this instruction and respond
+     * with an identical ping.
+     *
+     * @private
+     */
+    var sendPing = function sendPing() {
+        var currentTime = new Date().getTime();
+        tunnel.sendMessage(Guacamole.Tunnel.INTERNAL_DATA_OPCODE, 'ping', currentTime);
+        lastSentPing = currentTime;
+    };
+
     /**
      * Initiates a timeout which, if data is not received, causes the tunnel
      * to close with an error.
@@ -918,6 +942,7 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
         // Get rid of old timeouts (if any)
         window.clearTimeout(receive_timeout);
         window.clearTimeout(unstableTimeout);
+        window.clearTimeout(pingTimeout);
 
         // Clear unstable status
         if (tunnel.state === Guacamole.Tunnel.State.UNSTABLE)
@@ -933,6 +958,16 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
             tunnel.setState(Guacamole.Tunnel.State.UNSTABLE);
         }, tunnel.unstableThreshold);
 
+        var currentTime = new Date().getTime();
+        var pingDelay = Math.max(lastSentPing + PING_FREQUENCY - currentTime, 0);
+
+        // Ping tunnel endpoint regularly to test connection stability, sending
+        // the ping immediately if enough time has already elapsed
+        if (pingDelay > 0)
+            pingTimeout = window.setTimeout(sendPing, pingDelay);
+        else
+            sendPing();
+
     }
 
     /**
@@ -949,9 +984,7 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
         // Get rid of old timeouts (if any)
         window.clearTimeout(receive_timeout);
         window.clearTimeout(unstableTimeout);
-
-        // Cease connection test pings
-        window.clearInterval(pingInterval);
+        window.clearTimeout(pingTimeout);
 
         // Ignore if already closed
         if (tunnel.state === Guacamole.Tunnel.State.CLOSED)
@@ -1020,13 +1053,6 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
 
         socket.onopen = function(event) {
             reset_timeout();
-
-            // Ping tunnel endpoint regularly to test connection stability
-            pingInterval = setInterval(function sendPing() {
-                tunnel.sendMessage(Guacamole.Tunnel.INTERNAL_DATA_OPCODE,
-                    "ping", new Date().getTime());
-            }, PING_FREQUENCY);
-
         };
 
         socket.onclose = function(event) {

From 7f2ea222bba635b8ccb24316a8675b11343df386 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 28 Sep 2022 10:50:25 -0700
Subject: [PATCH 077/289] GUACAMOLE-1687: Clean, document, and clarify usage of
 tunnel timer reset function.

---
 .../src/main/webapp/modules/Tunnel.js         | 42 +++++++++++--------
 1 file changed, 25 insertions(+), 17 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/Tunnel.js b/guacamole-common-js/src/main/webapp/modules/Tunnel.js
index 2ff97d60d..5f3b79f3c 100644
--- a/guacamole-common-js/src/main/webapp/modules/Tunnel.js
+++ b/guacamole-common-js/src/main/webapp/modules/Tunnel.js
@@ -356,12 +356,16 @@ Guacamole.HTTPTunnel = function(tunnelURL, crossDomain, extraTunnelHeaders) {
     }
 
     /**
-     * Initiates a timeout which, if data is not received, causes the tunnel
-     * to close with an error.
-     * 
+     * Resets the state of timers tracking network activity and stability. If
+     * those timers are not yet started, invoking this function starts them.
+     * This function should be invoked when the tunnel is established and every
+     * time there is network activity on the tunnel, such that the timers can
+     * safely assume the network and/or server are not responding if this
+     * function has not been invoked for a significant period of time.
+     *
      * @private
      */
-    function reset_timeout() {
+    var resetTimers = function resetTimers() {
 
         // Get rid of old timeouts (if any)
         window.clearTimeout(receive_timeout);
@@ -381,7 +385,7 @@ Guacamole.HTTPTunnel = function(tunnelURL, crossDomain, extraTunnelHeaders) {
             tunnel.setState(Guacamole.Tunnel.State.UNSTABLE);
         }, tunnel.unstableThreshold);
 
-    }
+    };
 
     /**
      * Closes this tunnel, signaling the given status and corresponding
@@ -491,7 +495,7 @@ Guacamole.HTTPTunnel = function(tunnelURL, crossDomain, extraTunnelHeaders) {
             message_xmlhttprequest.onreadystatechange = function() {
                 if (message_xmlhttprequest.readyState === 4) {
 
-                    reset_timeout();
+                    resetTimers();
 
                     // If an error occurs during send, handle it
                     if (message_xmlhttprequest.status !== 200)
@@ -581,7 +585,7 @@ Guacamole.HTTPTunnel = function(tunnelURL, crossDomain, extraTunnelHeaders) {
             if (xmlhttprequest.readyState === 3 ||
                 xmlhttprequest.readyState === 4) {
 
-                reset_timeout();
+                resetTimers();
 
                 // Also poll every 30ms (some browsers don't repeatedly call onreadystatechange for new data)
                 if (pollingMode === POLLING_ENABLED) {
@@ -742,7 +746,7 @@ Guacamole.HTTPTunnel = function(tunnelURL, crossDomain, extraTunnelHeaders) {
     this.connect = function(data) {
 
         // Start waiting for connect
-        reset_timeout();
+        resetTimers();
 
         // Mark the tunnel as connecting
         tunnel.setState(Guacamole.Tunnel.State.CONNECTING);
@@ -760,7 +764,7 @@ Guacamole.HTTPTunnel = function(tunnelURL, crossDomain, extraTunnelHeaders) {
                 return;
             }
 
-            reset_timeout();
+            resetTimers();
 
             // Get UUID and HTTP-specific tunnel session token from response
             tunnel.setUUID(connect_xmlhttprequest.responseText);
@@ -932,12 +936,16 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
     };
 
     /**
-     * Initiates a timeout which, if data is not received, causes the tunnel
-     * to close with an error.
-     * 
+     * Resets the state of timers tracking network activity and stability. If
+     * those timers are not yet started, invoking this function starts them.
+     * This function should be invoked when the tunnel is established and every
+     * time there is network activity on the tunnel, such that the timers can
+     * safely assume the network and/or server are not responding if this
+     * function has not been invoked for a significant period of time.
+     *
      * @private
      */
-    function reset_timeout() {
+    var resetTimers = function resetTimers() {
 
         // Get rid of old timeouts (if any)
         window.clearTimeout(receive_timeout);
@@ -968,7 +976,7 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
         else
             sendPing();
 
-    }
+    };
 
     /**
      * Closes this tunnel, signaling the given status and corresponding
@@ -1043,7 +1051,7 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
 
     this.connect = function(data) {
 
-        reset_timeout();
+        resetTimers();
 
         // Mark the tunnel as connecting
         tunnel.setState(Guacamole.Tunnel.State.CONNECTING);
@@ -1052,7 +1060,7 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
         socket = new WebSocket(tunnelURL + "?" + data, "guacamole");
 
         socket.onopen = function(event) {
-            reset_timeout();
+            resetTimers();
         };
 
         socket.onclose = function(event) {
@@ -1074,7 +1082,7 @@ Guacamole.WebSocketTunnel = function(tunnelURL) {
         
         socket.onmessage = function(event) {
 
-            reset_timeout();
+            resetTimers();
 
             var message = event.data;
             var startIndex = 0;

From 06d321fe5dde0cfebee17ef6d21f8267a078ddff Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 27 Sep 2022 17:09:25 +0000
Subject: [PATCH 078/289] GUCAMOLE-1656: Do not expose the KSM config blob
 through the REST API.

---
 .../ksm/KsmAuthenticationProviderModule.java  |   8 +
 .../vault/ksm/conf/KsmAttributeService.java   | 215 ++++++++++++++
 .../vault/ksm/secret/KsmSecretService.java    |  19 +-
 .../vault/ksm/user/KsmConnection.java         |   5 +-
 .../vault/ksm/user/KsmConnectionGroup.java    |  49 ++--
 .../vault/ksm/user/KsmDirectory.java          |  93 ++++++
 .../vault/ksm/user/KsmDirectoryService.java   | 269 ++++--------------
 .../guacamole/vault/ksm/user/KsmUser.java     |  74 ++++-
 .../vault/ksm/user/KsmUserFactory.java        |  40 +++
 9 files changed, 519 insertions(+), 253 deletions(-)
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectory.java
 create mode 100644 extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUserFactory.java

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
index faf22aa4e..b9d38da93 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/KsmAuthenticationProviderModule.java
@@ -24,7 +24,10 @@ import org.apache.guacamole.vault.VaultAuthenticationProviderModule;
 import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
 import org.apache.guacamole.vault.ksm.secret.KsmSecretService;
+import org.apache.guacamole.vault.ksm.user.KsmConnectionGroup;
 import org.apache.guacamole.vault.ksm.user.KsmDirectoryService;
+import org.apache.guacamole.vault.ksm.user.KsmUserFactory;
+import org.apache.guacamole.vault.ksm.user.KsmUser;
 import org.apache.guacamole.vault.conf.VaultAttributeService;
 import org.apache.guacamole.vault.conf.VaultConfigurationService;
 import org.apache.guacamole.vault.ksm.secret.KsmClient;
@@ -67,6 +70,11 @@ public class KsmAuthenticationProviderModule
         install(new FactoryModuleBuilder()
                 .implement(KsmClient.class, KsmClient.class)
                 .build(KsmClientFactory.class));
+
+        // Bind factory for creating KsmUsers
+        install(new FactoryModuleBuilder()
+                .implement(KsmUser.class, KsmUser.class)
+                .build(KsmUserFactory.class));
     }
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
index 24958208d..c1d3b95d5 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
@@ -19,20 +19,30 @@
 
 package org.apache.guacamole.vault.ksm.conf;
 
+import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
+import java.util.Base64;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
 
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.form.BooleanField;
 import org.apache.guacamole.form.Form;
 import org.apache.guacamole.form.TextField;
+import org.apache.guacamole.language.TranslatableGuacamoleClientException;
 import org.apache.guacamole.vault.conf.VaultAttributeService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
+import com.keepersecurity.secretsManager.core.InMemoryStorage;
+import com.keepersecurity.secretsManager.core.SecretsManager;
+import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
 
 /**
  * A service that exposes KSM-specific attributes, allowing setting KSM
@@ -52,12 +62,41 @@ public class KsmAttributeService implements VaultAttributeService {
     @Inject
     private KsmConfigurationService configurationService;
 
+    /**
+     * A singleton ObjectMapper for converting a Map to a JSON string when
+     * generating a base64-encoded JSON KSM config blob.
+     */
+    private static final ObjectMapper objectMapper = new ObjectMapper();
+
+    /**
+     * All expected fields in the KSM configuration JSON blob.
+     */
+    private static final List<String> EXPECTED_KSM_FIELDS = (
+            Collections.unmodifiableList(Arrays.asList(
+                    SecretsManager.KEY_HOSTNAME,
+                    SecretsManager.KEY_CLIENT_ID,
+                    SecretsManager.KEY_PRIVATE_KEY,
+                    SecretsManager.KEY_CLIENT_KEY,
+                    SecretsManager.KEY_APP_KEY,
+                    SecretsManager.KEY_OWNER_PUBLIC_KEY,
+                    SecretsManager.KEY_SERVER_PUBIC_KEY_ID
+    )));
+
     /**
      * The name of the attribute which can contain a KSM configuration blob
      * associated with either a connection group or user.
      */
     public static final String KSM_CONFIGURATION_ATTRIBUTE = "ksm-config";
 
+    /**
+     * The KSM configuration attribute contains sensitive information, so it
+     * should not be exposed through the directory. Instead, if a value is
+     * set on the attributes of an object, the following value will be exposed
+     * in its place, and correspondingly the underlying value will not be
+     * changed if this value is provided to an update call.
+     */
+    public static final String KSM_ATTRIBUTE_PLACEHOLDER_VALUE = "**********";
+
     /**
      * All attributes related to configuring the KSM vault on a
      * per-connection-group or per-user basis.
@@ -133,5 +172,181 @@ public class KsmAttributeService implements VaultAttributeService {
         }
     }
 
+    /**
+     * Sanitize the value of the provided KSM config attribute. If the provided
+     * config value is non-empty, it will be replaced with the placeholder
+     * value to avoid leaking sensitive information. If the value is empty, it
+     * will be replaced by `null`.
+     *
+     * @param ksmAttributeValue
+     *    The KSM configuration attribute value to sanitize.
+     *
+     * @return
+     *    The sanitized KSM configuration attribute value, stripped of any
+     *    sensitive information.
+     */
+    public static String sanitizeKsmAttributeValue(String ksmAttributeValue) {
+
+        // Any non-empty values may contain sensitive information, and should
+        // be replaced by the safe placeholder value
+        if (ksmAttributeValue != null && !ksmAttributeValue.trim().isEmpty())
+            return KSM_ATTRIBUTE_PLACEHOLDER_VALUE;
+
+        // If the configuration value is empty, expose a null value
+        else
+            return null;
+
+    }
+
+    /**
+     * Return true if the provided input is a valid base64-encoded string,
+     * false otherwise.
+     *
+     * @param input
+     *     The string to check if base-64 encoded.
+     *
+     * @return
+     *     true if the provided input is a valid base64-encoded string,
+     *     false otherwise.
+     */
+    private static boolean isBase64(String input) {
+
+        try {
+            Base64.getDecoder().decode(input);
+            return true;
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+    }
+
+    /**
+     * Given a map of attribute values, check for the presence of the
+     * KSM_CONFIGURATION_ATTRIBUTE attribute. If it's set, check if it's a valid
+     * KSM one-time token. If so, attempt to translate it to a base-64-encoded
+     * json KSM config blob. If it's already a KSM config blob, validate it as
+     * config blob. If either validation fails, a GuacamoleException will be thrown.
+     * The processed attribute values will be returned.
+     *
+     * @param attributes
+     *     The attributes for which the KSM configuration attribute
+     *     parsing/validation should be performed.
+     *
+     * @throws GuacamoleException
+     *     If the KSM_CONFIGURATION_ATTRIBUTE is set, but fails to validate as
+     *     either a KSM one-time-token, or a KSM base64-encoded JSON config blob.
+     */
+    public Map<String, String> processAttributes(
+            Map<String, String> attributes) throws GuacamoleException {
+
+        // Get the value of the KSM config attribute in the provided map
+        String ksmConfigValue = attributes.get(
+                KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
+
+        // If the placeholder value was provided, do not update the attribute
+        if (KsmAttributeService.KSM_ATTRIBUTE_PLACEHOLDER_VALUE.equals(ksmConfigValue)) {
+
+            // Remove the attribute from the map so it won't be updated
+            attributes = new HashMap<>(attributes);
+            attributes.remove(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
+
+        }
+
+        // Check if the attribute is set to a non-empty value
+        else if (ksmConfigValue != null && !ksmConfigValue.trim().isEmpty()) {
+
+            // If it's already base64-encoded, it's a KSM configuration blob,
+            // so validate it immediately
+            if (isBase64(ksmConfigValue)) {
+
+                // Attempt to validate the config as a base64-econded KSM config blob
+                try {
+                    KsmConfig.parseKsmConfig(ksmConfigValue);
+
+                    // If it validates, the entity can be left alone - it's already valid
+                    return attributes;
+                }
+
+                catch (GuacamoleException exception) {
+
+                    // If the parsing attempt fails, throw a translatable error for display
+                    // on the frontend
+                    throw new TranslatableGuacamoleClientException(
+                            "Invalid base64-encoded JSON KSM config provided for "
+                            + KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE + " attribute",
+                            "CONNECTION_GROUP_ATTRIBUTES.ERROR_INVALID_KSM_CONFIG_BLOB",
+                            exception);
+                }
+            }
+
+            // It wasn't a valid base64-encoded string, it should be a one-time token, so
+            // attempt to validat it as such, and if valid, update the attribute to the
+            // base64 config blob generated by the token
+            try {
+
+                // Create an initially empty storage to be populated using the one-time token
+                InMemoryStorage storage = new InMemoryStorage();
+
+                // Populate the in-memory storage using the one-time-token
+                SecretsManager.initializeStorage(storage, ksmConfigValue, null);
+
+                // Create an options object using the values we extracted from the one-time token
+                SecretsManagerOptions options = new SecretsManagerOptions(
+                    storage, null,
+                    configurationService.getAllowUnverifiedCertificate());
+
+                // Attempt to fetch secrets using the options we created. This will both validate
+                // that the configuration works, and potentially populate missing fields that the
+                // initializeStorage() call did not set.
+                SecretsManager.getSecrets(options);
+
+                // Create a map to store the extracted values from the KSM storage
+                Map<String, String> configMap = new HashMap<>();
+
+                // Go through all the expected fields, extract from the KSM storage,
+                // and write to the newly created map
+                EXPECTED_KSM_FIELDS.forEach(configKey -> {
+
+                    // Only write the value into the new map if non-null
+                    String value = storage.getString(configKey);
+                    if (value != null)
+                        configMap.put(configKey, value);
+
+                });
+
+                // JSON-encode the value, and then base64 encode that to get the format
+                // that KSM would expect
+                String jsonString = objectMapper.writeValueAsString(configMap);
+                String base64EncodedJson = Base64.getEncoder().encodeToString(
+                        jsonString.getBytes(StandardCharsets.UTF_8));
+
+                // Finally, try to parse the newly generated token as a KSM config. If this
+                // works, the config should be fully functional
+                KsmConfig.parseKsmConfig(base64EncodedJson);
+
+                // Make a copy of the existing attributes, modifying just the value for
+                // KSM_CONFIGURATION_ATTRIBUTE
+                attributes = new HashMap<>(attributes);
+                attributes.put(
+                        KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, base64EncodedJson);
+
+            }
+
+            // The KSM SDK only throws raw Exceptions, so we can't be more specific
+            catch (Exception exception) {
+
+                // If the parsing attempt fails, throw a translatable error for display
+                // on the frontend
+                throw new TranslatableGuacamoleClientException(
+                        "Invalid one-time KSM token provided for "
+                        + KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE + " attribute",
+                        "CONNECTION_GROUP_ATTRIBUTES.ERROR_INVALID_KSM_ONE_TIME_TOKEN",
+                        exception);
+            }
+        }
+
+        return attributes;
+
+    }
+
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index 59c1450bf..515c1fc3d 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -47,12 +47,14 @@ import org.apache.guacamole.net.auth.Connectable;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.ConnectionGroup;
 import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.net.auth.UserContext;
 import org.apache.guacamole.protocol.GuacamoleConfiguration;
 import org.apache.guacamole.token.TokenFilter;
 import org.apache.guacamole.vault.ksm.GuacamoleExceptionSupplier;
 import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
+import org.apache.guacamole.vault.ksm.user.KsmDirectory;
 import org.apache.guacamole.vault.secret.VaultSecretService;
 import org.apache.guacamole.vault.secret.WindowsUsername;
 import org.slf4j.Logger;
@@ -299,7 +301,12 @@ public class KsmSecretService implements VaultSecretService {
         Set<String> observedIdentifiers = new HashSet<>();
         observedIdentifiers.add(parentIdentifier);
 
-        Directory<ConnectionGroup> connectionGroupDirectory = userContext.getConnectionGroupDirectory();
+        // Use the unwrapped connection group directory to avoid KSM config
+        // value sanitization
+        Directory<ConnectionGroup> connectionGroupDirectory = (
+                (KsmDirectory<ConnectionGroup>) userContext.getConnectionGroupDirectory()
+                ).getUnderlyingDirectory();
+
         while (true) {
 
             // Fetch the parent group, if one exists
@@ -378,10 +385,16 @@ public class KsmSecretService implements VaultSecretService {
 
         // If user KSM configs are enabled globally, and for the given connectable,
         // return the user-specific KSM config, if one exists
-        if (confService.getAllowUserConfig() && isKsmUserConfigEnabled(connectable))
+        if (confService.getAllowUserConfig() && isKsmUserConfigEnabled(connectable)) {
 
-            return userContext.self().getAttributes().get(
+            // Get the underlying user, to avoid the KSM config sanitization
+            User self = (
+                    ((KsmDirectory<User>) userContext.getUserDirectory())
+                    .getUnderlyingDirectory().get(userContext.self().getIdentifier()));
+
+            return self.getAttributes().get(
                     KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
+        }
 
 
         // If user-specific KSM config is disabled globally or for the given
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java
index 24d7dd062..3981486fe 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnection.java
@@ -62,10 +62,9 @@ public class KsmConnection extends DelegatingConnection {
         // Make a copy of the existing map
         Map<String, String> attributes = Maps.newHashMap(super.getAttributes());
 
-        // Add the configuration attribute
-        attributes.putIfAbsent(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, null);
+        // Add the user-config-enabled configuration attribute
+        attributes.putIfAbsent(KsmAttributeService.KSM_USER_CONFIG_ENABLED_ATTRIBUTE, null);
         return attributes;
-
     }
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java
index 175e4dd5f..68d445771 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java
@@ -30,34 +30,31 @@ import com.google.common.collect.Maps;
  /**
   * A KSM-specific connection group implementation that always exposes
   * the KSM_CONFIGURATION_ATTRIBUTE attribute, even when no value is set.
-  * This ensures that the attribute will always show up in the UI, even
-  * for connection groups that don't already have it set.
+  * The value of the attribute will be sanitized if non-empty. This ensures
+  * that the attribute will always show up in the UI, even for connection
+  * groups that don't already have it set, and that any sensitive information
+  * in the attribute value will not be exposed.
   */
  public class KsmConnectionGroup extends DelegatingConnectionGroup {
 
     /**
-     * Create a new KsmConnectionGroup instance, wrapping the provided
-     * ConnectionGroup.
+     * Create a new KsmConnectionGroup wrapping the provided ConnectionGroup record.
      *
      * @param connectionGroup
-     *     The ConnectionGroup instance to wrap.
+     *     The ConnectionGroup record to wrap.
      */
-    public KsmConnectionGroup(ConnectionGroup connectionGroup) {
-
-        // Wrap the provided connection group
+    KsmConnectionGroup(ConnectionGroup connectionGroup) {
         super(connectionGroup);
     }
 
-    @Override
-    public Map<String, String> getAttributes() {
-
-        // Make a copy of the existing map
-        Map<String, String> attributes = Maps.newHashMap(super.getAttributes());
-
-        // Add the configuration attribute
-        attributes.putIfAbsent(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, null);
-        return attributes;
-
+    /**
+     * Return the underlying wrapped connection group record.
+     *
+     * @return
+     *     The wrapped connection group record.
+     */
+    ConnectionGroup getUnderlyingConnectionGroup() {
+        return getDelegateConnectionGroup();
     }
 
     /**
@@ -70,4 +67,20 @@ import com.google.common.collect.Maps;
         return getDelegateConnectionGroup();
     }
 
+    @Override
+    public Map<String, String> getAttributes() {
+
+        // Make a copy of the existing map
+        Map<String, String> attributes = Maps.newHashMap(super.getAttributes());
+
+        // Sanitize the KSM configuration attribute, and ensure the attribute
+        // is always present
+        attributes.put(
+                KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE,
+                KsmAttributeService.sanitizeKsmAttributeValue(
+                    attributes.get(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE)));
+
+        return attributes;
+    }
+
  }
\ No newline at end of file
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectory.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectory.java
new file mode 100644
index 000000000..5cfcca947
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectory.java
@@ -0,0 +1,93 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.user;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.DelegatingDirectory;
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.Identifiable;
+
+/**
+ * A KSM-specific version of DecoratingDirectory that exposes the underlying
+ * directory for when it's needed.
+ */
+public abstract class KsmDirectory<ObjectType extends Identifiable>
+        extends DelegatingDirectory<ObjectType> {
+
+    /**
+     * Create a new KsmDirectory, delegating to the provided directory.
+     *
+     * @param directory
+     *    The directory to delegate to.
+     */
+    public KsmDirectory(Directory<ObjectType> directory) {
+        super(directory);
+    }
+
+    /**
+     * Returns the underlying directory that this DecoratingDirectory is
+     * delegating to.
+     *
+     * @return
+     *    The underlying directory.
+     */
+    public Directory<ObjectType> getUnderlyingDirectory() {
+        return getDelegateDirectory();
+    }
+
+    /**
+     * Process and return a potentially-modified version of the object
+     * with the same identifier in the wrapped directory.
+     *
+     * @param object
+     *     The object from the underlying directory.
+     *
+     * @return
+     *     A potentially-modified version of the object with the same
+     *     identifier in the wrapped directory.
+     */
+    protected abstract ObjectType wrap(ObjectType object);
+
+    @Override
+    public ObjectType get(String identifier) throws GuacamoleException {
+
+        // Process and return the object from the wrapped directory
+        return wrap(super.get(identifier));
+
+    }
+
+    @Override
+    public Collection<ObjectType> getAll(Collection<String> identifiers)
+            throws GuacamoleException {
+
+        // Process and return each object from the wrapped directory
+        return super.getAll(identifiers).stream().map(
+                superObject -> wrap(superObject)
+                ).collect(Collectors.toList());
+
+    }
+
+}
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
index 6ce734601..5203a06dd 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
@@ -19,32 +19,17 @@
 
 package org.apache.guacamole.vault.ksm.user;
 
-import java.nio.charset.StandardCharsets;
-import java.util.Arrays;
-import java.util.Base64;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.language.TranslatableGuacamoleClientException;
-import org.apache.guacamole.net.auth.Attributes;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.ConnectionGroup;
 import org.apache.guacamole.net.auth.DecoratingDirectory;
+import org.apache.guacamole.net.auth.DelegatingDirectory;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
-import org.apache.guacamole.vault.ksm.conf.KsmConfig;
-import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
 import org.apache.guacamole.vault.user.VaultDirectoryService;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.inject.Inject;
-import com.keepersecurity.secretsManager.core.InMemoryStorage;
-import com.keepersecurity.secretsManager.core.SecretsManager;
-import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
 
 /**
  * A KSM-specific vault directory service that wraps the connection group directory
@@ -54,175 +39,17 @@ import com.keepersecurity.secretsManager.core.SecretsManagerOptions;
 public class KsmDirectoryService extends VaultDirectoryService {
 
     /**
-     * Service for retrieving KSM configuration details.
+     * A factory for constructing new KsmUser instances.
      */
     @Inject
-    private KsmConfigurationService configurationService;
+    private KsmUserFactory ksmUserFactory;
 
     /**
-     * A singleton ObjectMapper for converting a Map to a JSON string when
-     * generating a base64-encoded JSON KSM config blob.
+     * Service for retrieving any custom attributes defined for the
+     * current vault implementation and processing of said attributes.
      */
-    private static final ObjectMapper objectMapper = new ObjectMapper();
-
-    /**
-     * All expected fields in the KSM configuration JSON blob.
-     */
-    private static final List<String> EXPECTED_KSM_FIELDS = (
-            Collections.unmodifiableList(Arrays.asList(
-                    SecretsManager.KEY_HOSTNAME,
-                    SecretsManager.KEY_CLIENT_ID,
-                    SecretsManager.KEY_PRIVATE_KEY,
-                    SecretsManager.KEY_CLIENT_KEY,
-                    SecretsManager.KEY_APP_KEY,
-                    SecretsManager.KEY_OWNER_PUBLIC_KEY,
-                    SecretsManager.KEY_SERVER_PUBIC_KEY_ID
-    )));
-
-    /**
-     * Return true if the provided input is a valid base64-encoded string,
-     * false otherwise.
-     *
-     * @param input
-     *     The string to check if base-64 encoded.
-     *
-     * @return
-     *     true if the provided input is a valid base64-encoded string,
-     *     false otherwise.
-     */
-    private static boolean isBase64(String input) {
-
-        try {
-            Base64.getDecoder().decode(input);
-            return true;
-        } catch (IllegalArgumentException e) {
-            return false;
-        }
-    }
-
-    /**
-     * Given an attributes-enabled entity, check for the presence of the
-     * KSM_CONFIGURATION_ATTRIBUTE attribute. If it's set, check if it's a valid
-     * KSM one-time token. If so, attempt to translate it to a base-64-encoded
-     * json KSM config blob, and set it back to the provided entity.
-     * If it's already a KSM config blob, validate it as config blob. If either
-     * validation fails, a GuacamoleException will be thrown.
-     *
-     * @param entity
-     *     The attributes-enabled entity for which the KSM configuration
-     *     attribute parsing/validation should be performed.
-     *
-     * @throws GuacamoleException
-     *     If the KSM_CONFIGURATION_ATTRIBUTE is set, but fails to validate as
-     *     either a KSM one-time-token, or a KSM base64-encoded JSON config blob.
-     */
-    public void processAttributes(Attributes entity) throws GuacamoleException {
-
-        // By default, if the KSM config attribute isn't being set, pass the
-        // provided attributes through without any changes
-        Map<String, String> attributes = entity.getAttributes();
-
-        // Get the value of the KSM config attribute in the provided map
-        String ksmConfigValue = attributes.get(
-                KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
-
-        // Check if the attribute is set to a non-empty value
-        if (ksmConfigValue != null && !ksmConfigValue.trim().isEmpty()) {
-
-            // If it's already base64-encoded, it's a KSM configuration blob,
-            // so validate it immediately
-            if (isBase64(ksmConfigValue)) {
-
-                // Attempt to validate the config as a base64-econded KSM config blob
-                try {
-                    KsmConfig.parseKsmConfig(ksmConfigValue);
-
-                    // If it validates, the entity can be left alone - it's already valid
-                    return;
-                }
-
-                catch (GuacamoleException exception) {
-
-                    // If the parsing attempt fails, throw a translatable error for display
-                    // on the frontend
-                    throw new TranslatableGuacamoleClientException(
-                            "Invalid base64-encoded JSON KSM config provided for "
-                            + KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE + " attribute",
-                            "CONNECTION_GROUP_ATTRIBUTES.ERROR_INVALID_KSM_CONFIG_BLOB",
-                            exception);
-                }
-            }
-
-            // It wasn't a valid base64-encoded string, it should be a one-time token, so
-            // attempt to validat it as such, and if valid, update the attribute to the
-            // base64 config blob generated by the token
-            try {
-
-                // Create an initially empty storage to be populated using the one-time token
-                InMemoryStorage storage = new InMemoryStorage();
-
-                // Populate the in-memory storage using the one-time-token
-                SecretsManager.initializeStorage(storage, ksmConfigValue, null);
-
-                // Create an options object using the values we extracted from the one-time token
-                SecretsManagerOptions options = new SecretsManagerOptions(
-                    storage, null,
-                    configurationService.getAllowUnverifiedCertificate());
-
-                // Attempt to fetch secrets using the options we created. This will both validate
-                // that the configuration works, and potentially populate missing fields that the
-                // initializeStorage() call did not set.
-                SecretsManager.getSecrets(options);
-
-                // Create a map to store the extracted values from the KSM storage
-                Map<String, String> configMap = new HashMap<>();
-
-                // Go through all the expected fields, extract from the KSM storage,
-                // and write to the newly created map
-                EXPECTED_KSM_FIELDS.forEach(configKey -> {
-
-                    // Only write the value into the new map if non-null
-                    String value = storage.getString(configKey);
-                    if (value != null)
-                        configMap.put(configKey, value);
-
-                });
-
-                // JSON-encode the value, and then base64 encode that to get the format
-                // that KSM would expect
-                String jsonString = objectMapper.writeValueAsString(configMap);
-                String base64EncodedJson = Base64.getEncoder().encodeToString(
-                        jsonString.getBytes(StandardCharsets.UTF_8));
-
-                // Finally, try to parse the newly generated token as a KSM config. If this
-                // works, the config should be fully functional
-                KsmConfig.parseKsmConfig(base64EncodedJson);
-
-                // Make a copy of the existing attributes, modifying just the value for
-                // KSM_CONFIGURATION_ATTRIBUTE
-                attributes = new HashMap<>(attributes);
-                attributes.put(
-                        KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, base64EncodedJson);
-
-                // Set the newly updated attributes back to the original object
-                entity.setAttributes(attributes);
-
-            }
-
-            // The KSM SDK only throws raw Exceptions, so we can't be more specific
-            catch (Exception exception) {
-
-                // If the parsing attempt fails, throw a translatable error for display
-                // on the frontend
-                throw new TranslatableGuacamoleClientException(
-                        "Invalid one-time KSM token provided for "
-                        + KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE + " attribute",
-                        "CONNECTION_GROUP_ATTRIBUTES.ERROR_INVALID_KSM_ONE_TIME_TOKEN",
-                        exception);
-            }
-        }
-
-    }
+    @Inject
+    private KsmAttributeService attributeService;
 
     @Override
     public Directory<Connection> getConnectionDirectory(
@@ -259,40 +86,45 @@ public class KsmDirectoryService extends VaultDirectoryService {
         // validate KSM configurations, and translate one-time-tokens, if possible,
         // as well as ensuring that all ConnectionGroups returned include the
         // KSM_CONFIGURATION_ATTRIBUTE attribute, so it will be available in the UI.
-        return new DecoratingDirectory<ConnectionGroup>(underlyingDirectory) {
+        // The value of the KSM_CONFIGURATION_ATTRIBUTE will be sanitized if set.
+        return new KsmDirectory<ConnectionGroup>(underlyingDirectory) {
 
             @Override
             public void add(ConnectionGroup connectionGroup) throws GuacamoleException {
 
-                // Check for the KSM config attribute and translate the one-time token
-                // if possible before adding
-                processAttributes(connectionGroup);
+                // Process attribute values before saving
+                connectionGroup.setAttributes(
+                    attributeService.processAttributes(
+                        connectionGroup.getAttributes()));
+
                 super.add(connectionGroup);
             }
 
             @Override
             public void update(ConnectionGroup connectionGroup) throws GuacamoleException {
 
-                // Check for the KSM config attribute and translate the one-time token
-                // if possible before updating
-                processAttributes(connectionGroup);
+                // Unwrap the existing ConnectionGroup
+                if (connectionGroup instanceof KsmConnectionGroup)
+                    connectionGroup = ((KsmConnectionGroup) connectionGroup).getUnderlyingConnectionGroup();
+
+                // Process attribute values before saving
+                connectionGroup.setAttributes(
+                    attributeService.processAttributes(
+                        connectionGroup.getAttributes()));
+
                 super.update(connectionGroup);
-            }
-
-            @Override
-            protected ConnectionGroup decorate(ConnectionGroup connectionGroup) throws GuacamoleException {
-
-                // Wrap the existing connection group in a KsmConnection to ensure the presence of the
-                // KSM_CONFIGURATION_ATTRIBUTE attribute
-                return new KsmConnectionGroup(connectionGroup);
 
             }
 
             @Override
-            protected ConnectionGroup undecorate(ConnectionGroup connectionGroup) throws GuacamoleException {
+            protected ConnectionGroup wrap(ConnectionGroup object) {
 
-                // Return the underlying connection group that the KsmConnectionGroup wraps
-                return ((KsmConnectionGroup) connectionGroup).getUnderlyConnectionGroup();
+                // Do not process the ConnectionGroup further if it does not exist
+                if (object == null)
+                    return null;
+
+                // Sanitize values when a ConnectionGroup is fetched from the directory
+                return new KsmConnectionGroup(object);
 
             }
 
@@ -307,40 +139,47 @@ public class KsmDirectoryService extends VaultDirectoryService {
         // validate KSM configurations, and translate one-time-tokens, if possible
         // Additionally, this directory will will decorate all users with a
         // KsmUser wrapper to ensure that all defined KSM fields will be exposed
-        // in the user attributes.
-        return new DecoratingDirectory<User>(underlyingDirectory) {
+        // in the user attributes.  The value of the KSM_CONFIGURATION_ATTRIBUTE
+        // will be sanitized if set.
+        return new KsmDirectory<User>(underlyingDirectory) {
 
             @Override
             public void add(User user) throws GuacamoleException {
 
-                // Check for the KSM config attribute and translate the one-time token
-                // if possible before adding
-                processAttributes(user);
+                // Process attribute values before saving
+                user.setAttributes(
+                    attributeService.processAttributes(
+                        user.getAttributes()));
+
                 super.add(user);
             }
 
             @Override
             public void update(User user) throws GuacamoleException {
 
-                // Check for the KSM config attribute and translate the one-time token
-                // if possible before updating
-                processAttributes(user);
+                // Unwrap the existing user
+                if (user instanceof KsmUser)
+                    user = ((KsmUser) user).getUnderlyingUser();
+
+                // Process attribute values before saving
+                user.setAttributes(
+                    attributeService.processAttributes(
+                        user.getAttributes()));
+
                 super.update(user);
+
             }
 
             @Override
-            protected User decorate(User user) throws GuacamoleException {
+            protected User wrap(User object) {
 
-                // Wrap in a KsmUser class to ensure that all defined KSM fields will be
-                // present
-                return new KsmUser(user);
-            }
+                // Do not process the user further if it does not exist
+                if (object == null)
+                    return null;
 
-            @Override
-            protected User undecorate(User user) throws GuacamoleException {
+                // Sanitize values when a user is fetched from the directory
+                return ksmUserFactory.create(object);
 
-                // Unwrap the KsmUser
-                return ((KsmUser) user).getUnderlyingUser();
             }
 
         };
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java
index dc2877564..9c002eb4d 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUser.java
@@ -21,27 +21,49 @@ package org.apache.guacamole.vault.ksm.user;
 
 import java.util.Map;
 
-import org.apache.guacamole.net.auth.DelegatingUser;
+import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.net.auth.User;
+import org.apache.guacamole.net.auth.DelegatingUser;
 import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
+import org.apache.guacamole.vault.ksm.conf.KsmConfigurationService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import com.google.common.collect.Maps;
+import com.google.inject.Inject;
+import com.google.inject.assistedinject.Assisted;
+import com.google.inject.assistedinject.AssistedInject;
 
-/**
- * A User that explicitly adds a blank entry for any defined
- * KSM user attributes.
- */
-public class KsmUser extends DelegatingUser {
+ /**
+  * A KSM-specific user implementation that exposes the
+  * KSM_CONFIGURATION_ATTRIBUTE attribute even if no value is set. but only
+  * if user-specific KSM configuration is enabled. The value of the attribute
+  * will be sanitized if non-empty. This ensures that the attribute will always
+  * show up in the UI when the feature is enabled, even for users that don't
+  * already have it set, and that any sensitive information in the attribute
+  * value will not be exposed.
+  */
+ public class KsmUser extends DelegatingUser {
 
     /**
-     * Create a new Vault user wrapping the provided User record. Any
-     * KSM-specific attribute forms will have empty values automatically
-     * populated when getAttributes() is called.
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(KsmUser.class);
+
+    /**
+     * Service for retrieving KSM configuration details.
+     */
+    @Inject
+    private KsmConfigurationService configurationService;
+
+    /**
+     * Create a new Ksmuser wrapping the provided User record.
      *
      * @param user
-     *     The user record to wrap.
+     *     The User record to wrap.
      */
-    KsmUser(User user) {
+    @AssistedInject
+    KsmUser(@Assisted User user) {
         super(user);
     }
 
@@ -61,9 +83,33 @@ public class KsmUser extends DelegatingUser {
         // Make a copy of the existing map
         Map<String, String> attributes = Maps.newHashMap(super.getAttributes());
 
-        // Add the configuration attribute
-        attributes.putIfAbsent(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, null);
+        // Figure out if user-level KSM config is enabled
+        boolean userKsmConfigEnabled = false;
+        try {
+            userKsmConfigEnabled = configurationService.getAllowUserConfig();
+        } catch (GuacamoleException e) {
+
+            logger.warn(
+                    "Disabling user KSM config due to exception: {}"
+                    , e.getMessage());
+            logger.debug("Error looking up if user KSM config is enabled.", e);
+
+        }
+
+        // If user-specific KSM configuration is not enabled, do not expose the
+        // attribute at all
+        if (!userKsmConfigEnabled)
+            attributes.remove(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);
+
+        else
+            // Sanitize the KSM configuration attribute, and ensure the attribute
+            // is always present
+            attributes.put(
+                    KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE,
+                    KsmAttributeService.sanitizeKsmAttributeValue(
+                        attributes.get(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE)));
+
         return attributes;
     }
 
-}
+ }
\ No newline at end of file
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUserFactory.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUserFactory.java
new file mode 100644
index 000000000..9aafbb622
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmUserFactory.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.user;
+
+import org.apache.guacamole.net.auth.User;
+
+/**
+ * Factory for creating KSM-specific users, which wrap an underlying User.
+ */
+public interface KsmUserFactory {
+
+    /**
+     * Returns a new instance of a KsmUser, wrapping the provided underlying User.
+     *
+     * @param user
+     *     The underlying User that should be wrapped.
+     *
+     * @return
+     *     A new instance of a KsmUser, wrapping the provided underlying User.
+     */
+    KsmUser create(User user);
+
+}

From b8d2a9edc19ca495576b44802eb61e617824df32 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 29 Sep 2022 03:12:13 +0000
Subject: [PATCH 079/289] GUACAMOLE-1656: Check if user KSM config is null
 before constructing a client.

---
 .../org/apache/guacamole/vault/ksm/secret/KsmSecretService.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index 515c1fc3d..f4d3c0626 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -163,7 +163,7 @@ public class KsmSecretService implements VaultSecretService {
 
                 // If the user config happens to be the same as admin-defined one,
                 // don't bother trying again
-                if (!Objects.equal(userKsmConfig, ksmConfig))
+                if (userKsmConfig != null && !Objects.equal(userKsmConfig, ksmConfig))
                     return getClient(userKsmConfig).getSecret(name);
 
                 return CompletableFuture.completedFuture(null);

From e1794550ef317fc4cd6eb88050f9dfb6117f9aec Mon Sep 17 00:00:00 2001
From: Joshua Lancaster <joshua.lancaster@kudelskisecurity.com>
Date: Fri, 30 Sep 2022 07:21:25 -0700
Subject: [PATCH 080/289] GUACAMOLE-1628: Docker image of guacamole client is
 missing unzip

---
 Dockerfile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 5bafc1972..c482775e9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -53,10 +53,10 @@ RUN /opt/guacamole/bin/build-guacamole.sh "$BUILD_DIR" /opt/guacamole "$BUILD_PR
 # For the runtime image, we start with the official Tomcat distribution
 FROM tomcat:${TOMCAT_VERSION}-${TOMCAT_JRE}
 
-# Install XMLStarlet for server.xml alterations
+# Install XMLStarlet for server.xml alterations and unzip for LOGBACK_LEVEL case
 RUN apt-get update -qq \
-    && apt-get install -y xmlstarlet \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get install -y xmlstarlet unzip\
+    && rm -rf /var/lib/apt/lists/* 
 
 # This is where the build artifacts go in the runtime image
 WORKDIR /opt/guacamole

From 417587259f427db04624b731d7536ee048b3856a Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 20 Sep 2022 17:07:17 -0700
Subject: [PATCH 081/289] GUACAMOLE-1224: Add CRUD-type events for Directory
 modifications.

---
 .../apache/guacamole/net/auth/Directory.java  |  98 +++++++
 .../guacamole/net/event/DirectoryEvent.java   | 111 ++++++++
 .../net/event/DirectoryFailureEvent.java      |  36 +++
 .../net/event/DirectorySuccessEvent.java      |  35 +++
 .../guacamole/net/auth/DirectoryTest.java     | 124 +++++++++
 .../ActiveConnectionDirectoryResource.java    |  10 +-
 .../ActiveConnectionResource.java             |  29 +--
 .../ConnectionDirectoryResource.java          |  10 +-
 .../rest/connection/ConnectionResource.java   |  33 ++-
 .../ConnectionGroupDirectoryResource.java     |  34 +--
 .../ConnectionGroupResource.java              |  27 +-
 .../directory/DirectoryObjectResource.java    | 198 +++++++++++++-
 .../DirectoryObjectResourceFactory.java       |   8 +-
 .../rest/directory/DirectoryResource.java     | 244 +++++++++++++++++-
 .../directory/DirectoryResourceFactory.java   |   7 +-
 .../rest/session/SessionResource.java         |   2 +-
 .../rest/session/UserContextResource.java     |  39 ++-
 .../session/UserContextResourceFactory.java   |   7 +-
 .../SharingProfileDirectoryResource.java      |  10 +-
 .../SharingProfileResource.java               |  26 +-
 .../rest/tunnel/TunnelCollectionResource.java |   2 +-
 .../guacamole/rest/tunnel/TunnelResource.java |  15 +-
 .../rest/tunnel/TunnelResourceFactory.java    |   6 +-
 .../rest/user/UserDirectoryResource.java      |   9 +-
 .../guacamole/rest/user/UserResource.java     |  45 ++--
 .../usergroup/UserGroupDirectoryResource.java |  10 +-
 .../rest/usergroup/UserGroupResource.java     |  23 +-
 27 files changed, 1022 insertions(+), 176 deletions(-)
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryFailureEvent.java
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectorySuccessEvent.java
 create mode 100644 guacamole-ext/src/test/java/org/apache/guacamole/net/auth/DirectoryTest.java

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java
index 287145fc0..ba1e1522d 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java
@@ -34,6 +34,104 @@ import org.apache.guacamole.GuacamoleException;
  */
 public interface Directory<ObjectType extends Identifiable> {
 
+    /**
+     * All Directory types that may be found on the {@link UserContext}
+     * interface.
+     */
+    public enum Type {
+
+        /**
+         * The type of a Directory that contains {@link ActiveConnection}
+         * objects.
+         */
+        ACTIVE_CONNECTION(ActiveConnection.class),
+
+        /**
+         * The type of a Directory that contains {@link Connection}
+         * objects.
+         */
+        CONNECTION(Connection.class),
+
+        /**
+         * The type of a Directory that contains {@link ConnectionGroup}
+         * objects.
+         */
+        CONNECTION_GROUP(ConnectionGroup.class),
+
+        /**
+         * The type of a Directory that contains {@link SharingProfile}
+         * objects.
+         */
+        SHARING_PROFILE(SharingProfile.class),
+
+        /**
+         * The type of a Directory that contains {@link User} objects.
+         */
+        USER(User.class),
+
+        /**
+         * The type of a Directory that contains {@link UserGroup}
+         * objects.
+         */
+        USER_GROUP(UserGroup.class);
+
+        /**
+         * The base class of the type of object stored within the type of
+         * Directory represented by this Directory.Type.
+         */
+        private final Class<? extends Identifiable> objectType;
+
+        /**
+         * Creates a new Directory.Type representing the type of a Directory
+         * that contains only subclasses of the given class.
+         *
+         * @param objectType
+         *     The base class of the type of object stored within the type of
+         *     Directory represented by this Directory.Type.
+         */
+        private Type(Class<? extends Identifiable> objectType) {
+            this.objectType = objectType;
+        }
+
+        /**
+         * Returns the base class of the type of object stored within a
+         * {@link Directory} of this type.
+         *
+         * @return
+         *     The base class of the type of object stored within a
+         *     {@link Directory} of this type.
+         */
+        public Class<? extends Identifiable> getObjectType() {
+            return objectType;
+        }
+
+        /**
+         * Returns the Directory.Type representing the type of a Directory that
+         * could contain an object having the given class. The class may be a
+         * subclass of the overall base class of the objects stored within the
+         * Directory.
+         *
+         * @param objectType
+         *     The class to determine the Directory.Type of.
+         *
+         * @return
+         *     The Directory.Type representing the type of a Directory that
+         *     could contain an object having the given class, or null if there
+         *     is no such Directory available via the UserContext interface.
+         */
+        public static Type of(Class<? extends Identifiable> objectType) {
+
+            for (Type type : Type.values()) {
+                if (type.getObjectType().isAssignableFrom(objectType))
+                    return type;
+            }
+
+            return null;
+
+        }
+
+    }
+
     /**
      * Returns the object having the given identifier. Note that changes to
      * the object returned will not necessarily affect the object stored within
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
new file mode 100644
index 000000000..2ff74bf94
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
@@ -0,0 +1,111 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.event;
+
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.Identifiable;
+
+/**
+ * Abstract basis for events which involve a modification made to the objects
+ * within a {@link Directory}.
+ *
+ * @param <ObjectType>
+ *     The type of object stored within the {@link Directory}.
+ */
+public interface DirectoryEvent<ObjectType extends Identifiable>
+        extends AuthenticationProviderEvent, UserEvent {
+
+    /**
+     * The types of directory operations that may be represented by a
+     * DirectoryEvent.
+     */
+    public enum Operation {
+
+        /**
+         * An object was added to the {@link Directory}. The object added can
+         * be accessed with {@link #getObject()}, and its identifier may be
+         * obtained from {@link #getObjectIdentifier()}.
+         */
+        ADD,
+
+        /**
+         * An object was retrieved from a {@link Directory}. The object
+         * retrieved can be accessed with {@link #getObject()}, and its
+         * identifier may be obtained from {@link #getObjectIdentifier()}.
+         */
+        GET,
+
+        /**
+         * An existing object within a {@link Directory} was modified. The
+         * modified object can be accessed with {@link #getObject()}, and its
+         * identifier may be obtained from {@link #getObjectIdentifier()}.
+         */
+        UPDATE,
+
+        /**
+         * An existing object within a {@link Directory} was deleted/removed.
+         * The identifier of the object that was deleted may be obtained from
+         * {@link #getObjectIdentifier()}. The full object that was deleted
+         * will be made available via {@link #getObject()} if possible, but
+         * this is not guaranteed for deletions.
+         */
+        REMOVE
+
+    }
+
+    /**
+     * Returns the type of objects stored within the {@link Directory}
+     * affected by the operation.
+     *
+     * @return
+     *     The type of objects stored within the {@link Directory}.
+     */
+    Directory.Type getDirectoryType();
+
+    /**
+     * Returns the operation that was performed/attempted.
+     *
+     * @return
+     *     The operation that was performed or attempted.
+     */
+    Operation getOperation();
+
+    /**
+     * Returns the identifier of the object affected by the operation. If the
+     * object was just created, this will be the identifier of the new object.
+     *
+     * @return
+     *     The identifier of the object affected by the operation.
+     */
+    String getObjectIdentifier();
+
+    /**
+     * Returns the object affected by the operation, if available. For
+     * deletions, there is no guarantee that the affected object will be
+     * available within this event. If the object is not available, null is
+     * returned.
+     *
+     * @return
+     *     The object affected by the operation performed, or null if that
+     *     object is not available in the context of this event.
+     */
+    ObjectType getObject();
+
+}
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryFailureEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryFailureEvent.java
new file mode 100644
index 000000000..a9ec474d1
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryFailureEvent.java
@@ -0,0 +1,36 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.event;
+
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.Identifiable;
+
+/**
+ * Event that is dispatched whenever a REST API request to create/modify/delete
+ * an object within a {@link Directory} fails. The specific failure is made
+ * available via {@link #getFailure()}.
+ *
+ * @param <ObjectType>
+ *     The type of object stored within the {@link Directory}.
+ */
+public interface DirectoryFailureEvent<ObjectType extends Identifiable>
+        extends DirectoryEvent<ObjectType>, FailureEvent {
+
+}
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectorySuccessEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectorySuccessEvent.java
new file mode 100644
index 000000000..691cee7f7
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectorySuccessEvent.java
@@ -0,0 +1,35 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.event;
+
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.Identifiable;
+
+/**
+ * Event that is dispatched whenever a REST API request to create/modify/delete
+ * an object within a {@link Directory} succeeds.
+ *
+ * @param <ObjectType>
+ *     The type of object stored within the {@link Directory}.
+ */
+public interface DirectorySuccessEvent<ObjectType extends Identifiable>
+        extends DirectoryEvent<ObjectType> {
+
+}
diff --git a/guacamole-ext/src/test/java/org/apache/guacamole/net/auth/DirectoryTest.java b/guacamole-ext/src/test/java/org/apache/guacamole/net/auth/DirectoryTest.java
new file mode 100644
index 000000000..04623aa58
--- /dev/null
+++ b/guacamole-ext/src/test/java/org/apache/guacamole/net/auth/DirectoryTest.java
@@ -0,0 +1,124 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.auth;
+
+import java.lang.reflect.Method;
+import java.lang.reflect.ParameterizedType;
+import java.lang.reflect.Type;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+import org.junit.Assert;
+import org.junit.Test;
+
+/**
+ * Test that verifies the functionality provided by the Directory interface.
+ */
+public class DirectoryTest {
+
+    /**
+     * Returns a Collection of all classes that have associated Directories
+     * available via the UserContext interface. The classes are retrieved
+     * using reflection by enumerating the type parameters of the return types
+     * of all functions that return a Directory.
+     *
+     * @return
+     *     A Collection of all classes that have associated Directories
+     *     available via the UserContext interface.
+     */
+    @SuppressWarnings("unchecked") // Verified via calls to isAssignableFrom()
+    private Collection<Class<? extends Identifiable>> getDirectoryTypes() {
+
+        Set<Class<? extends Identifiable>> types = new HashSet<>();
+
+        Method[] methods = UserContext.class.getMethods();
+        for (Method method : methods) {
+
+            if (!Directory.class.isAssignableFrom(method.getReturnType()))
+                continue;
+
+            Type retType = method.getGenericReturnType();
+            Assert.assertTrue("UserContext functions that return directories "
+                    + "must have proper type parameters for the returned "
+                    + "directory.", retType instanceof ParameterizedType);
+
+            Type[] typeArgs = ((ParameterizedType) retType).getActualTypeArguments();
+            Assert.assertEquals("UserContext functions that return directories "
+                    + "must properly declare exactly one type argument for "
+                    + "those directories.", 1, typeArgs.length);
+
+            Class<?> directoryType = (Class<?>) typeArgs[0];
+            Assert.assertTrue("Directories returned by UserContext functions "
+                    + "must contain subclasses of Identifiable.",
+                    Identifiable.class.isAssignableFrom(directoryType));
+
+            types.add((Class<? extends Identifiable>) directoryType);
+
+        }
+
+        return Collections.unmodifiableSet(types);
+
+    }
+
+    /**
+     * Verifies that Directory.Type covers the types of all directories exposed
+     * by the UserContext interface.
+     */
+    @Test
+    public void testTypeCoverage() {
+
+        Collection<Class<? extends Identifiable>> types = getDirectoryTypes();
+
+        Assert.assertEquals("Directory.Type must provide exactly one value "
+                + "for each type of directory provideed by the UserContext "
+                + "interface.", types.size(), Directory.Type.values().length);
+
+        for (Class<? extends Identifiable> type : types) {
+
+            Directory.Type dirType = Directory.Type.of(type);
+            Assert.assertNotNull("of() must provide mappings for all directory "
+                    + "types defined on the UserContext interface.", dirType);
+
+            Assert.assertEquals("getObjectType() must return the same base "
+                    + "superclass used by UserContext for all directory "
+                    + "types defined on the UserContext interface.", type,
+                    dirType.getObjectType());
+
+        }
+
+    }
+
+    /**
+     * Verifies that each type declared by Directory.Type exposes an
+     * associated class via getObjectType() which then maps back to the same
+     * type via Directory.Type.of().
+     */
+    @Test
+    public void testTypeIdentity() {
+        for (Directory.Type dirType : Directory.Type.values()) {
+            Assert.assertEquals("For all defined directory types, "
+                    + "Directory.Type.of(theType.getObjectType()) must "
+                    + "correctly map back to theType.", dirType,
+                    Directory.Type.of(dirType.getObjectType()));
+        }
+    }
+
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionDirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionDirectoryResource.java
index 5296565ab..88319f01c 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionDirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionDirectoryResource.java
@@ -26,6 +26,7 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.net.auth.ActiveConnection;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Permissions;
 import org.apache.guacamole.net.auth.UserContext;
@@ -48,6 +49,9 @@ public class ActiveConnectionDirectoryResource
      * operations and subresources available for the given ActiveConnection
      * Directory.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -63,11 +67,13 @@ public class ActiveConnectionDirectoryResource
      *     representing ActiveConnections.
      */
     @AssistedInject
-    public ActiveConnectionDirectoryResource(@Assisted UserContext userContext,
+    public ActiveConnectionDirectoryResource(
+            @Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext,
             @Assisted Directory<ActiveConnection> directory,
             DirectoryObjectTranslator<ActiveConnection, APIActiveConnection> translator,
             DirectoryObjectResourceFactory<ActiveConnection, APIActiveConnection> resourceFactory) {
-        super(userContext, directory, translator, resourceFactory);
+        super(authenticatedUser, userContext, ActiveConnection.class, directory, translator, resourceFactory);
     }
 
     @Override
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionResource.java
index 514daa124..59afe18d1 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/activeconnection/ActiveConnectionResource.java
@@ -30,6 +30,7 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.net.auth.ActiveConnection;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.UserContext;
@@ -47,17 +48,6 @@ import org.apache.guacamole.rest.directory.DirectoryResourceFactory;
 public class ActiveConnectionResource
         extends DirectoryObjectResource<ActiveConnection, APIActiveConnection> {
 
-    /**
-     * The UserContext associated with the Directory which contains the
-     * Connection exposed by this resource.
-     */
-    private final UserContext userContext;
-
-    /**
-     * The ActiveConnection exposed by this ActiveConnectionResource.
-     */
-    private final ActiveConnection activeConnection;
-
     /**
      * A factory which can be used to create instances of resources representing
      * Connection.
@@ -70,6 +60,9 @@ public class ActiveConnectionResource
      * Creates a new ActiveConnectionResource which exposes the operations and
      * subresources available for the given ActiveConnection.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -85,13 +78,12 @@ public class ActiveConnectionResource
      *     ActiveConnections.
      */
     @AssistedInject
-    public ActiveConnectionResource(@Assisted UserContext userContext,
+    public ActiveConnectionResource(@Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext,
             @Assisted Directory<ActiveConnection> directory,
             @Assisted ActiveConnection activeConnection,
             DirectoryObjectTranslator<ActiveConnection, APIActiveConnection> translator) {
-        super(userContext, directory, activeConnection, translator);
-        this.userContext = userContext;
-        this.activeConnection = activeConnection;
+        super(authenticatedUser, userContext, ActiveConnection.class, directory, activeConnection, translator);
     }
 
     /**
@@ -109,9 +101,12 @@ public class ActiveConnectionResource
     public DirectoryObjectResource<Connection, APIConnection> getConnection()
             throws GuacamoleException {
 
+        UserContext userContext = getUserContext();
+        ActiveConnection activeConnection = getInternalObject();
+        
         // Return the underlying connection as a resource
         return connectionDirectoryResourceFactory
-                .create(userContext, userContext.getConnectionDirectory())
+                .create(getAuthenticatedUser(), userContext, userContext.getConnectionDirectory())
                 .getObjectResource(activeConnection.getConnectionIdentifier());
 
     }
@@ -137,7 +132,7 @@ public class ActiveConnectionResource
             throws GuacamoleException {
 
         // Generate and return sharing credentials for the active connection
-        return new APIUserCredentials(activeConnection.getSharingCredentials(sharingProfileIdentifier));
+        return new APIUserCredentials(getInternalObject().getSharingCredentials(sharingProfileIdentifier));
 
     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionDirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionDirectoryResource.java
index 88408a796..612e05502 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionDirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionDirectoryResource.java
@@ -25,6 +25,7 @@ import javax.ws.rs.Consumes;
 import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Permissions;
@@ -47,6 +48,9 @@ public class ConnectionDirectoryResource
      * Creates a new ConnectionDirectoryResource which exposes the operations
      * and subresources available for the given Connection Directory.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -62,11 +66,11 @@ public class ConnectionDirectoryResource
      *     representing Connections.
      */
     @AssistedInject
-    public ConnectionDirectoryResource(@Assisted UserContext userContext,
-            @Assisted Directory<Connection> directory,
+    public ConnectionDirectoryResource(@Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext, @Assisted Directory<Connection> directory,
             DirectoryObjectTranslator<Connection, APIConnection> translator,
             DirectoryObjectResourceFactory<Connection, APIConnection> resourceFactory) {
-        super(userContext, directory, translator, resourceFactory);
+        super(authenticatedUser, userContext, Connection.class, directory, translator, resourceFactory);
     }
 
     @Override
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionResource.java
index 15586e187..484543ba2 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/connection/ConnectionResource.java
@@ -32,6 +32,7 @@ import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleSecurityException;
 import org.apache.guacamole.GuacamoleUnsupportedException;
 import org.apache.guacamole.net.auth.ActivityRecordSet;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Permissions;
@@ -65,17 +66,6 @@ public class ConnectionResource extends DirectoryObjectResource<Connection, APIC
      * Logger for this class.
      */
     private static final Logger logger = LoggerFactory.getLogger(ConnectionResource.class);
-    
-    /**
-     * The UserContext associated with the Directory which contains the
-     * Connection exposed by this resource.
-     */
-    private final UserContext userContext;
-
-    /**
-     * The Connection object represented by this ConnectionResource.
-     */
-    private final Connection connection;
 
     /**
      * A factory which can be used to create instances of resources representing
@@ -89,6 +79,9 @@ public class ConnectionResource extends DirectoryObjectResource<Connection, APIC
      * Creates a new ConnectionResource which exposes the operations and
      * subresources available for the given Connection.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -103,13 +96,12 @@ public class ConnectionResource extends DirectoryObjectResource<Connection, APIC
      *     object given.
      */
     @AssistedInject
-    public ConnectionResource(@Assisted UserContext userContext,
+    public ConnectionResource(@Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext,
             @Assisted Directory<Connection> directory,
             @Assisted Connection connection,
             DirectoryObjectTranslator<Connection, APIConnection> translator) {
-        super(userContext, directory, connection, translator);
-        this.userContext = userContext;
-        this.connection = connection;
+        super(authenticatedUser, userContext, Connection.class, directory, connection, translator);
     }
 
     /**
@@ -126,8 +118,10 @@ public class ConnectionResource extends DirectoryObjectResource<Connection, APIC
     public Map<String, String> getConnectionParameters()
             throws GuacamoleException {
 
+        Connection connection = getInternalObject();
+
         // Pull effective permissions
-        Permissions effective = userContext.self().getEffectivePermissions();
+        Permissions effective = getUserContext().self().getEffectivePermissions();
 
         // Retrieve permission sets
         SystemPermissionSet systemPermissions = effective.getSystemPermissions();
@@ -162,6 +156,8 @@ public class ConnectionResource extends DirectoryObjectResource<Connection, APIC
     public ConnectionHistoryResource getConnectionHistory()
             throws GuacamoleException {
 
+        Connection connection = getInternalObject();
+
         // Try the current getConnectionHistory() method, first, for connection history.
         try {
             return new ConnectionHistoryResource(connection.getConnectionHistory()
@@ -201,6 +197,9 @@ public class ConnectionResource extends DirectoryObjectResource<Connection, APIC
     public DirectoryResource<SharingProfile, APISharingProfile>
             getSharingProfileDirectoryResource() throws GuacamoleException {
 
+        UserContext userContext = getUserContext();
+        Connection connection = getInternalObject();
+                
         // Produce subset of all SharingProfiles, containing only those which
         // are associated with this connection
         Directory<SharingProfile> sharingProfiles = new DirectoryView<>(
@@ -209,7 +208,7 @@ public class ConnectionResource extends DirectoryObjectResource<Connection, APIC
         );
 
         // Return a new resource which provides access to only those SharingProfiles
-        return sharingProfileDirectoryResourceFactory.create(userContext, sharingProfiles);
+        return sharingProfileDirectoryResourceFactory.create(getAuthenticatedUser(), userContext, sharingProfiles);
 
     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupDirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupDirectoryResource.java
index 2be3a8859..adf42787a 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupDirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupDirectoryResource.java
@@ -25,6 +25,7 @@ import javax.ws.rs.Consumes;
 import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.ConnectionGroup;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Permissions;
@@ -44,28 +45,14 @@ import org.apache.guacamole.rest.directory.DirectoryResource;
 public class ConnectionGroupDirectoryResource
         extends DirectoryResource<ConnectionGroup, APIConnectionGroup> {
 
-    /**
-     * The UserContext associated with the Directory which contains the
-     * ConnectionGroup exposed by this resource.
-     */
-    private final UserContext userContext;
-
-    /**
-     * The Directory exposed by this resource.
-     */
-    private final Directory<ConnectionGroup> directory;
-
-    /**
-     * A factory which can be used to create instances of resources representing
-     * ConnectionGroups.
-     */
-    private final DirectoryObjectResourceFactory<ConnectionGroup, APIConnectionGroup> resourceFactory;
-
     /**
      * Creates a new ConnectionGroupDirectoryResource which exposes the
      * operations and subresources available for the given ConnectionGroup
      * Directory.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -81,23 +68,24 @@ public class ConnectionGroupDirectoryResource
      *     representing ConnectionGroups.
      */
     @AssistedInject
-    public ConnectionGroupDirectoryResource(@Assisted UserContext userContext,
+    public ConnectionGroupDirectoryResource(
+            @Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext,
             @Assisted Directory<ConnectionGroup> directory,
             DirectoryObjectTranslator<ConnectionGroup, APIConnectionGroup> translator,
             DirectoryObjectResourceFactory<ConnectionGroup, APIConnectionGroup> resourceFactory) {
-        super(userContext, directory, translator, resourceFactory);
-        this.userContext = userContext;
-        this.directory = directory;
-        this.resourceFactory = resourceFactory;
+        super(authenticatedUser, userContext, ConnectionGroup.class, directory, translator, resourceFactory);
     }
 
     @Override
     public DirectoryObjectResource<ConnectionGroup, APIConnectionGroup>
         getObjectResource(String identifier) throws GuacamoleException {
 
+        UserContext userContext = getUserContext();
+
         // Use root group if identifier is the standard root identifier
         if (identifier != null && identifier.equals(APIConnectionGroup.ROOT_IDENTIFIER))
-            return resourceFactory.create(userContext, directory,
+            return getResourceFactory().create(getAuthenticatedUser(), userContext, getDirectory(),
                     userContext.getRootConnectionGroup());
 
         return super.getObjectResource(identifier);
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupResource.java
index f91b8ebb9..22f41b0cf 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/connectiongroup/ConnectionGroupResource.java
@@ -29,6 +29,7 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.QueryParam;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.ConnectionGroup;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.UserContext;
@@ -45,21 +46,13 @@ import org.apache.guacamole.rest.directory.DirectoryObjectTranslator;
 public class ConnectionGroupResource
         extends DirectoryObjectResource<ConnectionGroup, APIConnectionGroup> {
 
-    /**
-     * The UserContext associated with the Directory which contains the
-     * ConnectionGroup exposed by this resource.
-     */
-    private final UserContext userContext;
-
-    /**
-     * The ConnectionGroup object represented by this ConnectionGroupResource.
-     */
-    private final ConnectionGroup connectionGroup;
-
     /**
      * Creates a new ConnectionGroupResource which exposes the operations and
      * subresources available for the given ConnectionGroup.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -75,13 +68,13 @@ public class ConnectionGroupResource
      *     object given.
      */
     @AssistedInject
-    public ConnectionGroupResource(@Assisted UserContext userContext,
+    public ConnectionGroupResource(
+            @Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext,
             @Assisted Directory<ConnectionGroup> directory,
             @Assisted ConnectionGroup connectionGroup,
             DirectoryObjectTranslator<ConnectionGroup, APIConnectionGroup> translator) {
-        super(userContext, directory, connectionGroup, translator);
-        this.userContext = userContext;
-        this.connectionGroup = connectionGroup;
+        super(authenticatedUser, userContext, ConnectionGroup.class, directory, connectionGroup, translator);
     }
 
     /**
@@ -107,8 +100,8 @@ public class ConnectionGroupResource
             throws GuacamoleException {
 
         // Retrieve the requested tree, filtering by the given permissions
-        ConnectionGroupTree tree = new ConnectionGroupTree(userContext,
-                connectionGroup, permissions);
+        ConnectionGroupTree tree = new ConnectionGroupTree(getUserContext(),
+                getInternalObject(), permissions);
 
         // Return tree as a connection group
         return tree.getRootAPIConnectionGroup();
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResource.java
index 7b354a226..8ed36fec0 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResource.java
@@ -19,6 +19,7 @@
 
 package org.apache.guacamole.rest.directory;
 
+import javax.inject.Inject;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.DELETE;
 import javax.ws.rs.GET;
@@ -27,9 +28,15 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
+import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Identifiable;
 import org.apache.guacamole.net.auth.UserContext;
+import org.apache.guacamole.net.event.DirectoryEvent;
+import org.apache.guacamole.net.event.DirectoryFailureEvent;
+import org.apache.guacamole.net.event.DirectorySuccessEvent;
+import org.apache.guacamole.rest.event.ListenerService;
 
 /**
  * A REST resource which abstracts the operations available on an existing
@@ -51,12 +58,22 @@ import org.apache.guacamole.net.auth.UserContext;
 @Consumes(MediaType.APPLICATION_JSON)
 public abstract class DirectoryObjectResource<InternalType extends Identifiable, ExternalType> {
 
+    /**
+     * The user that is accessing this resource.
+     */
+    private final AuthenticatedUser authenticatedUser;
+    
     /**
      * The UserContext associated with the Directory containing the object
      * represented by this DirectoryObjectResource.
      */
     private final UserContext userContext;
 
+    /**
+     * The type of object represented by this DirectoryObjectResource.
+     */
+    private final Class<InternalType> internalType;
+    
     /**
      * The Directory which contains the object represented by this
      * DirectoryObjectResource.
@@ -74,13 +91,26 @@ public abstract class DirectoryObjectResource<InternalType extends Identifiable,
      */
     private final DirectoryObjectTranslator<InternalType, ExternalType> translator;
 
+    /**
+     * Service for dispatching events to registered listeners.
+     */
+    @Inject
+    private ListenerService listenerService;
+
     /**
      * Creates a new DirectoryObjectResource which exposes the operations
      * available for the given object.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
+     * @param internalType
+     *     The type of object that this DirectoryObjectResource should
+     *     represent.
+     * 
      * @param directory
      *     The Directory which contains the given object.
      *
@@ -91,15 +121,162 @@ public abstract class DirectoryObjectResource<InternalType extends Identifiable,
      *     A DirectoryObjectTranslator implementation which handles the type of
      *     object given.
      */
-    public DirectoryObjectResource(UserContext userContext,
+    public DirectoryObjectResource(AuthenticatedUser authenticatedUser,
+            UserContext userContext, Class<InternalType> internalType,
             Directory<InternalType> directory, InternalType object,
             DirectoryObjectTranslator<InternalType, ExternalType> translator) {
+        this.authenticatedUser = authenticatedUser;
         this.userContext = userContext;
         this.directory = directory;
+        this.internalType = internalType;
         this.object = object;
         this.translator = translator;
     }
 
+    /**
+     * Notifies all registered listeners that the given operation has succeeded
+     * against the object represented by this resource.
+     * 
+     * @param operation
+     *     The operation that was performed.
+     *
+     * @throws GuacamoleException
+     *     If a listener throws a GuacamoleException from its event handler.
+     */
+    protected void fireDirectorySuccessEvent(DirectoryEvent.Operation operation)
+            throws GuacamoleException {
+        listenerService.handleEvent(new DirectorySuccessEvent<InternalType>() {
+
+            @Override
+            public Directory.Type getDirectoryType() {
+                return Directory.Type.of(internalType);
+            }
+
+            @Override
+            public DirectoryEvent.Operation getOperation() {
+                return operation;
+            }
+
+            @Override
+            public String getObjectIdentifier() {
+                return object.getIdentifier();
+            }
+
+            @Override
+            public InternalType getObject() {
+                return object;
+            }
+
+            @Override
+            public AuthenticatedUser getAuthenticatedUser() {
+                return authenticatedUser;
+            }
+
+            @Override
+            public AuthenticationProvider getAuthenticationProvider() {
+                return userContext.getAuthenticationProvider();
+            }
+
+        });
+    }
+
+    /**
+     * Notifies all registered listeners that the given operation has failed
+     * against the object represented by this resource.
+     *
+     * @param operation
+     *     The operation that failed.
+     *
+     * @param failure
+     *     The failure that occurred.
+     *
+     * @throws GuacamoleException
+     *     If a listener throws a GuacamoleException from its event handler.
+     */
+    protected void fireDirectoryFailureEvent(DirectoryEvent.Operation operation,
+            Throwable failure) throws GuacamoleException {
+        listenerService.handleEvent(new DirectoryFailureEvent<InternalType>() {
+
+            @Override
+            public Directory.Type getDirectoryType() {
+                return Directory.Type.of(internalType);
+            }
+
+            @Override
+            public DirectoryEvent.Operation getOperation() {
+                return operation;
+            }
+
+            @Override
+            public String getObjectIdentifier() {
+                return object.getIdentifier();
+            }
+
+            @Override
+            public InternalType getObject() {
+                return object;
+            }
+
+            @Override
+            public AuthenticatedUser getAuthenticatedUser() {
+                return authenticatedUser;
+            }
+
+            @Override
+            public AuthenticationProvider getAuthenticationProvider() {
+                return userContext.getAuthenticationProvider();
+            }
+
+            @Override
+            public Throwable getFailure() {
+                return failure;
+            }
+
+        });
+    }
+
+    /**
+     * Returns the user accessing this resource.
+     *
+     * @return
+     *     The user accessing this resource.
+     */
+    protected AuthenticatedUser getAuthenticatedUser() {
+        return authenticatedUser;
+    }
+
+    /**
+     * Returns the UserContext providing the Directory that contains the object
+     * exposed by this resource.
+     *
+     * @return 
+     *     The UserContext providing the Directory that contains the object
+     *     exposed by this resource.
+     */
+    protected UserContext getUserContext() {
+        return userContext;
+    }
+
+    /**
+     * Returns the Directory containing the object exposed by this resource.
+     *
+     * @return 
+     *     The Directory containing the object exposed by this resource.
+     */
+    protected Directory<InternalType> getDirectory() {
+        return directory;
+    }
+
+    /**
+     * Returns the object exposed by this resource.
+     *
+     * @return
+     *     The object exposed by this resource.
+     */
+    protected InternalType getInternalObject() {
+        return object;
+    }
+
     /**
      * Returns the object represented by this DirectoryObjectResource, in a
      * format intended for interchange.
@@ -138,7 +315,15 @@ public abstract class DirectoryObjectResource<InternalType extends Identifiable,
 
         // Perform update
         translator.applyExternalChanges(object, modifiedObject);
-        directory.update(object);
+
+        try {
+            directory.update(object);
+            fireDirectorySuccessEvent(DirectoryEvent.Operation.UPDATE);
+        }
+        catch (GuacamoleException | RuntimeException | Error e) {
+            fireDirectoryFailureEvent(DirectoryEvent.Operation.UPDATE, e);
+            throw e;
+        }
 
     }
 
@@ -150,7 +335,14 @@ public abstract class DirectoryObjectResource<InternalType extends Identifiable,
      */
     @DELETE
     public void deleteObject() throws GuacamoleException {
-        directory.remove(object.getIdentifier());
+        try {
+            directory.remove(object.getIdentifier());
+            fireDirectorySuccessEvent(DirectoryEvent.Operation.REMOVE);
+        }
+        catch (GuacamoleException | RuntimeException | Error e) {
+            fireDirectoryFailureEvent(DirectoryEvent.Operation.REMOVE, e);
+            throw e;
+        }
     }
 
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResourceFactory.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResourceFactory.java
index 613ac4220..423cb748b 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResourceFactory.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectResourceFactory.java
@@ -19,6 +19,7 @@
 
 package org.apache.guacamole.rest.directory;
 
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Identifiable;
 import org.apache.guacamole.net.auth.UserContext;
@@ -41,6 +42,9 @@ public interface DirectoryObjectResourceFactory<InternalType extends Identifiabl
     /**
      * Creates a new DirectoryObjectResource which exposes the given object.
      *
+     * @param authenticatedUser
+     *     The user that is accessing the resource.
+     *
      * @param userContext
      *     The UserContext which contains the given Directory.
      *
@@ -55,7 +59,7 @@ public interface DirectoryObjectResourceFactory<InternalType extends Identifiabl
      *     A new DirectoryObjectResource which exposes the given object.
      */
     DirectoryObjectResource<InternalType, ExternalType>
-        create(UserContext userContext, Directory<InternalType> directory,
-                InternalType object);
+        create(AuthenticatedUser authenticatedUser, UserContext userContext,
+                Directory<InternalType> directory, InternalType object);
 
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index e9b4b225b..50d428528 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -23,6 +23,7 @@ import java.util.Collection;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import javax.inject.Inject;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.GET;
 import javax.ws.rs.PATCH;
@@ -36,6 +37,8 @@ import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
 import org.apache.guacamole.GuacamoleUnsupportedException;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
+import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Identifiable;
 import org.apache.guacamole.net.auth.Permissions;
@@ -44,7 +47,11 @@ import org.apache.guacamole.net.auth.permission.ObjectPermission;
 import org.apache.guacamole.net.auth.permission.ObjectPermissionSet;
 import org.apache.guacamole.net.auth.permission.SystemPermission;
 import org.apache.guacamole.net.auth.permission.SystemPermissionSet;
+import org.apache.guacamole.net.event.DirectoryEvent;
+import org.apache.guacamole.net.event.DirectoryFailureEvent;
+import org.apache.guacamole.net.event.DirectorySuccessEvent;
 import org.apache.guacamole.rest.APIPatch;
+import org.apache.guacamole.rest.event.ListenerService;
 
 /**
  * A REST resource which abstracts the operations available on all Guacamole
@@ -68,12 +75,23 @@ import org.apache.guacamole.rest.APIPatch;
 @Consumes(MediaType.APPLICATION_JSON)
 public abstract class DirectoryResource<InternalType extends Identifiable, ExternalType> {
 
+    /**
+     * The user that is accessing this resource.
+     */
+    private final AuthenticatedUser authenticatedUser;
+    
     /**
      * The UserContext associated with the Directory being exposed by this
      * DirectoryResource.
      */
     private final UserContext userContext;
 
+    /**
+     * The type of object contained within the Directory exposed by this
+     * DirectoryResource.
+     */
+    private final Class<InternalType> internalType;
+
     /**
      * The Directory being exposed by this DirectoryResource.
      */
@@ -92,13 +110,25 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
      */
     private final DirectoryObjectResourceFactory<InternalType, ExternalType> resourceFactory;
 
+    /**
+     * Service for dispatching events to registered listeners.
+     */
+    @Inject
+    private ListenerService listenerService;
+
     /**
      * Creates a new DirectoryResource which exposes the operations available
      * for the given Directory.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
+     * @param internalType
+     *     The type of object contained within the given Directory.
+     *
      * @param directory
      *     The Directory being exposed by this DirectoryResource.
      *
@@ -110,11 +140,15 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
      *     A factory which can be used to create instances of resources
      *     representing individual objects contained within the given Directory.
      */
-    public DirectoryResource(UserContext userContext, Directory<InternalType> directory,
+    public DirectoryResource(AuthenticatedUser authenticatedUser,
+            UserContext userContext, Class<InternalType> internalType,
+            Directory<InternalType> directory,
             DirectoryObjectTranslator<InternalType, ExternalType> translator,
             DirectoryObjectResourceFactory<InternalType, ExternalType> resourceFactory) {
+        this.authenticatedUser = authenticatedUser;
         this.userContext = userContext;
         this.directory = directory;
+        this.internalType = internalType;
         this.translator = translator;
         this.resourceFactory = resourceFactory;
     }
@@ -139,6 +173,174 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
     protected abstract ObjectPermissionSet getObjectPermissions(
             Permissions permissions) throws GuacamoleException;
 
+    /**
+     * Notifies all registered listeners that the given operation has succeeded
+     * against the object having the given identifier within the Directory
+     * represented by this resource.
+     * 
+     * @param operation
+     *     The operation that was performed.
+     *
+     * @param identifier
+     *     The identifier of the object affected by the operation.
+     *
+     * @param object
+     *     The specific object affected by the operation, if available. If not
+     *     available, this may be null.
+     *
+     * @throws GuacamoleException
+     *     If a listener throws a GuacamoleException from its event handler.
+     */
+    protected void fireDirectorySuccessEvent(DirectoryEvent.Operation operation,
+                String identifier, InternalType object)
+            throws GuacamoleException {
+        listenerService.handleEvent(new DirectorySuccessEvent<InternalType>() {
+
+            @Override
+            public Directory.Type getDirectoryType() {
+                return Directory.Type.of(internalType);
+            }
+
+            @Override
+            public DirectoryEvent.Operation getOperation() {
+                return operation;
+            }
+
+            @Override
+            public String getObjectIdentifier() {
+                return identifier;
+            }
+
+            @Override
+            public InternalType getObject() {
+                return object;
+            }
+
+            @Override
+            public AuthenticatedUser getAuthenticatedUser() {
+                return authenticatedUser;
+            }
+
+            @Override
+            public AuthenticationProvider getAuthenticationProvider() {
+                return userContext.getAuthenticationProvider();
+            }
+
+        });
+    }
+
+    /**
+     * Notifies all registered listeners that the given operation has failed
+     * against the object having the given identifier within the Directory
+     * represented by this resource.
+     *
+     * @param operation
+     *     The operation that failed.
+     *
+     * @param identifier
+     *     The identifier of the object that would have been affected by the
+     *     operation had it succeeded.
+     *
+     * @param object
+     *     The specific object would have been affected by the operation, if
+     *     available, had it succeeded, including any changes that were
+     *     intended to be applied to the object. If not available, this may be
+     *     null.
+     *
+     * @param failure
+     *     The failure that occurred.
+     *
+     * @throws GuacamoleException
+     *     If a listener throws a GuacamoleException from its event handler.
+     */
+    protected void fireDirectoryFailureEvent(DirectoryEvent.Operation operation,
+                String identifier, InternalType object, Throwable failure)
+            throws GuacamoleException {
+        listenerService.handleEvent(new DirectoryFailureEvent<InternalType>() {
+
+            @Override
+            public Directory.Type getDirectoryType() {
+                return Directory.Type.of(internalType);
+            }
+
+            @Override
+            public DirectoryEvent.Operation getOperation() {
+                return operation;
+            }
+
+            @Override
+            public String getObjectIdentifier() {
+                return identifier;
+            }
+
+            @Override
+            public InternalType getObject() {
+                return object;
+            }
+
+            @Override
+            public AuthenticatedUser getAuthenticatedUser() {
+                return authenticatedUser;
+            }
+
+            @Override
+            public AuthenticationProvider getAuthenticationProvider() {
+                return userContext.getAuthenticationProvider();
+            }
+
+            @Override
+            public Throwable getFailure() {
+                return failure;
+            }
+
+        });
+    }
+
+    /**
+     * Returns the user accessing this resource.
+     *
+     * @return
+     *     The user accessing this resource.
+     */
+    protected AuthenticatedUser getAuthenticatedUser() {
+        return authenticatedUser;
+    }
+
+    /**
+     * Returns the UserContext providing the Directory exposed by this
+     * resource.
+     *
+     * @return 
+     *     The UserContext providing the Directory exposed by this resource.
+     */
+    protected UserContext getUserContext() {
+        return userContext;
+    }
+
+    /**
+     * Returns the Directory exposed by this resource.
+     *
+     * @return 
+     *     The Directory exposed by this resource.
+     */
+    protected Directory<InternalType> getDirectory() {
+        return directory;
+    }
+
+    /**
+     * Returns a factory that can be used to create instances of resources
+     * representing individual objects contained within the Directory exposed
+     * by this resource.
+     *
+     * @return 
+     *     A factory that can be used to create instances of resources
+     *     representing individual objects contained within the Directory
+     *     exposed by this resource.
+     */
+    public DirectoryObjectResourceFactory<InternalType, ExternalType> getResourceFactory() {
+        return resourceFactory;
+    }
+
     /**
      * Returns a map of all objects available within this DirectoryResource,
      * filtering the returned map by the given permission, if specified.
@@ -213,7 +415,15 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                 throw new GuacamoleClientException("Patch paths must start with \"/\".");
 
             // Remove specified object
-            directory.remove(path.substring(1));
+            String identifier = path.substring(1);
+            try {
+                directory.remove(identifier);
+                fireDirectorySuccessEvent(DirectoryEvent.Operation.REMOVE, identifier, null);
+            }
+            catch (GuacamoleException | RuntimeException | Error e) {
+                fireDirectoryFailureEvent(DirectoryEvent.Operation.REMOVE, identifier, null, e);
+                throw e;
+            }
 
         }
 
@@ -244,11 +454,18 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
         // Filter/sanitize object contents
         translator.filterExternalObject(userContext, object);
+        InternalType internal = translator.toInternalObject(object);
 
         // Create the new object within the directory
-        directory.add(translator.toInternalObject(object));
-
-        return object;
+        try {
+            directory.add(internal);
+            fireDirectorySuccessEvent(DirectoryEvent.Operation.ADD, internal.getIdentifier(), internal);
+            return object;
+        }
+        catch (GuacamoleException | RuntimeException | Error e) {
+            fireDirectoryFailureEvent(DirectoryEvent.Operation.ADD, internal.getIdentifier(), internal, e);
+            throw e;
+        }
 
     }
 
@@ -272,12 +489,21 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
             throws GuacamoleException {
 
         // Retrieve the object having the given identifier
-        InternalType object = directory.get(identifier);
-        if (object == null)
-            throw new GuacamoleResourceNotFoundException("Not found: \"" + identifier + "\"");
+        InternalType object;
+        try {
+            object = directory.get(identifier);
+            if (object == null)
+                throw new GuacamoleResourceNotFoundException("Not found: \"" + identifier + "\"");
+        }
+        catch (GuacamoleException | RuntimeException | Error e) {
+            fireDirectoryFailureEvent(DirectoryEvent.Operation.GET, identifier, null, e);
+            throw e;
+        }
 
         // Return a resource which provides access to the retrieved object
-        return resourceFactory.create(userContext, directory, object);
+        DirectoryObjectResource<InternalType, ExternalType> resource = resourceFactory.create(authenticatedUser, userContext, directory, object);
+        fireDirectorySuccessEvent(DirectoryEvent.Operation.GET, identifier, object);
+        return resource;
 
     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResourceFactory.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResourceFactory.java
index 357777a6f..c28294bae 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResourceFactory.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResourceFactory.java
@@ -19,6 +19,7 @@
 
 package org.apache.guacamole.rest.directory;
 
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Identifiable;
 import org.apache.guacamole.net.auth.UserContext;
@@ -41,6 +42,9 @@ public interface DirectoryResourceFactory<InternalType extends Identifiable, Ext
     /**
      * Creates a new DirectoryResource which exposes the given Directory.
      *
+     * @param authenticatedUser
+     *     The user that is accessing the resource.
+     *
      * @param userContext
      *     The UserContext from which the given Directory was obtained.
      *
@@ -52,6 +56,7 @@ public interface DirectoryResourceFactory<InternalType extends Identifiable, Ext
      *     A new DirectoryResource which exposes the given Directory.
      */
     DirectoryResource<InternalType, ExternalType>
-        create(UserContext userContext, Directory<InternalType> directory);
+        create(AuthenticatedUser authenticatedUser, UserContext userContext,
+                Directory<InternalType> directory);
 
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/session/SessionResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/session/SessionResource.java
index 0c334b068..6116c3785 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/session/SessionResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/session/SessionResource.java
@@ -116,7 +116,7 @@ public class SessionResource {
         UserContext userContext = session.getUserContext(authProviderIdentifier);
 
         // Return a resource exposing the retrieved UserContext
-        return userContextResourceFactory.create(userContext);
+        return userContextResourceFactory.create(session.getAuthenticatedUser(), userContext);
 
     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/session/UserContextResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/session/UserContextResource.java
index cbb04d172..b696259c3 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/session/UserContextResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/session/UserContextResource.java
@@ -30,6 +30,7 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.net.auth.ActiveConnection;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.ConnectionGroup;
 import org.apache.guacamole.net.auth.SharingProfile;
@@ -59,6 +60,11 @@ public class UserContextResource {
      */
     private final UserContext userContext;
 
+    /**
+     * The user that is accessing this resource.
+     */
+    private final AuthenticatedUser authenticatedUser;
+
     /**
      * Factory for creating DirectoryObjectResources which expose a given User.
      */
@@ -115,12 +121,17 @@ public class UserContextResource {
      * Creates a new UserContextResource which exposes the data within the
      * given UserContext.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext which should be exposed through this
      *     UserContextResource.
      */
     @AssistedInject
-    public UserContextResource(@Assisted UserContext userContext) {
+    public UserContextResource(@Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext) {
+        this.authenticatedUser = authenticatedUser;
         this.userContext = userContext;
     }
 
@@ -140,7 +151,7 @@ public class UserContextResource {
     @Path("self")
     public DirectoryObjectResource<User, APIUser> getSelfResource()
             throws GuacamoleException {
-        return userResourceFactory.create(userContext,
+        return userResourceFactory.create(authenticatedUser, userContext,
                 userContext.getUserDirectory(), userContext.self());
     }
 
@@ -158,8 +169,8 @@ public class UserContextResource {
     @Path("activeConnections")
     public DirectoryResource<ActiveConnection, APIActiveConnection>
         getActiveConnectionDirectoryResource() throws GuacamoleException {
-        return activeConnectionDirectoryResourceFactory.create(userContext,
-                userContext.getActiveConnectionDirectory());
+        return activeConnectionDirectoryResourceFactory.create(authenticatedUser,
+                userContext, userContext.getActiveConnectionDirectory());
     }
 
     /**
@@ -176,8 +187,8 @@ public class UserContextResource {
     @Path("connections")
     public DirectoryResource<Connection, APIConnection> getConnectionDirectoryResource()
             throws GuacamoleException {
-        return connectionDirectoryResourceFactory.create(userContext,
-                userContext.getConnectionDirectory());
+        return connectionDirectoryResourceFactory.create(authenticatedUser,
+                userContext, userContext.getConnectionDirectory());
     }
 
     /**
@@ -194,8 +205,8 @@ public class UserContextResource {
     @Path("connectionGroups")
     public DirectoryResource<ConnectionGroup, APIConnectionGroup> getConnectionGroupDirectoryResource()
             throws GuacamoleException {
-        return connectionGroupDirectoryResourceFactory.create(userContext,
-                userContext.getConnectionGroupDirectory());
+        return connectionGroupDirectoryResourceFactory.create(authenticatedUser,
+                userContext, userContext.getConnectionGroupDirectory());
     }
 
     /**
@@ -212,8 +223,8 @@ public class UserContextResource {
     @Path("sharingProfiles")
     public DirectoryResource<SharingProfile, APISharingProfile>
         getSharingProfileDirectoryResource() throws GuacamoleException {
-        return sharingProfileDirectoryResourceFactory.create(userContext,
-                userContext.getSharingProfileDirectory());
+        return sharingProfileDirectoryResourceFactory.create(authenticatedUser,
+                userContext, userContext.getSharingProfileDirectory());
     }
 
     /**
@@ -230,8 +241,8 @@ public class UserContextResource {
     @Path("users")
     public DirectoryResource<User, APIUser> getUserDirectoryResource()
             throws GuacamoleException {
-        return userDirectoryResourceFactory.create(userContext,
-                userContext.getUserDirectory());
+        return userDirectoryResourceFactory.create(authenticatedUser,
+                userContext, userContext.getUserDirectory());
     }
 
     /**
@@ -248,8 +259,8 @@ public class UserContextResource {
     @Path("userGroups")
     public DirectoryResource<UserGroup, APIUserGroup> getUserGroupDirectoryResource()
             throws GuacamoleException {
-        return userGroupDirectoryResourceFactory.create(userContext,
-                userContext.getUserGroupDirectory());
+        return userGroupDirectoryResourceFactory.create(authenticatedUser,
+                userContext, userContext.getUserGroupDirectory());
     }
 
     /**
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/session/UserContextResourceFactory.java b/guacamole/src/main/java/org/apache/guacamole/rest/session/UserContextResourceFactory.java
index 5eea3edf5..c969a6311 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/session/UserContextResourceFactory.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/session/UserContextResourceFactory.java
@@ -19,6 +19,7 @@
 
 package org.apache.guacamole.rest.session;
 
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.UserContext;
 
 /**
@@ -31,6 +32,9 @@ public interface UserContextResourceFactory {
      * Creates a new UserContextResource which exposes the contents of the
      * given UserContext.
      *
+     * @param authenticatedUser
+     *     The user that is accessing the resource.
+     *
      * @param userContext
      *     The UserContext whose contents should be exposed.
      *
@@ -38,6 +42,7 @@ public interface UserContextResourceFactory {
      *     A new UserContextResource which exposes the contents of the given
      *     UserContext.
      */
-    UserContextResource create(UserContext userContext);
+    UserContextResource create(AuthenticatedUser authenticatedUser,
+            UserContext userContext);
 
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileDirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileDirectoryResource.java
index ab24ef381..16ae29509 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileDirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileDirectoryResource.java
@@ -25,6 +25,7 @@ import javax.ws.rs.Consumes;
 import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Permissions;
 import org.apache.guacamole.net.auth.SharingProfile;
@@ -48,6 +49,9 @@ public class SharingProfileDirectoryResource
      * operations and subresources available for the given SharingProfile
      * Directory.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -63,11 +67,13 @@ public class SharingProfileDirectoryResource
      *     representing SharingProfiles.
      */
     @AssistedInject
-    public SharingProfileDirectoryResource(@Assisted UserContext userContext,
+    public SharingProfileDirectoryResource(
+            @Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext,
             @Assisted Directory<SharingProfile> directory,
             DirectoryObjectTranslator<SharingProfile, APISharingProfile> translator,
             DirectoryObjectResourceFactory<SharingProfile, APISharingProfile> resourceFactory) {
-        super(userContext, directory, translator, resourceFactory);
+        super(authenticatedUser, userContext, SharingProfile.class, directory, translator, resourceFactory);
     }
 
     @Override
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileResource.java
index 4797ade7f..46daac9b3 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/sharingprofile/SharingProfileResource.java
@@ -29,6 +29,7 @@ import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleSecurityException;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Permissions;
 import org.apache.guacamole.net.auth.SharingProfile;
@@ -49,21 +50,13 @@ import org.apache.guacamole.rest.directory.DirectoryObjectTranslator;
 public class SharingProfileResource
         extends DirectoryObjectResource<SharingProfile, APISharingProfile> {
 
-    /**
-     * The UserContext associated with the Directory which contains the
-     * SharingProfile exposed by this resource.
-     */
-    private final UserContext userContext;
-
-    /**
-     * The SharingProfile object represented by this SharingProfileResource.
-     */
-    private final SharingProfile sharingProfile;
-
     /**
      * Creates a new SharingProfileResource which exposes the operations and
      * subresources available for the given SharingProfile.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -78,13 +71,12 @@ public class SharingProfileResource
      *     object given.
      */
     @AssistedInject
-    public SharingProfileResource(@Assisted UserContext userContext,
+    public SharingProfileResource(@Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext,
             @Assisted Directory<SharingProfile> directory,
             @Assisted SharingProfile sharingProfile,
             DirectoryObjectTranslator<SharingProfile, APISharingProfile> translator) {
-        super(userContext, directory, sharingProfile, translator);
-        this.userContext = userContext;
-        this.sharingProfile = sharingProfile;
+        super(authenticatedUser, userContext, SharingProfile.class, directory, sharingProfile, translator);
     }
 
     /**
@@ -103,8 +95,10 @@ public class SharingProfileResource
     public Map<String, String> getParameters()
             throws GuacamoleException {
 
+        SharingProfile sharingProfile = getInternalObject();
+        
         // Pull effective permissions
-        Permissions effective = userContext.self().getEffectivePermissions();
+        Permissions effective = getUserContext().self().getEffectivePermissions();
 
         // Retrieve permission sets
         SystemPermissionSet systemPermissions = effective.getSystemPermissions();
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelCollectionResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelCollectionResource.java
index abd7b422d..770469c7e 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelCollectionResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelCollectionResource.java
@@ -105,7 +105,7 @@ public class TunnelCollectionResource {
             throw new GuacamoleResourceNotFoundException("No such tunnel.");
 
         // Return corresponding tunnel resource
-        return tunnelResourceFactory.create(tunnel);
+        return tunnelResourceFactory.create(session.getAuthenticatedUser(), tunnel);
 
     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelResource.java
index 7c0ec7eef..7107ab277 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelResource.java
@@ -34,6 +34,7 @@ import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.net.auth.ActiveConnection;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.UserContext;
 import org.apache.guacamole.protocols.ProtocolInfo;
 import org.apache.guacamole.rest.activeconnection.APIActiveConnection;
@@ -55,6 +56,11 @@ public class TunnelResource {
      */
     private static final String DEFAULT_MEDIA_TYPE = MediaType.APPLICATION_OCTET_STREAM;
 
+    /**
+     * The user that is accessing this resource.
+     */
+    private final AuthenticatedUser authenticatedUser;
+    
     /**
      * The tunnel that this TunnelResource represents.
      */
@@ -78,11 +84,16 @@ public class TunnelResource {
      * Creates a new TunnelResource which exposes the operations and
      * subresources available for the given tunnel.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param tunnel
      *     The tunnel that this TunnelResource should represent.
      */
     @AssistedInject
-    public TunnelResource(@Assisted UserTunnel tunnel) {
+    public TunnelResource(@Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserTunnel tunnel) {
+        this.authenticatedUser = authenticatedUser;
         this.tunnel = tunnel;
     }
 
@@ -110,7 +121,7 @@ public class TunnelResource {
             throw new GuacamoleResourceNotFoundException("No readable active connection for tunnel.");
 
         // Return the associated ActiveConnection as a resource
-        return activeConnectionResourceFactory.create(userContext,
+        return activeConnectionResourceFactory.create(authenticatedUser, userContext,
                 userContext.getActiveConnectionDirectory(), activeConnection);
 
     }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelResourceFactory.java b/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelResourceFactory.java
index 2deacf88a..9efdf9c68 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelResourceFactory.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/tunnel/TunnelResourceFactory.java
@@ -19,6 +19,7 @@
 
 package org.apache.guacamole.rest.tunnel;
 
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.tunnel.UserTunnel;
 
 /**
@@ -31,12 +32,15 @@ public interface TunnelResourceFactory {
      * Creates a new TunnelResource which exposes the contents of the
      * given tunnel.
      *
+     * @param authenticatedUser
+     *     The user that is accessing the resource.
+     *
      * @param tunnel
      *     The tunnel whose contents should be exposed.
      *
      * @return
      *     A new TunnelResource which exposes the contents of the given tunnel.
      */
-    TunnelResource create(UserTunnel tunnel);
+    TunnelResource create(AuthenticatedUser authenticatedUser, UserTunnel tunnel);
 
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserDirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserDirectoryResource.java
index f93016fe9..0918ca82f 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserDirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserDirectoryResource.java
@@ -25,6 +25,7 @@ import javax.ws.rs.Consumes;
 import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Permissions;
@@ -46,6 +47,9 @@ public class UserDirectoryResource extends DirectoryResource<User, APIUser> {
      * Creates a new UserDirectoryResource which exposes the operations and
      * subresources available for the given User Directory.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -61,11 +65,12 @@ public class UserDirectoryResource extends DirectoryResource<User, APIUser> {
      *     representing Users.
      */
     @AssistedInject
-    public UserDirectoryResource(@Assisted UserContext userContext,
+    public UserDirectoryResource(@Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext,
             @Assisted Directory<User> directory,
             DirectoryObjectTranslator<User, APIUser> translator,
             DirectoryObjectResourceFactory<User, APIUser> resourceFactory) {
-        super(userContext, directory, translator, resourceFactory);
+        super(authenticatedUser, userContext, User.class, directory, translator, resourceFactory);
     }
 
     @Override
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
index aa8a3ec7e..9b79fbb48 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
@@ -33,6 +33,7 @@ import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleSecurityException;
 import org.apache.guacamole.GuacamoleUnsupportedException;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.User;
@@ -63,27 +64,13 @@ public class UserResource
      */
     private static final Logger logger = LoggerFactory.getLogger(UserResource.class);
     
-    /**
-     * The UserContext associated with the Directory which contains the User
-     * exposed by this resource.
-     */
-    private final UserContext userContext;
-
-    /**
-     * The Directory which contains the User object represented by this
-     * UserResource.
-     */
-    private final Directory<User> directory;
-
-    /**
-     * The User object represented by this UserResource.
-     */
-    private final User user;
-
     /**
      * Creates a new UserResource which exposes the operations and subresources
      * available for the given User.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -97,14 +84,12 @@ public class UserResource
      *     A DirectoryObjectTranslator implementation which handles Users.
      */
     @AssistedInject
-    public UserResource(@Assisted UserContext userContext,
+    public UserResource(@Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext,
             @Assisted Directory<User> directory,
             @Assisted User user,
             DirectoryObjectTranslator<User, APIUser> translator) {
-        super(userContext, directory, user, translator);
-        this.userContext = userContext;
-        this.directory = directory;
-        this.user = user;
+        super(authenticatedUser, userContext, User.class, directory, user, translator);
     }
 
     /**
@@ -122,6 +107,8 @@ public class UserResource
     public UserHistoryResource getUserHistory()
             throws GuacamoleException {
 
+        User user = getInternalObject();
+
         // First try to retrieve history using the current getUserHistory() method.
         try {
             return new UserHistoryResource(user.getUserHistory());
@@ -147,7 +134,7 @@ public class UserResource
     public void updateObject(APIUser modifiedObject) throws GuacamoleException {
 
         // A user may not use this endpoint to update their password
-        User currentUser = userContext.self();
+        User currentUser = getUserContext().self();
         if (
                 currentUser.getIdentifier().equals(modifiedObject.getUsername())
                 && modifiedObject.getPassword() != null) {
@@ -178,13 +165,15 @@ public class UserResource
     public void updatePassword(APIUserPasswordUpdate userPasswordUpdate,
             @Context HttpServletRequest request) throws GuacamoleException {
 
+        User user = getInternalObject();
+
         // Build credentials
         Credentials credentials = new Credentials(user.getIdentifier(),
                 userPasswordUpdate.getOldPassword(), request);
 
         // Verify that the old password was correct
         try {
-            AuthenticationProvider authProvider = userContext.getAuthenticationProvider();
+            AuthenticationProvider authProvider = getUserContext().getAuthenticationProvider();
             if (authProvider.authenticateUser(credentials) == null)
                 throw new GuacamoleSecurityException("Permission denied.");
         }
@@ -196,7 +185,7 @@ public class UserResource
 
         // Set password to the newly provided one
         user.setPassword(userPasswordUpdate.getNewPassword());
-        directory.update(user);
+        getDirectory().update(user);
 
     }
 
@@ -211,7 +200,7 @@ public class UserResource
      */
     @Path("permissions")
     public PermissionSetResource getPermissions() {
-        return new PermissionSetResource(user);
+        return new PermissionSetResource(getInternalObject());
     }
 
     /**
@@ -228,7 +217,7 @@ public class UserResource
     @GET
     @Path("effectivePermissions")
     public APIPermissionSet getEffectivePermissions() throws GuacamoleException {
-        return new APIPermissionSet(user.getEffectivePermissions());
+        return new APIPermissionSet(getInternalObject().getEffectivePermissions());
     }
 
     /**
@@ -245,7 +234,7 @@ public class UserResource
      */
     @Path("userGroups")
     public RelatedObjectSetResource getUserGroups() throws GuacamoleException {
-        return new RelatedObjectSetResource(user.getUserGroups());
+        return new RelatedObjectSetResource(getInternalObject().getUserGroups());
     }
 
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupDirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupDirectoryResource.java
index fc4d48be3..44327a29c 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupDirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupDirectoryResource.java
@@ -25,6 +25,7 @@ import javax.ws.rs.Consumes;
 import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.UserGroup;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Permissions;
@@ -46,6 +47,9 @@ public class UserGroupDirectoryResource extends DirectoryResource<UserGroup, API
      * Creates a new UserGroupDirectoryResource which exposes the operations
      * and subresources available for the given UserGroup Directory.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -61,11 +65,13 @@ public class UserGroupDirectoryResource extends DirectoryResource<UserGroup, API
      *     representing UserGroups.
      */
     @AssistedInject
-    public UserGroupDirectoryResource(@Assisted UserContext userContext,
+    public UserGroupDirectoryResource(
+            @Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext,
             @Assisted Directory<UserGroup> directory,
             DirectoryObjectTranslator<UserGroup, APIUserGroup> translator,
             DirectoryObjectResourceFactory<UserGroup, APIUserGroup> resourceFactory) {
-        super(userContext, directory, translator, resourceFactory);
+        super(authenticatedUser, userContext, UserGroup.class, directory, translator, resourceFactory);
     }
 
     @Override
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupResource.java
index 350b59fed..6994484d9 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupResource.java
@@ -26,6 +26,7 @@ import javax.ws.rs.Path;
 import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.UserGroup;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.UserContext;
@@ -43,15 +44,13 @@ import org.apache.guacamole.rest.permission.PermissionSetResource;
 public class UserGroupResource
         extends DirectoryObjectResource<UserGroup, APIUserGroup> {
 
-    /**
-     * The UserGroup object represented by this UserGroupResource.
-     */
-    private final UserGroup userGroup;
-
     /**
      * Creates a new UserGroupResource which exposes the operations and
      * subresources available for the given UserGroup.
      *
+     * @param authenticatedUser
+     *     The user that is accessing this resource.
+     *
      * @param userContext
      *     The UserContext associated with the given Directory.
      *
@@ -65,12 +64,12 @@ public class UserGroupResource
      *     A DirectoryObjectTranslator implementation which handles Users.
      */
     @AssistedInject
-    public UserGroupResource(@Assisted UserContext userContext,
+    public UserGroupResource(@Assisted AuthenticatedUser authenticatedUser,
+            @Assisted UserContext userContext,
             @Assisted Directory<UserGroup> directory,
             @Assisted UserGroup userGroup,
             DirectoryObjectTranslator<UserGroup, APIUserGroup> translator) {
-        super(userContext, directory, userGroup, translator);
-        this.userGroup = userGroup;
+        super(authenticatedUser, userContext, UserGroup.class, directory, userGroup, translator);
     }
 
     /**
@@ -87,7 +86,7 @@ public class UserGroupResource
      */
     @Path("userGroups")
     public RelatedObjectSetResource getUserGroups() throws GuacamoleException {
-        return new RelatedObjectSetResource(userGroup.getUserGroups());
+        return new RelatedObjectSetResource(getInternalObject().getUserGroups());
     }
 
     /**
@@ -104,7 +103,7 @@ public class UserGroupResource
      */
     @Path("memberUsers")
     public RelatedObjectSetResource getMemberUsers() throws GuacamoleException {
-        return new RelatedObjectSetResource(userGroup.getMemberUsers());
+        return new RelatedObjectSetResource(getInternalObject().getMemberUsers());
     }
 
     /**
@@ -121,7 +120,7 @@ public class UserGroupResource
      */
     @Path("memberUserGroups")
     public RelatedObjectSetResource getMemberUserGroups() throws GuacamoleException {
-        return new RelatedObjectSetResource(userGroup.getMemberUserGroups());
+        return new RelatedObjectSetResource(getInternalObject().getMemberUserGroups());
     }
 
     /**
@@ -135,7 +134,7 @@ public class UserGroupResource
      */
     @Path("permissions")
     public PermissionSetResource getPermissions() {
-        return new PermissionSetResource(userGroup);
+        return new PermissionSetResource(getInternalObject());
     }
 
 }

From 79a1bcb2a3f66edaa3ce800eaa38c4280b0fc63d Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 22 Sep 2022 10:41:36 -0700
Subject: [PATCH 082/289] GUACAMOLE-1224: Extract getName() / setName() into
 common Nameable interface.

---
 .../apache/guacamole/net/auth/Connection.java | 15 +------
 .../guacamole/net/auth/ConnectionGroup.java   | 15 +------
 .../apache/guacamole/net/auth/Nameable.java   | 45 +++++++++++++++++++
 .../guacamole/net/auth/SharingProfile.java    | 18 +-------
 4 files changed, 48 insertions(+), 45 deletions(-)
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Nameable.java

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Connection.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Connection.java
index 3d8e64d64..24cf49c72 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Connection.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Connection.java
@@ -34,20 +34,7 @@ import org.apache.guacamole.protocol.GuacamoleConfiguration;
  * backing GuacamoleConfiguration may be intentionally obfuscated or tokenized
  * to protect sensitive configuration information.
  */
-public interface Connection extends Identifiable, Connectable, Attributes {
-
-    /**
-     * Returns the name assigned to this Connection.
-     * @return The name assigned to this Connection.
-     */
-    public String getName();
-
-    /**
-     * Sets the name assigned to this Connection.
-     *
-     * @param name The name to assign.
-     */
-    public void setName(String name);
+public interface Connection extends Identifiable, Connectable, Attributes, Nameable {
 
     /**
      * Returns the unique identifier of the parent ConnectionGroup for
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/ConnectionGroup.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/ConnectionGroup.java
index 74412de7d..a080afcc5 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/ConnectionGroup.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/ConnectionGroup.java
@@ -26,7 +26,7 @@ import org.apache.guacamole.GuacamoleException;
  * Represents a connection group, which can contain both other connection groups
  * as well as connections.
  */
-public interface ConnectionGroup extends Identifiable, Connectable, Attributes {
+public interface ConnectionGroup extends Identifiable, Connectable, Attributes, Nameable {
   
     /**
      * All legal types of connection group.
@@ -51,19 +51,6 @@ public interface ConnectionGroup extends Identifiable, Connectable, Attributes {
 
     };
 
-    /**
-     * Returns the name assigned to this ConnectionGroup.
-     * @return The name assigned to this ConnectionGroup.
-     */
-    public String getName();
-
-    /**
-     * Sets the name assigned to this ConnectionGroup.
-     *
-     * @param name The name to assign.
-     */
-    public void setName(String name);
-
     /**
      * Returns the unique identifier of the parent ConnectionGroup for
      * this ConnectionGroup.
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Nameable.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Nameable.java
new file mode 100644
index 000000000..d40206054
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Nameable.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.auth;
+
+/**
+ * An object which has a human-readable, arbitrary name. No requirement is
+ * imposed by this interface regarding whether this name must be unique,
+ * however implementations are free to impose such restrictions.
+ */
+public interface Nameable {
+
+    /**
+     * Returns the human-readable name assigned to this object.
+     *
+     * @return
+     *     The name assigned to this object.
+     */
+    String getName();
+
+    /**
+     * Sets the human-readable name assigned to this object.
+     *
+     * @param name
+     *     The name to assign.
+     */
+    void setName(String name);
+
+}
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/SharingProfile.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/SharingProfile.java
index 2d4c4326a..1fe75d912 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/SharingProfile.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/SharingProfile.java
@@ -25,23 +25,7 @@ import java.util.Map;
  * Represents the semantics which apply to an existing connection when shared,
  * along with a human-readable name and unique identifier.
  */
-public interface SharingProfile extends Identifiable, Attributes {
-
-    /**
-     * Returns the human-readable name assigned to this SharingProfile.
-     *
-     * @return
-     *     The name assigned to this SharingProfile.
-     */
-    public String getName();
-
-    /**
-     * Sets the human-readable name assigned to this SharingProfile.
-     *
-     * @param name
-     *     The name to assign.
-     */
-    public void setName(String name);
+public interface SharingProfile extends Identifiable, Attributes, Nameable {
 
     /**
      * Returns the identifier of the primary connection associated with this

From 9bda1b2c1951e471d97f25658927f452f5e33489 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 22 Sep 2022 10:41:02 -0700
Subject: [PATCH 083/289] GUACAMOLE-1224: Add a default, global event listener
 providing logging.

---
 .../guacamole/event/AffectedObject.java       | 124 +++++++++++++++++
 .../guacamole/event/EventLoggingListener.java | 130 ++++++++++++++++++
 .../org/apache/guacamole/event/Failure.java   |  56 ++++++++
 .../guacamole/event/LoggableDetail.java       |  39 ++++++
 .../guacamole/event/RequestingUser.java       |  59 ++++++++
 .../guacamole/extension/ExtensionModule.java  |   4 +-
 6 files changed, 411 insertions(+), 1 deletion(-)
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/event/Failure.java
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/event/LoggableDetail.java
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/event/RequestingUser.java

diff --git a/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java b/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
new file mode 100644
index 000000000..572a9693a
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
@@ -0,0 +1,124 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.event;
+
+import org.apache.guacamole.net.auth.Nameable;
+import org.apache.guacamole.net.event.DirectoryEvent;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Loggable representation of the object affected by an operation.
+ */
+public class AffectedObject implements LoggableDetail {
+
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(AffectedObject.class);
+    
+    /**
+     * The event representing the requested operation.
+     */
+    private final DirectoryEvent<?> event;
+
+    /**
+     * Creates a new AffectedObject representing the object affected by the
+     * operation described by the given event.
+     *
+     * @param event
+     *     The event representing the operation.
+     */
+    public AffectedObject(DirectoryEvent<?> event) {
+        this.event = event;
+    }
+
+    @Override
+    public String toString() {
+
+        Object object = event.getObject();
+        String identifier = event.getObjectIdentifier();
+
+        String objectType;
+        String name = null; // Not all objects have names
+
+        // Obtain name of object (if applicable and available)
+        if (object instanceof Nameable) {
+            try {
+                name = ((Nameable) object).getName();
+            }
+            catch (RuntimeException | Error e) {
+                logger.debug("Name of object \"{}\" could not be retrieved.", identifier, e);
+            }
+        }
+
+        // Determine type of object
+        switch (event.getDirectoryType()) {
+
+            // Active connections
+            case ACTIVE_CONNECTION:
+                objectType = "active connection";
+                break;
+
+            // Connections
+            case CONNECTION:
+                objectType = "connection";
+                break;
+
+            // Connection groups
+            case CONNECTION_GROUP:
+                objectType = "connection group";
+                break;
+
+            // Sharing profiles
+            case SHARING_PROFILE:
+                objectType = "sharing profile";
+                break;
+
+            // Users
+            case USER:
+                objectType = "user";
+                break;
+
+            // User groups
+            case USER_GROUP:
+                objectType = "user group";
+                break;
+
+            // Unknown
+            default:
+                objectType = (object != null) ? object.getClass().toString() : "an unknown object";
+                
+        }
+
+        // Describe at least the type of the object and its identifier,
+        // including the name of the object, as well, if available
+        if (identifier != null) {
+            if (name != null)
+                return objectType + " \"" + identifier + "\" (currently named \"" + name + "\")";
+            else
+                return objectType + " \"" + identifier + "\"";
+        }
+        else
+            return objectType;
+
+    }
+    
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
new file mode 100644
index 000000000..def5c19d9
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
@@ -0,0 +1,130 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.event;
+
+import javax.annotation.Nonnull;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleResourceNotFoundException;
+import org.apache.guacamole.net.event.DirectoryEvent;
+import org.apache.guacamole.net.event.DirectoryFailureEvent;
+import org.apache.guacamole.net.event.DirectorySuccessEvent;
+import org.apache.guacamole.net.event.listener.Listener;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Listener that records each event that occurs in the logs, such as changes
+ * made to objects via the REST API.
+ */
+public class EventLoggingListener implements Listener {
+
+    /**
+     * Logger for this class.
+     */
+    private final Logger logger = LoggerFactory.getLogger(EventLoggingListener.class);
+
+    /**
+     * Logs that an operation was performed on an object within a Directory
+     * successfully.
+     *
+     * @param event
+     *     The event describing the operation successfully performed on the
+     *     object.
+     */
+    private void logSuccess(DirectorySuccessEvent<?> event) {
+        DirectoryEvent.Operation op = event.getOperation();
+        switch (op) {
+
+            case GET:
+                logger.debug("{} successfully accessed/retrieved {}", new RequestingUser(event), new AffectedObject(event));
+                break;
+
+            case ADD:
+                logger.info("{} successfully created {}", new RequestingUser(event), new AffectedObject(event));
+                break;
+
+            case UPDATE:
+                logger.info("{} successfully updated {}", new RequestingUser(event), new AffectedObject(event));
+                break;
+
+            case REMOVE:
+                logger.info("{} successfully deleted {}", new RequestingUser(event), new AffectedObject(event));
+                break;
+
+            default:
+                logger.warn("DirectoryEvent operation type has no corresponding log message implemented: {}", op);
+                logger.info("{} successfully performed an unknown action on {} {}", new RequestingUser(event), new AffectedObject(event));
+
+        }
+    }
+
+    /**
+     * Logs that an operation failed to be performed on an object within a
+     * Directory.
+     *
+     * @param event
+     *     The event describing the operation that failed.
+     */
+    private void logFailure(DirectoryFailureEvent<?> event) {
+        DirectoryEvent.Operation op = event.getOperation();
+        switch (op) {
+
+            case GET:
+                if (event.getFailure() instanceof GuacamoleResourceNotFoundException)
+                    logger.debug("{} failed to access/retrieve {}: {}", new RequestingUser(event), new AffectedObject(event), new Failure(event));
+                else
+                    logger.info("{} failed to access/retrieve {}: {}", new RequestingUser(event), new AffectedObject(event), new Failure(event));
+                break;
+
+            case ADD:
+                logger.info("{} failed to create {}: {}", new RequestingUser(event), new AffectedObject(event), new Failure(event));
+                break;
+
+            case UPDATE:
+                logger.info("{} failed to update {}: {}", new RequestingUser(event), new AffectedObject(event), new Failure(event));
+                break;
+
+            case REMOVE:
+                logger.info("{} failed to delete {}: {}", new RequestingUser(event), new AffectedObject(event), new Failure(event));
+                break;
+
+            default:
+                logger.warn("DirectoryEvent operation type has no corresponding log message implemented: {}", op);
+                logger.info("{} failed to perform an unknown action on {}: {}", new RequestingUser(event), new AffectedObject(event), new Failure(event));
+
+        }
+    }
+
+    @Override
+    public void handleEvent(@Nonnull Object event) throws GuacamoleException {
+
+        if (event instanceof DirectorySuccessEvent)
+            logSuccess((DirectorySuccessEvent<?>) event);
+
+        else if (event instanceof DirectoryFailureEvent)
+            logFailure((DirectoryFailureEvent<?>) event);
+
+        else
+            logger.debug("Ignoring unknown/unimplemented event type: {}",
+                    event.getClass());
+
+    }
+
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/Failure.java b/guacamole/src/main/java/org/apache/guacamole/event/Failure.java
new file mode 100644
index 000000000..10b3c960b
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/event/Failure.java
@@ -0,0 +1,56 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.event;
+
+import org.apache.guacamole.net.event.FailureEvent;
+
+/**
+ * Loggable representation of a failure that occurred.
+ */
+public class Failure implements LoggableDetail {
+
+    /**
+     * The event representing the failure.
+     */
+    private final FailureEvent event;
+
+    /**
+     * Creates a new Failure representing the failure described by the given
+     * event.
+     *
+     * @param event 
+     *     The event representing the failure.
+     */
+    public Failure(FailureEvent event) {
+        this.event = event;
+    }
+
+    @Override
+    public String toString() {
+
+        Throwable failure = event.getFailure();
+        if (failure == null)
+            return "unknown error (no specific failure recorded)";
+
+        return failure.getMessage();
+        
+    }
+    
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/LoggableDetail.java b/guacamole/src/main/java/org/apache/guacamole/event/LoggableDetail.java
new file mode 100644
index 000000000..909412e40
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/event/LoggableDetail.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.event;
+
+/**
+ * Provides a {@link #toString()} implementation that returns a human-readable
+ * string that is intended to be logged and which describes a particular detail
+ * of an event.
+ */
+public interface LoggableDetail {
+
+    /**
+     * {@inheritDoc}
+     * <p>
+     * A LoggableDetail implementation of toString() is required to return a
+     * string that is human-readable, describes a detail of a provided event,
+     * and that is intended to be logged.
+     */
+    @Override
+    String toString();
+
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/RequestingUser.java b/guacamole/src/main/java/org/apache/guacamole/event/RequestingUser.java
new file mode 100644
index 000000000..124aa8f80
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/event/RequestingUser.java
@@ -0,0 +1,59 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.event;
+
+import org.apache.guacamole.net.auth.AuthenticatedUser;
+import org.apache.guacamole.net.event.DirectoryEvent;
+
+/**
+ * Loggable representation of the user that requested an operation.
+ */
+public class RequestingUser implements LoggableDetail {
+
+    /**
+     * The event representing the requested operation.
+     */
+    private final DirectoryEvent<?> event;
+
+    /**
+     * Creates a new RequestingUser that represents the user that requested the
+     * operation described by the given event.
+     *
+     * @param event
+     *     The event representing the requested operation.
+     */
+    public RequestingUser(DirectoryEvent<?> event) {
+        this.event = event;
+    }
+
+    @Override
+    public String toString() {
+
+        AuthenticatedUser user = event.getAuthenticatedUser();
+        String identifier = user.getIdentifier();
+
+        if (AuthenticatedUser.ANONYMOUS_IDENTIFIER.equals(identifier))
+            return "Anonymous user (authenticated by \"" + user.getAuthenticationProvider().getIdentifier() + "\")";
+
+        return "User \"" + identifier + "\" (authenticated by \"" + user.getAuthenticationProvider().getIdentifier() + "\")";
+        
+    }
+
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionModule.java b/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionModule.java
index 0fcff57dd..e5fbe2e57 100644
--- a/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionModule.java
+++ b/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionModule.java
@@ -35,6 +35,7 @@ import org.apache.guacamole.auth.file.FileAuthenticationProvider;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.environment.Environment;
+import org.apache.guacamole.event.EventLoggingListener;
 import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.event.listener.Listener;
 import org.apache.guacamole.properties.StringSetProperty;
@@ -628,8 +629,9 @@ public class ExtensionModule extends ServletModule {
         final Set<String> toleratedAuthProviders = getToleratedAuthenticationProviders();
         loadExtensions(javaScriptResources, cssResources, toleratedAuthProviders);
 
-        // Always bind default file-driven auth last
+        // Always bind default file-driven auth and event logging last
         bindAuthenticationProvider(FileAuthenticationProvider.class, toleratedAuthProviders);
+        bindListener(EventLoggingListener.class);
 
         // Dynamically generate app.js and app.css from extensions
         serve("/app.js").with(new ResourceServlet(new SequenceResource(javaScriptResources)));

From 8c36eaf55da22ac07dac9cda0c608bb5c94f4cb2 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Sun, 2 Oct 2022 11:19:01 -0700
Subject: [PATCH 084/289] GUACAMOLE-1224: Add events for overall webapp
 startup/shutdown.

---
 .../net/event/ApplicationShutdownEvent.java   | 36 ++++++++++++++++
 .../net/event/ApplicationStartedEvent.java    | 29 +++++++++++++
 .../GuacamoleServletContextListener.java      | 43 +++++++++++++++++--
 .../guacamole/event/EventLoggingListener.java | 11 ++++-
 4 files changed, 115 insertions(+), 4 deletions(-)
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/event/ApplicationShutdownEvent.java
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/event/ApplicationStartedEvent.java

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/ApplicationShutdownEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/ApplicationShutdownEvent.java
new file mode 100644
index 000000000..ba7f50bac
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/ApplicationShutdownEvent.java
@@ -0,0 +1,36 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.event;
+
+import org.apache.guacamole.net.auth.AuthenticationProvider;
+import org.apache.guacamole.net.auth.UserContext;
+import org.apache.guacamole.net.event.listener.Listener;
+
+/**
+ * Event that is dispatched when the web application has nearly completely shut
+ * down, including the authentication/authorization portion of extensions. Any
+ * installed extensions are still loaded (such that they may receive this event
+ * via {@link Listener#handleEvent(java.lang.Object)}, but their authentication
+ * providers will have been shut down via {@link AuthenticationProvider#shutdown()},
+ * and resources from user sessions will have been closed and released via
+ * {@link UserContext#invalidate()}.
+ */
+public interface ApplicationShutdownEvent {
+}
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/ApplicationStartedEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/ApplicationStartedEvent.java
new file mode 100644
index 000000000..cf2ae2f3b
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/ApplicationStartedEvent.java
@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.event;
+
+/**
+ * Event that is dispatched when the web application has finished starting up,
+ * including all extensions. This event indicates only that the web application
+ * startup process has completed and all extensions have been loaded. It does
+ * not indicate whether all extensions have started successfully.
+ */
+public interface ApplicationStartedEvent {
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java b/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java
index 2b3f155d0..1068477c4 100644
--- a/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java
+++ b/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java
@@ -35,11 +35,14 @@ import org.apache.guacamole.environment.LocalEnvironment;
 import org.apache.guacamole.extension.ExtensionModule;
 import org.apache.guacamole.log.LogModule;
 import org.apache.guacamole.net.auth.AuthenticationProvider;
+import org.apache.guacamole.net.event.ApplicationShutdownEvent;
+import org.apache.guacamole.net.event.ApplicationStartedEvent;
 import org.apache.guacamole.properties.BooleanGuacamoleProperty;
 import org.apache.guacamole.properties.FileGuacamoleProperties;
 import org.apache.guacamole.rest.RESTServiceModule;
 import org.apache.guacamole.rest.auth.HashTokenSessionMap;
 import org.apache.guacamole.rest.auth.TokenSessionMap;
+import org.apache.guacamole.rest.event.ListenerService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -125,7 +128,13 @@ public class GuacamoleServletContextListener extends GuiceServletContextListener
      */
     @Inject
     private List<File> temporaryFiles;
-    
+
+    /**
+     * Service for dispatching events to registered listeners.
+     */
+    @Inject
+    private ListenerService listenerService;
+
     /**
      * Internal reference to the Guice injector that was lazily created when
      * getInjector() was first invoked.
@@ -179,6 +188,17 @@ public class GuacamoleServletContextListener extends GuiceServletContextListener
         // Store reference to injector for use by Jersey and HK2 bridge
         servletContextEvent.getServletContext().setAttribute(GUICE_INJECTOR, injector);
 
+        // Inform any listeners that application startup has completed
+        try {
+            listenerService.handleEvent(new ApplicationStartedEvent() {
+                // The application startup event currently has no content
+            });
+        }
+        catch (GuacamoleException e) {
+            logger.error("An extension listening for application startup failed: {}", e.getMessage());
+            logger.debug("Extension failed internally while handling the application startup event.", e);
+        }
+
     }
 
     @Override
@@ -228,19 +248,36 @@ public class GuacamoleServletContextListener extends GuiceServletContextListener
             // Clean up reference to Guice injector
             servletContextEvent.getServletContext().removeAttribute(GUICE_INJECTOR);
 
-            // Shutdown TokenSessionMap
+            // Shutdown TokenSessionMap, invalidating all sessions (logging all
+            // users out)
             if (sessionMap != null)
                 sessionMap.shutdown();
 
-            // Unload all extensions
+            // Unload authentication for all extensions
             if (authProviders != null) {
                 for (AuthenticationProvider authProvider : authProviders)
                     authProvider.shutdown();
             }
 
+            // Inform any listeners that application shutdown has completed
+            try {
+                listenerService.handleEvent(new ApplicationShutdownEvent() {
+                    // The application shutdown event currently has no content
+                });
+            }
+            catch (GuacamoleException e) {
+                logger.error("An extension listening for application shutdown failed: {}", e.getMessage());
+                logger.debug("Extension failed internally while handling the application shutdown event.", e);
+            }
+
         }
         finally {
 
+            // NOTE: This temporary file cleanup must happen AFTER firing the
+            // ApplicationShutdownEvent, or an extension that relies on a .jar
+            // file among those temporary files might fail internally when
+            // attempting to process the event.
+
             // Regardless of what may succeed/fail here, always attempt to
             // clean up ALL temporary files
             if (temporaryFiles != null)
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
index def5c19d9..f3b804892 100644
--- a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
+++ b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
@@ -22,6 +22,8 @@ package org.apache.guacamole.event;
 import javax.annotation.Nonnull;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
+import org.apache.guacamole.net.event.ApplicationShutdownEvent;
+import org.apache.guacamole.net.event.ApplicationStartedEvent;
 import org.apache.guacamole.net.event.DirectoryEvent;
 import org.apache.guacamole.net.event.DirectoryFailureEvent;
 import org.apache.guacamole.net.event.DirectorySuccessEvent;
@@ -115,12 +117,19 @@ public class EventLoggingListener implements Listener {
     @Override
     public void handleEvent(@Nonnull Object event) throws GuacamoleException {
 
+        // General object creation/modification/deletion
         if (event instanceof DirectorySuccessEvent)
             logSuccess((DirectorySuccessEvent<?>) event);
-
         else if (event instanceof DirectoryFailureEvent)
             logFailure((DirectoryFailureEvent<?>) event);
 
+        // Application startup/shutdown
+        else if (event instanceof ApplicationStartedEvent)
+            logger.info("The Apache Guacamole web application has started.");
+        else if (event instanceof ApplicationShutdownEvent)
+            logger.info("The Apache Guacamole web application has shut down.");
+
+        // Unknown events
         else
             logger.debug("Ignoring unknown/unimplemented event type: {}",
                     event.getClass());

From 63de886e5d81e802ce317b4f26d8f01cea297059 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Sun, 2 Oct 2022 11:20:04 -0700
Subject: [PATCH 085/289] GUACAMOLE-1224: Ensure all user sessions are
 explicitly invalidated prior to application shutdown.

---
 .../org/apache/guacamole/rest/auth/HashTokenSessionMap.java | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
index a344ab911..24f653098 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
@@ -225,7 +225,13 @@ public class HashTokenSessionMap implements TokenSessionMap {
 
     @Override
     public void shutdown() {
+
+        // Terminate the automatic session invalidation thread
         executor.shutdownNow();
+
+        // Forcibly invalidate any remaining sessions
+        sessionMap.values().stream().forEach(GuacamoleSession::invalidate);
+
     }
 
 }

From b3319b817d57dfb46f87d879130c85bfc2921afe Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Sun, 2 Oct 2022 11:58:32 -0700
Subject: [PATCH 086/289] GUACAMOLE-1224: Add user session invalidation/logout
 event.

---
 .../event/UserSessionInvalidatedEvent.java    | 27 ++++++++++++++
 .../apache/guacamole/GuacamoleSession.java    | 37 +++++++++++++++----
 .../guacamole/event/EventLoggingListener.java |  6 +++
 .../guacamole/event/RequestingUser.java       |  6 +--
 .../rest/auth/AuthenticationService.java      |  9 +----
 5 files changed, 67 insertions(+), 18 deletions(-)
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/event/UserSessionInvalidatedEvent.java

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/UserSessionInvalidatedEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/UserSessionInvalidatedEvent.java
new file mode 100644
index 000000000..4398cfa89
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/UserSessionInvalidatedEvent.java
@@ -0,0 +1,27 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.event;
+
+/**
+ * Event that is dispatched when a user has logged out or their session has
+ * expired.
+ */
+public interface UserSessionInvalidatedEvent extends UserEvent {
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java b/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java
index 24ea196c5..3e8d488c3 100644
--- a/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java
+++ b/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java
@@ -23,12 +23,13 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
-import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.net.GuacamoleTunnel;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.UserContext;
+import org.apache.guacamole.net.event.UserSessionInvalidatedEvent;
 import org.apache.guacamole.rest.auth.DecoratedUserContext;
+import org.apache.guacamole.rest.event.ListenerService;
 import org.apache.guacamole.tunnel.UserTunnel;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -58,8 +59,12 @@ public class GuacamoleSession {
     /**
      * All currently-active tunnels, indexed by tunnel UUID.
      */
-    private final Map<String, UserTunnel> tunnels =
-            new ConcurrentHashMap<String, UserTunnel>();
+    private final Map<String, UserTunnel> tunnels = new ConcurrentHashMap<>();
+
+    /**
+     * Service for dispatching events to registered event listeners.
+     */
+    private final ListenerService listenerService;
 
     /**
      * The last time this session was accessed.
@@ -70,9 +75,9 @@ public class GuacamoleSession {
      * Creates a new Guacamole session associated with the given
      * AuthenticatedUser and UserContexts.
      *
-     * @param environment
-     *     The environment of the Guacamole server associated with this new
-     *     session.
+     * @param listenerService
+     *     The service to use to notify registered event listeners when this
+     *     session is invalidated.
      *
      * @param authenticatedUser
      *     The authenticated user to associate this session with.
@@ -83,11 +88,12 @@ public class GuacamoleSession {
      * @throws GuacamoleException
      *     If an error prevents the session from being created.
      */
-    public GuacamoleSession(Environment environment,
+    public GuacamoleSession(ListenerService listenerService,
             AuthenticatedUser authenticatedUser,
             List<DecoratedUserContext> userContexts)
             throws GuacamoleException {
         this.lastAccessedTime = System.currentTimeMillis();
+        this.listenerService = listenerService;
         this.authenticatedUser = authenticatedUser;
         this.userContexts = userContexts;
     }
@@ -260,6 +266,23 @@ public class GuacamoleSession {
         // Invalidate the authenticated user object
         authenticatedUser.invalidate();
 
+        // Advise any registered listeners that the user's session is now
+        // invalidated
+        try {
+            listenerService.handleEvent(new UserSessionInvalidatedEvent() {
+
+                @Override
+                public AuthenticatedUser getAuthenticatedUser() {
+                    return authenticatedUser;
+                }
+
+            });
+        }
+        catch (GuacamoleException e) {
+            logger.error("An extension listening for session invalidation failed: {}", e.getMessage());
+            logger.debug("Extension failed internally while handling the session invalidation event.", e);
+        }
+
     }
     
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
index f3b804892..85d616cbb 100644
--- a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
+++ b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
@@ -27,6 +27,7 @@ import org.apache.guacamole.net.event.ApplicationStartedEvent;
 import org.apache.guacamole.net.event.DirectoryEvent;
 import org.apache.guacamole.net.event.DirectoryFailureEvent;
 import org.apache.guacamole.net.event.DirectorySuccessEvent;
+import org.apache.guacamole.net.event.UserSessionInvalidatedEvent;
 import org.apache.guacamole.net.event.listener.Listener;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -123,6 +124,11 @@ public class EventLoggingListener implements Listener {
         else if (event instanceof DirectoryFailureEvent)
             logFailure((DirectoryFailureEvent<?>) event);
 
+        // Logout / session expiration
+        else if (event instanceof UserSessionInvalidatedEvent)
+            logger.info("{} has logged out, or their session has expired or "
+                    + "been terminated.", new RequestingUser((UserSessionInvalidatedEvent) event));
+
         // Application startup/shutdown
         else if (event instanceof ApplicationStartedEvent)
             logger.info("The Apache Guacamole web application has started.");
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/RequestingUser.java b/guacamole/src/main/java/org/apache/guacamole/event/RequestingUser.java
index 124aa8f80..bcc14f4c4 100644
--- a/guacamole/src/main/java/org/apache/guacamole/event/RequestingUser.java
+++ b/guacamole/src/main/java/org/apache/guacamole/event/RequestingUser.java
@@ -20,7 +20,7 @@
 package org.apache.guacamole.event;
 
 import org.apache.guacamole.net.auth.AuthenticatedUser;
-import org.apache.guacamole.net.event.DirectoryEvent;
+import org.apache.guacamole.net.event.UserEvent;
 
 /**
  * Loggable representation of the user that requested an operation.
@@ -30,7 +30,7 @@ public class RequestingUser implements LoggableDetail {
     /**
      * The event representing the requested operation.
      */
-    private final DirectoryEvent<?> event;
+    private final UserEvent event;
 
     /**
      * Creates a new RequestingUser that represents the user that requested the
@@ -39,7 +39,7 @@ public class RequestingUser implements LoggableDetail {
      * @param event
      *     The event representing the requested operation.
      */
-    public RequestingUser(DirectoryEvent<?> event) {
+    public RequestingUser(UserEvent event) {
         this.event = event;
     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
index 705d7a856..48a2d5a36 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
@@ -30,7 +30,6 @@ import org.apache.guacamole.GuacamoleSecurityException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.GuacamoleUnauthorizedException;
 import org.apache.guacamole.GuacamoleSession;
-import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Credentials;
@@ -56,12 +55,6 @@ public class AuthenticationService {
      */
     private static final Logger logger = LoggerFactory.getLogger(AuthenticationService.class);
 
-    /**
-     * The Guacamole server environment.
-     */
-    @Inject
-    private Environment environment;
-
     /**
      * All configured authentication providers which can be used to
      * authenticate users or retrieve data associated with authenticated users.
@@ -443,7 +436,7 @@ public class AuthenticationService {
             // If no existing session, generate a new token/session pair
             else {
                 authToken = authTokenGenerator.getToken();
-                tokenSessionMap.put(authToken, new GuacamoleSession(environment, authenticatedUser, userContexts));
+                tokenSessionMap.put(authToken, new GuacamoleSession(listenerService, authenticatedUser, userContexts));
                 logger.debug("Login was successful for user \"{}\".", authenticatedUser.getIdentifier());
             }
 

From 818471ac8489f9b75452c99e1a356412dad2425b Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 3 Oct 2022 13:41:54 -0700
Subject: [PATCH 087/289] GUACAMOLE-1224: Migrate existing auth-related logging
 to global event listener.

---
 .../InMemoryAuthenticationFailureTracker.java | 37 +-------
 .../guacamole/net/auth/Credentials.java       | 32 +++++++
 .../net/event/AuthenticationSuccessEvent.java | 49 +++++++++-
 .../guacamole/event/EventLoggingListener.java | 56 ++++++++++-
 .../apache/guacamole/event/RemoteAddress.java | 95 +++++++++++++++++++
 .../rest/auth/AuthenticationService.java      | 78 +--------------
 6 files changed, 233 insertions(+), 114 deletions(-)
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/event/RemoteAddress.java

diff --git a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/InMemoryAuthenticationFailureTracker.java b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/InMemoryAuthenticationFailureTracker.java
index b655168e1..58ed4e014 100644
--- a/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/InMemoryAuthenticationFailureTracker.java
+++ b/extensions/guacamole-auth-ban/src/main/java/org/apache/guacamole/auth/ban/status/InMemoryAuthenticationFailureTracker.java
@@ -21,7 +21,6 @@ package org.apache.guacamole.auth.ban.status;
 
 import com.github.benmanes.caffeine.cache.Cache;
 import com.github.benmanes.caffeine.cache.Caffeine;
-import javax.servlet.http.HttpServletRequest;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.language.TranslatableGuacamoleClientTooManyException;
@@ -88,40 +87,6 @@ public class InMemoryAuthenticationFailureTracker implements AuthenticationFailu
 
     }
 
-    /**
-     * Returns whether the given Credentials do not contain any specific
-     * authentication parameters, including HTTP parameters. An authentication
-     * request that contains no parameters whatsoever will tend to be the
-     * first, anonymous, credential-less authentication attempt that results in
-     * the initial login screen rendering.
-     *
-     * @param credentials
-     *     The Credentials object to test.
-     *
-     * @return
-     *     true if the given Credentials contain no authentication parameters
-     *     whatsoever, false otherwise.
-     */
-    private boolean isEmpty(Credentials credentials) {
-
-        // An authentication request that contains an explicit username or
-        // password (even if blank) is non-empty, regardless of how the values
-        // were passed
-        if (credentials.getUsername() != null || credentials.getPassword() != null)
-            return false;
-
-        // All further tests depend on HTTP request details
-        HttpServletRequest request = credentials.getRequest();
-        if (request == null)
-            return true;
-
-        // An authentication request is non-empty if it contains any HTTP
-        // parameters at all or contains an authentication token
-        return !request.getParameterNames().hasMoreElements()
-                && request.getHeader("Guacamole-Token") == null;
-
-    }
-
     /**
      * Reports that the given address has just failed to authenticate and
      * returns the AuthenticationFailureStatus that represents that failure. If
@@ -168,7 +133,7 @@ public class InMemoryAuthenticationFailureTracker implements AuthenticationFailu
             boolean failed) throws GuacamoleException {
 
         // Ignore requests that do not contain explicit parameters of any kind
-        if (isEmpty(credentials))
+        if (credentials.isEmpty())
             return;
 
         // Determine originating address of the authentication request
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java
index 40f991244..6ad0e240b 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java
@@ -236,4 +236,36 @@ public class Credentials implements Serializable {
         this.remoteHostname = remoteHostname;
     }
 
+    /**
+     * Returns whether this Credentials object does not contain any specific
+     * authentication parameters, including HTTP parameters and the HTTP header
+     * used for the authentication token. An authentication request that
+     * contains no parameters whatsoever will tend to be the first, anonymous,
+     * credential-less authentication attempt that results in the initial login
+     * screen rendering.
+     *
+     * @return
+     *     true if this Credentials object contains no authentication
+     *     parameters whatsoever, false otherwise.
+     */
+    public boolean isEmpty() {
+
+        // An authentication request that contains an explicit username or
+        // password (even if blank) is non-empty, regardless of how the values
+        // were passed
+        if (getUsername() != null || getPassword() != null)
+            return false;
+
+        // All further tests depend on HTTP request details
+        HttpServletRequest httpRequest = getRequest();
+        if (httpRequest == null)
+            return true;
+
+        // An authentication request is non-empty if it contains any HTTP
+        // parameters at all or contains an authentication token
+        return !httpRequest.getParameterNames().hasMoreElements()
+                && httpRequest.getHeader("Guacamole-Token") == null;
+
+    }
+
 }
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationSuccessEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationSuccessEvent.java
index a9b21dce8..a7270968e 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationSuccessEvent.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/AuthenticationSuccessEvent.java
@@ -42,17 +42,47 @@ public class AuthenticationSuccessEvent implements UserEvent, CredentialEvent,
      */
     private final AuthenticatedUser authenticatedUser;
 
+    /**
+     * Whether the successful authentication attempt represented by this event
+     * is related to an established Guacamole session.
+     */
+    private final boolean existingSession;
+    
     /**
      * Creates a new AuthenticationSuccessEvent which represents a successful
      * authentication attempt by the user identified by the given
-     * AuthenticatedUser object.
+     * AuthenticatedUser object. The authentication attempt is presumed to be
+     * a fresh authentication attempt unrelated to an established session (a
+     * login attempt).
      *
      * @param authenticatedUser
      *     The AuthenticatedUser identifying the user that successfully
      *     authenticated.
      */
     public AuthenticationSuccessEvent(AuthenticatedUser authenticatedUser) {
+        this(authenticatedUser, false);
+    }
+
+    /**
+     * Creates a new AuthenticationSuccessEvent which represents a successful
+     * authentication attempt by the user identified by the given
+     * AuthenticatedUser object. Whether the authentication attempt is
+     * related to an established session (a periodic re-authentication attempt
+     * that updates session status) or not (a fresh login attempt) is
+     * determined by the value of the provided flag.
+     *
+     * @param authenticatedUser
+     *     The AuthenticatedUser identifying the user that successfully
+     *     authenticated.
+     *
+     * @param existingSession
+     *     Whether this AuthenticationSuccessEvent represents an
+     *     re-authentication attempt that updates the status of an established
+     *     Guacamole session.
+     */
+    public AuthenticationSuccessEvent(AuthenticatedUser authenticatedUser, boolean existingSession) {
         this.authenticatedUser = authenticatedUser;
+        this.existingSession = existingSession;
     }
 
     @Override
@@ -70,4 +100,21 @@ public class AuthenticationSuccessEvent implements UserEvent, CredentialEvent,
         return getAuthenticatedUser().getAuthenticationProvider();
     }
 
+    /**
+     * Returns whether the successful authentication attempt represented by
+     * this event is related to an established Guacamole session. During normal
+     * operation, the Guacamole web application will periodically
+     * re-authenticate with the server to verify its authentication token and
+     * update the session state, in which case the value returned by this
+     * function will be true. If the user was not already authenticated and has
+     * just initially logged in, false is returned.
+     *
+     * @return
+     *     true if this AuthenticationSuccessEvent is related to a Guacamole
+     *     session that was already established, false otherwise.
+     */
+    public boolean isExistingSession() {
+        return existingSession;
+    }
+
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
index 85d616cbb..2cf3a70d6 100644
--- a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
+++ b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
@@ -22,8 +22,12 @@ package org.apache.guacamole.event;
 import javax.annotation.Nonnull;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
+import org.apache.guacamole.net.auth.Credentials;
+import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
 import org.apache.guacamole.net.event.ApplicationShutdownEvent;
 import org.apache.guacamole.net.event.ApplicationStartedEvent;
+import org.apache.guacamole.net.event.AuthenticationFailureEvent;
+import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
 import org.apache.guacamole.net.event.DirectoryEvent;
 import org.apache.guacamole.net.event.DirectoryFailureEvent;
 import org.apache.guacamole.net.event.DirectorySuccessEvent;
@@ -115,6 +119,52 @@ public class EventLoggingListener implements Listener {
         }
     }
 
+    /**
+     * Logs that authentication succeeded for a user.
+     *
+     * @param event
+     *     The event describing the authentication attempt that succeeded.
+     */
+    private void logSuccess(AuthenticationSuccessEvent event) {
+        if (!event.isExistingSession())
+            logger.info("{} successfully authenticated from {}",
+                    new RequestingUser(event),
+                    new RemoteAddress(event.getCredentials()));
+        else
+            logger.debug("{} successfully re-authenticated their existing "
+                    + "session from {}", new RequestingUser(event),
+                    new RemoteAddress(event.getCredentials()));
+    }
+
+    /**
+     * Logs that authentication failed for a user.
+     *
+     * @param event
+     *     The event describing the authentication attempt that failed.
+     */
+    private void logFailure(AuthenticationFailureEvent event) {
+
+        Credentials creds = event.getCredentials();
+        String username = creds.getUsername();
+
+        if (creds.isEmpty())
+            logger.debug("Empty authentication attempt (login screen "
+                    + "initialization) from {} failed: {}",
+                    new RemoteAddress(creds), new Failure(event));
+        else if (username == null || username.isEmpty())
+            logger.debug("Anonymous authentication attempt from {} failed: {}",
+                    new RemoteAddress(creds), new Failure(event));
+        else if (event.getFailure() instanceof GuacamoleInsufficientCredentialsException)
+            logger.debug("Authentication attempt from {} for user \"{}\" "
+                    + "requires additional credentials to continue: {}",
+                    new RemoteAddress(creds), username, new Failure(event));
+        else
+            logger.warn("Authentication attempt from {} for user \"{}\" "
+                    + "failed: {}", new RemoteAddress(creds), username,
+                    new Failure(event));
+
+    }
+
     @Override
     public void handleEvent(@Nonnull Object event) throws GuacamoleException {
 
@@ -124,7 +174,11 @@ public class EventLoggingListener implements Listener {
         else if (event instanceof DirectoryFailureEvent)
             logFailure((DirectoryFailureEvent<?>) event);
 
-        // Logout / session expiration
+        // Login / logout / session expiration
+        else if (event instanceof AuthenticationSuccessEvent)
+            logSuccess((AuthenticationSuccessEvent) event);
+        else if (event instanceof AuthenticationFailureEvent)
+            logFailure((AuthenticationFailureEvent) event);
         else if (event instanceof UserSessionInvalidatedEvent)
             logger.info("{} has logged out, or their session has expired or "
                     + "been terminated.", new RequestingUser((UserSessionInvalidatedEvent) event));
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/RemoteAddress.java b/guacamole/src/main/java/org/apache/guacamole/event/RemoteAddress.java
new file mode 100644
index 000000000..f55602f59
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/event/RemoteAddress.java
@@ -0,0 +1,95 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.event;
+
+import java.util.regex.Pattern;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.guacamole.net.auth.Credentials;
+
+/**
+ * Loggable representation of the remote address of a user, including any
+ * intervening proxies noted by "X-Forwarded-For". This representation takes
+ * into account the fact that "X-Forwarded-For" may come from an untrusted
+ * source, logging such addresses within square brackets alongside the trusted
+ * source IP.
+ */
+public class RemoteAddress implements LoggableDetail {
+
+    /**
+     * Regular expression which matches any IPv4 address.
+     */
+    private static final String IPV4_ADDRESS_REGEX = "([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})";
+
+    /**
+     * Regular expression which matches any IPv6 address.
+     */
+    private static final String IPV6_ADDRESS_REGEX = "([0-9a-fA-F]*(:[0-9a-fA-F]*){0,7})";
+
+    /**
+     * Regular expression which matches any IP address, regardless of version.
+     */
+    private static final String IP_ADDRESS_REGEX = "(" + IPV4_ADDRESS_REGEX + "|" + IPV6_ADDRESS_REGEX + ")";
+
+    /**
+     * Regular expression which matches any Port Number.
+     */
+    private static final String PORT_NUMBER_REGEX = "(:[0-9]{1,5})?";
+
+    /**
+     * Pattern which matches valid values of the de-facto standard
+     * "X-Forwarded-For" header.
+     */
+    private static final Pattern X_FORWARDED_FOR = Pattern.compile("^" + IP_ADDRESS_REGEX + PORT_NUMBER_REGEX + "(, " + IP_ADDRESS_REGEX + PORT_NUMBER_REGEX + ")*$");
+
+    /**
+     * The credentials supplied by the user when they authenticated.
+     */
+    private final Credentials creds;
+
+    /**
+     * Creates a new RemoteAddress representing the source address of the HTTP
+     * request that provided the given Credentials.
+     *
+     * @param creds
+     *     The Credentials associated with the request whose source address
+     *     should be represented by this RemoteAddress.
+     */
+    public RemoteAddress(Credentials creds) {
+        this.creds = creds;
+    }
+
+    @Override
+    public String toString() {
+
+        HttpServletRequest request = creds.getRequest();
+        if (request == null)
+            return creds.getRemoteAddress();
+
+        // Log X-Forwarded-For, if present and valid
+        String header = request.getHeader("X-Forwarded-For");
+        if (header != null && X_FORWARDED_FOR.matcher(header).matches())
+            return "[" + header + ", " + request.getRemoteAddr() + "]";
+
+        // If header absent or invalid, just use source IP
+        return request.getRemoteAddr();
+
+    }
+
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
index 48a2d5a36..305073de3 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
@@ -21,9 +21,7 @@ package org.apache.guacamole.rest.auth;
 
 import java.util.ArrayList;
 import java.util.List;
-import java.util.regex.Pattern;
 import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
 
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleSecurityException;
@@ -98,57 +96,6 @@ public class AuthenticationService {
      */
     public static final String TOKEN_PARAMETER_NAME = "token";
 
-    /**
-     * Regular expression which matches any IPv4 address.
-     */
-    private static final String IPV4_ADDRESS_REGEX = "([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})";
-
-    /**
-     * Regular expression which matches any IPv6 address.
-     */
-    private static final String IPV6_ADDRESS_REGEX = "([0-9a-fA-F]*(:[0-9a-fA-F]*){0,7})";
-
-    /**
-     * Regular expression which matches any IP address, regardless of version.
-     */
-    private static final String IP_ADDRESS_REGEX = "(" + IPV4_ADDRESS_REGEX + "|" + IPV6_ADDRESS_REGEX + ")";
-
-    /**
-     * Regular expression which matches any Port Number.
-     */
-    private static final String PORT_NUMBER_REGEX = "(:[0-9]{1,5})?";
-    
-    /**
-     * Pattern which matches valid values of the de-facto standard
-     * "X-Forwarded-For" header.
-     */
-    private static final Pattern X_FORWARDED_FOR = Pattern.compile("^" + IP_ADDRESS_REGEX + PORT_NUMBER_REGEX + "(, " + IP_ADDRESS_REGEX + PORT_NUMBER_REGEX + ")*$");
-
-    /**
-     * Returns a formatted string containing an IP address, or list of IP
-     * addresses, which represent the HTTP client and any involved proxies. As
-     * the headers used to determine proxies can easily be forged, this data is
-     * superficially validated to ensure that it at least looks like a list of
-     * IPs.
-     *
-     * @param request
-     *     The HTTP request to format.
-     *
-     * @return
-     *     A formatted string containing one or more IP addresses.
-     */
-    private String getLoggableAddress(HttpServletRequest request) {
-
-        // Log X-Forwarded-For, if present and valid
-        String header = request.getHeader("X-Forwarded-For");
-        if (header != null && X_FORWARDED_FOR.matcher(header).matches())
-            return "[" + header + ", " + request.getRemoteAddr() + "]";
-
-        // If header absent or invalid, just use source IP
-        return request.getRemoteAddr();
-
-    }
-
     /**
      * Attempts authentication against all AuthenticationProviders, in order,
      * using the provided credentials. The first authentication failure takes
@@ -437,12 +384,12 @@ public class AuthenticationService {
             else {
                 authToken = authTokenGenerator.getToken();
                 tokenSessionMap.put(authToken, new GuacamoleSession(listenerService, authenticatedUser, userContexts));
-                logger.debug("Login was successful for user \"{}\".", authenticatedUser.getIdentifier());
             }
 
             // Report authentication success
             try {
-                listenerService.handleEvent(new AuthenticationSuccessEvent(authenticatedUser));
+                listenerService.handleEvent(new AuthenticationSuccessEvent(authenticatedUser,
+                        existingSession != null));
             }
             catch (GuacamoleException e) {
                 throw new GuacamoleAuthenticationProcessException("User "
@@ -454,25 +401,9 @@ public class AuthenticationService {
         // Log and rethrow any authentication errors
         catch (GuacamoleAuthenticationProcessException e) {
 
-            // Get request and username for sake of logging
-            HttpServletRequest request = credentials.getRequest();
-            String username = credentials.getUsername();
-
             listenerService.handleEvent(new AuthenticationFailureEvent(credentials,
                     e.getAuthenticationProvider(), e.getCause()));
 
-            // Log authentication failures with associated usernames
-            if (username != null) {
-                if (logger.isWarnEnabled())
-                    logger.warn("Authentication attempt from {} for user \"{}\" failed.",
-                            getLoggableAddress(request), username);
-            }
-
-            // Log anonymous authentication failures
-            else if (logger.isDebugEnabled())
-                logger.debug("Anonymous authentication attempt from {} failed.",
-                        getLoggableAddress(request));
-
             // Rethrow exception
             e.rethrowCause();
 
@@ -490,11 +421,6 @@ public class AuthenticationService {
 
         }
 
-        if (logger.isInfoEnabled())
-            logger.info("User \"{}\" successfully authenticated from {}.",
-                    authenticatedUser.getIdentifier(),
-                    getLoggableAddress(credentials.getRequest()));
-
         return authToken;
 
     }

From e5761551e4c9a4d2d997cbe8fcebc740f363765c Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 3 Oct 2022 15:57:11 -0700
Subject: [PATCH 088/289] GUACAMOLE-1224: Log identifiers of extensions
 reporting authentication failures.

---
 .../guacamole/event/EventLoggingListener.java | 32 ++++++++++++++-----
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
index 2cf3a70d6..90a929765 100644
--- a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
+++ b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
@@ -22,6 +22,7 @@ package org.apache.guacamole.event;
 import javax.annotation.Nonnull;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
+import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
 import org.apache.guacamole.net.event.ApplicationShutdownEvent;
@@ -144,6 +145,8 @@ public class EventLoggingListener implements Listener {
      */
     private void logFailure(AuthenticationFailureEvent event) {
 
+        AuthenticationProvider authProvider = event.getAuthenticationProvider();
+
         Credentials creds = event.getCredentials();
         String username = creds.getUsername();
 
@@ -154,14 +157,27 @@ public class EventLoggingListener implements Listener {
         else if (username == null || username.isEmpty())
             logger.debug("Anonymous authentication attempt from {} failed: {}",
                     new RemoteAddress(creds), new Failure(event));
-        else if (event.getFailure() instanceof GuacamoleInsufficientCredentialsException)
-            logger.debug("Authentication attempt from {} for user \"{}\" "
-                    + "requires additional credentials to continue: {}",
-                    new RemoteAddress(creds), username, new Failure(event));
-        else
-            logger.warn("Authentication attempt from {} for user \"{}\" "
-                    + "failed: {}", new RemoteAddress(creds), username,
-                    new Failure(event));
+        else if (event.getFailure() instanceof GuacamoleInsufficientCredentialsException) {
+            if (authProvider != null)
+                logger.debug("Authentication attempt from {} for user \"{}\" "
+                        + "requires additional credentials to continue: {} "
+                        + "(requested by \"{}\")", new RemoteAddress(creds),
+                        username, new Failure(event), authProvider.getIdentifier());
+            else
+                logger.debug("Authentication attempt from {} for user \"{}\" "
+                        + "requires additional credentials to continue: {}",
+                        new RemoteAddress(creds), username, new Failure(event));
+        }
+        else {
+            if (authProvider != null)
+                logger.warn("Authentication attempt from {} for user \"{}\" "
+                        + "failed: {} (rejected by \"{}\")", new RemoteAddress(creds),
+                        username, new Failure(event), authProvider.getIdentifier());
+            else
+                logger.warn("Authentication attempt from {} for user \"{}\" "
+                        + "failed: {}", new RemoteAddress(creds), username,
+                        new Failure(event));
+        }
 
     }
 

From 93e74224667c0cef73d176f464ea1490a3c30889 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 4 Oct 2022 14:15:48 -0700
Subject: [PATCH 089/289] GUACAMOLE-1224: Extract base interface for events
 affecting objects stored in a Directory.

---
 .../guacamole/net/event/DirectoryEvent.java   | 41 +++++-------
 .../net/event/DirectoryObjectEvent.java       | 65 +++++++++++++++++++
 .../guacamole/event/AffectedObject.java       |  6 +-
 3 files changed, 85 insertions(+), 27 deletions(-)
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryObjectEvent.java

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
index 2ff74bf94..725c75048 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
@@ -24,13 +24,14 @@ import org.apache.guacamole.net.auth.Identifiable;
 
 /**
  * Abstract basis for events which involve a modification made to the objects
- * within a {@link Directory}.
+ * within a {@link Directory} through the operations exposed by the Directory
+ * interface.
  *
  * @param <ObjectType>
  *     The type of object stored within the {@link Directory}.
  */
 public interface DirectoryEvent<ObjectType extends Identifiable>
-        extends AuthenticationProviderEvent, UserEvent {
+        extends DirectoryObjectEvent<ObjectType> {
 
     /**
      * The types of directory operations that may be represented by a
@@ -70,15 +71,6 @@ public interface DirectoryEvent<ObjectType extends Identifiable>
 
     }
 
-    /**
-     * Returns the type of objects stored within the {@link Directory}
-     * affected by the operation.
-     *
-     * @return
-     *     The type of objects stored within the {@link Directory}.
-     */
-    Directory.Type getDirectoryType();
-
     /**
      * Returns the operation that was performed/attempted.
      *
@@ -88,24 +80,25 @@ public interface DirectoryEvent<ObjectType extends Identifiable>
     Operation getOperation();
 
     /**
-     * Returns the identifier of the object affected by the operation. If the
-     * object was just created, this will be the identifier of the new object.
-     *
-     * @return
-     *     The identifier of the object affected by the operation.
+     * {@inheritDoc}
+     * <p>
+     * If the object was just created, this will be the identifier of the new
+     * object.
      */
+    @Override
     String getObjectIdentifier();
 
     /**
-     * Returns the object affected by the operation, if available. For
-     * deletions, there is no guarantee that the affected object will be
-     * available within this event. If the object is not available, null is
-     * returned.
-     *
-     * @return
-     *     The object affected by the operation performed, or null if that
-     *     object is not available in the context of this event.
+     * {@inheritDoc}
+     * <p>
+     * Currently, for object creation ({@link Operation#ADD}), retrieval
+     * ({@link Operation#GET}), modification and ({@link Operation#UPDATE}),
+     * it can be expected that the affected object will be available, however
+     * the caller should verify this regardless. For deletions
+     * ({@link Operation#REMOVE}), the object can only be made available for
+     * single deletions, and cannot be made available for batch deletions.
      */
+    @Override
     ObjectType getObject();
 
 }
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryObjectEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryObjectEvent.java
new file mode 100644
index 000000000..812fcbe60
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryObjectEvent.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.event;
+
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.Identifiable;
+
+/**
+ * Abstract basis for events which affect or directly relate to objects that
+ * may be stored within a {@link Directory}.
+ *
+ * @param <ObjectType>
+ *     The type of object stored within the {@link Directory}.
+ */
+public interface DirectoryObjectEvent<ObjectType extends Identifiable>
+        extends AuthenticationProviderEvent, UserEvent {
+
+    /**
+     * Returns the type of {@link Directory} that contains the object affected
+     * by the operation.
+     *
+     * @return
+     *     The type of objects stored within the {@link Directory}.
+     */
+    Directory.Type getDirectoryType();
+
+    /**
+     * Returns the identifier of the object affected by the operation.
+     *
+     * @return
+     *     The identifier of the object affected by the operation.
+     */
+    String getObjectIdentifier();
+
+    /**
+     * Returns the object affected by the operation, if available. Whether the
+     * affected object is available is context- and implementation-dependent.
+     * There is no general guarantee across all implementations of this event
+     * that the affected object will be available. If the object is not
+     * available, null is returned.
+     *
+     * @return
+     *     The object affected by the operation performed, or null if that
+     *     object is not available in the context of this event.
+     */
+    ObjectType getObject();
+
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java b/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
index 572a9693a..aec678be2 100644
--- a/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
+++ b/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
@@ -20,9 +20,9 @@
 package org.apache.guacamole.event;
 
 import org.apache.guacamole.net.auth.Nameable;
-import org.apache.guacamole.net.event.DirectoryEvent;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.apache.guacamole.net.event.DirectoryObjectEvent;
 
 /**
  * Loggable representation of the object affected by an operation.
@@ -37,7 +37,7 @@ public class AffectedObject implements LoggableDetail {
     /**
      * The event representing the requested operation.
      */
-    private final DirectoryEvent<?> event;
+    private final DirectoryObjectEvent<?> event;
 
     /**
      * Creates a new AffectedObject representing the object affected by the
@@ -46,7 +46,7 @@ public class AffectedObject implements LoggableDetail {
      * @param event
      *     The event representing the operation.
      */
-    public AffectedObject(DirectoryEvent<?> event) {
+    public AffectedObject(DirectoryObjectEvent<?> event) {
         this.event = event;
     }
 

From 9b7982a7f2b4c93aab3874386eaa84ae5362def0 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 4 Oct 2022 15:11:20 -0700
Subject: [PATCH 090/289] GUACAMOLE-1224: Clarify context of
 getAuthenticationProvider() for DirectoryObjectEvents.

---
 .../guacamole/net/event/DirectoryObjectEvent.java  | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryObjectEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryObjectEvent.java
index 812fcbe60..62dc36a6f 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryObjectEvent.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryObjectEvent.java
@@ -19,6 +19,8 @@
 
 package org.apache.guacamole.net.event;
 
+import org.apache.guacamole.net.auth.AuthenticatedUser;
+import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.Identifiable;
 
@@ -32,6 +34,18 @@ import org.apache.guacamole.net.auth.Identifiable;
 public interface DirectoryObjectEvent<ObjectType extends Identifiable>
         extends AuthenticationProviderEvent, UserEvent {
 
+    /**
+     * {@inheritDoc}
+     * <p>
+     * NOTE: For subclasses of {@link DirectoryObjectEvent}, this will be the
+     * AuthenticationProvider associated with the affected object. This is not
+     * necessarily the same as the AuthenticationProvider that authenticated
+     * the user performing the operation, which can be retrieved via
+     * {@link #getAuthenticatedUser()} and {@link AuthenticatedUser#getAuthenticationProvider()}.
+     */
+    @Override
+    AuthenticationProvider getAuthenticationProvider();
+
     /**
      * Returns the type of {@link Directory} that contains the object affected
      * by the operation.

From a0a5335c4d887c7e9586baf51d353809616db946 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 5 Oct 2022 09:09:28 -0700
Subject: [PATCH 091/289] GUACAMOLE-1224: Further clarify DirectoryObjectEvent,
 renaming to IdentifiableObjectEvent.

---
 .../guacamole/net/event/DirectoryEvent.java   |  2 +-
 ...vent.java => IdentifiableObjectEvent.java} | 21 ++++++++++---------
 .../guacamole/event/AffectedObject.java       |  6 +++---
 3 files changed, 15 insertions(+), 14 deletions(-)
 rename guacamole-ext/src/main/java/org/apache/guacamole/net/event/{DirectoryObjectEvent.java => IdentifiableObjectEvent.java} (75%)

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
index 725c75048..5e9116496 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
@@ -31,7 +31,7 @@ import org.apache.guacamole.net.auth.Identifiable;
  *     The type of object stored within the {@link Directory}.
  */
 public interface DirectoryEvent<ObjectType extends Identifiable>
-        extends DirectoryObjectEvent<ObjectType> {
+        extends IdentifiableObjectEvent<ObjectType> {
 
     /**
      * The types of directory operations that may be represented by a
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryObjectEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/IdentifiableObjectEvent.java
similarity index 75%
rename from guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryObjectEvent.java
rename to guacamole-ext/src/main/java/org/apache/guacamole/net/event/IdentifiableObjectEvent.java
index 62dc36a6f..69ecfeaa4 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryObjectEvent.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/IdentifiableObjectEvent.java
@@ -26,29 +26,30 @@ import org.apache.guacamole.net.auth.Identifiable;
 
 /**
  * Abstract basis for events which affect or directly relate to objects that
- * may be stored within a {@link Directory}.
+ * are {@link Identifiable} and may be stored within a {@link Directory}.
  *
  * @param <ObjectType>
- *     The type of object stored within the {@link Directory}.
+ *     The type of object affected or related to the event.
  */
-public interface DirectoryObjectEvent<ObjectType extends Identifiable>
+public interface IdentifiableObjectEvent<ObjectType extends Identifiable>
         extends AuthenticationProviderEvent, UserEvent {
 
     /**
      * {@inheritDoc}
      * <p>
-     * NOTE: For subclasses of {@link DirectoryObjectEvent}, this will be the
-     * AuthenticationProvider associated with the affected object. This is not
-     * necessarily the same as the AuthenticationProvider that authenticated
-     * the user performing the operation, which can be retrieved via
-     * {@link #getAuthenticatedUser()} and {@link AuthenticatedUser#getAuthenticationProvider()}.
+     * NOTE: For subclasses of {@link IdentifiableObjectEvent}, this will be the
+     * AuthenticationProvider associated with the affected, {@link Identifiable}
+     * object. This is not necessarily the same as the AuthenticationProvider
+     * that authenticated the user performing the operation, which can be
+     * retrieved via {@link #getAuthenticatedUser()} and
+     * {@link AuthenticatedUser#getAuthenticationProvider()}.
      */
     @Override
     AuthenticationProvider getAuthenticationProvider();
 
     /**
-     * Returns the type of {@link Directory} that contains the object affected
-     * by the operation.
+     * Returns the type of {@link Directory} that may contains the object
+     * affected by the operation.
      *
      * @return
      *     The type of objects stored within the {@link Directory}.
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java b/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
index aec678be2..b95122bae 100644
--- a/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
+++ b/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
@@ -22,7 +22,7 @@ package org.apache.guacamole.event;
 import org.apache.guacamole.net.auth.Nameable;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.apache.guacamole.net.event.DirectoryObjectEvent;
+import org.apache.guacamole.net.event.IdentifiableObjectEvent;
 
 /**
  * Loggable representation of the object affected by an operation.
@@ -37,7 +37,7 @@ public class AffectedObject implements LoggableDetail {
     /**
      * The event representing the requested operation.
      */
-    private final DirectoryObjectEvent<?> event;
+    private final IdentifiableObjectEvent<?> event;
 
     /**
      * Creates a new AffectedObject representing the object affected by the
@@ -46,7 +46,7 @@ public class AffectedObject implements LoggableDetail {
      * @param event
      *     The event representing the operation.
      */
-    public AffectedObject(DirectoryObjectEvent<?> event) {
+    public AffectedObject(IdentifiableObjectEvent<?> event) {
         this.event = event;
     }
 

From 606c7bd55ceb62bd404e949ef5c8042ff65f0936 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 5 Oct 2022 09:32:08 -0700
Subject: [PATCH 092/289] GUACAMOLE-1224: Improve readability of JavaDoc by
 shortening text of hyperlinked enum values.

---
 .../java/org/apache/guacamole/net/event/DirectoryEvent.java | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
index 5e9116496..468851af1 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/event/DirectoryEvent.java
@@ -91,11 +91,11 @@ public interface DirectoryEvent<ObjectType extends Identifiable>
     /**
      * {@inheritDoc}
      * <p>
-     * Currently, for object creation ({@link Operation#ADD}), retrieval
-     * ({@link Operation#GET}), modification and ({@link Operation#UPDATE}),
+     * Currently, for object creation ({@link Operation#ADD ADD}), retrieval
+     * ({@link Operation#GET GET}), and modification ({@link Operation#UPDATE UPDATE}),
      * it can be expected that the affected object will be available, however
      * the caller should verify this regardless. For deletions
-     * ({@link Operation#REMOVE}), the object can only be made available for
+     * ({@link Operation#REMOVE REMOVE}), the object can only be made available for
      * single deletions, and cannot be made available for batch deletions.
      */
     @Override

From 36b5842d426d907482c7db27c3bbb91a5daa9de5 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 5 Oct 2022 09:41:54 -0700
Subject: [PATCH 093/289] GUACAMOLE-1224: Log user password updates.

---
 .../guacamole/event/AffectedObject.java       |  4 +++
 .../guacamole/event/EventLoggingListener.java | 33 +++++++++++++++++--
 .../guacamole/rest/user/UserResource.java     | 32 +++++++++++++-----
 3 files changed, 58 insertions(+), 11 deletions(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java b/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
index b95122bae..c610bf177 100644
--- a/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
+++ b/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
@@ -94,6 +94,10 @@ public class AffectedObject implements LoggableDetail {
 
             // Users
             case USER:
+
+                if (identifier.equals(event.getAuthenticatedUser().getIdentifier()))
+                    return "their own user account";
+
                 objectType = "user";
                 break;
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
index 90a929765..b21b8b230 100644
--- a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
+++ b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
@@ -24,6 +24,8 @@ import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
 import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Credentials;
+import org.apache.guacamole.net.auth.Identifiable;
+import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
 import org.apache.guacamole.net.event.ApplicationShutdownEvent;
 import org.apache.guacamole.net.event.ApplicationStartedEvent;
@@ -32,6 +34,7 @@ import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
 import org.apache.guacamole.net.event.DirectoryEvent;
 import org.apache.guacamole.net.event.DirectoryFailureEvent;
 import org.apache.guacamole.net.event.DirectorySuccessEvent;
+import org.apache.guacamole.net.event.IdentifiableObjectEvent;
 import org.apache.guacamole.net.event.UserSessionInvalidatedEvent;
 import org.apache.guacamole.net.event.listener.Listener;
 import org.slf4j.Logger;
@@ -48,6 +51,26 @@ public class EventLoggingListener implements Listener {
      */
     private final Logger logger = LoggerFactory.getLogger(EventLoggingListener.class);
 
+    /**
+     * Returns whether the given event affects the password of a User object.
+     *
+     * @param event
+     *     The event to check.
+     *
+     * @return
+     *     true if a user's password is specifically set or modified by the
+     *     given event, false otherwise.
+     */
+    private boolean isPasswordAffected(IdentifiableObjectEvent<?> event) {
+
+        Identifiable object = event.getObject();
+        if (!(object instanceof User))
+            return false;
+
+        return ((User) object).getPassword() != null;
+        
+    }
+
     /**
      * Logs that an operation was performed on an object within a Directory
      * successfully.
@@ -65,11 +88,17 @@ public class EventLoggingListener implements Listener {
                 break;
 
             case ADD:
-                logger.info("{} successfully created {}", new RequestingUser(event), new AffectedObject(event));
+                if (isPasswordAffected(event))
+                    logger.info("{} successfully created {}, setting their password", new RequestingUser(event), new AffectedObject(event));
+                else
+                    logger.info("{} successfully created {}", new RequestingUser(event), new AffectedObject(event));
                 break;
 
             case UPDATE:
-                logger.info("{} successfully updated {}", new RequestingUser(event), new AffectedObject(event));
+                if (isPasswordAffected(event))
+                    logger.info("{} successfully updated {}, changing their password", new RequestingUser(event), new AffectedObject(event));
+                else
+                    logger.info("{} successfully updated {}", new RequestingUser(event), new AffectedObject(event));
                 break;
 
             case REMOVE:
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
index 9b79fbb48..91600f736 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
@@ -41,6 +41,7 @@ import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.UserContext;
 import org.apache.guacamole.net.auth.credentials.GuacamoleCredentialsException;
 import org.apache.guacamole.net.auth.simple.SimpleActivityRecordSet;
+import org.apache.guacamole.net.event.DirectoryEvent;
 import org.apache.guacamole.rest.directory.DirectoryObjectResource;
 import org.apache.guacamole.rest.directory.DirectoryObjectTranslator;
 import org.apache.guacamole.rest.history.UserHistoryResource;
@@ -134,13 +135,19 @@ public class UserResource
     public void updateObject(APIUser modifiedObject) throws GuacamoleException {
 
         // A user may not use this endpoint to update their password
-        User currentUser = getUserContext().self();
-        if (
-                currentUser.getIdentifier().equals(modifiedObject.getUsername())
-                && modifiedObject.getPassword() != null) {
-            throw new GuacamoleSecurityException(
-                    "Permission denied. The password update endpoint must"
-                    + " be used to change the current user's password.");
+        try {
+            User currentUser = getUserContext().self();
+            if (
+                    currentUser.getIdentifier().equals(modifiedObject.getUsername())
+                    && modifiedObject.getPassword() != null) {
+                throw new GuacamoleSecurityException(
+                        "Permission denied. The password update endpoint must"
+                        + " be used to change the current user's password.");
+            }
+        }
+        catch (GuacamoleException | RuntimeException | Error e) {
+            fireDirectoryFailureEvent(DirectoryEvent.Operation.UPDATE, e);
+            throw e;
         }
 
         super.updateObject(modifiedObject);
@@ -184,8 +191,15 @@ public class UserResource
         }
 
         // Set password to the newly provided one
-        user.setPassword(userPasswordUpdate.getNewPassword());
-        getDirectory().update(user);
+        try {
+            user.setPassword(userPasswordUpdate.getNewPassword());
+            getDirectory().update(user);
+            fireDirectorySuccessEvent(DirectoryEvent.Operation.UPDATE);
+        }
+        catch (GuacamoleException | RuntimeException | Error e) {
+            fireDirectoryFailureEvent(DirectoryEvent.Operation.UPDATE, e);
+            throw e;
+        }
 
     }
 

From f43b1198183b35782471a95c8cf3b3ef6565180c Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 5 Oct 2022 10:34:52 -0700
Subject: [PATCH 094/289] GUACAMOLE-1224: Log receipt of authentication
 requests at trace level.

---
 .../java/org/apache/guacamole/event/EventLoggingListener.java | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
index b21b8b230..16bee6ae8 100644
--- a/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
+++ b/guacamole/src/main/java/org/apache/guacamole/event/EventLoggingListener.java
@@ -30,6 +30,7 @@ import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredential
 import org.apache.guacamole.net.event.ApplicationShutdownEvent;
 import org.apache.guacamole.net.event.ApplicationStartedEvent;
 import org.apache.guacamole.net.event.AuthenticationFailureEvent;
+import org.apache.guacamole.net.event.AuthenticationRequestReceivedEvent;
 import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
 import org.apache.guacamole.net.event.DirectoryEvent;
 import org.apache.guacamole.net.event.DirectoryFailureEvent;
@@ -227,6 +228,9 @@ public class EventLoggingListener implements Listener {
         else if (event instanceof UserSessionInvalidatedEvent)
             logger.info("{} has logged out, or their session has expired or "
                     + "been terminated.", new RequestingUser((UserSessionInvalidatedEvent) event));
+        else if (event instanceof AuthenticationRequestReceivedEvent)
+            logger.trace("Authentication request received from {}",
+                    new RemoteAddress(((AuthenticationRequestReceivedEvent) event).getCredentials()));
 
         // Application startup/shutdown
         else if (event instanceof ApplicationStartedEvent)

From 89433ee3c7c3fe12b85ac5de9f2e8669218a2e8f Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 5 Oct 2022 10:42:59 -0700
Subject: [PATCH 095/289] GUACAMOLE-1224: Log extension sources of objects
 affected by REST API.

---
 .../org/apache/guacamole/event/AffectedObject.java    | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java b/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
index c610bf177..c08b4ed03 100644
--- a/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
+++ b/guacamole/src/main/java/org/apache/guacamole/event/AffectedObject.java
@@ -55,6 +55,7 @@ public class AffectedObject implements LoggableDetail {
 
         Object object = event.getObject();
         String identifier = event.getObjectIdentifier();
+        String dataSource = event.getAuthenticationProvider().getIdentifier();
 
         String objectType;
         String name = null; // Not all objects have names
@@ -95,8 +96,8 @@ public class AffectedObject implements LoggableDetail {
             // Users
             case USER:
 
-                if (identifier.equals(event.getAuthenticatedUser().getIdentifier()))
-                    return "their own user account";
+                if (identifier != null && identifier.equals(event.getAuthenticatedUser().getIdentifier()))
+                    return "their own user account within \"" + dataSource + "\"";
 
                 objectType = "user";
                 break;
@@ -116,12 +117,12 @@ public class AffectedObject implements LoggableDetail {
         // including the name of the object, as well, if available
         if (identifier != null) {
             if (name != null)
-                return objectType + " \"" + identifier + "\" (currently named \"" + name + "\")";
+                return objectType + " \"" + identifier + "\" within \"" + dataSource + "\" (currently named \"" + name + "\")";
             else
-                return objectType + " \"" + identifier + "\"";
+                return objectType + " \"" + identifier + "\" within \"" + dataSource + "\"";
         }
         else
-            return objectType;
+            return objectType + " within \"" + dataSource + "\"";
 
     }
     

From 79f72aad4fc0feece22c6ff0397430607da1ed5c Mon Sep 17 00:00:00 2001
From: Mike Jumper <mjumper@apache.org>
Date: Sun, 13 Nov 2022 12:12:59 -0800
Subject: [PATCH 096/289] GUACAMOLE-1716: Remove usage of AccessController
 (deprecated in Java 17 and later).

---
 .../extension/DirectoryClassLoader.java       | 43 +--------------
 .../apache/guacamole/extension/Extension.java |  2 +-
 .../extension/ExtensionClassLoader.java       | 55 +------------------
 .../guacamole/extension/ExtensionModule.java  |  2 +-
 4 files changed, 4 insertions(+), 98 deletions(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/extension/DirectoryClassLoader.java b/guacamole/src/main/java/org/apache/guacamole/extension/DirectoryClassLoader.java
index 215c3c00c..83ad9be73 100644
--- a/guacamole/src/main/java/org/apache/guacamole/extension/DirectoryClassLoader.java
+++ b/guacamole/src/main/java/org/apache/guacamole/extension/DirectoryClassLoader.java
@@ -24,9 +24,6 @@ import java.io.FilenameFilter;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.net.URLClassLoader;
-import java.security.AccessController;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 import java.util.ArrayList;
 import java.util.Collection;
 import org.apache.guacamole.GuacamoleException;
@@ -37,44 +34,6 @@ import org.apache.guacamole.GuacamoleException;
  */
 public class DirectoryClassLoader extends URLClassLoader {
 
-    /**
-     * Returns an instance of DirectoryClassLoader configured to load .jar
-     * files from the given directory. Calling this function multiple times
-     * will not affect previously-returned instances of DirectoryClassLoader.
-     *
-     * @param dir
-     *     The directory from which .jar files should be read.
-     *
-     * @return
-     *     A DirectoryClassLoader instance which loads classes from the .jar
-     *     files in the given directory.
-     *
-     * @throws GuacamoleException
-     *     If the given file is not a directory, or the contents of the given
-     *     directory cannot be read.
-     */
-    public static DirectoryClassLoader getInstance(final File dir)
-            throws GuacamoleException {
-
-        try {
-            // Attempt to create singleton classloader which loads classes from
-            // all .jar's in the lib directory defined in guacamole.properties
-            return AccessController.doPrivileged(new PrivilegedExceptionAction<DirectoryClassLoader>() {
-
-                @Override
-                public DirectoryClassLoader run() throws GuacamoleException {
-                    return new DirectoryClassLoader(dir);
-                }
-
-            });
-        }
-
-        catch (PrivilegedActionException e) {
-            throw (GuacamoleException) e.getException();
-        }
-
-    }
-
     /**
      * Returns all .jar files within the given directory as an array of URLs.
      *
@@ -142,7 +101,7 @@ public class DirectoryClassLoader extends URLClassLoader {
      *     directory cannot be read.
      */
 
-    private DirectoryClassLoader(File dir) throws GuacamoleException {
+    public DirectoryClassLoader(File dir) throws GuacamoleException {
         super(getJarURLs(dir), DirectoryClassLoader.class.getClassLoader());
     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/extension/Extension.java b/guacamole/src/main/java/org/apache/guacamole/extension/Extension.java
index f6cf80df2..be67a384b 100644
--- a/guacamole/src/main/java/org/apache/guacamole/extension/Extension.java
+++ b/guacamole/src/main/java/org/apache/guacamole/extension/Extension.java
@@ -397,7 +397,7 @@ public class Extension {
             }
 
             // Create isolated classloader for this extension
-            classLoader = ExtensionClassLoader.getInstance(file, temporaryFiles, parent);
+            classLoader = new ExtensionClassLoader(file, temporaryFiles, parent);
 
         }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionClassLoader.java b/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionClassLoader.java
index 03faf53cb..6473aa230 100644
--- a/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionClassLoader.java
+++ b/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionClassLoader.java
@@ -29,9 +29,6 @@ import java.net.URL;
 import java.net.URLClassLoader;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.security.AccessController;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 import java.util.ArrayList;
 import java.util.Enumeration;
 import java.util.List;
@@ -74,56 +71,6 @@ public class ExtensionClassLoader extends URLClassLoader {
      */
     private final ClassLoader parent;
 
-    /**
-     * Returns an instance of ExtensionClassLoader configured to load classes
-     * from the given extension .jar. If a necessary class cannot be found
-     * within the .jar, the given parent ClassLoader is used. Calling this
-     * function multiple times will not affect previously-returned instances of
-     * ExtensionClassLoader.
-     *
-     * @param extension
-     *     The extension .jar file from which classes should be loaded.
-     *
-     * @param temporaryFiles
-     *     A modifiable List that should be populated with all temporary files
-     *     created for the given extension. These files should be deleted on
-     *     application shutdown in reverse order.
-     *
-     * @param parent
-     *     The ClassLoader to use if class resolution through the extension
-     *     .jar fails.
-     *
-     * @return
-     *     A ExtensionClassLoader instance which loads classes from the
-     *     given extension .jar file.
-     *
-     * @throws GuacamoleException
-     *     If the given file is not actually a file, or the contents of the
-     *     file cannot be read.
-     */
-    public static ExtensionClassLoader getInstance(final File extension,
-            final List<File> temporaryFiles, final ClassLoader parent)
-            throws GuacamoleException {
-
-        try {
-            // Attempt to create classloader which loads classes from the given
-            // .jar file
-            return AccessController.doPrivileged(new PrivilegedExceptionAction<ExtensionClassLoader>() {
-
-                @Override
-                public ExtensionClassLoader run() throws GuacamoleException {
-                    return new ExtensionClassLoader(extension, temporaryFiles, parent);
-                }
-
-            });
-        }
-
-        catch (PrivilegedActionException e) {
-            throw (GuacamoleException) e.getException();
-        }
-
-    }
-
     /**
      * Returns the URL that refers to the given file. If the given file refers
      * to a directory, an exception is thrown.
@@ -320,7 +267,7 @@ public class ExtensionClassLoader extends URLClassLoader {
      *     If the given file is not actually a file, or the contents of the
      *     file cannot be read.
      */
-    private ExtensionClassLoader(File extension, List<File> temporaryFiles,
+    public ExtensionClassLoader(File extension, List<File> temporaryFiles,
             ClassLoader parent) throws GuacamoleException {
         super(getExtensionURLs(extension, temporaryFiles), null);
         this.parent = parent;
diff --git a/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionModule.java b/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionModule.java
index e5fbe2e57..d13b9d0ad 100644
--- a/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionModule.java
+++ b/guacamole/src/main/java/org/apache/guacamole/extension/ExtensionModule.java
@@ -182,7 +182,7 @@ public class ExtensionModule extends ServletModule {
             return ExtensionModule.class.getClassLoader();
 
         // Return classloader which loads classes from all .jars within the lib directory
-        return DirectoryClassLoader.getInstance(libDir);
+        return new DirectoryClassLoader(libDir);
 
     }
 

From c82ca370e209ba836ff77df237310e7ea79d9c49 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 22 Nov 2022 20:32:18 +0000
Subject: [PATCH 097/289] GUACAMOLE-1656: Fix user preferences permissioning.

---
 .../vault/ksm/conf/KsmAttributeService.java   | 20 +++++++++++--------
 .../ksm/conf/KsmConfigurationService.java     |  8 +++++---
 .../vault/ksm/user/KsmDirectoryService.java   |  1 -
 .../directives/guacSettingsPreferences.js     | 17 ++++++++--------
 .../templates/settingsPreferences.html        |  6 +++---
 5 files changed, 29 insertions(+), 23 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
index c1d3b95d5..8b3c5d938 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java
@@ -145,11 +145,6 @@ public class KsmAttributeService implements VaultAttributeService {
 
     @Override
     public Collection<Form> getUserAttributes() {
-        return KSM_ATTRIBUTES;
-    }
-
-    @Override
-    public Collection<Form> getUserPreferenceAttributes() {
 
         try {
 
@@ -161,15 +156,24 @@ public class KsmAttributeService implements VaultAttributeService {
         catch (GuacamoleException e) {
 
             logger.warn(
-                    "Unable to determine if user preference attributes "
+                    "Unable to determine if KSM user attributes "
                     + "should be exposed due to config parsing error: {}.", e.getMessage());
             logger.debug(
-                    "Config parsing error prevented checking user preference configuration",
+                    "Config parsing error prevented checking user attribute configuration",
                     e);
 
-            // If the configuration can't be parsed, default to not exposing the attribute
+            // If the configuration can't be parsed, default to not exposing the attributes
             return Collections.emptyList();
         }
+
+    }
+
+    @Override
+    public Collection<Form> getUserPreferenceAttributes() {
+
+        // KSM-specific user preference attributes have the same semantics as
+        // user attributes
+        return getUserAttributes();
     }
 
     /**
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
index 9d2e4565f..5571ef9df 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
@@ -150,11 +150,13 @@ public class KsmConfigurationService extends VaultConfigurationService {
     }
 
     /**
-     * Return whether users should be able to provide their own KSM configs.
+     * Return whether user-level KSM configs should be enabled. If this
+     * flag is set to true, users can edit their own KSM configs, as can
+     * admins. If set to false, no existing user-specific KSM configuration
+     * will be exposed through the UI or used when looking up secrets.
      *
      * @return
-     *     true if users should be able to provide their own KSM configs,
-     *     false otherwise.
+     *     true if user-specific KSM configuration is enabled, false otherwise.
      *
      * @throws GuacamoleException
      *     If the value specified within guacamole.properties cannot be
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
index 5203a06dd..18934c99e 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
@@ -23,7 +23,6 @@ import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.net.auth.Connection;
 import org.apache.guacamole.net.auth.ConnectionGroup;
 import org.apache.guacamole.net.auth.DecoratingDirectory;
-import org.apache.guacamole.net.auth.DelegatingDirectory;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
diff --git a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
index a3f0fd2e5..005d2398b 100644
--- a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
+++ b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
@@ -143,12 +143,13 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
             $scope.newPasswordMatch = null;
 
             /**
-             * Whether the current user can change their own password, or null
-             * if this is not yet known.
+             * Whether the current user can edit themselves - i.e. update their
+             * password or change user preference attributes, or null if this
+             * is not yet known.
              *
              * @type Boolean
              */
-            $scope.canChangePassword = null;
+            $scope.canUpdateSelf = null;
 
             /**
              * Update the current user's password to the password currently set within
@@ -206,13 +207,13 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
             permissionService.getEffectivePermissions(dataSource, username)
             .then(function permissionsRetrieved(permissions) {
 
-                // Add action for changing password if permission is granted
-                $scope.canChangePassword = PermissionSet.hasUserPermission(permissions,
+                // Add action for updaing password or user preferences if permission is granted
+                $scope.canUpdateSelf = PermissionSet.hasUserPermission(permissions,
                         PermissionSet.ObjectPermissionType.UPDATE, username);
                         
             })
             ['catch'](requestService.createErrorCallback(function permissionsFailed(error) {
-                $scope.canChangePassword = false;
+                $scope.canUpdateSelf = false;
             }));
 
             /**
@@ -224,8 +225,8 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
              */
             $scope.isLoaded = function isLoaded() {
 
-                return $scope.canChangePassword !== null
-                    && $scope.languages         !== null;
+                return $scope.canUpdateSelf !== null
+                    && $scope.languages     !== null;
 
             };
 
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
index 6ecf6e0e7..7c154df89 100644
--- a/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
@@ -7,8 +7,8 @@
     </div>
     
     <!-- Password update -->
-    <h2 class="header" ng-show="canChangePassword">{{'SETTINGS_PREFERENCES.SECTION_HEADER_UPDATE_PASSWORD' | translate}}</h2>
-    <div class="settings section update-password" ng-show="canChangePassword">
+    <h2 class="header" ng-show="canUpdateSelf">{{'SETTINGS_PREFERENCES.SECTION_HEADER_UPDATE_PASSWORD' | translate}}</h2>
+    <div class="settings section update-password" ng-show="canUpdateSelf">
         <p>{{'SETTINGS_PREFERENCES.HELP_UPDATE_PASSWORD' | translate}}</p>
 
         <!-- Password editor -->
@@ -90,7 +90,7 @@
     </div>
 
     <!-- User attributes section -->
-    <div class="attributes" ng-show="attributes.length">
+    <div class="attributes" ng-show="canUpdateSelf && attributes.length">
         <guac-form namespace="'USER_ATTRIBUTES'" content="attributes"
                    model="user.attributes"></guac-form>
 

From 69334b05e21813b57acadd9aec2478574366b440 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 29 Nov 2022 19:22:11 +0000
Subject: [PATCH 098/289] GUACAMOLE-1721: Store only auth token from auth
 response in localStorage.

---
 .../app/auth/service/authenticationService.js | 41 +++++++++++--------
 1 file changed, 23 insertions(+), 18 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
index 199d6cb2e..ce44b184c 100644
--- a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
+++ b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
@@ -61,18 +61,21 @@ angular.module('auth').factory('authenticationService', ['$injector',
     var cachedResult = null;
 
     /**
-     * The unique identifier of the local storage key which stores the result
-     * of the last authentication attempt.
+     * The unique identifier of the local storage key which stores the latest
+     * authentication token.
      *
      * @type String
      */
-    var AUTH_STORAGE_KEY = 'GUAC_AUTH';
+    var AUTH_TOKEN_STORAGE_KEY = 'GUAC_AUTH_TOKEN';
 
     /**
-     * Retrieves the last successful authentication result. If the user has not
+     * Retrieves the authentication result cached in memory. If the user has not
      * yet authenticated, the user has logged out, or the last authentication
      * attempt failed, null is returned.
      *
+     * NOTE: setAuthenticationResult() will be called upon page load, so the
+     * cache should always be populated after the page has successfully loaded.
+     *
      * @returns {AuthenticationResult}
      *     The last successful authentication result, or null if the user is not
      *     currently authenticated.
@@ -84,12 +87,7 @@ angular.module('auth').factory('authenticationService', ['$injector',
             return cachedResult;
 
         // Return explicit null if no auth data is currently stored
-        var data = localStorageService.getItem(AUTH_STORAGE_KEY);
-        if (!data)
-            return null;
-
-        // Update cache and return retrieved auth result
-        return (cachedResult = new AuthenticationResult(data));
+        return null;
 
     };
 
@@ -103,21 +101,28 @@ angular.module('auth').factory('authenticationService', ['$injector',
      */
     var setAuthenticationResult = function setAuthenticationResult(data) {
 
-        // Clear the currently-stored result if the last attempt failed
+        // Clear the currently-stored result and auth token if the last
+        // attempt failed
         if (!data) {
             cachedResult = null;
-            localStorageService.removeItem(AUTH_STORAGE_KEY);
+            localStorageService.removeItem(AUTH_TOKEN_STORAGE_KEY);
         }
 
-        // Otherwise store the authentication attempt directly
+        // Otherwise, store the authentication attempt directly.
+        // Note that only the auth token is stored in persistent local storage.
+        // To re-obtain an autentication result upon a fresh page load,
+        // reauthenticate with the persistent token, which can be obtained by
+        // calling getCurrentToken().
         else {
 
             // Always store in cache
             cachedResult = data;
 
-            // Persist result past tab/window closure ONLY if not anonymous
+            // Persist only the auth token past tab/window closure, and only
+            // if not anonymous
             if (data.username !== AuthenticationResult.ANONYMOUS_USERNAME)
-                localStorageService.setItem(AUTH_STORAGE_KEY, data);
+                localStorageService.setItem(
+                        AUTH_TOKEN_STORAGE_KEY, data.authToken);
 
         }
 
@@ -363,13 +368,13 @@ angular.module('auth').factory('authenticationService', ['$injector',
      */
     service.getCurrentToken = function getCurrentToken() {
 
-        // Return auth token, if available
+        // Return cached auth token, if available
         var authData = getAuthenticationResult();
         if (authData)
             return authData.authToken;
 
-        // No auth data present
-        return null;
+        // Fall back to the value from local storage if not found in cache
+        return localStorageService.getItem(AUTH_TOKEN_STORAGE_KEY);
 
     };
 

From b9044caf65f8d56a77dd994823a50eb7dfb48cef Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 29 Nov 2022 20:58:51 +0000
Subject: [PATCH 099/289] GUACAMOLE-1772: Allow user configuration of KSM API
 call timeout.

---
 .../ksm/conf/KsmConfigurationService.java     | 32 +++++++++++++++++++
 .../guacamole/vault/ksm/secret/KsmClient.java | 31 +++++++++++-------
 .../vault/ksm/secret/KsmClientFactory.java    |  9 ++++--
 .../vault/ksm/secret/KsmSecretService.java    |  3 +-
 4 files changed, 61 insertions(+), 14 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
index 5571ef9df..197b979e2 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmConfigurationService.java
@@ -28,6 +28,7 @@ import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.properties.BooleanGuacamoleProperty;
+import org.apache.guacamole.properties.LongGuacamoleProperty;
 import org.apache.guacamole.properties.StringGuacamoleProperty;
 import org.apache.guacamole.vault.conf.VaultConfigurationService;
 
@@ -120,6 +121,17 @@ public class KsmConfigurationService extends VaultConfigurationService {
         }
     };
 
+    /**
+     * The minimum number of milliseconds between KSM API calls.
+     */
+    private static final LongGuacamoleProperty KSM_API_CALL_INTERVAL = new LongGuacamoleProperty() {
+
+        @Override
+        public String getName() {
+            return "ksm-api-call-interval";
+        }
+    };
+
     /**
      * Creates a new KsmConfigurationService which reads the configuration
      * from "ksm-token-mapping.yml" and properties from
@@ -176,6 +188,20 @@ public class KsmConfigurationService extends VaultConfigurationService {
         return environment.getProperty(MATCH_USER_DOMAINS, false);
     }
 
+    /**
+     * Return the minimum number of milliseconds between KSM API calls. If not
+     * otherwise configured, this value will be 10 seconds.
+     *
+     * @return
+     *     The minimum number of milliseconds between KSM API calls.
+     *
+     * @throws GuacamoleException
+     *     If the value specified within guacamole.properties cannot be
+     *     parsed or does not exist.
+     */
+    public long getKsmApiInterval() throws GuacamoleException {
+        return environment.getProperty(KSM_API_CALL_INTERVAL, 10000L);
+    }
 
     /**
      * Return the globally-defined base-64-encoded JSON KSM configuration blob
@@ -189,7 +215,12 @@ public class KsmConfigurationService extends VaultConfigurationService {
      *     If the value specified within guacamole.properties cannot be
      *     parsed or does not exist.
      */
+    @Nonnull
+    @SuppressWarnings("null")
     public String getKsmConfig() throws GuacamoleException {
+
+        // This will always return a non-null value; an exception would be
+        // thrown if the required value is not set
         return environment.getRequiredProperty(KSM_CONFIG);
     }
 
@@ -235,6 +266,7 @@ public class KsmConfigurationService extends VaultConfigurationService {
      * @throws GuacamoleException
      *     If an invalid ksmConfig parameter is provided.
      */
+    @Nonnull
     public SecretsManagerOptions getSecretsManagerOptions(@Nonnull String ksmConfig) throws GuacamoleException {
 
         return new SecretsManagerOptions(
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
index 3aa436f69..1dbcd73a8 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClient.java
@@ -95,12 +95,6 @@ public class KsmClient {
      */
     private static final Pattern KEEPER_FILE_NOTATION = Pattern.compile("^(keeper://)?[^/]*/file/.+");
 
-    /**
-     * The maximum amount of time that an entry will be stored in the cache
-     * before being refreshed, in milliseconds.
-     */
-    private static final long CACHE_INTERVAL = 5000;
-
     /**
      * The KSM configuration associated with this client instance.
      */
@@ -115,6 +109,13 @@ public class KsmClient {
      */
     private final ReadWriteLock cacheLock = new ReentrantReadWriteLock();
 
+    /**
+     * The maximum amount of time that an entry will be stored in the cache
+     * before being refreshed, in milliseconds. This is also the shortest
+     * possible interval between API calls to KSM.
+     */
+    private final long cacheInterval;
+
     /**
      * The timestamp that the cache was last refreshed, in milliseconds, as
      * returned by System.currentTimeMillis(). This value is automatically
@@ -215,19 +216,27 @@ public class KsmClient {
     private final Set<String> cachedAmbiguousDomains = new HashSet<>();
 
     /**
-     * Create a new KSM client based around the provided KSM configuration.
+     * Create a new KSM client based around the provided KSM configuration and
+     * API timeout setting.
      *
      * @param ksmConfig
      *     The KSM configuration to use when retrieving properties from KSM.
+     *
+     * @param apiInterval
+     *     The minimum number of milliseconds that must elapse between KSM API
+     *     calls.
      */
     @AssistedInject
-    public KsmClient(@Assisted SecretsManagerOptions ksmConfig) {
+    public KsmClient(
+            @Assisted SecretsManagerOptions ksmConfig,
+            @Assisted long apiInterval) {
         this.ksmConfig = ksmConfig;
+        this.cacheInterval = apiInterval;
     }
 
     /**
      * Validates that all cached data is current with respect to
-     * {@link #CACHE_INTERVAL}, refreshing data from the server as needed.
+     * {@link #cacheInterval}, refreshing data from the server as needed.
      *
      * @throws GuacamoleException
      *     If an error occurs preventing the cached data from being refreshed.
@@ -240,7 +249,7 @@ public class KsmClient {
         // continuing
         cacheLock.readLock().lock();
         try {
-            if (currentTime - cacheTimestamp < CACHE_INTERVAL)
+            if (currentTime - cacheTimestamp < cacheInterval)
                 return;
         }
         finally {
@@ -252,7 +261,7 @@ public class KsmClient {
 
             // Cache may have been updated since the read-only check. Re-verify
             // that the cache has expired before continuing with a full refresh
-            if (currentTime - cacheTimestamp < CACHE_INTERVAL)
+            if (currentTime - cacheTimestamp < cacheInterval)
                 return;
 
             // Attempt to pull all records first, allowing that operation to
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClientFactory.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClientFactory.java
index f8220c16f..d97711893 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClientFactory.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmClientFactory.java
@@ -30,16 +30,21 @@ public interface KsmClientFactory {
 
     /**
      * Returns a new instance of a KsmClient instance associated with
-     * the provided KSM configuration options.
+     * the provided KSM configuration options and API interval.
      *
      * @param ksmConfigOptions
      *     The KSM config options to use when constructing the KsmClient
      *     object.
      *
+     * @param apiInterval
+     *     The minimum number of milliseconds that must elapse between KSM API
+     *     calls.
+     *
      * @return
      *     A new KsmClient instance associated with the provided KSM config
      *     options.
      */
-    KsmClient create(@Nonnull SecretsManagerOptions ksmConfigOptions);
+    KsmClient create(
+            @Nonnull SecretsManagerOptions ksmConfigOptions, long apiInterval);
 
 }
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
index f4d3c0626..717a125e3 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java
@@ -124,7 +124,7 @@ public class KsmSecretService implements VaultSecretService {
 
         // Create and store a new KSM client instance for the provided KSM config blob
         SecretsManagerOptions options = confService.getSecretsManagerOptions(ksmConfig);
-        ksmClient = ksmClientFactory.create(options);
+        ksmClient = ksmClientFactory.create(options, confService.getKsmApiInterval());
         KsmClient prevClient = ksmClientMap.putIfAbsent(ksmConfig, ksmClient);
 
         // If the client was already set before this thread got there, use the existing one
@@ -274,6 +274,7 @@ public class KsmSecretService implements VaultSecretService {
      *     no KSM config is found in the connection group tree, and the value is also not
      *     defined in the config file.
      */
+    @Nonnull
     private String getConnectionGroupKsmConfig(
             UserContext userContext, Connectable connectable) throws GuacamoleException {
 

From 18d971a8378c1c4fbdae4b0a9f7e2bec3fa14750 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 1 Dec 2022 00:22:02 +0000
Subject: [PATCH 100/289] GUACAMOLE-1723: Enforce access time restrictions for
 logged in users.

---
 .../modules/guacamole-auth-jdbc-base/pom.xml  |   6 +
 .../JDBCAuthenticationProviderModule.java     |  13 +-
 .../guacamole/auth/jdbc/JDBCEnvironment.java  |  15 ++
 .../ActiveConnectionDirectory.java            |   6 +
 .../auth/jdbc/base/RestrictedObject.java      |  47 +++++
 .../jdbc/connection/ConnectionDirectory.java  |   6 +
 .../ConnectionGroupDirectory.java             |   6 +
 .../SharingProfileDirectory.java              |   6 +
 .../AbstractGuacamoleTunnelService.java       |  71 +++++--
 .../AccessEnforcingDelegatingTunnel.java      | 196 ++++++++++++++++++
 ...ccessEnforcingDelegatingTunnelFactory.java |  54 +++++
 .../jdbc/tunnel/ActiveConnectionRecord.java   |   7 +
 .../auth/jdbc/user/UserDirectory.java         |   6 +
 .../jdbc/usergroup/UserGroupDirectory.java    |   6 +
 .../auth/mysql/conf/MySQLEnvironment.java     |   9 +
 .../mysql/conf/MySQLGuacamoleProperties.java  |  13 ++
 .../conf/PostgreSQLEnvironment.java           |   9 +
 .../conf/PostgreSQLGuacamoleProperties.java   |  13 ++
 .../sqlserver/conf/SQLServerEnvironment.java  |   9 +
 .../conf/SQLServerGuacamoleProperties.java    |  13 ++
 20 files changed, 497 insertions(+), 14 deletions(-)
 create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnel.java
 create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnelFactory.java

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml
index 9c99593bf..ac9856240 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml
@@ -94,6 +94,12 @@
             <artifactId>guice</artifactId>
         </dependency>
 
+        <!-- Guice Assisted Inject Extension -->
+        <dependency>
+            <groupId>com.google.inject.extensions</groupId>
+            <artifactId>guice-assistedinject</artifactId>
+        </dependency>
+
         <!-- Guava - Utility Library -->
         <dependency>
             <groupId>com.google.guava</groupId>
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
index 5ae0ea53f..e47ccf259 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
@@ -20,6 +20,8 @@
 package org.apache.guacamole.auth.jdbc;
 
 import com.google.inject.Scopes;
+import com.google.inject.assistedinject.FactoryModuleBuilder;
+
 import javax.sql.DataSource;
 import org.apache.guacamole.auth.jdbc.user.ModeledUserContext;
 import org.apache.guacamole.auth.jdbc.connectiongroup.RootConnectionGroup;
@@ -38,6 +40,8 @@ import org.apache.guacamole.auth.jdbc.permission.SystemPermissionMapper;
 import org.apache.guacamole.auth.jdbc.user.UserMapper;
 import org.apache.guacamole.auth.jdbc.connectiongroup.ConnectionGroupService;
 import org.apache.guacamole.auth.jdbc.connection.ConnectionService;
+import org.apache.guacamole.auth.jdbc.tunnel.AccessEnforcingDelegatingTunnel;
+import org.apache.guacamole.auth.jdbc.tunnel.AccessEnforcingDelegatingTunnelFactory;
 import org.apache.guacamole.auth.jdbc.tunnel.GuacamoleTunnelService;
 import org.apache.guacamole.auth.jdbc.security.PasswordEncryptionService;
 import org.apache.guacamole.auth.jdbc.security.SHA256PasswordEncryptionService;
@@ -196,7 +200,14 @@ public class JDBCAuthenticationProviderModule extends MyBatisModule {
         bind(UserGroupPermissionService.class);
         bind(UserPermissionService.class);
         bind(UserService.class);
-        
+
+        // Bind Factories
+        install(new FactoryModuleBuilder()
+                .implement(
+                        AccessEnforcingDelegatingTunnel.class,
+                        AccessEnforcingDelegatingTunnel.class)
+                .build(AccessEnforcingDelegatingTunnelFactory.class));
+
     }
 
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
index 763793d62..778d5b29f 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
@@ -227,4 +227,19 @@ public abstract class JDBCEnvironment extends DelegatingEnvironment {
      */
     public abstract boolean trackExternalConnectionHistory() throws GuacamoleException;
 
+    /**
+     * Returns a boolean value representing whether access time windows should
+     * be enforced for active connections - i.e. whether a currently-connected
+     * user should be disconnected upon the closure of an access window, or
+     * when the user is disabled.
+     *
+     * @return
+     *     True if a connected user should be disconnected upon an access time
+     *     window closing, or the user being disabled.
+     *
+     * @throws GuacamoleException
+     *     If guacamole.properties cannot be parsed.
+     */
+    public abstract boolean enforceAccessWindowsForActiveSessions() throws GuacamoleException;
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java
index b0d6324aa..b9a149933 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java
@@ -44,34 +44,40 @@ public class ActiveConnectionDirectory extends RestrictedObject
 
     @Override
     public ActiveConnection get(String identifier) throws GuacamoleException {
+        validateUserAccess();
         return activeConnectionService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     public Collection<ActiveConnection> getAll(Collection<String> identifiers)
             throws GuacamoleException {
+        validateUserAccess();
         Collection<TrackedActiveConnection> objects = activeConnectionService.retrieveObjects(getCurrentUser(), identifiers);
         return Collections.<ActiveConnection>unmodifiableCollection(objects);
     }
 
     @Override
     public Set<String> getIdentifiers() throws GuacamoleException {
+        validateUserAccess();
         return activeConnectionService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     public void add(ActiveConnection object) throws GuacamoleException {
+        validateUserAccess();
         activeConnectionService.createObject(getCurrentUser(), object);
     }
 
     @Override
     public void update(ActiveConnection object) throws GuacamoleException {
+        validateUserAccess();
         TrackedActiveConnection connection = (TrackedActiveConnection) object;
         activeConnectionService.updateObject(getCurrentUser(), connection);
     }
 
     @Override
     public void remove(String identifier) throws GuacamoleException {
+        validateUserAccess();
         activeConnectionService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/RestrictedObject.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/RestrictedObject.java
index 66979d487..461ce5804 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/RestrictedObject.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/RestrictedObject.java
@@ -19,7 +19,13 @@
 
 package org.apache.guacamole.auth.jdbc.base;
 
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleUnauthorizedException;
+import org.apache.guacamole.auth.jdbc.JDBCEnvironment;
 import org.apache.guacamole.auth.jdbc.user.ModeledAuthenticatedUser;
+import org.apache.guacamole.auth.jdbc.user.ModeledUser;
+
+import com.google.inject.Inject;
 
 /**
  * Common base class for objects that are associated with the users that
@@ -33,6 +39,12 @@ public abstract class RestrictedObject {
      */
     private ModeledAuthenticatedUser currentUser;
 
+    /**
+     * The environment of the Guacamole server.
+     */
+    @Inject
+    private JDBCEnvironment environment;
+
     /**
      * Initializes this object, associating it with the current authenticated
      * user and populating it with data from the given model object
@@ -68,4 +80,39 @@ public abstract class RestrictedObject {
         this.currentUser = currentUser;
     }
 
+    /**
+     * Validate that the current user is within a valid access time window
+     * and not disabled. If the user account is disabled or not within a
+     * valid access window, a GuacamoleUnauthorizedException will be thrown.
+     *
+     * This method can be called by RestrictedObject implementations before
+     * any operation that's specific to the current logged in user, to make
+     * sure that their access is still valid and enabled.
+     *
+     * If accessWindowCheckEnabled is set to false, the check will be skipped,
+     * and GuacamoleUnauthorizedException will never be thrown.
+     *
+     * @throws GuacamoleException
+     *     If the user is outside of a valid access window, the user is
+     *     disabled, or an error occurs while trying to determine access time
+     *     restriction configuration.
+     */
+    protected void validateUserAccess() throws GuacamoleException {
+
+        // If access windows shouldn't be checked for active sessions, skip
+        // this check entirely
+        if (!environment.enforceAccessWindowsForActiveSessions())
+            return;
+
+        // If the user is outside of a valid access time window or disabled,
+        // throw an exception to immediately log them out
+        ModeledUser modeledUser = getCurrentUser().getUser();
+        if (
+                !modeledUser.isAccountAccessible()
+                || !modeledUser.isAccountValid()
+                || modeledUser.isDisabled()
+        )
+            throw new GuacamoleUnauthorizedException("Permission Denied.");
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
index 52a127df4..54ca79033 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
@@ -45,12 +45,14 @@ public class ConnectionDirectory extends RestrictedObject
 
     @Override
     public Connection get(String identifier) throws GuacamoleException {
+        validateUserAccess();
         return connectionService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     @Transactional
     public Collection<Connection> getAll(Collection<String> identifiers) throws GuacamoleException {
+        validateUserAccess();
         Collection<ModeledConnection> objects = connectionService.retrieveObjects(getCurrentUser(), identifiers);
         return Collections.<Connection>unmodifiableCollection(objects);
     }
@@ -58,18 +60,21 @@ public class ConnectionDirectory extends RestrictedObject
     @Override
     @Transactional
     public Set<String> getIdentifiers() throws GuacamoleException {
+        validateUserAccess();
         return connectionService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     @Transactional
     public void add(Connection object) throws GuacamoleException {
+        validateUserAccess();
         connectionService.createObject(getCurrentUser(), object);
     }
 
     @Override
     @Transactional
     public void update(Connection object) throws GuacamoleException {
+        validateUserAccess();
         ModeledConnection connection = (ModeledConnection) object;
         connectionService.updateObject(getCurrentUser(), connection);
     }
@@ -77,6 +82,7 @@ public class ConnectionDirectory extends RestrictedObject
     @Override
     @Transactional
     public void remove(String identifier) throws GuacamoleException {
+        validateUserAccess();
         connectionService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java
index 9f3930597..030432793 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java
@@ -45,12 +45,14 @@ public class ConnectionGroupDirectory extends RestrictedObject
 
     @Override
     public ConnectionGroup get(String identifier) throws GuacamoleException {
+        validateUserAccess();
         return connectionGroupService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     @Transactional
     public Collection<ConnectionGroup> getAll(Collection<String> identifiers) throws GuacamoleException {
+        validateUserAccess();
         Collection<ModeledConnectionGroup> objects = connectionGroupService.retrieveObjects(getCurrentUser(), identifiers);
         return Collections.<ConnectionGroup>unmodifiableCollection(objects);
     }
@@ -58,18 +60,21 @@ public class ConnectionGroupDirectory extends RestrictedObject
     @Override
     @Transactional
     public Set<String> getIdentifiers() throws GuacamoleException {
+        validateUserAccess();
         return connectionGroupService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     @Transactional
     public void add(ConnectionGroup object) throws GuacamoleException {
+        validateUserAccess();
         connectionGroupService.createObject(getCurrentUser(), object);
     }
 
     @Override
     @Transactional
     public void update(ConnectionGroup object) throws GuacamoleException {
+        validateUserAccess();
         ModeledConnectionGroup connectionGroup = (ModeledConnectionGroup) object;
         connectionGroupService.updateObject(getCurrentUser(), connectionGroup);
     }
@@ -77,6 +82,7 @@ public class ConnectionGroupDirectory extends RestrictedObject
     @Override
     @Transactional
     public void remove(String identifier) throws GuacamoleException {
+        validateUserAccess();
         connectionGroupService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java
index 632557052..57ccb6d63 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java
@@ -44,12 +44,14 @@ public class SharingProfileDirectory extends RestrictedObject
 
     @Override
     public SharingProfile get(String identifier) throws GuacamoleException {
+        validateUserAccess();
         return sharingProfileService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     @Transactional
     public Collection<SharingProfile> getAll(Collection<String> identifiers) throws GuacamoleException {
+        validateUserAccess();
         return Collections.<SharingProfile>unmodifiableCollection(
             sharingProfileService.retrieveObjects(getCurrentUser(), identifiers)
         );
@@ -58,18 +60,21 @@ public class SharingProfileDirectory extends RestrictedObject
     @Override
     @Transactional
     public Set<String> getIdentifiers() throws GuacamoleException {
+        validateUserAccess();
         return sharingProfileService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     @Transactional
     public void add(SharingProfile object) throws GuacamoleException {
+        validateUserAccess();
         sharingProfileService.createObject(getCurrentUser(), object);
     }
 
     @Override
     @Transactional
     public void update(SharingProfile object) throws GuacamoleException {
+        validateUserAccess();
         ModeledSharingProfile sharingProfile = (ModeledSharingProfile) object;
         sharingProfileService.updateObject(getCurrentUser(), sharingProfile);
     }
@@ -77,6 +82,7 @@ public class SharingProfileDirectory extends RestrictedObject
     @Override
     @Transactional
     public void remove(String identifier) throws GuacamoleException {
+        validateUserAccess();
         sharingProfileService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java
index 8c16363a6..f26b8ea13 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java
@@ -46,6 +46,7 @@ import org.apache.guacamole.GuacamoleResourceNotFoundException;
 import org.apache.guacamole.GuacamoleSecurityException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.GuacamoleUpstreamException;
+import org.apache.guacamole.auth.jdbc.JDBCEnvironment;
 import org.apache.guacamole.auth.jdbc.connection.ConnectionMapper;
 import org.apache.guacamole.net.GuacamoleSocket;
 import org.apache.guacamole.net.GuacamoleTunnel;
@@ -63,6 +64,7 @@ import org.apache.guacamole.auth.jdbc.sharingprofile.ModeledSharingProfile;
 import org.apache.guacamole.auth.jdbc.sharingprofile.SharingProfileParameterMapper;
 import org.apache.guacamole.auth.jdbc.sharingprofile.SharingProfileParameterModel;
 import org.apache.guacamole.auth.jdbc.user.RemoteAuthenticatedUser;
+import org.apache.guacamole.auth.jdbc.user.UserService;
 import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration;
 import org.apache.guacamole.protocol.FailoverGuacamoleSocket;
 import org.slf4j.Logger;
@@ -117,6 +119,24 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
     @Inject
     private SharedConnectionMap connectionMap;
 
+    /**
+     * Service for fetching users.
+     */
+    @Inject
+    private UserService userService;
+
+    /**
+     * The environment of the Guacamole server.
+     */
+    @Inject
+    private JDBCEnvironment environment;
+
+    /**
+     * Provider for creating AccessEnforcingDelegatingTunnel instances.
+     */
+    @Inject
+    private AccessEnforcingDelegatingTunnelFactory accessEnforcingTunnelFactory;
+
     /**
      * All active connections through the tunnel having a given UUID.
      */
@@ -385,13 +405,21 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
      * connection, which MUST already be acquired via acquire(). The given
      * client information will be passed to guacd when the connection is
      * established.
-     * 
+     *
      * The connection will be automatically released when it closes, or if it
      * fails to establish entirely.
      *
+     * If user access window restrictions are enabled for active sessions,
+     * they will be automatically enforced for any valid database users as the
+     * tunnel is used.
+     *
      * @param activeConnection
      *     The active connection record of the connection in use.
      *
+     * @param user
+     *     The user record in the database for the user connecting to the
+     *     connection, if any.
+     *
      * @param info
      *     Information describing the Guacamole client connecting to the given
      *     connection.
@@ -412,8 +440,10 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
      *     If an error occurs while the connection is being established, or
      *     while connection configuration information is being retrieved.
      */
-    private GuacamoleTunnel assignGuacamoleTunnel(ActiveConnectionRecord activeConnection,
-            GuacamoleClientInformation info, Map<String, String> tokens,
+    private GuacamoleTunnel assignGuacamoleTunnel(
+            ActiveConnectionRecord activeConnection,
+            ModeledAuthenticatedUser user, GuacamoleClientInformation info,
+            Map<String, String> tokens,
             boolean interceptErrors) throws GuacamoleException {
 
         // Record new active connection
@@ -476,12 +506,21 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
                 getUnconfiguredGuacamoleSocket(connection.getGuacamoleProxyConfiguration(),
                         cleanupTask), config, info);
 
-            // Assign and return new tunnel
+            // Assign new tunnel
+            GuacamoleTunnel tunnel;
             if (interceptErrors)
-                return activeConnection.assignGuacamoleTunnel(new FailoverGuacamoleSocket(socket), socket.getConnectionID());
+                tunnel = activeConnection.assignGuacamoleTunnel(new FailoverGuacamoleSocket(socket), socket.getConnectionID());
             else
-                return activeConnection.assignGuacamoleTunnel(socket, socket.getConnectionID());
-            
+                tunnel = activeConnection.assignGuacamoleTunnel(socket, socket.getConnectionID());
+
+            // If there is an associated database user, and access window
+            // restrictions are enabled for active sessions, wrap the tunnel
+            // in order to check user login validity on every instruction read
+            if (user != null && environment.enforceAccessWindowsForActiveSessions()) {
+                tunnel = accessEnforcingTunnelFactory.create(tunnel, user);
+            }
+
+            return tunnel;
         }
 
         // Execute cleanup if socket could not be created
@@ -631,8 +670,10 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
         acquire(user, Collections.singletonList(connection), true);
 
         // Connect only if the connection was successfully acquired
-        ActiveConnectionRecord connectionRecord = new ActiveConnectionRecord(connectionMap, user, connection);
-        return assignGuacamoleTunnel(connectionRecord, info, tokens, false);
+        ActiveConnectionRecord connectionRecord = new ActiveConnectionRecord(
+                connectionMap, user, connection);
+        return assignGuacamoleTunnel(
+                connectionRecord, user, info, tokens, false);
 
     }
 
@@ -677,9 +718,10 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
             try {
 
                 // Connect to acquired child
-                ActiveConnectionRecord connectionRecord = new ActiveConnectionRecord(connectionMap, user, connectionGroup, connection);
-                GuacamoleTunnel tunnel = assignGuacamoleTunnel(connectionRecord,
-                        info, tokens, connections.size() > 1);
+                ActiveConnectionRecord connectionRecord = new ActiveConnectionRecord(
+                        connectionMap, user, connectionGroup, connection);
+                GuacamoleTunnel tunnel = assignGuacamoleTunnel(
+                        connectionRecord, user, info, tokens, connections.size() > 1);
 
                 // If session affinity is enabled, prefer this connection going forward
                 if (connectionGroup.isSessionAffinityEnabled())
@@ -736,7 +778,10 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
                 user, definition.getActiveConnection(), definition.getSharingProfile());
 
         // Connect to shared connection described by the created record
-        GuacamoleTunnel tunnel = assignGuacamoleTunnel(connectionRecord, info, tokens, false);
+        GuacamoleTunnel tunnel = assignGuacamoleTunnel(
+                connectionRecord, userService.retrieveAuthenticatedUser(
+                    user.getAuthenticationProvider(), user.getCredentials()),
+                info, tokens, false);
 
         // Register tunnel, such that it is closed when the
         // SharedConnectionDefinition is invalidated
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnel.java
new file mode 100644
index 000000000..5ee08330c
--- /dev/null
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnel.java
@@ -0,0 +1,196 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.jdbc.tunnel;
+
+import java.util.concurrent.atomic.AtomicReference;
+
+import javax.annotation.Nonnull;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleUnauthorizedException;
+import org.apache.guacamole.auth.jdbc.user.ModeledAuthenticatedUser;
+import org.apache.guacamole.auth.jdbc.user.ModeledUser;
+import org.apache.guacamole.auth.jdbc.user.UserService;
+import org.apache.guacamole.io.GuacamoleReader;
+import org.apache.guacamole.net.DelegatingGuacamoleTunnel;
+import org.apache.guacamole.net.GuacamoleTunnel;
+import org.apache.guacamole.protocol.FilteredGuacamoleReader;
+import org.apache.guacamole.protocol.GuacamoleFilter;
+import org.apache.guacamole.protocol.GuacamoleInstruction;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.google.inject.Inject;
+import com.google.inject.assistedinject.Assisted;
+import com.google.inject.assistedinject.AssistedInject;
+
+/**
+ * A tunnel implementation that enforces access window restriction for the
+ * provided ModeledUser, throwing a GuacamoleUnauthorizedException if the
+ * user's configured access window has closed, or if the user has become
+ * disabled. All other tunnel implementation is delegated to the underlying
+ * tunnel object.
+ */
+public class AccessEnforcingDelegatingTunnel extends DelegatingGuacamoleTunnel {
+
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(
+            AccessEnforcingDelegatingTunnel.class);
+
+    /**
+     * The number of milliseconds between subsequent refreshes of the user
+     * from the DB.
+     */
+    private static final long USER_MODEL_REFRESH_INTERVAL = 10000;
+
+    /**
+     * The user who's access window restrictions should be applied for the
+     * wrapped tunnel.
+     */
+    private final AtomicReference<ModeledUser> user;
+
+    /**
+     * A thread that will continously refresh the user
+     */
+    private final Thread userRefreshThread;
+
+    /**
+     * A service to use for refreshing the user from the DB.
+     */
+    @Inject
+    private UserService userService;
+
+    /**
+     * Create a new tunnel that will enforce the access window restrictions of
+     * the provided user, during usage of the provided tunnel.
+     *
+     * @param tunnel
+     *     The tunnel to delegate to.
+     *
+     * @param modeledAuthenticatedUser
+     *     The user whose access restrictions should be applied.
+     *
+     */
+    @AssistedInject
+    public AccessEnforcingDelegatingTunnel(
+            @Nonnull @Assisted GuacamoleTunnel tunnel,
+            @Nonnull @Assisted ModeledAuthenticatedUser modeledAuthenticatedUser) {
+
+        super(tunnel);
+        this.user = new AtomicReference<>(modeledAuthenticatedUser.getUser());
+
+        this.userRefreshThread = new Thread(() -> {
+            while (true) {
+
+                try {
+
+                    // Fetch an up-to-date user record from the DB to ensure
+                    // that any access restrictions modified while this tunnel
+                    // is open will be taken into account
+                    this.user.set(userService.retrieveUser(
+                        modeledAuthenticatedUser.getAuthenticationProvider(),
+                        modeledAuthenticatedUser));
+                }
+
+                // If an error occurs while trying to fetch the updated user,
+                // log the warning / exception and stop the refresh thread
+                catch (GuacamoleException e) {
+
+                    logger.warn(
+                            "Aborting user refresh thread due to error: {}",
+                            e.getMessage());
+                    logger.debug(
+                            "Exception caught while attempting to refresh user.", e);
+
+                    return;
+                }
+
+                try {
+
+                    // Wait a bit before refreshing the user record again
+                    Thread.sleep(USER_MODEL_REFRESH_INTERVAL);
+                }
+
+                // If interrupted by the tunnel, exit immediately
+                catch (InterruptedException e) {
+                    return;
+                }
+            }
+        });
+    }
+
+    @Override
+    public GuacamoleReader acquireReader() {
+
+        // Start periodically refreshing the user record
+        userRefreshThread.start();
+
+        // Filter received instructions, checking if the user's login
+        // is still valid for each one. If the login is invalid,
+        // log them out immediately and close the tunnel.
+        return new FilteredGuacamoleReader(
+            super.acquireReader(),
+            new GuacamoleFilter() {
+
+                @Override
+                public GuacamoleInstruction filter(
+                        GuacamoleInstruction instruction) throws GuacamoleException {
+
+                    // The user record, at most USER_MODEL_REFRESH_INTERVAL
+                    // milliseconds old
+                    ModeledUser modeledUser = user.get();
+
+                    // If the user is outside of a valid access time window,
+                    // or disabled, throw an exception to immediately log them out
+                    if (
+                            !modeledUser.isAccountAccessible()
+                            || !modeledUser.isAccountValid()
+                            || modeledUser.isDisabled()
+                    ) {
+                        throw new GuacamoleUnauthorizedException("Permission Denied.");
+                    }
+
+                    return instruction;
+                }
+            }
+        );
+    }
+
+    @Override
+    public void releaseReader() {
+
+        // Interrupt the refresh thread; it will clean itself up
+        userRefreshThread.interrupt();
+
+        super.releaseReader();
+    }
+
+    @Override
+    public void close() throws GuacamoleException {
+
+        // Interrupt the refresh thread; it will clean itself up
+        userRefreshThread.interrupt();
+
+        super.close();
+    }
+
+}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnelFactory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnelFactory.java
new file mode 100644
index 000000000..0c6350766
--- /dev/null
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnelFactory.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.jdbc.tunnel;
+
+import javax.annotation.Nonnull;
+
+import org.apache.guacamole.auth.jdbc.user.ModeledAuthenticatedUser;
+import org.apache.guacamole.net.GuacamoleTunnel;
+
+/**
+ * A factory for creating AccessEnforcingDelegatingTunnel instances.
+ */
+public interface AccessEnforcingDelegatingTunnelFactory {
+
+    /**
+     * Create and return a new AccessEnforcingDelegatingTunnel wrapping the
+     * provided tunnel and enforcing the user restrictions associated with the
+     * provided user.
+     *
+     * @param tunnel
+     *     The tunnel to delegate to.
+     *
+     * @param user
+     *     The user whose access window restrictions should be applied for the
+     *     wrapped tunel.
+     *
+     * @return
+     *     A new AccessEnforcingDelegatingTunnel wrapping the provided tunnel
+     *     and enforcing the user restrictions associated with the provided
+     *     user.
+     *
+     */
+    public AccessEnforcingDelegatingTunnel create(
+            @Nonnull GuacamoleTunnel tunnel,
+            @Nonnull ModeledAuthenticatedUser user);
+
+}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/ActiveConnectionRecord.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/ActiveConnectionRecord.java
index c3150ca97..df25159a9 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/ActiveConnectionRecord.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/ActiveConnectionRecord.java
@@ -21,6 +21,9 @@ package org.apache.guacamole.auth.jdbc.tunnel;
 
 import java.util.Date;
 import java.util.UUID;
+
+import javax.annotation.Nonnull;
+
 import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordModel;
 import org.apache.guacamole.auth.jdbc.connection.ModeledConnection;
 import org.apache.guacamole.auth.jdbc.connection.ModeledConnectionRecord;
@@ -377,6 +380,8 @@ public class ActiveConnectionRecord extends ModeledConnectionRecord {
      * @return
      *     The newly-created tunnel associated with this connection record.
      */
+    @Nonnull
+    @SuppressWarnings("null")
     public GuacamoleTunnel assignGuacamoleTunnel(final GuacamoleSocket socket,
             String connectionID) {
 
@@ -400,6 +405,8 @@ public class ActiveConnectionRecord extends ModeledConnectionRecord {
             this.connectionID = connectionID;
 
         // Return newly-created tunnel
+        // NOTE: Guaranteed to be non-null since it was just set in this
+        // method, and there is no functionality to set it to null
         return this.tunnel;
         
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java
index dffd8e2ec..db8bea12f 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java
@@ -45,12 +45,14 @@ public class UserDirectory extends RestrictedObject
 
     @Override
     public User get(String identifier) throws GuacamoleException {
+        validateUserAccess();
         return userService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     @Transactional
     public Collection<User> getAll(Collection<String> identifiers) throws GuacamoleException {
+        validateUserAccess();
         Collection<ModeledUser> objects = userService.retrieveObjects(getCurrentUser(), identifiers);
         return Collections.<User>unmodifiableCollection(objects);
     }
@@ -58,18 +60,21 @@ public class UserDirectory extends RestrictedObject
     @Override
     @Transactional
     public Set<String> getIdentifiers() throws GuacamoleException {
+        validateUserAccess();
         return userService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     @Transactional
     public void add(User object) throws GuacamoleException {
+        validateUserAccess();
         userService.createObject(getCurrentUser(), object);
     }
 
     @Override
     @Transactional
     public void update(User object) throws GuacamoleException {
+        validateUserAccess();
         ModeledUser user = (ModeledUser) object;
         userService.updateObject(getCurrentUser(), user);
     }
@@ -77,6 +82,7 @@ public class UserDirectory extends RestrictedObject
     @Override
     @Transactional
     public void remove(String identifier) throws GuacamoleException {
+        validateUserAccess();
         userService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java
index 911b8521f..f61af0bea 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java
@@ -44,12 +44,14 @@ public class UserGroupDirectory extends RestrictedObject
 
     @Override
     public UserGroup get(String identifier) throws GuacamoleException {
+        validateUserAccess();
         return userGroupService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     @Transactional
     public Collection<UserGroup> getAll(Collection<String> identifiers) throws GuacamoleException {
+        validateUserAccess();
         Collection<ModeledUserGroup> objects = userGroupService.retrieveObjects(getCurrentUser(), identifiers);
         return Collections.<UserGroup>unmodifiableCollection(objects);
     }
@@ -57,18 +59,21 @@ public class UserGroupDirectory extends RestrictedObject
     @Override
     @Transactional
     public Set<String> getIdentifiers() throws GuacamoleException {
+        validateUserAccess();
         return userGroupService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     @Transactional
     public void add(UserGroup object) throws GuacamoleException {
+        validateUserAccess();
         userGroupService.createObject(getCurrentUser(), object);
     }
 
     @Override
     @Transactional
     public void update(UserGroup object) throws GuacamoleException {
+        validateUserAccess();
         ModeledUserGroup group = (ModeledUserGroup) object;
         userGroupService.updateObject(getCurrentUser(), group);
     }
@@ -76,6 +81,7 @@ public class UserGroupDirectory extends RestrictedObject
     @Override
     @Transactional
     public void remove(String identifier) throws GuacamoleException {
+        validateUserAccess();
         userGroupService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java
index d8344ec81..9ac722624 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java
@@ -412,4 +412,13 @@ public class MySQLEnvironment extends JDBCEnvironment {
                 true);
     }
 
+    @Override
+    public boolean enforceAccessWindowsForActiveSessions() throws GuacamoleException {
+
+        // Enforce access window restrictions for active sessions unless explicitly disabled
+        return getProperty(
+                MySQLGuacamoleProperties.MYSQL_ENFORCE_ACCESS_WINDOWS_FOR_ACTIVE_SESSIONS,
+                true);
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
index 6a5944fd3..c676feaad 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
@@ -278,4 +278,17 @@ public class MySQLGuacamoleProperties {
 
     };
 
+    /**
+     * Whether or not user-specific access time windows should be enforced for active sessions,
+     * i.e. whether users with active sessions should be logged out immediately when an access
+     * window closes or the user is disabled.
+     */
+    public static final BooleanGuacamoleProperty MYSQL_ENFORCE_ACCESS_WINDOWS_FOR_ACTIVE_SESSIONS =
+            new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "mysql-enforce-access-windows-for-active-sessions"; }
+
+    };
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java
index ac08e0ae0..5e0a5a1fe 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java
@@ -371,4 +371,13 @@ public class PostgreSQLEnvironment extends JDBCEnvironment {
                 true);
     }
 
+    @Override
+    public boolean enforceAccessWindowsForActiveSessions() throws GuacamoleException {
+
+        // Enforce access window restrictions for active sessions unless explicitly disabled
+        return getProperty(
+                PostgreSQLGuacamoleProperties.POSTGRESQL_ENFORCE_ACCESS_WINDOWS_FOR_ACTIVE_SESSIONS,
+                true);
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
index dfa00b68c..636c0a1c7 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
@@ -290,4 +290,17 @@ public class PostgreSQLGuacamoleProperties {
 
     };
 
+    /**
+     * Whether or not user-specific access time windows should be enforced for active sessions,
+     * i.e. whether users with active sessions should be logged out immediately when an access
+     * window closes or the user is disabled.
+     */
+    public static final BooleanGuacamoleProperty POSTGRESQL_ENFORCE_ACCESS_WINDOWS_FOR_ACTIVE_SESSIONS =
+            new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "postgresql-enforce-access-windows-for-active-sessions"; }
+
+    };
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
index 0b6983691..7d88d7399 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
@@ -268,4 +268,13 @@ public class SQLServerEnvironment extends JDBCEnvironment {
                 true);
     }
 
+    @Override
+    public boolean enforceAccessWindowsForActiveSessions() throws GuacamoleException {
+
+        // Enforce access window restrictions for active sessions unless explicitly disabled
+        return getProperty(
+                SQLServerGuacamoleProperties.SQLSERVER_ENFORCE_ACCESS_WINDOWS_FOR_ACTIVE_SESSIONS,
+                true);
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
index 432454ed8..e7b1c6982 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
@@ -220,4 +220,17 @@ public class SQLServerGuacamoleProperties {
 
     };
 
+    /**
+     * Whether or not user-specific access time windows should be enforced for active sessions,
+     * i.e. whether users with active sessions should be logged out immediately when an access
+     * window closes or the user is disabled.
+     */
+    public static final BooleanGuacamoleProperty SQLSERVER_ENFORCE_ACCESS_WINDOWS_FOR_ACTIVE_SESSIONS =
+            new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "sqlserver-enforce-access-windows-for-active-sessions"; }
+
+    };
+
 }

From 89945caa5f70b4a3c925fd6066c7fcbb0135fd80 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 2 Dec 2022 04:35:56 +0000
Subject: [PATCH 101/289] GUACAMOLE-1723: Simplify active window check; do not
 refresh from DB during active sessions.

---
 .../modules/guacamole-auth-jdbc-base/pom.xml  |   6 -
 .../JDBCAuthenticationProviderModule.java     |  13 +-
 .../guacamole/auth/jdbc/JDBCEnvironment.java  |   7 +-
 .../ActiveConnectionDirectory.java            |   6 -
 .../auth/jdbc/base/RestrictedObject.java      |  47 -----
 .../jdbc/connection/ConnectionDirectory.java  |   6 -
 .../ConnectionGroupDirectory.java             |   6 -
 .../SharingProfileDirectory.java              |   6 -
 .../AbstractGuacamoleTunnelService.java       |  71 ++-----
 .../AccessEnforcingDelegatingTunnel.java      | 196 ------------------
 ...ccessEnforcingDelegatingTunnelFactory.java |  54 -----
 .../jdbc/tunnel/ActiveConnectionRecord.java   |   7 -
 .../auth/jdbc/user/ModeledUserContext.java    |  41 ++++
 .../auth/jdbc/user/UserDirectory.java         |   6 -
 .../jdbc/usergroup/UserGroupDirectory.java    |   6 -
 .../mysql/conf/MySQLGuacamoleProperties.java  |   2 +-
 .../conf/PostgreSQLGuacamoleProperties.java   |   2 +-
 .../conf/SQLServerGuacamoleProperties.java    |   2 +-
 .../net/auth/DelegatingUserContext.java       |   5 +
 .../guacamole/net/auth/UserContext.java       |  21 ++
 .../apache/guacamole/GuacamoleSession.java    |  16 ++
 .../rest/auth/HashTokenSessionMap.java        |  29 ++-
 22 files changed, 123 insertions(+), 432 deletions(-)
 delete mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnel.java
 delete mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnelFactory.java

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml
index ac9856240..9c99593bf 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/pom.xml
@@ -94,12 +94,6 @@
             <artifactId>guice</artifactId>
         </dependency>
 
-        <!-- Guice Assisted Inject Extension -->
-        <dependency>
-            <groupId>com.google.inject.extensions</groupId>
-            <artifactId>guice-assistedinject</artifactId>
-        </dependency>
-
         <!-- Guava - Utility Library -->
         <dependency>
             <groupId>com.google.guava</groupId>
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
index e47ccf259..5ae0ea53f 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
@@ -20,8 +20,6 @@
 package org.apache.guacamole.auth.jdbc;
 
 import com.google.inject.Scopes;
-import com.google.inject.assistedinject.FactoryModuleBuilder;
-
 import javax.sql.DataSource;
 import org.apache.guacamole.auth.jdbc.user.ModeledUserContext;
 import org.apache.guacamole.auth.jdbc.connectiongroup.RootConnectionGroup;
@@ -40,8 +38,6 @@ import org.apache.guacamole.auth.jdbc.permission.SystemPermissionMapper;
 import org.apache.guacamole.auth.jdbc.user.UserMapper;
 import org.apache.guacamole.auth.jdbc.connectiongroup.ConnectionGroupService;
 import org.apache.guacamole.auth.jdbc.connection.ConnectionService;
-import org.apache.guacamole.auth.jdbc.tunnel.AccessEnforcingDelegatingTunnel;
-import org.apache.guacamole.auth.jdbc.tunnel.AccessEnforcingDelegatingTunnelFactory;
 import org.apache.guacamole.auth.jdbc.tunnel.GuacamoleTunnelService;
 import org.apache.guacamole.auth.jdbc.security.PasswordEncryptionService;
 import org.apache.guacamole.auth.jdbc.security.SHA256PasswordEncryptionService;
@@ -200,14 +196,7 @@ public class JDBCAuthenticationProviderModule extends MyBatisModule {
         bind(UserGroupPermissionService.class);
         bind(UserPermissionService.class);
         bind(UserService.class);
-
-        // Bind Factories
-        install(new FactoryModuleBuilder()
-                .implement(
-                        AccessEnforcingDelegatingTunnel.class,
-                        AccessEnforcingDelegatingTunnel.class)
-                .build(AccessEnforcingDelegatingTunnelFactory.class));
-
+        
     }
 
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
index 778d5b29f..77f038734 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
@@ -230,12 +230,11 @@ public abstract class JDBCEnvironment extends DelegatingEnvironment {
     /**
      * Returns a boolean value representing whether access time windows should
      * be enforced for active connections - i.e. whether a currently-connected
-     * user should be disconnected upon the closure of an access window, or
-     * when the user is disabled.
+     * user should be disconnected upon the closure of an access window.
      *
      * @return
-     *     True if a connected user should be disconnected upon an access time
-     *     window closing, or the user being disabled.
+     *     true if a connected user should be disconnected upon an access time
+     *     window closing, false otherwise.
      *
      * @throws GuacamoleException
      *     If guacamole.properties cannot be parsed.
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java
index b9a149933..b0d6324aa 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java
@@ -44,40 +44,34 @@ public class ActiveConnectionDirectory extends RestrictedObject
 
     @Override
     public ActiveConnection get(String identifier) throws GuacamoleException {
-        validateUserAccess();
         return activeConnectionService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     public Collection<ActiveConnection> getAll(Collection<String> identifiers)
             throws GuacamoleException {
-        validateUserAccess();
         Collection<TrackedActiveConnection> objects = activeConnectionService.retrieveObjects(getCurrentUser(), identifiers);
         return Collections.<ActiveConnection>unmodifiableCollection(objects);
     }
 
     @Override
     public Set<String> getIdentifiers() throws GuacamoleException {
-        validateUserAccess();
         return activeConnectionService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     public void add(ActiveConnection object) throws GuacamoleException {
-        validateUserAccess();
         activeConnectionService.createObject(getCurrentUser(), object);
     }
 
     @Override
     public void update(ActiveConnection object) throws GuacamoleException {
-        validateUserAccess();
         TrackedActiveConnection connection = (TrackedActiveConnection) object;
         activeConnectionService.updateObject(getCurrentUser(), connection);
     }
 
     @Override
     public void remove(String identifier) throws GuacamoleException {
-        validateUserAccess();
         activeConnectionService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/RestrictedObject.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/RestrictedObject.java
index 461ce5804..66979d487 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/RestrictedObject.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/RestrictedObject.java
@@ -19,13 +19,7 @@
 
 package org.apache.guacamole.auth.jdbc.base;
 
-import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.GuacamoleUnauthorizedException;
-import org.apache.guacamole.auth.jdbc.JDBCEnvironment;
 import org.apache.guacamole.auth.jdbc.user.ModeledAuthenticatedUser;
-import org.apache.guacamole.auth.jdbc.user.ModeledUser;
-
-import com.google.inject.Inject;
 
 /**
  * Common base class for objects that are associated with the users that
@@ -39,12 +33,6 @@ public abstract class RestrictedObject {
      */
     private ModeledAuthenticatedUser currentUser;
 
-    /**
-     * The environment of the Guacamole server.
-     */
-    @Inject
-    private JDBCEnvironment environment;
-
     /**
      * Initializes this object, associating it with the current authenticated
      * user and populating it with data from the given model object
@@ -80,39 +68,4 @@ public abstract class RestrictedObject {
         this.currentUser = currentUser;
     }
 
-    /**
-     * Validate that the current user is within a valid access time window
-     * and not disabled. If the user account is disabled or not within a
-     * valid access window, a GuacamoleUnauthorizedException will be thrown.
-     *
-     * This method can be called by RestrictedObject implementations before
-     * any operation that's specific to the current logged in user, to make
-     * sure that their access is still valid and enabled.
-     *
-     * If accessWindowCheckEnabled is set to false, the check will be skipped,
-     * and GuacamoleUnauthorizedException will never be thrown.
-     *
-     * @throws GuacamoleException
-     *     If the user is outside of a valid access window, the user is
-     *     disabled, or an error occurs while trying to determine access time
-     *     restriction configuration.
-     */
-    protected void validateUserAccess() throws GuacamoleException {
-
-        // If access windows shouldn't be checked for active sessions, skip
-        // this check entirely
-        if (!environment.enforceAccessWindowsForActiveSessions())
-            return;
-
-        // If the user is outside of a valid access time window or disabled,
-        // throw an exception to immediately log them out
-        ModeledUser modeledUser = getCurrentUser().getUser();
-        if (
-                !modeledUser.isAccountAccessible()
-                || !modeledUser.isAccountValid()
-                || modeledUser.isDisabled()
-        )
-            throw new GuacamoleUnauthorizedException("Permission Denied.");
-    }
-
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
index 54ca79033..52a127df4 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
@@ -45,14 +45,12 @@ public class ConnectionDirectory extends RestrictedObject
 
     @Override
     public Connection get(String identifier) throws GuacamoleException {
-        validateUserAccess();
         return connectionService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     @Transactional
     public Collection<Connection> getAll(Collection<String> identifiers) throws GuacamoleException {
-        validateUserAccess();
         Collection<ModeledConnection> objects = connectionService.retrieveObjects(getCurrentUser(), identifiers);
         return Collections.<Connection>unmodifiableCollection(objects);
     }
@@ -60,21 +58,18 @@ public class ConnectionDirectory extends RestrictedObject
     @Override
     @Transactional
     public Set<String> getIdentifiers() throws GuacamoleException {
-        validateUserAccess();
         return connectionService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     @Transactional
     public void add(Connection object) throws GuacamoleException {
-        validateUserAccess();
         connectionService.createObject(getCurrentUser(), object);
     }
 
     @Override
     @Transactional
     public void update(Connection object) throws GuacamoleException {
-        validateUserAccess();
         ModeledConnection connection = (ModeledConnection) object;
         connectionService.updateObject(getCurrentUser(), connection);
     }
@@ -82,7 +77,6 @@ public class ConnectionDirectory extends RestrictedObject
     @Override
     @Transactional
     public void remove(String identifier) throws GuacamoleException {
-        validateUserAccess();
         connectionService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java
index 030432793..9f3930597 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java
@@ -45,14 +45,12 @@ public class ConnectionGroupDirectory extends RestrictedObject
 
     @Override
     public ConnectionGroup get(String identifier) throws GuacamoleException {
-        validateUserAccess();
         return connectionGroupService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     @Transactional
     public Collection<ConnectionGroup> getAll(Collection<String> identifiers) throws GuacamoleException {
-        validateUserAccess();
         Collection<ModeledConnectionGroup> objects = connectionGroupService.retrieveObjects(getCurrentUser(), identifiers);
         return Collections.<ConnectionGroup>unmodifiableCollection(objects);
     }
@@ -60,21 +58,18 @@ public class ConnectionGroupDirectory extends RestrictedObject
     @Override
     @Transactional
     public Set<String> getIdentifiers() throws GuacamoleException {
-        validateUserAccess();
         return connectionGroupService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     @Transactional
     public void add(ConnectionGroup object) throws GuacamoleException {
-        validateUserAccess();
         connectionGroupService.createObject(getCurrentUser(), object);
     }
 
     @Override
     @Transactional
     public void update(ConnectionGroup object) throws GuacamoleException {
-        validateUserAccess();
         ModeledConnectionGroup connectionGroup = (ModeledConnectionGroup) object;
         connectionGroupService.updateObject(getCurrentUser(), connectionGroup);
     }
@@ -82,7 +77,6 @@ public class ConnectionGroupDirectory extends RestrictedObject
     @Override
     @Transactional
     public void remove(String identifier) throws GuacamoleException {
-        validateUserAccess();
         connectionGroupService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java
index 57ccb6d63..632557052 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java
@@ -44,14 +44,12 @@ public class SharingProfileDirectory extends RestrictedObject
 
     @Override
     public SharingProfile get(String identifier) throws GuacamoleException {
-        validateUserAccess();
         return sharingProfileService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     @Transactional
     public Collection<SharingProfile> getAll(Collection<String> identifiers) throws GuacamoleException {
-        validateUserAccess();
         return Collections.<SharingProfile>unmodifiableCollection(
             sharingProfileService.retrieveObjects(getCurrentUser(), identifiers)
         );
@@ -60,21 +58,18 @@ public class SharingProfileDirectory extends RestrictedObject
     @Override
     @Transactional
     public Set<String> getIdentifiers() throws GuacamoleException {
-        validateUserAccess();
         return sharingProfileService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     @Transactional
     public void add(SharingProfile object) throws GuacamoleException {
-        validateUserAccess();
         sharingProfileService.createObject(getCurrentUser(), object);
     }
 
     @Override
     @Transactional
     public void update(SharingProfile object) throws GuacamoleException {
-        validateUserAccess();
         ModeledSharingProfile sharingProfile = (ModeledSharingProfile) object;
         sharingProfileService.updateObject(getCurrentUser(), sharingProfile);
     }
@@ -82,7 +77,6 @@ public class SharingProfileDirectory extends RestrictedObject
     @Override
     @Transactional
     public void remove(String identifier) throws GuacamoleException {
-        validateUserAccess();
         sharingProfileService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java
index f26b8ea13..8c16363a6 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java
@@ -46,7 +46,6 @@ import org.apache.guacamole.GuacamoleResourceNotFoundException;
 import org.apache.guacamole.GuacamoleSecurityException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.GuacamoleUpstreamException;
-import org.apache.guacamole.auth.jdbc.JDBCEnvironment;
 import org.apache.guacamole.auth.jdbc.connection.ConnectionMapper;
 import org.apache.guacamole.net.GuacamoleSocket;
 import org.apache.guacamole.net.GuacamoleTunnel;
@@ -64,7 +63,6 @@ import org.apache.guacamole.auth.jdbc.sharingprofile.ModeledSharingProfile;
 import org.apache.guacamole.auth.jdbc.sharingprofile.SharingProfileParameterMapper;
 import org.apache.guacamole.auth.jdbc.sharingprofile.SharingProfileParameterModel;
 import org.apache.guacamole.auth.jdbc.user.RemoteAuthenticatedUser;
-import org.apache.guacamole.auth.jdbc.user.UserService;
 import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration;
 import org.apache.guacamole.protocol.FailoverGuacamoleSocket;
 import org.slf4j.Logger;
@@ -119,24 +117,6 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
     @Inject
     private SharedConnectionMap connectionMap;
 
-    /**
-     * Service for fetching users.
-     */
-    @Inject
-    private UserService userService;
-
-    /**
-     * The environment of the Guacamole server.
-     */
-    @Inject
-    private JDBCEnvironment environment;
-
-    /**
-     * Provider for creating AccessEnforcingDelegatingTunnel instances.
-     */
-    @Inject
-    private AccessEnforcingDelegatingTunnelFactory accessEnforcingTunnelFactory;
-
     /**
      * All active connections through the tunnel having a given UUID.
      */
@@ -405,21 +385,13 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
      * connection, which MUST already be acquired via acquire(). The given
      * client information will be passed to guacd when the connection is
      * established.
-     *
+     * 
      * The connection will be automatically released when it closes, or if it
      * fails to establish entirely.
      *
-     * If user access window restrictions are enabled for active sessions,
-     * they will be automatically enforced for any valid database users as the
-     * tunnel is used.
-     *
      * @param activeConnection
      *     The active connection record of the connection in use.
      *
-     * @param user
-     *     The user record in the database for the user connecting to the
-     *     connection, if any.
-     *
      * @param info
      *     Information describing the Guacamole client connecting to the given
      *     connection.
@@ -440,10 +412,8 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
      *     If an error occurs while the connection is being established, or
      *     while connection configuration information is being retrieved.
      */
-    private GuacamoleTunnel assignGuacamoleTunnel(
-            ActiveConnectionRecord activeConnection,
-            ModeledAuthenticatedUser user, GuacamoleClientInformation info,
-            Map<String, String> tokens,
+    private GuacamoleTunnel assignGuacamoleTunnel(ActiveConnectionRecord activeConnection,
+            GuacamoleClientInformation info, Map<String, String> tokens,
             boolean interceptErrors) throws GuacamoleException {
 
         // Record new active connection
@@ -506,21 +476,12 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
                 getUnconfiguredGuacamoleSocket(connection.getGuacamoleProxyConfiguration(),
                         cleanupTask), config, info);
 
-            // Assign new tunnel
-            GuacamoleTunnel tunnel;
+            // Assign and return new tunnel
             if (interceptErrors)
-                tunnel = activeConnection.assignGuacamoleTunnel(new FailoverGuacamoleSocket(socket), socket.getConnectionID());
+                return activeConnection.assignGuacamoleTunnel(new FailoverGuacamoleSocket(socket), socket.getConnectionID());
             else
-                tunnel = activeConnection.assignGuacamoleTunnel(socket, socket.getConnectionID());
-
-            // If there is an associated database user, and access window
-            // restrictions are enabled for active sessions, wrap the tunnel
-            // in order to check user login validity on every instruction read
-            if (user != null && environment.enforceAccessWindowsForActiveSessions()) {
-                tunnel = accessEnforcingTunnelFactory.create(tunnel, user);
-            }
-
-            return tunnel;
+                return activeConnection.assignGuacamoleTunnel(socket, socket.getConnectionID());
+            
         }
 
         // Execute cleanup if socket could not be created
@@ -670,10 +631,8 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
         acquire(user, Collections.singletonList(connection), true);
 
         // Connect only if the connection was successfully acquired
-        ActiveConnectionRecord connectionRecord = new ActiveConnectionRecord(
-                connectionMap, user, connection);
-        return assignGuacamoleTunnel(
-                connectionRecord, user, info, tokens, false);
+        ActiveConnectionRecord connectionRecord = new ActiveConnectionRecord(connectionMap, user, connection);
+        return assignGuacamoleTunnel(connectionRecord, info, tokens, false);
 
     }
 
@@ -718,10 +677,9 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
             try {
 
                 // Connect to acquired child
-                ActiveConnectionRecord connectionRecord = new ActiveConnectionRecord(
-                        connectionMap, user, connectionGroup, connection);
-                GuacamoleTunnel tunnel = assignGuacamoleTunnel(
-                        connectionRecord, user, info, tokens, connections.size() > 1);
+                ActiveConnectionRecord connectionRecord = new ActiveConnectionRecord(connectionMap, user, connectionGroup, connection);
+                GuacamoleTunnel tunnel = assignGuacamoleTunnel(connectionRecord,
+                        info, tokens, connections.size() > 1);
 
                 // If session affinity is enabled, prefer this connection going forward
                 if (connectionGroup.isSessionAffinityEnabled())
@@ -778,10 +736,7 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS
                 user, definition.getActiveConnection(), definition.getSharingProfile());
 
         // Connect to shared connection described by the created record
-        GuacamoleTunnel tunnel = assignGuacamoleTunnel(
-                connectionRecord, userService.retrieveAuthenticatedUser(
-                    user.getAuthenticationProvider(), user.getCredentials()),
-                info, tokens, false);
+        GuacamoleTunnel tunnel = assignGuacamoleTunnel(connectionRecord, info, tokens, false);
 
         // Register tunnel, such that it is closed when the
         // SharedConnectionDefinition is invalidated
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnel.java
deleted file mode 100644
index 5ee08330c..000000000
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnel.java
+++ /dev/null
@@ -1,196 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.jdbc.tunnel;
-
-import java.util.concurrent.atomic.AtomicReference;
-
-import javax.annotation.Nonnull;
-
-import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.GuacamoleUnauthorizedException;
-import org.apache.guacamole.auth.jdbc.user.ModeledAuthenticatedUser;
-import org.apache.guacamole.auth.jdbc.user.ModeledUser;
-import org.apache.guacamole.auth.jdbc.user.UserService;
-import org.apache.guacamole.io.GuacamoleReader;
-import org.apache.guacamole.net.DelegatingGuacamoleTunnel;
-import org.apache.guacamole.net.GuacamoleTunnel;
-import org.apache.guacamole.protocol.FilteredGuacamoleReader;
-import org.apache.guacamole.protocol.GuacamoleFilter;
-import org.apache.guacamole.protocol.GuacamoleInstruction;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.google.inject.Inject;
-import com.google.inject.assistedinject.Assisted;
-import com.google.inject.assistedinject.AssistedInject;
-
-/**
- * A tunnel implementation that enforces access window restriction for the
- * provided ModeledUser, throwing a GuacamoleUnauthorizedException if the
- * user's configured access window has closed, or if the user has become
- * disabled. All other tunnel implementation is delegated to the underlying
- * tunnel object.
- */
-public class AccessEnforcingDelegatingTunnel extends DelegatingGuacamoleTunnel {
-
-    /**
-     * Logger for this class.
-     */
-    private static final Logger logger = LoggerFactory.getLogger(
-            AccessEnforcingDelegatingTunnel.class);
-
-    /**
-     * The number of milliseconds between subsequent refreshes of the user
-     * from the DB.
-     */
-    private static final long USER_MODEL_REFRESH_INTERVAL = 10000;
-
-    /**
-     * The user who's access window restrictions should be applied for the
-     * wrapped tunnel.
-     */
-    private final AtomicReference<ModeledUser> user;
-
-    /**
-     * A thread that will continously refresh the user
-     */
-    private final Thread userRefreshThread;
-
-    /**
-     * A service to use for refreshing the user from the DB.
-     */
-    @Inject
-    private UserService userService;
-
-    /**
-     * Create a new tunnel that will enforce the access window restrictions of
-     * the provided user, during usage of the provided tunnel.
-     *
-     * @param tunnel
-     *     The tunnel to delegate to.
-     *
-     * @param modeledAuthenticatedUser
-     *     The user whose access restrictions should be applied.
-     *
-     */
-    @AssistedInject
-    public AccessEnforcingDelegatingTunnel(
-            @Nonnull @Assisted GuacamoleTunnel tunnel,
-            @Nonnull @Assisted ModeledAuthenticatedUser modeledAuthenticatedUser) {
-
-        super(tunnel);
-        this.user = new AtomicReference<>(modeledAuthenticatedUser.getUser());
-
-        this.userRefreshThread = new Thread(() -> {
-            while (true) {
-
-                try {
-
-                    // Fetch an up-to-date user record from the DB to ensure
-                    // that any access restrictions modified while this tunnel
-                    // is open will be taken into account
-                    this.user.set(userService.retrieveUser(
-                        modeledAuthenticatedUser.getAuthenticationProvider(),
-                        modeledAuthenticatedUser));
-                }
-
-                // If an error occurs while trying to fetch the updated user,
-                // log the warning / exception and stop the refresh thread
-                catch (GuacamoleException e) {
-
-                    logger.warn(
-                            "Aborting user refresh thread due to error: {}",
-                            e.getMessage());
-                    logger.debug(
-                            "Exception caught while attempting to refresh user.", e);
-
-                    return;
-                }
-
-                try {
-
-                    // Wait a bit before refreshing the user record again
-                    Thread.sleep(USER_MODEL_REFRESH_INTERVAL);
-                }
-
-                // If interrupted by the tunnel, exit immediately
-                catch (InterruptedException e) {
-                    return;
-                }
-            }
-        });
-    }
-
-    @Override
-    public GuacamoleReader acquireReader() {
-
-        // Start periodically refreshing the user record
-        userRefreshThread.start();
-
-        // Filter received instructions, checking if the user's login
-        // is still valid for each one. If the login is invalid,
-        // log them out immediately and close the tunnel.
-        return new FilteredGuacamoleReader(
-            super.acquireReader(),
-            new GuacamoleFilter() {
-
-                @Override
-                public GuacamoleInstruction filter(
-                        GuacamoleInstruction instruction) throws GuacamoleException {
-
-                    // The user record, at most USER_MODEL_REFRESH_INTERVAL
-                    // milliseconds old
-                    ModeledUser modeledUser = user.get();
-
-                    // If the user is outside of a valid access time window,
-                    // or disabled, throw an exception to immediately log them out
-                    if (
-                            !modeledUser.isAccountAccessible()
-                            || !modeledUser.isAccountValid()
-                            || modeledUser.isDisabled()
-                    ) {
-                        throw new GuacamoleUnauthorizedException("Permission Denied.");
-                    }
-
-                    return instruction;
-                }
-            }
-        );
-    }
-
-    @Override
-    public void releaseReader() {
-
-        // Interrupt the refresh thread; it will clean itself up
-        userRefreshThread.interrupt();
-
-        super.releaseReader();
-    }
-
-    @Override
-    public void close() throws GuacamoleException {
-
-        // Interrupt the refresh thread; it will clean itself up
-        userRefreshThread.interrupt();
-
-        super.close();
-    }
-
-}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnelFactory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnelFactory.java
deleted file mode 100644
index 0c6350766..000000000
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AccessEnforcingDelegatingTunnelFactory.java
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.jdbc.tunnel;
-
-import javax.annotation.Nonnull;
-
-import org.apache.guacamole.auth.jdbc.user.ModeledAuthenticatedUser;
-import org.apache.guacamole.net.GuacamoleTunnel;
-
-/**
- * A factory for creating AccessEnforcingDelegatingTunnel instances.
- */
-public interface AccessEnforcingDelegatingTunnelFactory {
-
-    /**
-     * Create and return a new AccessEnforcingDelegatingTunnel wrapping the
-     * provided tunnel and enforcing the user restrictions associated with the
-     * provided user.
-     *
-     * @param tunnel
-     *     The tunnel to delegate to.
-     *
-     * @param user
-     *     The user whose access window restrictions should be applied for the
-     *     wrapped tunel.
-     *
-     * @return
-     *     A new AccessEnforcingDelegatingTunnel wrapping the provided tunnel
-     *     and enforcing the user restrictions associated with the provided
-     *     user.
-     *
-     */
-    public AccessEnforcingDelegatingTunnel create(
-            @Nonnull GuacamoleTunnel tunnel,
-            @Nonnull ModeledAuthenticatedUser user);
-
-}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/ActiveConnectionRecord.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/ActiveConnectionRecord.java
index df25159a9..c3150ca97 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/ActiveConnectionRecord.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/ActiveConnectionRecord.java
@@ -21,9 +21,6 @@ package org.apache.guacamole.auth.jdbc.tunnel;
 
 import java.util.Date;
 import java.util.UUID;
-
-import javax.annotation.Nonnull;
-
 import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordModel;
 import org.apache.guacamole.auth.jdbc.connection.ModeledConnection;
 import org.apache.guacamole.auth.jdbc.connection.ModeledConnectionRecord;
@@ -380,8 +377,6 @@ public class ActiveConnectionRecord extends ModeledConnectionRecord {
      * @return
      *     The newly-created tunnel associated with this connection record.
      */
-    @Nonnull
-    @SuppressWarnings("null")
     public GuacamoleTunnel assignGuacamoleTunnel(final GuacamoleSocket socket,
             String connectionID) {
 
@@ -405,8 +400,6 @@ public class ActiveConnectionRecord extends ModeledConnectionRecord {
             this.connectionID = connectionID;
 
         // Return newly-created tunnel
-        // NOTE: Guaranteed to be non-null since it was just set in this
-        // method, and there is no functionality to set it to null
         return this.tunnel;
         
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUserContext.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUserContext.java
index 1416b0b39..e5ad5d2ea 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUserContext.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUserContext.java
@@ -29,6 +29,7 @@ import java.util.Collection;
 import java.util.Date;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.auth.jdbc.base.RestrictedObject;
+import org.apache.guacamole.auth.jdbc.JDBCEnvironment;
 import org.apache.guacamole.auth.jdbc.activeconnection.ActiveConnectionDirectory;
 import org.apache.guacamole.auth.jdbc.base.ActivityRecordModel;
 import org.apache.guacamole.auth.jdbc.connection.ConnectionRecordSet;
@@ -50,6 +51,8 @@ import org.apache.guacamole.net.auth.SharingProfile;
 import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.net.auth.UserContext;
 import org.apache.guacamole.net.auth.UserGroup;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * UserContext implementation which is driven by an arbitrary, underlying
@@ -58,6 +61,11 @@ import org.apache.guacamole.net.auth.UserGroup;
 public class ModeledUserContext extends RestrictedObject
     implements org.apache.guacamole.net.auth.UserContext {
 
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(ModeledUserContext.class);
+
     /**
      * User directory restricted by the permissions of the user associated
      * with this context.
@@ -130,6 +138,12 @@ public class ModeledUserContext extends RestrictedObject
     @Inject
     private UserRecordMapper userRecordMapper;
 
+    /**
+     * The environment of the Guacamole server.
+     */
+    @Inject
+    private JDBCEnvironment environment;
+
     /**
      * The activity record associated with this user's Guacamole session. If
      * this user's session will not have an associated activity record, such as
@@ -296,4 +310,31 @@ public class ModeledUserContext extends RestrictedObject
 
     }
 
+    @Override
+    public boolean isValid() {
+
+        try {
+            // If access window enforcement is disabled for active sessions,
+            // skip validity checks entirely
+            if (!environment.enforceAccessWindowsForActiveSessions())
+                return true;
+        }
+
+        catch (GuacamoleException e) {
+
+            logger.warn(
+                    "Unable to determine if access window enforcement is"
+                    + " enabled for active sessions; enforcing by default: {}"
+                    , e.getMessage());
+            logger.debug("Unable to determine access window enforcement policy.", e);
+
+        }
+
+        // A user context is valid if the associated user's account is valid
+        // for the current date, and the user is within an access time window
+        ModeledUser user = getCurrentUser().getUser();
+        return user.isAccountValid() && user.isAccountAccessible();
+
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java
index db8bea12f..dffd8e2ec 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java
@@ -45,14 +45,12 @@ public class UserDirectory extends RestrictedObject
 
     @Override
     public User get(String identifier) throws GuacamoleException {
-        validateUserAccess();
         return userService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     @Transactional
     public Collection<User> getAll(Collection<String> identifiers) throws GuacamoleException {
-        validateUserAccess();
         Collection<ModeledUser> objects = userService.retrieveObjects(getCurrentUser(), identifiers);
         return Collections.<User>unmodifiableCollection(objects);
     }
@@ -60,21 +58,18 @@ public class UserDirectory extends RestrictedObject
     @Override
     @Transactional
     public Set<String> getIdentifiers() throws GuacamoleException {
-        validateUserAccess();
         return userService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     @Transactional
     public void add(User object) throws GuacamoleException {
-        validateUserAccess();
         userService.createObject(getCurrentUser(), object);
     }
 
     @Override
     @Transactional
     public void update(User object) throws GuacamoleException {
-        validateUserAccess();
         ModeledUser user = (ModeledUser) object;
         userService.updateObject(getCurrentUser(), user);
     }
@@ -82,7 +77,6 @@ public class UserDirectory extends RestrictedObject
     @Override
     @Transactional
     public void remove(String identifier) throws GuacamoleException {
-        validateUserAccess();
         userService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java
index f61af0bea..911b8521f 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java
@@ -44,14 +44,12 @@ public class UserGroupDirectory extends RestrictedObject
 
     @Override
     public UserGroup get(String identifier) throws GuacamoleException {
-        validateUserAccess();
         return userGroupService.retrieveObject(getCurrentUser(), identifier);
     }
 
     @Override
     @Transactional
     public Collection<UserGroup> getAll(Collection<String> identifiers) throws GuacamoleException {
-        validateUserAccess();
         Collection<ModeledUserGroup> objects = userGroupService.retrieveObjects(getCurrentUser(), identifiers);
         return Collections.<UserGroup>unmodifiableCollection(objects);
     }
@@ -59,21 +57,18 @@ public class UserGroupDirectory extends RestrictedObject
     @Override
     @Transactional
     public Set<String> getIdentifiers() throws GuacamoleException {
-        validateUserAccess();
         return userGroupService.getIdentifiers(getCurrentUser());
     }
 
     @Override
     @Transactional
     public void add(UserGroup object) throws GuacamoleException {
-        validateUserAccess();
         userGroupService.createObject(getCurrentUser(), object);
     }
 
     @Override
     @Transactional
     public void update(UserGroup object) throws GuacamoleException {
-        validateUserAccess();
         ModeledUserGroup group = (ModeledUserGroup) object;
         userGroupService.updateObject(getCurrentUser(), group);
     }
@@ -81,7 +76,6 @@ public class UserGroupDirectory extends RestrictedObject
     @Override
     @Transactional
     public void remove(String identifier) throws GuacamoleException {
-        validateUserAccess();
         userGroupService.deleteObject(getCurrentUser(), identifier);
     }
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
index c676feaad..ca17757a4 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
@@ -281,7 +281,7 @@ public class MySQLGuacamoleProperties {
     /**
      * Whether or not user-specific access time windows should be enforced for active sessions,
      * i.e. whether users with active sessions should be logged out immediately when an access
-     * window closes or the user is disabled.
+     * window closes.
      */
     public static final BooleanGuacamoleProperty MYSQL_ENFORCE_ACCESS_WINDOWS_FOR_ACTIVE_SESSIONS =
             new BooleanGuacamoleProperty() {
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
index 636c0a1c7..3f33ec44f 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
@@ -293,7 +293,7 @@ public class PostgreSQLGuacamoleProperties {
     /**
      * Whether or not user-specific access time windows should be enforced for active sessions,
      * i.e. whether users with active sessions should be logged out immediately when an access
-     * window closes or the user is disabled.
+     * window closes.
      */
     public static final BooleanGuacamoleProperty POSTGRESQL_ENFORCE_ACCESS_WINDOWS_FOR_ACTIVE_SESSIONS =
             new BooleanGuacamoleProperty() {
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
index e7b1c6982..1f2500350 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
@@ -223,7 +223,7 @@ public class SQLServerGuacamoleProperties {
     /**
      * Whether or not user-specific access time windows should be enforced for active sessions,
      * i.e. whether users with active sessions should be logged out immediately when an access
-     * window closes or the user is disabled.
+     * window closes.
      */
     public static final BooleanGuacamoleProperty SQLSERVER_ENFORCE_ACCESS_WINDOWS_FOR_ACTIVE_SESSIONS =
             new BooleanGuacamoleProperty() {
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserContext.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserContext.java
index 4b0343181..7431fa899 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserContext.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserContext.java
@@ -162,4 +162,9 @@ public class DelegatingUserContext implements UserContext {
         return userContext.getPrivileged();
     }
 
+    @Override
+    public boolean isValid() {
+        return userContext.isValid();
+    }
+
 }
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserContext.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserContext.java
index 3f75b899c..a9ea7ea0c 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserContext.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserContext.java
@@ -40,6 +40,27 @@ public interface UserContext {
      */
     User self();
 
+    /**
+     * Returns true if the session for the User associated with this user
+     * context is valid, or false otherwise. If the session is not valid,
+     * the webapp can be expected to terminate the session within a short
+     * period of time.
+     *
+     * NOTE: The webapp currently checks once a minute, and terminates any
+     * session marked as invalid.
+     *
+     * @return
+     *     true if the session for the User associated with this user
+     *     context is valid, or false otherwise.
+     */
+    default boolean isValid() {
+
+        // A user context is always valid unless explicitly updated by an
+        // implementation
+        return true;
+
+    }
+
     /**
      * Returns an arbitrary REST resource representing this UserContext. The
      * REST resource returned must be properly annotated with JSR-311
diff --git a/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java b/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java
index 3e8d488c3..0458639d1 100644
--- a/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java
+++ b/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java
@@ -132,6 +132,22 @@ public class GuacamoleSession {
         return Collections.unmodifiableList(userContexts);
     }
 
+    /**
+     * Returns true if all user contexts associated with this session are
+     * valid, or false if any user context is not valid. If a session is not
+     * valid, it may no longer be used, and invalidate() should be invoked.
+     *
+     * @return
+     *     true if all user contexts associated with this session are
+     *     valid, or false if any user context is not valid.
+     */
+    public boolean isValid() {
+
+        // Immediately return false if any user context is not valid
+        return !userContexts.stream().anyMatch(
+                userContext -> !userContext.isValid());
+    }
+
     /**
      * Returns the UserContext associated with this session that originated
      * from the AuthenticationProvider with the given identifier. If no such
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
index 24f653098..15d11eb62 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
@@ -94,7 +94,8 @@ public class HashTokenSessionMap implements TokenSessionMap {
 
     /**
      * Task which iterates through all active sessions, evicting those sessions
-     * which are beyond the session timeout.
+     * which are beyond the session timeout, or are marked as invalid by an
+     * extension.
      */
     private class SessionEvictionTask implements Runnable {
 
@@ -105,7 +106,8 @@ public class HashTokenSessionMap implements TokenSessionMap {
 
         /**
          * Creates a new task which automatically evicts sessions which are
-         * older than the specified timeout.
+         * older than the specified timeout, or are marked as invalid by an
+         * extension.
          * 
          * @param sessionTimeout The maximum age of any session, in
          *                       milliseconds.
@@ -116,16 +118,16 @@ public class HashTokenSessionMap implements TokenSessionMap {
 
         /**
          * Iterates through all active sessions, evicting those sessions which
-         * are beyond the session timeout. Internal errors which would
-         * otherwise stop the session eviction process are caught, logged, and
-         * the process is allowed to proceed.
+         * are beyond the session timeout, or are marked as invalid. Internal
+         * errors which would otherwise stop the session eviction process are
+         * caught, logged, and the process is allowed to proceed.
          */
-        private void evictExpiredSessions() {
+        private void evictExpiredOrInvalidSessions() {
 
             // Get start time of session check time
             long sessionCheckStart = System.currentTimeMillis();
 
-            logger.debug("Checking for expired sessions...");
+            logger.debug("Checking for expired or invalid sessions...");
 
             // For each session, remove sesions which have expired
             Iterator<Map.Entry<String, GuacamoleSession>> entries = sessionMap.entrySet().iterator();
@@ -136,6 +138,15 @@ public class HashTokenSessionMap implements TokenSessionMap {
 
                 try {
 
+                    // Invalidate any sessions which have been flagged as invalid by extensions
+                    if (!session.isValid()) {
+                        logger.debug(
+                                "Session \"{}\" has been invalidated by an extension.",
+                                entry.getKey());
+                        entries.remove();
+                        session.invalidate();
+                    }
+
                     // Do not expire sessions which are active
                     if (session.hasTunnels())
                         continue;
@@ -170,13 +181,13 @@ public class HashTokenSessionMap implements TokenSessionMap {
         @Override
         public void run() {
 
-            // The evictExpiredSessions() function should already
+            // The evictExpiredOrInvalidSessions() function should already
             // automatically handle and log all unexpected internal errors,
             // but wrap the entire call in a try/catch plus additional logging
             // to ensure that absolutely no errors can result in the entire
             // thread dying
             try {
-                evictExpiredSessions();
+                evictExpiredOrInvalidSessions();
             }
             catch (Throwable t) {
                 logger.error("An unexpected internal error prevented the "

From bb5aea96f133c6dbe8589b92c1d383b9bef676fa Mon Sep 17 00:00:00 2001
From: Alex Leitner <leitnersalex@gmail.com>
Date: Wed, 28 Dec 2022 20:15:26 +0000
Subject: [PATCH 102/289] GUACAMOLE-1728: Allow Null User Object attributes to
 be saved.

---
 .../guacamole/rest/directory/DirectoryObjectTranslator.java  | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectTranslator.java
index f3fe75564..b8af563a5 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryObjectTranslator.java
@@ -145,8 +145,9 @@ public abstract class DirectoryObjectTranslator<InternalType extends Identifiabl
                 String attributeValue = attributes.get(attributeName);
 
                 // Include attribute value within filtered map only if
-                // (1) defined and (2) present within provided map
-                if (attributeValue != null)
+                // defined or present within provided map
+                if (attributeValue != null || 
+                        attributes.containsKey(attributeName))
                     filtered.put(attributeName, attributeValue);
 
             }

From c375e6fcee2882001e79e6c457702f7cfef25a36 Mon Sep 17 00:00:00 2001
From: jbochenski <test123@test123.pl>
Date: Wed, 4 Jan 2023 15:32:34 +0100
Subject: [PATCH 103/289] GUACAMOLE-1730: Add polish translation.

---
 .../src/main/resources/guac-manifest.json     |    3 +-
 .../src/main/resources/translations/pl.json   |    5 +
 .../src/main/resources/guac-manifest.json     |    1 +
 .../src/main/resources/translations/pl.json   |   13 +
 .../src/main/resources/translations/pl.json   |  113 ++
 .../src/main/resources/guac-manifest.json     |    1 +
 .../src/main/resources/guac-manifest.json     |    1 +
 .../src/main/resources/guac-manifest.json     |    1 +
 .../src/main/resources/guac-manifest.json     |    1 +
 .../src/main/resources/translations/pl.json   |   18 +
 .../src/main/resources/translations/pl.json   |   26 +
 .../src/main/resources/guac-manifest.json     |    1 +
 .../src/main/resources/guac-manifest.json     |    1 +
 .../src/main/resources/guac-manifest.json     |    1 +
 .../src/main/resources/guac-manifest.json     |    1 +
 .../src/main/resources/translations/pl.json   |   43 +
 .../src/main/resources/guac-manifest.json     |    1 +
 .../src/main/resources/translations/pl.json   |   14 +
 .../main/frontend/src/translations/pl.json    | 1051 +++++++++++++++++
 19 files changed, 1295 insertions(+), 1 deletion(-)
 create mode 100644 extensions/guacamole-auth-ban/src/main/resources/translations/pl.json
 create mode 100644 extensions/guacamole-auth-duo/src/main/resources/translations/pl.json
 create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pl.json
 create mode 100644 extensions/guacamole-auth-quickconnect/src/main/resources/translations/pl.json
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/pl.json
 create mode 100644 extensions/guacamole-auth-totp/src/main/resources/translations/pl.json
 create mode 100644 extensions/guacamole-history-recording-storage/src/main/resources/translations/pl.json
 create mode 100644 guacamole/src/main/frontend/src/translations/pl.json

diff --git a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
index 0133a7364..2acdb0efd 100644
--- a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
@@ -10,7 +10,8 @@
     ],
 
     "translations" : [
-        "translations/en.json"
+        "translations/en.json",
+        "translations/pl.json"
     ]
 
 }
diff --git a/extensions/guacamole-auth-ban/src/main/resources/translations/pl.json b/extensions/guacamole-auth-ban/src/main/resources/translations/pl.json
new file mode 100644
index 000000000..0ba1f80c5
--- /dev/null
+++ b/extensions/guacamole-auth-ban/src/main/resources/translations/pl.json
@@ -0,0 +1,5 @@
+{
+    "LOGIN": {
+        "ERROR_TOO_MANY_ATTEMPTS" : "Zbyt wiele nieudanych prób logowania. Spróbuj ponownie później."
+    }
+}
diff --git a/extensions/guacamole-auth-duo/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-duo/src/main/resources/guac-manifest.json
index fe1043a63..45a278248 100644
--- a/extensions/guacamole-auth-duo/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-duo/src/main/resources/guac-manifest.json
@@ -16,6 +16,7 @@
         "translations/fr.json",
         "translations/ja.json",
         "translations/ko.json",
+        "translations/pl.json",
         "translations/pt.json",
         "translations/ru.json",
         "translations/zh.json"
diff --git a/extensions/guacamole-auth-duo/src/main/resources/translations/pl.json b/extensions/guacamole-auth-duo/src/main/resources/translations/pl.json
new file mode 100644
index 000000000..dd4d3b88a
--- /dev/null
+++ b/extensions/guacamole-auth-duo/src/main/resources/translations/pl.json
@@ -0,0 +1,13 @@
+{
+
+    "DATA_SOURCE_DUO" : {
+        "NAME" : "Duo TFA Backend"
+    },
+
+    "LOGIN" : {
+        "FIELD_HEADER_GUAC_DUO_SIGNED_RESPONSE" : "",
+        "INFO_DUO_VALIDATION_CODE_INCORRECT"    : "Nieprawidłowy kod weryfikacyjny Duo.",
+        "INFO_DUO_AUTH_REQUIRED"                : "Aby kontynuować uwierzytelnij się w Duo."
+    }
+
+}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pl.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pl.json
new file mode 100644
index 000000000..8c31932aa
--- /dev/null
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pl.json
@@ -0,0 +1,113 @@
+{
+
+    "LOGIN" : {
+
+        "ERROR_PASSWORD_BLANK"    : "@:APP.ERROR_PASSWORD_BLANK",
+        "ERROR_PASSWORD_SAME"     : "Nowe hasło musi być inne od tego, które wygasło.",
+        "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
+        "ERROR_NOT_VALID"         : "To konto użytkownika nie jest poprawne.",
+        "ERROR_NOT_ACCESSIBLE"    : "Dostęp do tego konta jest obecnie zablokowany. Spróbuj ponownie później.",
+
+        "INFO_PASSWORD_EXPIRED" : "Twoje hasło wygasło i należy je zresetować. Wprowadź nowe hasło, aby kontynuować.",
+
+        "FIELD_HEADER_NEW_PASSWORD"         : "Nowe hasło",
+        "FIELD_HEADER_CONFIRM_NEW_PASSWORD" : "Potwierdź nowe hasło"
+
+    },
+
+    "CONNECTION_ATTRIBUTES" : {
+
+        "FIELD_HEADER_MAX_CONNECTIONS"          : "Maksymalna liczba połączeń:",
+        "FIELD_HEADER_MAX_CONNECTIONS_PER_USER" : "Maksymalna liczba połączeń dla jednego użytkownika:",
+
+        "FIELD_HEADER_FAILOVER_ONLY"            : "Używaj tylko do przełączania awaryjnego:",
+        "FIELD_HEADER_WEIGHT"                   : "Waga połączenia:",
+
+        "FIELD_HEADER_GUACD_HOSTNAME"   : "Nazwa Hosta:",
+        "FIELD_HEADER_GUACD_ENCRYPTION" : "Szyfrowanie:",
+        "FIELD_HEADER_GUACD_PORT"       : "Port:",
+
+        "FIELD_OPTION_GUACD_ENCRYPTION_EMPTY" : "",
+        "FIELD_OPTION_GUACD_ENCRYPTION_NONE"  : "Brak (nieszyfrowane)",
+        "FIELD_OPTION_GUACD_ENCRYPTION_SSL"   : "SSL / TLS",
+
+        "SECTION_HEADER_CONCURRENCY"    : "Limity Jednoczesnych Połączeń",
+        "SECTION_HEADER_LOAD_BALANCING" : "Równoważenie Obciążenia",
+        "SECTION_HEADER_GUACD"          : "Parametry Guacamole Proxy (guacd)"
+
+    },
+
+    "CONNECTION_GROUP_ATTRIBUTES" : {
+
+        "FIELD_HEADER_ENABLE_SESSION_AFFINITY"  : "Włącz powiązanie sesji:",
+        "FIELD_HEADER_MAX_CONNECTIONS"          : "Maksymalna liczba połączeń:",
+        "FIELD_HEADER_MAX_CONNECTIONS_PER_USER" : "Maksymalna liczba połączeń dla jednego użytkownika:",
+
+        "SECTION_HEADER_CONCURRENCY" : "Limity Jednoczesnych Połączeń (Grupy Równoważenia Obciążenia)"
+
+    },
+
+    "DATA_SOURCE_MYSQL" : {
+        "NAME" : "MySQL"
+    },
+
+    "DATA_SOURCE_MYSQL_SHARED" : {
+        "NAME" : "Współdzielone połączenia (MySQL)"
+    },
+
+    "DATA_SOURCE_POSTGRESQL" : {
+        "NAME" : "PostgreSQL"
+    },
+
+    "DATA_SOURCE_POSTGRESQL_SHARED" : {
+        "NAME" : "Współdzielone połączenia (PostgreSQL)"
+    },
+
+    "DATA_SOURCE_SQLSERVER" : {
+        "NAME" : "SQL Server"
+    },
+
+    "DATA_SOURCE_SQLSERVER_SHARED" : {
+        "NAME" : "Współdzielone połączenia (SQL Server)"
+    },
+
+    "HOME" : {
+        "INFO_SHARED_BY" : "Współdzielone przez {USERNAME}"
+    },
+
+    "PASSWORD_POLICY" : {
+
+        "ERROR_CONTAINS_USERNAME"      : "Hasła nie mogą zawierać nazwy użytkownika.",
+        "ERROR_REQUIRES_DIGIT"         : "Hasła muszą zawierać przynajmniej jedną cyfrę.",
+        "ERROR_REQUIRES_MULTIPLE_CASE" : "Hasła muszą zawierać zarówno wielkie, jak i małe litery.",
+        "ERROR_REQUIRES_NON_ALNUM"     : "Hasła muszą zawierać co najmniej jeden znak specjalny.",
+        "ERROR_REUSED"                 : "To hasło zostało już użyte. Nie można ponownie użyć żadnego z poprzednich {HISTORY_SIZE} {HISTORY_SIZE, plural, one{hasła} other{haseł}}.",
+        "ERROR_TOO_SHORT"              : "Hasło musi mieć co najmniej {LENGTH} {LENGTH, plural, one{znak} other{znaków}} długości.",
+        "ERROR_TOO_YOUNG"              : "Hasło do tego konta zostało już zresetowane. Poczekać przynajmniej {WAIT} {WAIT, plural, one{dzień} other{dni}} dłużej przed ponowną zmianą hasła."
+
+    },
+
+    "USER_ATTRIBUTES" : {
+
+        "FIELD_HEADER_DISABLED"            : "Logowanie zablokowane:",
+        "FIELD_HEADER_EXPIRED"             : "Hasło wygasło:",
+        "FIELD_HEADER_ACCESS_WINDOW_END"   : "Nie zezwalaj na dostęp po:",
+        "FIELD_HEADER_ACCESS_WINDOW_START" : "Zezwalaj na dostęp od:",
+        "FIELD_HEADER_TIMEZONE"            : "Strefa czasowa użytkownika:",
+        "FIELD_HEADER_VALID_FROM"          : "Włącz konto od:",
+        "FIELD_HEADER_VALID_UNTIL"         : "Wyłącz konto po:",
+
+        "SECTION_HEADER_RESTRICTIONS" : "Ograniczenia Konta",
+        "SECTION_HEADER_PROFILE"      : "Profil"
+
+    },
+
+    "USER_GROUP_ATTRIBUTES" : {
+
+        "FIELD_HEADER_DISABLED" : "Wyłączona:",
+
+        "SECTION_HEADER_RESTRICTIONS" : "Ograniczenia Grupy"
+
+    }
+
+}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json
index 28f35a96b..eab708f56 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/guac-manifest.json
@@ -26,6 +26,7 @@
         "translations/fr.json",
         "translations/ja.json",
         "translations/ko.json",
+        "translations/pl.json",
         "translations/pt.json",
         "translations/ru.json",
         "translations/zh.json"
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json
index 00e052a8e..49d4be358 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/guac-manifest.json
@@ -26,6 +26,7 @@
         "translations/fr.json",
         "translations/ja.json",
         "translations/ko.json",
+        "translations/pl.json",
         "translations/pt.json",
         "translations/ru.json",
         "translations/zh.json"
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/resources/guac-manifest.json
index 860b66837..0ac4016fc 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/resources/guac-manifest.json
@@ -26,6 +26,7 @@
         "translations/fr.json",
         "translations/ja.json",
         "translations/ko.json",
+        "translations/pl.json",
         "translations/pt.json",
         "translations/ru.json",
         "translations/zh.json"
diff --git a/extensions/guacamole-auth-quickconnect/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-quickconnect/src/main/resources/guac-manifest.json
index b61baae1c..3c8f9b744 100644
--- a/extensions/guacamole-auth-quickconnect/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-quickconnect/src/main/resources/guac-manifest.json
@@ -27,6 +27,7 @@
         "translations/fr.json",
         "translations/ja.json",
         "translations/ko.json",
+        "translations/pl.json",
         "translations/pt.json",
         "translations/ru.json",
         "translations/zh.json"
diff --git a/extensions/guacamole-auth-quickconnect/src/main/resources/translations/pl.json b/extensions/guacamole-auth-quickconnect/src/main/resources/translations/pl.json
new file mode 100644
index 000000000..e213f94b6
--- /dev/null
+++ b/extensions/guacamole-auth-quickconnect/src/main/resources/translations/pl.json
@@ -0,0 +1,18 @@
+{
+
+    "DATA_SOURCE_QUICKCONNECT" : {
+        "NAME" : "QuickConnect"
+    },
+
+    "QUICKCONNECT" : {
+        "ACTION_CONNECT"        : "Połącz",
+        
+        "ERROR_INVALID_URI"      : "Podano nieprawidłowy URI",
+        "ERROR_NO_HOST"          : "Nie podano hosta",
+        "ERROR_NO_PROTOCOL"      : "Nie podano protokołu",
+        "ERROR_NOT_ABSOLUTE_URI" : "Adres URI nie jest absolutny",
+        
+        "FIELD_PLACEHOLDER_URI" : "Podaj URI Połączenia"
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/pl.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/pl.json
new file mode 100644
index 000000000..9e391ecf9
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/pl.json
@@ -0,0 +1,26 @@
+{
+
+    "DATA_SOURCE_CAS" : {
+        "NAME" : "CAS SSO Backend"
+    },
+
+    "DATA_SOURCE_OPENID" : {
+        "NAME" : "OpenID SSO Backend"
+    },
+
+    "DATA_SOURCE_SAML" : {
+        "NAME" : "SAML SSO Backend"
+    },
+
+    "LOGIN" : {
+        "FIELD_HEADER_ID_TOKEN"      : "",
+        "FIELD_HEADER_STATE"         : "",
+        "FIELD_HEADER_TICKET"        : "",
+        "INFO_IDP_REDIRECT_PENDING"  : "Proszę czekać, przekierowanie do dostawcy tożsamości...",
+        "NAME_IDP_CAS"               : "CAS",
+        "NAME_IDP_OPENID"            : "OpenID",
+        "NAME_IDP_SAML"              : "SAML",
+        "SECTION_HEADER_SSO_OPTIONS" : "Zaloguj z:"
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/resources/guac-manifest.json
index aec7870a9..b663659aa 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/resources/guac-manifest.json
@@ -25,6 +25,7 @@
         "translations/fr.json",
         "translations/ja.json",
         "translations/ko.json",
+        "translations/pl.json",
         "translations/pt.json",
         "translations/ru.json",
         "translations/zh.json"
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/guac-manifest.json
index 1b7a2a162..1cd83739f 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/guac-manifest.json
@@ -25,6 +25,7 @@
         "translations/fr.json",
         "translations/ja.json",
         "translations/ko.json",
+        "translations/pl.json",
         "translations/pt.json",
         "translations/ru.json",
         "translations/zh.json"
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json
index 10e1c74aa..67e56cf57 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json
@@ -25,6 +25,7 @@
         "translations/fr.json",
         "translations/ja.json",
         "translations/ko.json",
+        "translations/pl.json",
         "translations/pt.json",
         "translations/ru.json",
         "translations/zh.json"
diff --git a/extensions/guacamole-auth-totp/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-totp/src/main/resources/guac-manifest.json
index 6bb04ff2b..5b5e5f191 100644
--- a/extensions/guacamole-auth-totp/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-totp/src/main/resources/guac-manifest.json
@@ -16,6 +16,7 @@
         "translations/fr.json",
         "translations/ja.json",
         "translations/ko.json",
+        "translations/pl.json",
         "translations/pt.json",
         "translations/ru.json",
         "translations/zh.json"
diff --git a/extensions/guacamole-auth-totp/src/main/resources/translations/pl.json b/extensions/guacamole-auth-totp/src/main/resources/translations/pl.json
new file mode 100644
index 000000000..208a1e8d4
--- /dev/null
+++ b/extensions/guacamole-auth-totp/src/main/resources/translations/pl.json
@@ -0,0 +1,43 @@
+{
+
+    "DATA_SOURCE_TOTP" : {
+        "NAME" : "TOTP TFA Backend"
+    },
+
+    "LOGIN" : {
+        "FIELD_HEADER_GUAC_TOTP" : ""
+    },
+
+    "TOTP" : {
+
+        "ACTION_HIDE_DETAILS" : "Ukryj",
+        "ACTION_SHOW_DETAILS" : "Pokaż",
+
+        "FIELD_HEADER_ALGORITHM"  : "Algorytm:",
+        "FIELD_HEADER_DIGITS"     : "Cyfry:",
+        "FIELD_HEADER_INTERVAL"   : "Interwał:",
+        "FIELD_HEADER_SECRET_KEY" : "Sekretny klucz:",
+
+        "FIELD_PLACEHOLDER_CODE" : "Kod weryfikacyjny",
+
+        "INFO_CODE_REQUIRED"       : "Podaj kod weryfikacyjny, aby potwierdzić swoją tożsamość.",
+        "INFO_ENROLL_REQUIRED"     : "Uwierzytelnianie wieloskładnikowe zostało włączone na Twoim koncie.",
+        "INFO_VERIFICATION_FAILED" : "Weryfikacja nie powiodła się. Spróbuj ponownie.",
+
+        "HELP_ENROLL_BARCODE" : "Aby zakończyć proces rejestracji, zeskanuj poniższy kod kreskowy za pomocą aplikacji do uwierzytelniania dwuskładnikowego na swoim telefonie lub urządzeniu.",
+        "HELP_ENROLL_VERIFY"  : "Po zeskanowaniu kodu kreskowego, wprowadź {DIGITS}-cyfrowy kod weryfikacyjny aby potwierdzić, że proces rejestracji przebiegł pomyślnie.",
+
+        "SECTION_HEADER_DETAILS" : "Szczegóły:"
+
+    },
+    
+    "USER_ATTRIBUTES" : {
+        
+        "FIELD_HEADER_GUAC_TOTP_KEY_GENERATED" : "Wygenerowano klucz:",
+        "FIELD_HEADER_GUAC_TOTP_KEY_CONFIRMED" : "Potwierdzono urządzenie uwierzytelniające:",
+        
+        "SECTION_HEADER_TOTP_ENROLLMENT_STATUS" : "Status Rejestracji TOTP"
+        
+    }
+
+}
diff --git a/extensions/guacamole-history-recording-storage/src/main/resources/guac-manifest.json b/extensions/guacamole-history-recording-storage/src/main/resources/guac-manifest.json
index 51422359d..943e6597c 100644
--- a/extensions/guacamole-history-recording-storage/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-history-recording-storage/src/main/resources/guac-manifest.json
@@ -11,6 +11,7 @@
 
     "translations" : [
         "translations/en.json"
+        "translations/pl.json"
     ]
 
 }
diff --git a/extensions/guacamole-history-recording-storage/src/main/resources/translations/pl.json b/extensions/guacamole-history-recording-storage/src/main/resources/translations/pl.json
new file mode 100644
index 000000000..fc8f63f4a
--- /dev/null
+++ b/extensions/guacamole-history-recording-storage/src/main/resources/translations/pl.json
@@ -0,0 +1,14 @@
+{
+
+    "DATA_SOURCE_RECORDING_STORAGE" : {
+        "NAME" : "Session Recording Storage"
+    },
+
+    "RECORDING_STORAGE" : {
+        "INFO_GUACAMOLE_SESSION_RECORDING" :  "Graficzne nagranie sesji zdalnego pulpitu",
+        "INFO_SERVER_LOG" :  "Serwer/system log",
+        "INFO_TYPESCRIPT" :  "Tesktowe nagranie sesji",
+        "INFO_TYPESCRIPT_TIMING" :  "Informacje o czasie dla tesktowego nagrania sesji"
+    }
+
+}
diff --git a/guacamole/src/main/frontend/src/translations/pl.json b/guacamole/src/main/frontend/src/translations/pl.json
new file mode 100644
index 000000000..00afb3e70
--- /dev/null
+++ b/guacamole/src/main/frontend/src/translations/pl.json
@@ -0,0 +1,1051 @@
+{
+
+    "NAME" : "Polski",
+
+    "APP" : {
+
+        "NAME"    : "Apache Guacamole",
+        "VERSION" : "${project.version}",
+
+        "ACTION_ACKNOWLEDGE"        : "OK",
+        "ACTION_CANCEL"             : "Anuluj",
+        "ACTION_CLONE"              : "Klonuj",
+        "ACTION_CONTINUE"           : "Kontynuuj",
+        "ACTION_DELETE"             : "Usuń",
+        "ACTION_DELETE_SESSIONS"    : "Zakończ Sesję",
+        "ACTION_DOWNLOAD"           : "Pobierz",
+        "ACTION_LOGIN"              : "Zaloguj",
+        "ACTION_LOGIN_AGAIN"        : "Zaloguj Ponownie",
+        "ACTION_LOGOUT"             : "Wyloguj",
+        "ACTION_MANAGE_CONNECTIONS" : "Połączenia",
+        "ACTION_MANAGE_PREFERENCES" : "Preferencje",
+        "ACTION_MANAGE_SETTINGS"    : "Ustawienia",
+        "ACTION_MANAGE_SESSIONS"    : "Aktywne Sesje",
+        "ACTION_MANAGE_USERS"       : "Użytkownicy",
+        "ACTION_MANAGE_USER_GROUPS" : "Grupy",
+        "ACTION_NAVIGATE_BACK"      : "Wstecz",
+        "ACTION_NAVIGATE_HOME"      : "Główna",
+        "ACTION_PAUSE"              : "Pauza",
+        "ACTION_PLAY"               : "Odtwórz",
+        "ACTION_SAVE"               : "Zapisz",
+        "ACTION_SEARCH"             : "Szukaj",
+        "ACTION_SHARE"              : "Udostępnij",
+        "ACTION_UPDATE_PASSWORD"    : "Zmień Hasło",
+        "ACTION_VIEW_HISTORY"       : "Historia",
+        "ACTION_VIEW_RECORDING"     : "Obejrzyj",
+
+        "DIALOG_HEADER_ERROR" : "Błąd",
+
+        "ERROR_PAGE_UNAVAILABLE"  : "Wystąpił błąd i ta akcja nie może zostać zakończona. Jeśli problem nie zniknie, powiadom administratora systemu.",
+        "ERROR_PASSWORD_BLANK"    : "Hasło nie może być puste.",
+        "ERROR_PASSWORD_MISMATCH" : "Podane hasła nie pasują do siebie.",
+
+        "FIELD_HEADER_PASSWORD"       : "Hasło:",
+        "FIELD_HEADER_PASSWORD_AGAIN" : "Powtórz Hasło:",
+
+        "FIELD_PLACEHOLDER_FILTER" : "Filtruj",
+
+        "FORMAT_DATE_TIME_PRECISE" : "yyyy-MM-dd HH:mm:ss",
+
+        "INFO_ACTIVE_USER_COUNT" : "Aktualnie w użyciu przez {USERS} {USERS, plural, one{użytkownika} other{użytkowników}}.",
+        "INFO_LOGGED_OUT"        : "Zostałeś wylogowany.",
+
+        "TEXT_ANONYMOUS_USER"   : "Anonimowy",
+        "TEXT_HISTORY_DURATION" : "{VALUE} {UNIT, select, second{{VALUE, plural, one{sekunda} other{sekund(-y)}}} minute{{VALUE, plural, one{minuta} other{minut(y)}}} hour{{VALUE, plural, one{godzina} other{godzin(y)}}} day{{VALUE, plural, one{dzień} other{dni}}} other{}}",
+        "TEXT_UNTRANSLATED" : "{MESSAGE}"
+
+    },
+
+    "CLIENT" : {
+
+        "ACTION_ACKNOWLEDGE"               : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CANCEL"                    : "@:APP.ACTION_CANCEL",
+        "ACTION_CLEAR_COMPLETED_TRANSFERS" : "Wyczyść",
+        "ACTION_CONTINUE"                  : "@:APP.ACTION_CONTINUE",
+        "ACTION_DISCONNECT"                : "Rozłącz",
+        "ACTION_LOGOUT"                    : "@:APP.ACTION_LOGOUT",
+        "ACTION_NAVIGATE_BACK"             : "@:APP.ACTION_NAVIGATE_BACK",
+        "ACTION_NAVIGATE_HOME"             : "@:APP.ACTION_NAVIGATE_HOME",
+        "ACTION_RECONNECT"                 : "Połącz Ponownie",
+        "ACTION_SAVE_FILE"                 : "@:APP.ACTION_SAVE",
+        "ACTION_SHARE"                     : "@:APP.ACTION_SHARE",
+        "ACTION_UPLOAD_FILES"              : "Wyślij Pliki",
+
+        "DIALOG_HEADER_CONNECTING"       : "Łączenie",
+        "DIALOG_HEADER_CONNECTION_ERROR" : "Błąd Połączenia",
+        "DIALOG_HEADER_DISCONNECTED"     : "Rozłączono",
+
+        "ERROR_CLIENT_201"     : "Połączenie zostało zamknięte, ponieważ serwer jest zajęty. Odczekaj kilka minut i spróbuj ponownie.",
+        "ERROR_CLIENT_202"     : "Serwer Guacamole zamknął połączenie, ponieważ zdalny pulpit nie odpowiada przez zbyt długi czas. Spróbuj ponownie lub skontaktuj się z administratorem.",
+        "ERROR_CLIENT_203"     : "Serwer zdalnego pulpitu napotkał błąd i zamknął połączenie. Spróbuj ponownie lub skontaktuj się z administratorem.",
+        "ERROR_CLIENT_207"     : "Serwer zdalnego pulpitu jest aktualnie nieosiągalny. Jeśli problem nie zniknie powiadom administratora systemu lub sprawdź log systemu.",
+        "ERROR_CLIENT_208"     : "Serwer zdalnego pulpitu jest aktualnie nieosiągalny. Jeśli problem nie zniknie powiadom administratora systemu lub sprawdź log systemu.",
+        "ERROR_CLIENT_209"     : "Serwer zdalnego pulpitu zamknął połączenie, ponieważ koliduje z innym połączeniem. Spróbuj ponownie później.",
+        "ERROR_CLIENT_20A"     : "Serwer zdalnego pulpitu zamknął połączenie, ponieważ wydaje się być nieaktywne. Jeśli nie jest to pożądane zachowanie powiadom administratora systemu lub sprawdź ustawienia.",
+        "ERROR_CLIENT_20B"     : "Serwer zdalnego pulpitu wymusił zamknięcie połączenia. Jeśli nie jest to pożądane zachowanie powiadom administratora systemu lub sprawdź log systemu.",
+        "ERROR_CLIENT_301"     : "Logowanie nieudane. Spróbuj ponownie.",
+        "ERROR_CLIENT_303"     : "Serwer zdalnego pulpitu nie zezwolił na połączenie. Poproś administratora systemu o nadanie uprawnień dla Twojego konta lub sprawdź ustawienia.",
+        "ERROR_CLIENT_308"     : "Serwer Guacamole zamknął połączenie, ponieważ nie otrzymał odpowiedzi od Twojej przeglądarki przez zbyt długi czas. Zazwyczaj jest to spowodowane niską szybkością i jakością połączenia. Sprawdź swoje ustawienia sieci i spróbuj ponownie.",
+        "ERROR_CLIENT_31D"     : "Serwer Guacamole nie zezwolił na połączenie, ponieważ wykorzystałeś limit jednoczesnych połączeń dla pojedynczego użytkownika. Zamknij jedno lub kilka połączeń i spróbuj ponownie.",
+        "ERROR_CLIENT_DEFAULT" : "Wystąpił błąd wewnętrzny serwera Guacamole i połączenie zostało zakończone. Jeśli problem nie zniknie, powiadom administratora systemu lub sprawdź log systemu.",
+
+        "ERROR_TUNNEL_201"     : "Serwer Guacamole odrzucił tę próbę połączenia, ponieważ istnieje zbyt wiele aktywnych połączeń. Poczekaj kilka minut i spróbuj ponownie.",
+        "ERROR_TUNNEL_202"     : "Połączenie zostało zamknięte, ponieważ serwer nie odpowiada przez zbyt długo czas. Zazwyczaj spowodowane jest to niską szybkością i jakością połączenia. Sprawdź swoje ustawienia sieci i spróbuj ponownie lub poinformuj administratora systemu.",
+        "ERROR_TUNNEL_203"     : "Serwer napotkał błąd i zamknął połączenie. Spróbuj ponownie lub skontaktuj się z administratorem systemu",
+        "ERROR_TUNNEL_204"     : "Żądane połączenie nie istnieje. Sprawdź nazwę połączenia i spróbuj ponownie",
+        "ERROR_TUNNEL_205"     : "To połączenie jest aktualnie w użyciu oraz jednoczesny dostęp dla tego połączenia nie jest dozwolony. Spróbuj ponownie później.",
+        "ERROR_TUNNEL_207"     : "Serwer Guacamole jest aktualnie nieosiągalny. Sprawdź swoją sieć i spróbuj ponownie.",
+        "ERROR_TUNNEL_208"     : "Serwer Guacamole nie akceptuje połączeń. Sprawdź swoją sieć i spróbuj ponownie.",
+        "ERROR_TUNNEL_301"     : "Nie masz dostępu do tego połączenia, ponieważ nie jesteś zalogowany. Zaloguj się i spróbuj ponownie.",
+        "ERROR_TUNNEL_303"     : "Nie masz uprawnień do tego połączenia. Jeśli potrzebujesz uprawnień poproś administratora systemu o dodanie Cię do listy użytkowników z zezwoleniem lub sprawdź ustawienia systemu. ",
+        "ERROR_TUNNEL_308"     : "Serwer Guacamole zamknął połączenie, ponieważ nie otrzymał odpowiedzi od Twojej przeglądarki przez zbyt długi czas. Zazwyczaj jest to spowodowane niską szybkością i jakością połączenia. Sprawdź swoje ustawienia sieci i spróbuj ponownie.",
+        "ERROR_TUNNEL_31D"     : "Serwer Guacamole nie zezwolił na połączenie, ponieważ wykorzystałeś limit jednoczesnych połączeń dla pojedynczego użytkownika. Zamknij jedno lub kilka połączeń i spróbuj ponownie.",
+        "ERROR_TUNNEL_DEFAULT" : "Wystąpił błąd wewnętrzny serwera Guacamole i połączenie zostało zakończone. Jeśli problem nie zniknie, powiadom administratora systemu lub sprawdź log systemu.",
+
+        "ERROR_UPLOAD_100"     : "Transfer plików jest nie wspierany lub wyłączony. Skontaktuj się z administratorem systemu lub sprawdź log systemu.",
+        "ERROR_UPLOAD_201"     : "Zbyt wiele plików jest aktualnie transferowanych. Poczekaj na zakończenie trwających transferów i spróbuj ponownie.",
+        "ERROR_UPLOAD_202"     : "Plik nie może zostać przesłany, ponieważ Serwer zdalnego pulpitu nie odpowiada przez zbyt długi czas. Spróbuj ponownie lub skontaktuj się z administratorem systemu",
+        "ERROR_UPLOAD_203"     : "Serwer zdalnego pulpitu napotkał na błąd podczas transferu. Spróbuj ponownie lub skontaktuj się z administratorem systemu",
+        "ERROR_UPLOAD_204"     : "Docelowa ścieżka transferu pliku nie istnieje. Upewnij się, że ścieżka docelowa istnieje i spróbuj ponownie.",
+        "ERROR_UPLOAD_205"     : "Lokalizacja docelowa dla transferu pliku jest aktualnie zablokowana. Poczekaj na zakończenie trwający zadań i spróbuj ponownie.",
+        "ERROR_UPLOAD_301"     : "Nie masz uprawnień do przesłania tego pliku, ponieważ jest nie zalogowany. Zaloguj się i spróbuj ponownie.",
+        "ERROR_UPLOAD_303"     : "Nie masz uprawnień do przesłania tego pliku. Jeśli potrzebujesz dostępu sprawdź ustawienia systemu lub skontaktuj się z administratorem systemu.",
+        "ERROR_UPLOAD_308"     : "Transfer pliku utknął w martwym punkcie. Zazwyczaj jest to spowodowane niską szybkością i jakością połączenia. Sprawdź swoje ustawienia sieci i spróbuj ponownie.",
+        "ERROR_UPLOAD_31D"     : "Zbyt wiele plików jest aktualnie transferowanych. Poczekaj na zakończenie trwających transferów i spróbuj ponownie.",
+        "ERROR_UPLOAD_DEFAULT" : "Wystąpił błąd wewnętrzny serwera Guacamole i połączenie zostało zakończone. Jeśli problem nie zniknie, powiadom administratora systemu lub sprawdź log systemu.",
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "HELP_CLIPBOARD"           : "Tekst skopiowany/wycięty wewnątrz serwera Guacamole pojawi się tutaj. Zmiany dokonane w tym miejscu będą miały wpływ na zawartość zdalnego schowka",
+        "HELP_INPUT_METHOD_NONE"   : "Żadna metoda wejścia nie jest w użyciu. Wejście klawiatury jest akceptowane z podłączonej fizycznej klawiatury.",
+        "HELP_INPUT_METHOD_OSK"    : "Wyświetl i zaakceptuj dane wejściowe z wbudowanej klawiatury ekranowej Guacamole. Klawiatura ekranowa umożliwia wpisywanie kombinacji klawiszy, które w innym przypadku byłyby niemożliwe (takich jak Ctrl-Alt-Del)",
+        "HELP_INPUT_METHOD_TEXT"   : "Zezwalaj na pisanie tekstu i emuluj zdarzenia klawiatury na podstawie wpisanego tekstu. Jest to konieczne w przypadku urządzeń takich jak telefony komórkowe, które nie mają fizycznej klawiatury.",
+        "HELP_MOUSE_MODE"          : "Określa zachowanie zdalnej myszy w odniesieniu do dotknięć.",
+        "HELP_MOUSE_MODE_ABSOLUTE" : "Dotknij, aby kliknąć. Kliknięcie następuje w miejscu dotknięcia.",
+        "HELP_MOUSE_MODE_RELATIVE" : "Przeciągnij, aby przesunąć wskaźnik myszy i dotknij, aby kliknąć. Kliknięcie następuje w miejscu, w którym znajduje się wskaźnik.",
+        "HELP_SHARE_LINK"          : "Aktualne połączenie jest udostępniane, dostęp może uzyskać każdy posiadający {LINKS, plural, one{link} other{linki}}:",
+
+        "INFO_CONNECTION_SHARED" : "To połączenie jest teraz udostępniane.",
+        "INFO_NO_FILE_TRANSFERS" : "Brak transferów plików.",
+
+        "NAME_INPUT_METHOD_NONE"   : "Brak",
+        "NAME_INPUT_METHOD_OSK"    : "Klawiatura ekranowa",
+        "NAME_INPUT_METHOD_TEXT"   : "Pole tekstowe",
+        "NAME_KEY_CTRL"            : "Ctrl",
+        "NAME_KEY_ALT"             : "Alt",
+        "NAME_KEY_ESC"             : "Esc",
+        "NAME_KEY_TAB"             : "Tab",
+        "NAME_MOUSE_MODE_ABSOLUTE" : "Ekran dotykowy",
+        "NAME_MOUSE_MODE_RELATIVE" : "Touchpad",
+
+        "SECTION_HEADER_CLIPBOARD"      : "Schowek",
+        "SECTION_HEADER_DEVICES"        : "Urządzenia",
+        "SECTION_HEADER_DISPLAY"        : "Wyświetlanie",
+        "SECTION_HEADER_FILE_TRANSFERS" : "Transfer Plików",
+        "SECTION_HEADER_INPUT_METHOD"   : "Metoda wejścia",
+        "SECTION_HEADER_MOUSE_MODE"     : "Tryb emulacji myszy",
+
+        "TEXT_ZOOM_AUTO_FIT"              : "Automatycznie dopasuj do okna przeglądarki",
+        "TEXT_CLIENT_STATUS_IDLE"         : "Bezczynne.",
+        "TEXT_CLIENT_STATUS_CONNECTING"   : "Łączenie z Guacamole...",
+        "TEXT_CLIENT_STATUS_DISCONNECTED" : "Zostałeś rozłączony.",
+        "TEXT_CLIENT_STATUS_UNSTABLE"     : "Połączenie sieciowe z serwerem Guacamole wydaje się być niestabilne.",
+        "TEXT_CLIENT_STATUS_WAITING"      : "Połączono z Guacamole. Czekanie na odpowiedź...",
+        "TEXT_RECONNECT_COUNTDOWN"        : "Ponowne połączenie za {REMAINING} {REMAINING, plural, one{sekundę} other{sekund(-y)}}...",
+        "TEXT_FILE_TRANSFER_PROGRESS"     : "{PROGRESS} {UNIT, select, b{B} kb{KB} mb{MB} gb{GB} other{}}",
+
+        "URL_OSK_LAYOUT" : "layouts/en-us-qwerty.json"
+
+    },
+
+    "COLOR_SCHEME" : {
+
+        "ACTION_CANCEL"       : "@:APP.ACTION_CANCEL",
+        "ACTION_HIDE_DETAILS" : "Ukryj",
+        "ACTION_SAVE"         : "@:APP.ACTION_SAVE",
+        "ACTION_SHOW_DETAILS" : "Pokaż",
+
+        "FIELD_HEADER_BACKGROUND" : "Drugi plan",
+        "FIELD_HEADER_FOREGROUND" : "Pierwszy plan",
+
+        "FIELD_OPTION_CUSTOM" : "Niestandardowy...",
+
+        "SECTION_HEADER_DETAILS" : "Szczegóły:"
+
+    },
+
+    "DATA_SOURCE_DEFAULT" : {
+        "NAME" : "Domyślny (XML)"
+    },
+
+    "FORM" : {
+
+        "FIELD_PLACEHOLDER_DATE" : "YYYY-MM-DD",
+        "FIELD_PLACEHOLDER_TIME" : "HH:MM:SS",
+
+        "HELP_SHOW_PASSWORD" : "Naciśnij aby pokazać hasło",
+        "HELP_HIDE_PASSWORD" : "Naciśnij aby ukryć hasło"
+
+    },
+
+    "HOME" : {
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "INFO_ACTIVE_USER_COUNT" : "@:APP.INFO_ACTIVE_USER_COUNT",
+
+        "INFO_NO_RECENT_CONNECTIONS" : "Brak ostatnich połączeń.",
+
+        "PASSWORD_CHANGED" : "Hasło zmienione.",
+
+        "SECTION_HEADER_ALL_CONNECTIONS"    : "Wszystkie połączenia",
+        "SECTION_HEADER_RECENT_CONNECTIONS" : "Ostatnie połączenia"
+
+    },
+
+    "LIST" : {
+
+        "TEXT_ANONYMOUS_USER" : "Anonimowy"
+
+    },
+
+    "LOGIN": {
+
+        "ACTION_ACKNOWLEDGE" : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CONTINUE"    : "@:APP.ACTION_CONTINUE",
+        "ACTION_LOGIN"       : "@:APP.ACTION_LOGIN",
+
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
+
+        "ERROR_INVALID_LOGIN" : "Niepoprawny Login",
+
+        "FIELD_HEADER_USERNAME" : "Użytkownik",
+        "FIELD_HEADER_PASSWORD" : "Hasło"
+
+    },
+
+    "MANAGE_CONNECTION" : {
+
+        "ACTION_ACKNOWLEDGE"          : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CANCEL"               : "@:APP.ACTION_CANCEL",
+        "ACTION_CLONE"                : "@:APP.ACTION_CLONE",
+        "ACTION_DELETE"               : "@:APP.ACTION_DELETE",
+        "ACTION_SAVE"                 : "@:APP.ACTION_SAVE",
+
+        "DIALOG_HEADER_CONFIRM_DELETE" : "Usuń Połączenie",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
+
+        "FIELD_HEADER_LOCATION" : "Lokalizacja:",
+        "FIELD_HEADER_NAME"     : "Nazwa:",
+        "FIELD_HEADER_PROTOCOL" : "Protokół:",
+
+        "FORMAT_HISTORY_START" : "@:APP.FORMAT_DATE_TIME_PRECISE",
+
+        "INFO_CONNECTION_DURATION_UNKNOWN" : "--",
+        "INFO_CONNECTION_ACTIVE_NOW"       : "Aktywne Teraz",
+        "INFO_CONNECTION_NOT_USED"         : "To połączenie nie zostało jeszcze użyte.",
+
+        "SECTION_HEADER_EDIT_CONNECTION" : "Edytuj Połączenie",
+        "SECTION_HEADER_HISTORY"         : "Historia Użycia",
+        "SECTION_HEADER_PARAMETERS"      : "Parametry",
+
+        "TABLE_HEADER_HISTORY_USERNAME"   : "Użytkownik",
+        "TABLE_HEADER_HISTORY_START"      : "Czas Rozpoczęcia",
+        "TABLE_HEADER_HISTORY_DURATION"   : "Czas Trwania",
+        "TABLE_HEADER_HISTORY_REMOTEHOST" : "Zdalny Host",
+
+        "TEXT_CONFIRM_DELETE"   : "Połączenia nie mogą zostać przywrócone po ich usunięciu. Czy na pewno chcesz usunąć to połączenie?",
+        "TEXT_HISTORY_DURATION" : "@:APP.TEXT_HISTORY_DURATION"
+
+    },
+
+    "MANAGE_CONNECTION_GROUP" : {
+
+        "ACTION_ACKNOWLEDGE"   : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CANCEL"        : "@:APP.ACTION_CANCEL",
+        "ACTION_CLONE"         : "@:APP.ACTION_CLONE",
+        "ACTION_DELETE"        : "@:APP.ACTION_DELETE",
+        "ACTION_SAVE"          : "@:APP.ACTION_SAVE",
+
+        "DIALOG_HEADER_CONFIRM_DELETE" : "Usuń Grupę Połączeń",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
+
+        "FIELD_HEADER_LOCATION" : "Lokalizacja:",
+        "FIELD_HEADER_NAME"     : "Nazwa:",
+        "FIELD_HEADER_TYPE"     : "Typ:",
+
+        "NAME_TYPE_BALANCING"       : "Równoważący obciążenie",
+        "NAME_TYPE_ORGANIZATIONAL"  : "Organizacyjny",
+
+        "SECTION_HEADER_EDIT_CONNECTION_GROUP" : "Edytuj Grupę Połączeń",
+
+        "TEXT_CONFIRM_DELETE" : "Grupy połączeń nie mogą zostać przywrócone po tym jak zostaną usunięte. Czy na pewno chcesz usunąć tę grupę połączeń?"
+
+    },
+
+    "MANAGE_SHARING_PROFILE" : {
+
+        "ACTION_ACKNOWLEDGE" : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CANCEL"      : "@:APP.ACTION_CANCEL",
+        "ACTION_CLONE"       : "@:APP.ACTION_CLONE",
+        "ACTION_DELETE"      : "@:APP.ACTION_DELETE",
+        "ACTION_SAVE"        : "@:APP.ACTION_SAVE",
+
+        "DIALOG_HEADER_CONFIRM_DELETE" : "Usuń Profil Udostępniania",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
+
+        "FIELD_HEADER_NAME"               : "Nazwa:",
+        "FIELD_HEADER_PRIMARY_CONNECTION" : "Podstawowe Połączenie:",
+
+        "SECTION_HEADER_EDIT_SHARING_PROFILE" : "Edytuj Profil Udostępniania",
+        "SECTION_HEADER_PARAMETERS"           : "Parametry",
+
+        "TEXT_CONFIRM_DELETE" : "Profile udostępniania nie mogą zostać przywrócone po tym jak zostaną usunięte. Czy na pewno chcesz usunąć ten profil udostępniania?"
+
+    },
+
+    "MANAGE_USER" : {
+
+        "ACTION_ACKNOWLEDGE"   : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CANCEL"        : "@:APP.ACTION_CANCEL",
+        "ACTION_CLONE"         : "@:APP.ACTION_CLONE",
+        "ACTION_DELETE"        : "@:APP.ACTION_DELETE",
+        "ACTION_SAVE"          : "@:APP.ACTION_SAVE",
+
+        "DIALOG_HEADER_CONFIRM_DELETE" : "Usuń Użytkownika",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
+
+        "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
+
+        "FIELD_HEADER_ADMINISTER_SYSTEM"             : "Administracja systemem:",
+        "FIELD_HEADER_CHANGE_OWN_PASSWORD"           : "Zmiana własnego hasła:",
+        "FIELD_HEADER_CREATE_NEW_USERS"              : "Tworzenie nowych użytkowników:",
+        "FIELD_HEADER_CREATE_NEW_USER_GROUPS"        : "Tworzenie nowych grup użytkowników:",
+        "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "Tworzenie nowych połączeń:",
+        "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "Tworzenie nowych grup połączeń:",
+        "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "Tworzenie nowych profili udostępniania:",
+        "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
+        "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
+        "FIELD_HEADER_USERNAME"                      : "Nazwa użytkownika:",
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "HELP_NO_USER_GROUPS" : "Ten użytkownik nie należy obecnie do żadnej grupy. Rozwiń tę sekcje aby dodać do grupy.",
+
+        "INFO_READ_ONLY"                : "Ten użytkownik nie może być edytowany",
+        "INFO_NO_USER_GROUPS_AVAILABLE" : "Brak dostępnych grup.",
+
+        "SECTION_HEADER_ALL_CONNECTIONS"     : "Wszystkie Połączenia",
+        "SECTION_HEADER_CONNECTIONS"         : "Połączenia",
+        "SECTION_HEADER_CURRENT_CONNECTIONS" : "Obecne Połączenia",
+        "SECTION_HEADER_EDIT_USER"           : "Edytuj Użytkownika",
+        "SECTION_HEADER_PERMISSIONS"         : "Uprawnienia",
+        "SECTION_HEADER_USER_GROUPS"         : "Grupy",
+
+        "TEXT_CONFIRM_DELETE" : "Użytkownicy nie mogą zostać przywróceni po tym jak zostaną usunięci. Czy na pewno chcesz usunąć tego użytkownika?"
+
+    },
+
+    "MANAGE_USER_GROUP" : {
+
+        "ACTION_ACKNOWLEDGE"   : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CANCEL"        : "@:APP.ACTION_CANCEL",
+        "ACTION_CLONE"         : "@:APP.ACTION_CLONE",
+        "ACTION_DELETE"        : "@:APP.ACTION_DELETE",
+        "ACTION_SAVE"          : "@:APP.ACTION_SAVE",
+
+        "DIALOG_HEADER_CONFIRM_DELETE" : "Usuń grupę",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
+
+        "FIELD_HEADER_ADMINISTER_SYSTEM"             : "@:MANAGE_USER.FIELD_HEADER_ADMINISTER_SYSTEM",
+        "FIELD_HEADER_CHANGE_OWN_PASSWORD"           : "@:MANAGE_USER.FIELD_HEADER_CHANGE_OWN_PASSWORD",
+        "FIELD_HEADER_CREATE_NEW_USERS"              : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_USERS",
+        "FIELD_HEADER_CREATE_NEW_USER_GROUPS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_USER_GROUPS",
+        "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
+        "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
+        "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
+        "FIELD_HEADER_USER_GROUP_NAME"               : "Nazwa grupy:",
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "HELP_NO_USER_GROUPS"        : "To grupa nie należy do żadnej grupy. Rozwiń tę sekcje aby dodać do grupy.",
+        "HELP_NO_MEMBER_USER_GROUPS" : "Ta grupa nie zawiera żadnych grup. Rozwiń tę sekcje aby dodać grupy.",
+        "HELP_NO_MEMBER_USERS"       : "Ta grupa nie zawiera żadnych użytkowników. Rozwiń tę sekcje aby dodać użytkowników do grupy.",
+
+        "INFO_READ_ONLY"                : "Ta grupa nie może być edytowana",
+        "INFO_NO_USER_GROUPS_AVAILABLE" : "@:MANAGE_USER.INFO_NO_USER_GROUPS_AVAILABLE",
+        "INFO_NO_USERS_AVAILABLE"       : "Brak dostępnych użytkowników.",
+
+        "SECTION_HEADER_ALL_CONNECTIONS"     : "@:MANAGE_USER.SECTION_HEADER_ALL_CONNECTIONS",
+        "SECTION_HEADER_CONNECTIONS"         : "@:MANAGE_USER.SECTION_HEADER_CONNECTIONS",
+        "SECTION_HEADER_CURRENT_CONNECTIONS" : "@:MANAGE_USER.SECTION_HEADER_CURRENT_CONNECTIONS",
+        "SECTION_HEADER_EDIT_USER_GROUP"     : "Edytuj Grupę",
+        "SECTION_HEADER_MEMBER_USERS"        : "Należący użytkownicy",
+        "SECTION_HEADER_MEMBER_USER_GROUPS"  : "Należące grupy",
+        "SECTION_HEADER_PERMISSIONS"         : "@:MANAGE_USER.SECTION_HEADER_PERMISSIONS",
+        "SECTION_HEADER_USER_GROUPS"         : "Grupy nadrzędne",
+
+        "TEXT_CONFIRM_DELETE" : "Grupy nie mogą zostać przywrócone po tym jak zostaną usunięte. Czy na pewno chcesz usunąć tę grupę?"
+
+    },
+
+    "PLAYER" : {
+
+        "ACTION_CANCEL" : "@:APP.ACTION_CANCEL",
+        "ACTION_PAUSE"  : "@:APP.ACTION_PAUSE",
+        "ACTION_PLAY"   : "@:APP.ACTION_PLAY",
+
+        "INFO_LOADING_RECORDING" : "Twoje nagranie jest właśnie ładowane. Proszę czekać...",
+        "INFO_SEEK_IN_PROGRESS"  : "Szukanie żądanej pozycji. Proszę czekać..."
+
+    },
+
+    "PROTOCOL_KUBERNETES" : {
+
+        "FIELD_HEADER_BACKSPACE"       : "Klawisz Backspace wysyła:",
+        "FIELD_HEADER_CA_CERT"         : "Certyfikat CA:",
+        "FIELD_HEADER_CLIENT_CERT"     : "Certyfikat klienta:",
+        "FIELD_HEADER_CLIENT_KEY"      : "Klucz klienta:",
+        "FIELD_HEADER_COLOR_SCHEME"    : "Schemat kolorów:",
+        "FIELD_HEADER_CONTAINER"       : "Nazwa kontenera:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH"  : "Automatycznie utwórz ścieżkę nagrywania:",
+        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "Automatycznie utwórz ścieżkę maszynopisu:",
+        "FIELD_HEADER_EXEC_COMMAND"    : "Komenda (exec):",
+        "FIELD_HEADER_FONT_NAME"       : "Nazwa czcionki:",
+        "FIELD_HEADER_FONT_SIZE"       : "Rozmiar czcionki:",
+        "FIELD_HEADER_HOSTNAME"        : "Nazwa Hosta:",
+        "FIELD_HEADER_IGNORE_CERT"     : "Ignoruj certyfikat serwera:",
+        "FIELD_HEADER_NAMESPACE"       : "Przestrzeń nazw:",
+        "FIELD_HEADER_POD"             : "Nazwa pod'a:",
+        "FIELD_HEADER_PORT"            : "Port:",
+        "FIELD_HEADER_READ_ONLY"       : "Tylko do odczytu:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Wyklucz mysz:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Wyklucz grafiki/strumienie:",
+        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Dołącz zdarzenia klawiszy:",
+        "FIELD_HEADER_RECORDING_NAME"  : "Nazwa nagrania:",
+        "FIELD_HEADER_RECORDING_PATH"  : "Ścieżka nagrania:",
+        "FIELD_HEADER_SCROLLBACK"      : "Maksymalny rozmiar przewijania:",
+        "FIELD_HEADER_TYPESCRIPT_NAME" : "Nazwa maszynopisu:",
+        "FIELD_HEADER_TYPESCRIPT_PATH" : "Ścieżka maszynopisu:",
+        "FIELD_HEADER_USE_SSL"         : "Użyj SSL/TLS",
+
+        "FIELD_OPTION_BACKSPACE_EMPTY" : "",
+        "FIELD_OPTION_BACKSPACE_8"     : "Backspace (Ctrl-H)",
+        "FIELD_OPTION_BACKSPACE_127"   : "Delete (Ctrl-?)",
+
+        "FIELD_OPTION_COLOR_SCHEME_BLACK_WHITE" : "Czarny na białym",
+        "FIELD_OPTION_COLOR_SCHEME_EMPTY"       : "",
+        "FIELD_OPTION_COLOR_SCHEME_GRAY_BLACK"  : "Szary na czarnym",
+        "FIELD_OPTION_COLOR_SCHEME_GREEN_BLACK" : "Zielony na czarnym",
+        "FIELD_OPTION_COLOR_SCHEME_WHITE_BLACK" : "Biały na czarnym",
+
+        "FIELD_OPTION_FONT_SIZE_8"     : "8",
+        "FIELD_OPTION_FONT_SIZE_9"     : "9",
+        "FIELD_OPTION_FONT_SIZE_10"    : "10",
+        "FIELD_OPTION_FONT_SIZE_11"    : "11",
+        "FIELD_OPTION_FONT_SIZE_12"    : "12",
+        "FIELD_OPTION_FONT_SIZE_14"    : "14",
+        "FIELD_OPTION_FONT_SIZE_18"    : "18",
+        "FIELD_OPTION_FONT_SIZE_24"    : "24",
+        "FIELD_OPTION_FONT_SIZE_30"    : "30",
+        "FIELD_OPTION_FONT_SIZE_36"    : "36",
+        "FIELD_OPTION_FONT_SIZE_48"    : "48",
+        "FIELD_OPTION_FONT_SIZE_60"    : "60",
+        "FIELD_OPTION_FONT_SIZE_72"    : "72",
+        "FIELD_OPTION_FONT_SIZE_96"    : "96",
+        "FIELD_OPTION_FONT_SIZE_EMPTY" : "",
+
+        "NAME" : "Kubernetes",
+
+        "SECTION_HEADER_AUTHENTICATION" : "Uwierzytelnianie",
+        "SECTION_HEADER_BEHAVIOR"       : "Zachowanie terminala",
+        "SECTION_HEADER_CONTAINER"      : "Kontener",
+        "SECTION_HEADER_DISPLAY"        : "Wyświetlanie",
+        "SECTION_HEADER_RECORDING"      : "Nagrywanie Ekranu",
+        "SECTION_HEADER_TYPESCRIPT"     : "Maszynopis (Tekstowe nagranie sesji)",
+        "SECTION_HEADER_NETWORK"        : "Sieć"
+
+    },
+
+    "PROTOCOL_RDP" : {
+
+        "FIELD_HEADER_CLIENT_NAME"     : "Nazwa klienta:",
+        "FIELD_HEADER_COLOR_DEPTH"     : "Głębia kolorów:",
+        "FIELD_HEADER_CONSOLE"         : "Konsola administratora:",
+        "FIELD_HEADER_CONSOLE_AUDIO"   : "Wspieraj dźwięk w konsoli:",
+        "FIELD_HEADER_CREATE_DRIVE_PATH" : "Automatycznie utwórz dysk:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH" : "Automatycznie utwórz ścieżkę nagrywania:",
+        "FIELD_HEADER_DISABLE_AUDIO"   : "Wyłącz dźwięk:",
+        "FIELD_HEADER_DISABLE_AUTH"    : "Wyłącz uwierzytelnianie:",
+        "FIELD_HEADER_DISABLE_COPY"    : "Wyłącz kopiowanie ze zdalnego pulpitu:",
+        "FIELD_HEADER_DISABLE_DOWNLOAD" : "Wyłącz pobieranie plików:",
+        "FIELD_HEADER_DISABLE_PASTE"   : "Wyłącz wklejanie z klienta:",
+        "FIELD_HEADER_DISABLE_UPLOAD"   : "Wyłącz przesyłanie plików:",
+        "FIELD_HEADER_DOMAIN"          : "Domena:",
+        "FIELD_HEADER_DPI"             : "Rozdzielczość (DPI):",
+        "FIELD_HEADER_DRIVE_NAME"       : "Nazwa dysku:",
+        "FIELD_HEADER_DRIVE_PATH"       : "Ścieżka dysku:",
+        "FIELD_HEADER_ENABLE_AUDIO_INPUT"         : "Włącz wejście dźwięku (mikrofon):",
+        "FIELD_HEADER_ENABLE_DESKTOP_COMPOSITION" : "Włącz kompozycje pulpitu (Aero):",
+        "FIELD_HEADER_ENABLE_DRIVE"               : "Włącz dysk:",
+        "FIELD_HEADER_ENABLE_FONT_SMOOTHING"      : "Włącz wygładzanie czcionek (ClearType):",
+        "FIELD_HEADER_ENABLE_FULL_WINDOW_DRAG"    : "Włącz przeciąganie w pełnym oknie:",
+        "FIELD_HEADER_ENABLE_MENU_ANIMATIONS"     : "Włącz animacje menu:",
+        "FIELD_HEADER_DISABLE_BITMAP_CACHING"     : "Wyłącz bitmap caching:",
+        "FIELD_HEADER_DISABLE_OFFSCREEN_CACHING"  : "Wyłącz off-screen caching:",
+        "FIELD_HEADER_DISABLE_GLYPH_CACHING"      : "Wyłącz glyph caching:",
+        "FIELD_HEADER_DISABLE_GFX"                : "Wyłącz Rozszerzenie Potoku Graficznego:",
+        "FIELD_HEADER_ENABLE_PRINTING"            : "Włącz drukowanie:",
+        "FIELD_HEADER_ENABLE_SFTP"     : "Włącz SFTP:",
+        "FIELD_HEADER_ENABLE_THEMING"             : "Włącz motyw:",
+        "FIELD_HEADER_ENABLE_TOUCH"               : "Włącz multi-touch:",
+        "FIELD_HEADER_ENABLE_WALLPAPER"           : "Włącz tapetę:",
+        "FIELD_HEADER_FORCE_LOSSLESS"             : "Wymuś bezstratną kompresję:",
+        "FIELD_HEADER_GATEWAY_DOMAIN"   : "Domena:",
+        "FIELD_HEADER_GATEWAY_HOSTNAME" : "Nazwa hosta:",
+        "FIELD_HEADER_GATEWAY_PASSWORD" : "Hasło:",
+        "FIELD_HEADER_GATEWAY_PORT"     : "Port:",
+        "FIELD_HEADER_GATEWAY_USERNAME" : "Użytkownik:",
+        "FIELD_HEADER_HEIGHT"          : "Wysokość:",
+        "FIELD_HEADER_HOSTNAME"        : "Nazwa hosta:",
+        "FIELD_HEADER_IGNORE_CERT"     : "Ignoruj certyfikat serwera:",
+        "FIELD_HEADER_INITIAL_PROGRAM" : "Program początkowy:",
+        "FIELD_HEADER_LOAD_BALANCE_INFO" : "Load balance info/cookie:",
+        "FIELD_HEADER_NORMALIZE_CLIPBOARD" : "Zakończenie linii:",
+        "FIELD_HEADER_PASSWORD"        : "Hasło:",
+        "FIELD_HEADER_PORT"            : "Port:",
+        "FIELD_HEADER_PRINTER_NAME"    : "Nazwa przekierowanej drukarki:",
+        "FIELD_HEADER_PRECONNECTION_BLOB" : "Preconnection BLOB (VM ID):",
+        "FIELD_HEADER_PRECONNECTION_ID"   : "Źródłowe ID RDP:",
+        "FIELD_HEADER_READ_ONLY"      : "Tylko do odczytu:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Wyklucz mysz:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Wyklucz grafiki/strumienie:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_TOUCH"  : "Wyklucz zdarzenia dotykowe:",
+        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Dołącz zdarzenia klawiszy:",
+        "FIELD_HEADER_RECORDING_NAME" : "Nazwa nagrania:",
+        "FIELD_HEADER_RECORDING_PATH" : "Ścieżka nagrania:",
+        "FIELD_HEADER_RESIZE_METHOD" : "Metoda zmiany rozmiaru:",
+        "FIELD_HEADER_REMOTE_APP_ARGS" : "Parametry:",
+        "FIELD_HEADER_REMOTE_APP_DIR"  : "Katalog roboczy:",
+        "FIELD_HEADER_REMOTE_APP"      : "Program:",
+        "FIELD_HEADER_SECURITY"        : "Tryb bezpieczeństwa:",
+        "FIELD_HEADER_SERVER_LAYOUT"   : "Układ klawiatury:",
+        "FIELD_HEADER_SFTP_DIRECTORY"             : "Domyślny katalog dla przesyłania:",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "Wyłącz pobieranie plików:",
+        "FIELD_HEADER_SFTP_HOST_KEY"              : "Publiczny klucz hosta (Base64):",
+        "FIELD_HEADER_SFTP_HOSTNAME"              : "Nazwa Hosta:",
+        "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "Interwał utrzymania aktywności (keepalive) SFTP:",
+        "FIELD_HEADER_SFTP_PASSPHRASE"            : "Hasło klucza:",
+        "FIELD_HEADER_SFTP_PASSWORD"              : "Hasło:",
+        "FIELD_HEADER_SFTP_PORT"                  : "Port:",
+        "FIELD_HEADER_SFTP_PRIVATE_KEY"           : "Klucz prywatny:",
+        "FIELD_HEADER_SFTP_ROOT_DIRECTORY"        : "Katalog nadrzędny przeglądarki plików:",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "Wyłącz przesyłanie plików:",
+        "FIELD_HEADER_SFTP_USERNAME"              : "Użytkownik:",
+        "FIELD_HEADER_STATIC_CHANNELS" : "Nazwy statycznych kanałów:",
+        "FIELD_HEADER_TIMEZONE"        : "Strefa czasowa:",
+        "FIELD_HEADER_USERNAME"        : "Użytkownik:",
+        "FIELD_HEADER_WIDTH"           : "Szerokość:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Adres rozgłoszeniowy (broadcast) dla pakietu WoL:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "Adres MAC zdalnego hosta:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "Wyślij pakiet WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "Port UDP dla pakietu WoL:",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Czas oczekiwania na rozruch hosta:",
+
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_EMPTY"    : "",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_PRESERVE" : "Zachowaj tak, jak jest",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_UNIX"     : "Linux/Mac/Unix (LF)",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_WINDOWS"  : "Windows (CRLF)",
+
+        "FIELD_OPTION_COLOR_DEPTH_16"    : "Low color (16-bit)",
+        "FIELD_OPTION_COLOR_DEPTH_24"    : "True color (24-bit)",
+        "FIELD_OPTION_COLOR_DEPTH_32"    : "True color (32-bit)",
+        "FIELD_OPTION_COLOR_DEPTH_8"     : "256 color",
+        "FIELD_OPTION_COLOR_DEPTH_EMPTY" : "",
+
+        "FIELD_OPTION_RESIZE_METHOD_DISPLAY_UPDATE" : "\"Aktualizacja Wyświetlania\" kanał wirtualny (RDP 8.1+)",
+        "FIELD_OPTION_RESIZE_METHOD_EMPTY"          : "",
+        "FIELD_OPTION_RESIZE_METHOD_RECONNECT"      : "Połącz Ponownie",
+
+        "FIELD_OPTION_SECURITY_ANY"   : "Dowolny",
+        "FIELD_OPTION_SECURITY_EMPTY" : "",
+        "FIELD_OPTION_SECURITY_NLA"   : "NLA (Uwierzytelnianie Na Poziomie Sieci)",
+        "FIELD_OPTION_SECURITY_RDP"   : "szyfrowanie RDP",
+        "FIELD_OPTION_SECURITY_TLS"   : "szyfrowanie TLS",
+        "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
+
+        "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Szwajcarski Niemiecki (Qwertz)",
+        "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "Niemiecki (Qwertz)",
+        "FIELD_OPTION_SERVER_LAYOUT_EMPTY"        : "",
+        "FIELD_OPTION_SERVER_LAYOUT_EN_GB_QWERTY" : "UK Angielski (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_EN_US_QWERTY" : "US Angielski (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_ES_ES_QWERTY" : "Hiszpański (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_ES_LATAM_QWERTY" : "Latynoamerykański (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_FAILSAFE"     : "Unicode",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_BE_AZERTY" : "Belgijski Francuski (Azerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_CA_QWERTY" : "Kanadyjski Francuski (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_CH_QWERTZ" : "Szwajcarski Francuski (Qwertz)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_FR_AZERTY" : "Francuski (Azerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_HU_HU_QWERTZ" : "Węgierski (Qwertz)",
+        "FIELD_OPTION_SERVER_LAYOUT_IT_IT_QWERTY" : "Włoski (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japoński (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_NO_NO_QWERTY" : "Norweski (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polski (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portugalski Brazylijski (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Szwecki (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Duński (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turecki-Q (Qwerty)",
+
+        "NAME" : "RDP",
+
+        "SECTION_HEADER_AUTHENTICATION"     : "Uwierzytelnianie",
+        "SECTION_HEADER_BASIC_PARAMETERS"   : "Ustawienia Podstawowe",
+        "SECTION_HEADER_CLIPBOARD"          : "Schowek",
+        "SECTION_HEADER_DEVICE_REDIRECTION" : "Przekierowanie Urządzeń",
+        "SECTION_HEADER_DISPLAY"            : "Wyświetlanie",
+        "SECTION_HEADER_GATEWAY"            : "Remote Desktop Gateway",
+        "SECTION_HEADER_LOAD_BALANCING"     : "Load Balancing",
+        "SECTION_HEADER_NETWORK"            : "Sieć",
+        "SECTION_HEADER_PERFORMANCE"        : "Wydajność",
+        "SECTION_HEADER_PRECONNECTION_PDU"  : "Wstępne połączenie PDU / Hyper-V",
+        "SECTION_HEADER_RECORDING"          : "Nagrywanie Ekranu",
+        "SECTION_HEADER_REMOTEAPP"          : "RemoteApp",
+        "SECTION_HEADER_SFTP"               : "SFTP",
+        "SECTION_HEADER_WOL"                : "Wake-on-LAN (WoL)"
+
+    },
+
+    "PROTOCOL_SSH" : {
+
+        "FIELD_HEADER_BACKSPACE"    : "Klawisz Backspace wysyła:",
+        "FIELD_HEADER_COLOR_SCHEME" : "Schemat kolorów:",
+        "FIELD_HEADER_COMMAND"      : "Wykonaj polecenie:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH" : "Automatycznie utwórz ścieżkę nagrywania:",
+        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "Automatycznie utwórz ścieżkę maszynopisu:",
+        "FIELD_HEADER_DISABLE_COPY"  : "Wyłącz kopiowanie z terminala:",
+        "FIELD_HEADER_DISABLE_PASTE" : "Wyłącz wklejanie z klienta:",
+        "FIELD_HEADER_FONT_NAME"     : "Nazwa czcionki:",
+        "FIELD_HEADER_FONT_SIZE"     : "Rozmiar czcionki:",
+        "FIELD_HEADER_ENABLE_SFTP"   : "Włącz SFTP:",
+        "FIELD_HEADER_HOST_KEY"      : "Publiczny klucz hosta (Base64):",
+        "FIELD_HEADER_HOSTNAME"      : "Nazwa Hosta:",
+        "FIELD_HEADER_LOCALE"        : "Język/Ustawienia regionalne ($LANG):",
+        "FIELD_HEADER_USERNAME"      : "Użytkownik:",
+        "FIELD_HEADER_PASSWORD"      : "Hasło:",
+        "FIELD_HEADER_PASSPHRASE"    : "Hasło klucza:",
+        "FIELD_HEADER_PORT"          : "Port:",
+        "FIELD_HEADER_PRIVATE_KEY"   : "Klucz prywatny:",
+        "FIELD_HEADER_SCROLLBACK"    : "Maksymalny rozmiar przewijania:",
+        "FIELD_HEADER_READ_ONLY"     : "Tylko do odczytu:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Wyklucz mysz:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Wyklucz grafiki/strumienie:",
+        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Dołącz zdarzenia klawiszy:",
+        "FIELD_HEADER_RECORDING_NAME" : "Nazwa nagrania:",
+        "FIELD_HEADER_RECORDING_PATH" : "Ścieżka nagrania:",
+        "FIELD_HEADER_SERVER_ALIVE_INTERVAL" : "Interwał utrzymywania aktywności serwera (keepalive):",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD" : "Wyłącz pobieranie plików:",
+        "FIELD_HEADER_SFTP_ROOT_DIRECTORY"   : "Katalog nadrzędny przeglądarki plików:",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"   : "Wyłącz przesyłanie plików:",
+        "FIELD_HEADER_TERMINAL_TYPE"   : "Typ terminala:",
+        "FIELD_HEADER_TIMEZONE"        : "Strefa czasowa ($TZ):",
+        "FIELD_HEADER_TYPESCRIPT_NAME" : "Nazwa maszynopisu:",
+        "FIELD_HEADER_TYPESCRIPT_PATH" : "Ścieżka maszynopisu:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Adres rozgłoszeniowy (broadcast) dla pakietu WoL:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "Adres MAC zdalnego hosta:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "Wyślij pakiet WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "Port UDP dla pakietu WoL:",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Czas oczekiwania na rozruch hosta:",
+
+        "FIELD_OPTION_BACKSPACE_EMPTY" : "",
+        "FIELD_OPTION_BACKSPACE_8"     : "Backspace (Ctrl-H)",
+        "FIELD_OPTION_BACKSPACE_127"   : "Delete (Ctrl-?)",
+
+        "FIELD_OPTION_COLOR_SCHEME_BLACK_WHITE" : "Czarny na białym",
+        "FIELD_OPTION_COLOR_SCHEME_EMPTY"       : "",
+        "FIELD_OPTION_COLOR_SCHEME_GRAY_BLACK"  : "Szary na czarnym",
+        "FIELD_OPTION_COLOR_SCHEME_GREEN_BLACK" : "Zielony na czarnym",
+        "FIELD_OPTION_COLOR_SCHEME_WHITE_BLACK" : "Biały na czarnym",
+
+        "FIELD_OPTION_FONT_SIZE_8"     : "8",
+        "FIELD_OPTION_FONT_SIZE_9"     : "9",
+        "FIELD_OPTION_FONT_SIZE_10"    : "10",
+        "FIELD_OPTION_FONT_SIZE_11"    : "11",
+        "FIELD_OPTION_FONT_SIZE_12"    : "12",
+        "FIELD_OPTION_FONT_SIZE_14"    : "14",
+        "FIELD_OPTION_FONT_SIZE_18"    : "18",
+        "FIELD_OPTION_FONT_SIZE_24"    : "24",
+        "FIELD_OPTION_FONT_SIZE_30"    : "30",
+        "FIELD_OPTION_FONT_SIZE_36"    : "36",
+        "FIELD_OPTION_FONT_SIZE_48"    : "48",
+        "FIELD_OPTION_FONT_SIZE_60"    : "60",
+        "FIELD_OPTION_FONT_SIZE_72"    : "72",
+        "FIELD_OPTION_FONT_SIZE_96"    : "96",
+        "FIELD_OPTION_FONT_SIZE_EMPTY" : "",
+
+        "FIELD_OPTION_TERMINAL_TYPE_ANSI"           : "ansi",
+        "FIELD_OPTION_TERMINAL_TYPE_EMPTY"          : "",
+        "FIELD_OPTION_TERMINAL_TYPE_LINUX"          : "linux",
+        "FIELD_OPTION_TERMINAL_TYPE_VT100"          : "vt100",
+        "FIELD_OPTION_TERMINAL_TYPE_VT220"          : "vt220",
+        "FIELD_OPTION_TERMINAL_TYPE_XTERM"          : "xterm",
+        "FIELD_OPTION_TERMINAL_TYPE_XTERM_256COLOR" : "xterm-256color",
+
+        "NAME" : "SSH",
+
+        "SECTION_HEADER_AUTHENTICATION" : "Uwierzytelnianie",
+        "SECTION_HEADER_BEHAVIOR"       : "Zachowanie Terminala",
+        "SECTION_HEADER_CLIPBOARD"      : "Schowek",
+        "SECTION_HEADER_DISPLAY"        : "Wyświetlanie",
+        "SECTION_HEADER_NETWORK"        : "Sieć",
+        "SECTION_HEADER_RECORDING"      : "Nagrywanie Ekranu",
+        "SECTION_HEADER_SESSION"        : "Sesja / Środowisko",
+        "SECTION_HEADER_TYPESCRIPT"     : "Maszynopis (Tekstowe Nagranie Sesji)",
+        "SECTION_HEADER_SFTP"           : "SFTP",
+        "SECTION_HEADER_WOL"            : "Wake-on-LAN (WoL)"
+
+    },
+
+    "PROTOCOL_TELNET" : {
+
+        "FIELD_HEADER_BACKSPACE"      : "Klawisz Backspace wysyła:",
+        "FIELD_HEADER_COLOR_SCHEME"   : "Schemat kolorów:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH" : "Automatycznie utwórz ścieżkę nagrywania:",
+        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "Automatycznie utwórz ścieżkę maszynopisu:",
+        "FIELD_HEADER_DISABLE_COPY"   : "Wyłącz kopiowanie z terminala:",
+        "FIELD_HEADER_DISABLE_PASTE"  : "Wyłącz wklejanie z klienta:",
+        "FIELD_HEADER_FONT_NAME"      : "Nazwa czcionki:",
+        "FIELD_HEADER_FONT_SIZE"      : "Rozmiar czcionki:",
+        "FIELD_HEADER_HOSTNAME"       : "Nazwa Hosta:",
+        "FIELD_HEADER_LOGIN_FAILURE_REGEX" : "Wyrażenie regularne nieudanego logowania:",
+        "FIELD_HEADER_LOGIN_SUCCESS_REGEX" : "Wyrażenie regularne udanego logowania:",
+        "FIELD_HEADER_USERNAME"       : "Użytkownik:",
+        "FIELD_HEADER_USERNAME_REGEX" : "Wyrażenie regularne użytkownika:",
+        "FIELD_HEADER_PASSWORD"       : "Hasło:",
+        "FIELD_HEADER_PASSWORD_REGEX" : "Wyrażenie regularne hasła",
+        "FIELD_HEADER_PORT"           : "Port:",
+        "FIELD_HEADER_READ_ONLY"      : "Tylko do odczytu:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Wyklucz mysz:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Wyklucz grafiki/strumienie:",
+        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Dołącz wciśnięcia klawiszy:",
+        "FIELD_HEADER_RECORDING_NAME" : "Nazwa nagrania:",
+        "FIELD_HEADER_RECORDING_PATH" : "Ścieżka nagrania:",
+        "FIELD_HEADER_SCROLLBACK"     : "Maksymalny rozmiar przewijania:",
+        "FIELD_HEADER_TERMINAL_TYPE"   : "Typ terminala:",
+        "FIELD_HEADER_TYPESCRIPT_NAME" : "Nazwa maszynopisu:",
+        "FIELD_HEADER_TYPESCRIPT_PATH" : "Ścieżka maszynopisu:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Adres rozgłoszeniowy (broadcast) dla pakietu WoL:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "Adres MAC zdalnego hosta:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "Wyślij pakiet WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "Port UDP dla pakietu WoL:",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Czas oczekiwania na rozruch hosta:",
+
+        "FIELD_OPTION_BACKSPACE_EMPTY" : "",
+        "FIELD_OPTION_BACKSPACE_8"     : "Backspace (Ctrl-H)",
+        "FIELD_OPTION_BACKSPACE_127"   : "Delete (Ctrl-?)",
+
+        "FIELD_OPTION_COLOR_SCHEME_BLACK_WHITE" : "Czarny na białym",
+        "FIELD_OPTION_COLOR_SCHEME_EMPTY"       : "",
+        "FIELD_OPTION_COLOR_SCHEME_GRAY_BLACK"  : "Szary na czarnym",
+        "FIELD_OPTION_COLOR_SCHEME_GREEN_BLACK" : "Zielony na czarnym",
+        "FIELD_OPTION_COLOR_SCHEME_WHITE_BLACK" : "Biały na czarnym",
+
+        "FIELD_OPTION_FONT_SIZE_8"     : "8",
+        "FIELD_OPTION_FONT_SIZE_9"     : "9",
+        "FIELD_OPTION_FONT_SIZE_10"    : "10",
+        "FIELD_OPTION_FONT_SIZE_11"    : "11",
+        "FIELD_OPTION_FONT_SIZE_12"    : "12",
+        "FIELD_OPTION_FONT_SIZE_14"    : "14",
+        "FIELD_OPTION_FONT_SIZE_18"    : "18",
+        "FIELD_OPTION_FONT_SIZE_24"    : "24",
+        "FIELD_OPTION_FONT_SIZE_30"    : "30",
+        "FIELD_OPTION_FONT_SIZE_36"    : "36",
+        "FIELD_OPTION_FONT_SIZE_48"    : "48",
+        "FIELD_OPTION_FONT_SIZE_60"    : "60",
+        "FIELD_OPTION_FONT_SIZE_72"    : "72",
+        "FIELD_OPTION_FONT_SIZE_96"    : "96",
+        "FIELD_OPTION_FONT_SIZE_EMPTY" : "",
+
+        "FIELD_OPTION_TERMINAL_TYPE_ANSI"           : "ansi",
+        "FIELD_OPTION_TERMINAL_TYPE_EMPTY"          : "",
+        "FIELD_OPTION_TERMINAL_TYPE_LINUX"          : "linux",
+        "FIELD_OPTION_TERMINAL_TYPE_VT100"          : "vt100",
+        "FIELD_OPTION_TERMINAL_TYPE_VT220"          : "vt220",
+        "FIELD_OPTION_TERMINAL_TYPE_XTERM"          : "xterm",
+        "FIELD_OPTION_TERMINAL_TYPE_XTERM_256COLOR" : "xterm-256color",
+
+        "NAME" : "Telnet",
+
+        "SECTION_HEADER_AUTHENTICATION" : "Uwierzytelnianie",
+        "SECTION_HEADER_BEHAVIOR"       : "Zachowanie Terminala",
+        "SECTION_HEADER_CLIPBOARD"      : "Schowek",
+        "SECTION_HEADER_DISPLAY"        : "Wyświetlanie",
+        "SECTION_HEADER_RECORDING"      : "Nagrywanie Ekranu",
+        "SECTION_HEADER_TYPESCRIPT"     : "Maszynopis (Tekstowe Nagranie Sesji)",
+        "SECTION_HEADER_NETWORK"        : "Sieć",
+        "SECTION_HEADER_WOL"            : "Wake-on-LAN (WoL)"
+
+    },
+
+    "PROTOCOL_VNC" : {
+
+        "FIELD_HEADER_AUDIO_SERVERNAME" : "Nazwa serwera audio:",
+        "FIELD_HEADER_CLIPBOARD_ENCODING" : "Kodowanie:",
+        "FIELD_HEADER_COLOR_DEPTH"      : "Głębia kolorów:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH" : "Automatycznie utwórz ścieżkę nagrywania:",
+        "FIELD_HEADER_CURSOR"           : "Kursor:",
+        "FIELD_HEADER_DEST_HOST"        : "Docelowy host:",
+        "FIELD_HEADER_DEST_PORT"        : "Docelowy port:",
+        "FIELD_HEADER_DISABLE_COPY"     : "Wyłącz kopiowanie ze zdalnego pulpitu:",
+        "FIELD_HEADER_DISABLE_PASTE"    : "Wyłącz wklejanie z klienta:",
+        "FIELD_HEADER_ENABLE_AUDIO"     : "Włącz dźwięk:",
+        "FIELD_HEADER_ENABLE_SFTP"      : "Włącz SFTP:",
+        "FIELD_HEADER_FORCE_LOSSLESS"   : "Wymuś bezstratną kompresję:",
+        "FIELD_HEADER_HOSTNAME"         : "Nazwa Hosta:",
+        "FIELD_HEADER_USERNAME"         : "Użytkownik:",
+        "FIELD_HEADER_PASSWORD"         : "Hasło:",
+        "FIELD_HEADER_PORT"             : "Port:",
+        "FIELD_HEADER_READ_ONLY"        : "Tylko do odczytu:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Wyklucz mysz:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Wyklucz grafiki/strumienie:",
+        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Dołącz zdarzenia klawiszy:",
+        "FIELD_HEADER_RECORDING_NAME" : "Nazwa nagrania:",
+        "FIELD_HEADER_RECORDING_PATH" : "Ścieżka nagrania:",
+        "FIELD_HEADER_SFTP_DIRECTORY"             : "Domyślny katalog przesyłania:",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "Wyłącz pobieranie plików:",
+        "FIELD_HEADER_SFTP_HOST_KEY"              : "Publiczny klucz hosta (Base64):",
+        "FIELD_HEADER_SFTP_HOSTNAME"              : "Nazwa Hosta:",
+        "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "Interwał utrzymania aktywności (keepalive) SFTP:",
+        "FIELD_HEADER_SFTP_PASSPHRASE"            : "Hasło klucza:",
+        "FIELD_HEADER_SFTP_PASSWORD"              : "Hasło:",
+        "FIELD_HEADER_SFTP_PORT"                  : "Port:",
+        "FIELD_HEADER_SFTP_PRIVATE_KEY"           : "Klucz prywatny:",
+        "FIELD_HEADER_SFTP_ROOT_DIRECTORY"        : "Katalog nadrzędny przeglądarki plików:",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "Wyłącz przesyłanie plików:",
+        "FIELD_HEADER_SFTP_USERNAME"              : "Użytkownik:",
+        "FIELD_HEADER_SWAP_RED_BLUE"    : "Zamień czerwone/niebieskie komponenty:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Adres rozgłoszeniowy (broadcast) dla pakietu WoL:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "Adres MAC zdalnego hosta:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "Wyślij pakiet WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "Port UDP dla pakietu WoL:",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Czas oczekiwania na rozruch hosta:",
+
+        "FIELD_OPTION_COLOR_DEPTH_8"     : "256 color",
+        "FIELD_OPTION_COLOR_DEPTH_16"    : "Low color (16-bit)",
+        "FIELD_OPTION_COLOR_DEPTH_24"    : "True color (24-bit)",
+        "FIELD_OPTION_COLOR_DEPTH_32"    : "True color (32-bit)",
+        "FIELD_OPTION_COLOR_DEPTH_EMPTY" : "",
+
+        "FIELD_OPTION_CURSOR_EMPTY"  : "",
+        "FIELD_OPTION_CURSOR_LOCAL"  : "Lokalny",
+        "FIELD_OPTION_CURSOR_REMOTE" : "Zdalny",
+
+        "FIELD_OPTION_CLIPBOARD_ENCODING_CP1252"    : "CP1252",
+        "FIELD_OPTION_CLIPBOARD_ENCODING_EMPTY"     : "",
+        "FIELD_OPTION_CLIPBOARD_ENCODING_ISO8859_1" : "ISO 8859-1",
+        "FIELD_OPTION_CLIPBOARD_ENCODING_UTF_8"     : "UTF-8",
+        "FIELD_OPTION_CLIPBOARD_ENCODING_UTF_16"    : "UTF-16",
+
+        "NAME" : "VNC",
+
+        "SECTION_HEADER_AUDIO"          : "Dźwięk",
+        "SECTION_HEADER_AUTHENTICATION" : "Uwierzytelnianie",
+        "SECTION_HEADER_CLIPBOARD"      : "Schowek",
+        "SECTION_HEADER_DISPLAY"        : "Wyświetlanie",
+        "SECTION_HEADER_NETWORK"        : "Sieć",
+        "SECTION_HEADER_RECORDING"      : "Nagrywanie Ekranu",
+        "SECTION_HEADER_REPEATER"       : "Przekaźnik VNC",
+        "SECTION_HEADER_SFTP"           : "SFTP",
+        "SECTION_HEADER_WOL"            : "Wake-on-LAN (WoL)"
+
+    },
+
+    "SETTINGS" : {
+
+        "SECTION_HEADER_SETTINGS" : "Ustawienia"
+
+    },
+
+    "SETTINGS_CONNECTION_HISTORY" : {
+
+        "ACTION_DOWNLOAD"       : "@:APP.ACTION_DOWNLOAD",
+        "ACTION_SEARCH"         : "@:APP.ACTION_SEARCH",
+        "ACTION_VIEW_RECORDING" : "@:APP.ACTION_VIEW_RECORDING",
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "FILENAME_HISTORY_CSV" : "history.csv",
+
+        "FORMAT_DATE" : "@:APP.FORMAT_DATE_TIME_PRECISE",
+
+        "HELP_CONNECTION_HISTORY" : "Rekordy historii poprzednich połączeń są wylistowane tutaj i można je sortować klikając nagłówki kolumn. Aby wyszukać określone rekordy wprowadź ciąg filtru i kliknij \"Szukaj\". Tylko rekordy pasujące do podanego filtru zostaną wyświetlone.",
+
+        "INFO_CONNECTION_DURATION_UNKNOWN" : "--",
+        "INFO_NO_HISTORY"                  : "Brak pasujących rekordów",
+
+        "TABLE_HEADER_SESSION_CONNECTION_NAME" : "Nazwa połączenia",
+        "TABLE_HEADER_SESSION_DURATION"        : "Czas trwania",
+        "TABLE_HEADER_SESSION_LOGS"            : "Logi",
+        "TABLE_HEADER_SESSION_REMOTEHOST"      : "Zdalny host",
+        "TABLE_HEADER_SESSION_STARTDATE"       : "Czas rozpoczęcia",
+        "TABLE_HEADER_SESSION_USERNAME"        : "Użytkownik",
+
+        "TEXT_HISTORY_DURATION" : "@:APP.TEXT_HISTORY_DURATION"
+
+    },
+
+    "SETTINGS_CONNECTIONS" : {
+
+        "ACTION_ACKNOWLEDGE"          : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_NEW_CONNECTION"       : "Nowe Połączenie",
+        "ACTION_NEW_CONNECTION_GROUP" : "Nowa Grupa",
+        "ACTION_NEW_SHARING_PROFILE"  : "Nowy Profil Udostępniania",
+
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "HELP_CONNECTIONS"   : "Kliknij lub naciśnij połączenie poniżej, aby nim zarządzać. W zależności od poziomu dostępu, połączenia mogą być dodawane i usuwane, a ich właściwości (protokół, nazwa hosta, port itp.) mogą być zmieniane.",
+
+        "INFO_ACTIVE_USER_COUNT" : "@:APP.INFO_ACTIVE_USER_COUNT",
+
+        "SECTION_HEADER_CONNECTIONS"     : "Połączenia"
+
+    },
+
+    "SETTINGS_PREFERENCES" : {
+
+        "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
+        "ACTION_SAVE"               : "@:APP.ACTION_SAVE",
+        "ACTION_UPDATE_PASSWORD"    : "@:APP.ACTION_UPDATE_PASSWORD",
+
+        "DIALOG_HEADER_ERROR"    : "@:APP.DIALOG_HEADER_ERROR",
+
+        "ERROR_PASSWORD_BLANK"    : "@:APP.ERROR_PASSWORD_BLANK",
+        "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
+
+        "FIELD_HEADER_LANGUAGE"           : "Język:",
+        "FIELD_HEADER_PASSWORD"           : "Hasło:",
+        "FIELD_HEADER_PASSWORD_OLD"       : "Obecne Hasło:",
+        "FIELD_HEADER_PASSWORD_NEW"       : "Nowe Hasło:",
+        "FIELD_HEADER_PASSWORD_NEW_AGAIN" : "Powtórz Nowe Hasło:",
+        "FIELD_HEADER_TIMEZONE"           : "Strefa Czasowa:",
+        "FIELD_HEADER_USERNAME"           : "Użytkownik:",
+
+        "HELP_DEFAULT_INPUT_METHOD" : "Domyślna metoda wprowadzania określa sposób odbierania zdarzeń klawiatury przez Guacamole. Zmiana tego ustawienia może być konieczna w przypadku korzystania z urządzenia mobilnego lub pisania w edytorze IME. To ustawienie można zmienić dla każdego połączenia w menu Guacamole.",
+        "HELP_DEFAULT_MOUSE_MODE"   : "Domyślny tryb emulacji myszy określa, jak zdalna mysz będzie się zachowywać w nowych połączeniach w odniesieniu do dotknięć. To ustawienie można zmienić dla każdego połączenia w menu Guacamole.",
+        "HELP_INPUT_METHOD_NONE"    : "@:CLIENT.HELP_INPUT_METHOD_NONE",
+        "HELP_INPUT_METHOD_OSK"     : "@:CLIENT.HELP_INPUT_METHOD_OSK",
+        "HELP_INPUT_METHOD_TEXT"    : "@:CLIENT.HELP_INPUT_METHOD_TEXT",
+        "HELP_LOCALE"               : "Poniższe opcje są związane z ustawieniami regionalnymi użytkownika i wpłyną na sposób wyświetlania różnych części interfejsu",
+        "HELP_MOUSE_MODE_ABSOLUTE"  : "@:CLIENT.HELP_MOUSE_MODE_ABSOLUTE",
+        "HELP_MOUSE_MODE_RELATIVE"  : "@:CLIENT.HELP_MOUSE_MODE_RELATIVE",
+        "HELP_UPDATE_PASSWORD"      : "Jeśli chcesz zmienić swoje hasło, wprowadź poniżej obecne hasło i żądane nowe hasło, a następnie kliknij \"Zmień Hasło\". Zmiana będzie miała efekt natychmiastowy.",
+
+        "INFO_PASSWORD_CHANGED" : "Hasło zmienione.",
+        "INFO_PREFERENCE_ATTRIBUTES_CHANGED" : "Ustawienia użytkownika zapisane.",
+
+        "NAME_INPUT_METHOD_NONE" : "@:CLIENT.NAME_INPUT_METHOD_NONE",
+        "NAME_INPUT_METHOD_OSK"  : "@:CLIENT.NAME_INPUT_METHOD_OSK",
+        "NAME_INPUT_METHOD_TEXT" : "@:CLIENT.NAME_INPUT_METHOD_TEXT",
+
+        "SECTION_HEADER_DEFAULT_INPUT_METHOD" : "Domyślna Metoda Wprowadzania",
+        "SECTION_HEADER_DEFAULT_MOUSE_MODE"   : "Domyślny Tryb Emulacji Myszy",
+        "SECTION_HEADER_UPDATE_PASSWORD"      : "Zmień Hasło"
+
+    },
+
+    "SETTINGS_USERS" : {
+
+        "ACTION_ACKNOWLEDGE"   : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_NEW_USER"      : "Nowy Użytkownik",
+
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "FORMAT_DATE" : "@:APP.FORMAT_DATE_TIME_PRECISE",
+
+        "HELP_USERS" : "Kliknij lub dotknij użytkownika poniżej, aby nim zarządzać. W zależności od Twojego poziomu dostępu, użytkowników można dodawać i usuwać, a także zmieniać ich hasła.",
+
+        "SECTION_HEADER_USERS"       : "Użytkownicy",
+
+        "TABLE_HEADER_FULL_NAME"   : "Imię i Nazwisko",
+        "TABLE_HEADER_LAST_ACTIVE" : "Ostatnio aktywny",
+        "TABLE_HEADER_ORGANIZATION" : "Organizacja",
+        "TABLE_HEADER_USERNAME"    : "Nazwa użytkownika"
+
+    },
+
+    "SETTINGS_USER_GROUPS" : {
+
+        "ACTION_ACKNOWLEDGE"    : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_NEW_USER_GROUP" : "Nowa Grupa",
+
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "FORMAT_DATE" : "@:APP.FORMAT_DATE_TIME_PRECISE",
+
+        "HELP_USER_GROUPS" : "Kliknij lub naciśnij grupę poniżej, aby nią zarządzać. W zależności od Twojego poziomu dostępu, grupy mogą być dodawane i usuwane, a ich użytkownicy i grupy mogą być edytowane.",
+
+        "SECTION_HEADER_USER_GROUPS" : "Grupy",
+
+        "TABLE_HEADER_USER_GROUP_NAME" : "Nazwa Grupy"
+
+    },
+
+    "SETTINGS_SESSIONS" : {
+
+        "ACTION_ACKNOWLEDGE" : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CANCEL"      : "@:APP.ACTION_CANCEL",
+        "ACTION_DELETE"      : "Zakończ sesję",
+
+        "DIALOG_HEADER_CONFIRM_DELETE" : "Zakończ Sesję",
+        "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "FORMAT_STARTDATE" : "@:APP.FORMAT_DATE_TIME_PRECISE",
+
+        "HELP_SESSIONS" : "Ta strona zostanie wypełniona aktualnie aktywnymi połączeniami. Lista połączeń i możliwość ich zakończenia zależy od Twojego poziomu dostępu. Jeśli chcesz zakończyć jedną lub więcej sesji, zaznacz pola obok tych sesji i kliknij \"Zakończ sesję\". Zakończenie sesji spowoduje natychmiastowe rozłączenie użytkownika z powiązanym połączeniem.",
+
+
+        "INFO_NO_SESSIONS" : "Brak aktywnych połączeń",
+
+        "SECTION_HEADER_SESSIONS" : "Aktywne Połączenia",
+
+        "TABLE_HEADER_SESSION_CONNECTION_NAME" : "Nazwa połączenia",
+        "TABLE_HEADER_SESSION_REMOTEHOST"      : "Zdalny host",
+        "TABLE_HEADER_SESSION_STARTDATE"       : "Aktywne od",
+        "TABLE_HEADER_SESSION_USERNAME"        : "Użytkownik",
+
+        "TEXT_CONFIRM_DELETE" : "Czy na pewno chcesz zakończyć wszystkie wybrane sesje? Użytkownicy korzystający z tych sesji zostaną natychmiast rozłączeni."
+
+    },
+
+    "USER_ATTRIBUTES" : {
+
+        "FIELD_HEADER_GUAC_EMAIL_ADDRESS"       : "Adres email:",
+        "FIELD_HEADER_GUAC_FULL_NAME"           : "Imię i Nazwisko:",
+        "FIELD_HEADER_GUAC_ORGANIZATION"        : "Organizacja:",
+        "FIELD_HEADER_GUAC_ORGANIZATIONAL_ROLE" : "Rola:"
+
+    },
+
+    "USER_MENU" : {
+
+        "ACTION_LOGOUT"             : "@:APP.ACTION_LOGOUT",
+        "ACTION_MANAGE_CONNECTIONS" : "@:APP.ACTION_MANAGE_CONNECTIONS",
+        "ACTION_MANAGE_PREFERENCES" : "@:APP.ACTION_MANAGE_PREFERENCES",
+        "ACTION_MANAGE_SESSIONS"    : "@:APP.ACTION_MANAGE_SESSIONS",
+        "ACTION_MANAGE_SETTINGS"    : "@:APP.ACTION_MANAGE_SETTINGS",
+        "ACTION_MANAGE_USERS"       : "@:APP.ACTION_MANAGE_USERS",
+        "ACTION_MANAGE_USER_GROUPS" : "@:APP.ACTION_MANAGE_USER_GROUPS",
+        "ACTION_NAVIGATE_HOME"      : "@:APP.ACTION_NAVIGATE_HOME",
+        "ACTION_VIEW_HISTORY"       : "@:APP.ACTION_VIEW_HISTORY"
+
+    }
+
+}
\ No newline at end of file

From 56b4cc436d4dbc7cb426e07bd4ff03d8136d3908 Mon Sep 17 00:00:00 2001
From: Mike Jumper <mjumper@apache.org>
Date: Tue, 10 Jan 2023 23:30:47 -0800
Subject: [PATCH 104/289] GUACAMOLE-1731: Correct parent project version
 (bumped to 1.5.0).

---
 extensions/guacamole-auth-ban/pom.xml                       | 6 +++---
 .../src/main/resources/guac-manifest.json                   | 2 +-
 extensions/guacamole-display-statistics/pom.xml             | 4 ++--
 .../src/main/resources/guac-manifest.json                   | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/extensions/guacamole-auth-ban/pom.xml b/extensions/guacamole-auth-ban/pom.xml
index 68b8d6f90..fcc2a272d 100644
--- a/extensions/guacamole-auth-ban/pom.xml
+++ b/extensions/guacamole-auth-ban/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-auth-ban</artifactId>
     <packaging>jar</packaging>
-    <version>1.4.0</version>
+    <version>1.5.0</version>
     <name>guacamole-auth-ban</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.4.0</version>
+        <version>1.5.0</version>
         <relativePath>../</relativePath>
     </parent>
 
@@ -51,7 +51,7 @@
         <dependency>
             <groupId>org.apache.guacamole</groupId>
             <artifactId>guacamole-ext</artifactId>
-            <version>1.4.0</version>
+            <version>1.5.0</version>
             <scope>provided</scope>
 
             <!-- Exclude transitive dependencies that will be overridden by
diff --git a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
index 0133a7364..6ff943160 100644
--- a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.4.0",
+    "guacamoleVersion" : "1.5.0",
 
     "name"      : "Brute-force Authentication Detection/Prevention",
     "namespace" : "ban",
diff --git a/extensions/guacamole-display-statistics/pom.xml b/extensions/guacamole-display-statistics/pom.xml
index 403d974cf..929c0311c 100644
--- a/extensions/guacamole-display-statistics/pom.xml
+++ b/extensions/guacamole-display-statistics/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-display-statistics</artifactId>
     <packaging>jar</packaging>
-    <version>1.4.0</version>
+    <version>1.5.0</version>
     <name>guacamole-display-statistics</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.4.0</version>
+        <version>1.5.0</version>
         <relativePath>../</relativePath>
     </parent>
 
diff --git a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
index 71c84b384..ada097116 100644
--- a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.4.0",
+    "guacamoleVersion" : "1.5.0",
 
     "name"      : "Display Statistic Toolbar",
     "namespace" : "display-stats",

From c9a7c7bae4a8e517b62c783dfccba11f8ca7c43e Mon Sep 17 00:00:00 2001
From: Ronan SALMON <ronan.s@lmon.io>
Date: Mon, 6 Feb 2023 17:02:17 +0100
Subject: [PATCH 105/289] GUACAMOLE-1733: Add missing optional configuration
 options from docker start.sh script

---
 guacamole-docker/bin/start.sh | 49 +++++++++++++++++++++++++----------
 1 file changed, 36 insertions(+), 13 deletions(-)

diff --git a/guacamole-docker/bin/start.sh b/guacamole-docker/bin/start.sh
index 76f8ffee4..3a9387083 100755
--- a/guacamole-docker/bin/start.sh
+++ b/guacamole-docker/bin/start.sh
@@ -664,19 +664,21 @@ END
     fi
 
     # Update config file
-    set_optional_property "radius-hostname"         "$RADIUS_HOSTNAME"
-    set_optional_property "radius-auth-port"        "$RADIUS_AUTH_PORT"
-    set_property          "radius-shared-secret"    "$RADIUS_SHARED_SECRET"
-    set_property          "radius-auth-protocol"    "$RADIUS_AUTH_PROTOCOL"
-    set_optional_property "radius-key-file"         "$RADIUS_KEY_FILE"
-    set_optional_property "radius-key-type"         "$RADIUS_KEY_TYPE"
-    set_optional_property "radius-key-password"     "$RADIUS_KEY_PASSWORD"
-    set_optional_property "radius-ca-file"          "$RADIUS_CA_FILE"
-    set_optional_property "radius-ca-type"          "$RADIUS_CA_TYPE"
-    set_optional_property "radius-ca-password"      "$RADIUS_CA_PASSWORD"
-    set_optional_property "radius-trust-all"        "$RADIUS_TRUST_ALL"
-    set_optional_property "radius-retries"          "$RADIUS_RETRIES"
-    set_optional_property "radius-timeout"          "$RADIUS_TIMEOUT"
+    set_optional_property "radius-hostname"                 "$RADIUS_HOSTNAME"
+    set_optional_property "radius-auth-port"                "$RADIUS_AUTH_PORT"
+    set_property          "radius-shared-secret"            "$RADIUS_SHARED_SECRET"
+    set_property          "radius-auth-protocol"            "$RADIUS_AUTH_PROTOCOL"
+    set_optional_property "radius-key-file"                 "$RADIUS_KEY_FILE"
+    set_optional_property "radius-key-type"                 "$RADIUS_KEY_TYPE"
+    set_optional_property "radius-key-password"             "$RADIUS_KEY_PASSWORD"
+    set_optional_property "radius-ca-file"                  "$RADIUS_CA_FILE"
+    set_optional_property "radius-ca-type"                  "$RADIUS_CA_TYPE"
+    set_optional_property "radius-ca-password"              "$RADIUS_CA_PASSWORD"
+    set_optional_property "radius-trust-all"                "$RADIUS_TRUST_ALL"
+    set_optional_property "radius-retries"                  "$RADIUS_RETRIES"
+    set_optional_property "radius-timeout"                  "$RADIUS_TIMEOUT"
+    set_optional_property "radius-eap-ttls-inner-protocol"  "$RADIUS_EAP_TTLS_INNER_PROTOCOL"
+    set_optional_property "radius-nas-ip"                   "$RADIUS_NAS_IP"
 
     set_optional_property \
        "radius-eap-ttls-inner-protocol" \
@@ -734,7 +736,10 @@ END
     set_property          "openid-redirect-uri"              "$OPENID_REDIRECT_URI"
     set_optional_property "openid-username-claim-type"       "$OPENID_USERNAME_CLAIM_TYPE"
     set_optional_property "openid-groups-claim-type"         "$OPENID_GROUPS_CLAIM_TYPE"
+    set_optional_property "openid-scope"                     "$OPENID_SCOPE"
+    set_optional_property "openid-allowed-clock-skew"        "$OPENID_ALLOWED_CLOCK_SKEW"
     set_optional_property "openid-max-token-validity"        "$OPENID_MAX_TOKEN_VALIDITY"
+    set_optional_property "openid-max-nonce-validity"        "$OPENID_MAX_NONCE_VALIDITY"
 
     # Add required .jar files to GUACAMOLE_EXT
     # "1-{}" make it sorted as a first provider (only authentication)
@@ -1064,6 +1069,11 @@ fi
 set_property "guacd-hostname" "$GUACD_HOSTNAME"
 set_property "guacd-port"     "$GUACD_PORT"
 
+# A comma-separated list of the identifiers of authentication providers that
+# should be allowed to fail internally without aborting the authentication process
+set_optional_property "skip-if-unavailable"     "$SKIP_IF_UNAVAILABLE"
+
+
 #
 # Track which authentication backends are installed
 #
@@ -1164,6 +1174,19 @@ if [ -n "$API_SESSION_TIMEOUT" ]; then
     associate_apisessiontimeout
 fi
 
+# Maximum number of bytes to accept within the entity body of any particular HTTP request
+set_optional_property "api-max-request-size" "$API_MAX_REQUEST_SIZE"
+
+# A comma-separated list of language keys to allow as display language 
+# choices within the Guacamole interface
+set_optional_property "allowed-languages" "$ALLOWED_LANGUAGES"
+
+# If set to “true”, Guacamole will first evaluate its environment to obtain the value
+# for any given configuration property, before using a value specified in 
+# guacamole.properties or falling back to a default value
+set_optional_property "enable-environment-properties" "$ENABLE_ENVIRONMENT_PROPERTIES"
+
+
 # Apply any overrides for default address ban behavior
 set_optional_property "ban-address-duration" "$BAN_ADDRESS_DURATION"
 set_optional_property "ban-max-addresses" "$BAN_MAX_ADDRESSES"

From cfffcdf0b74a445b3b9e8aa7be2f99a0c875015f Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 27 Feb 2023 14:44:46 -0800
Subject: [PATCH 106/289] GUACAMOLE-1745: Ensure deep copies of session storage
 are created only if necessary.

---
 .../storage/services/sessionStorageFactory.js | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/storage/services/sessionStorageFactory.js b/guacamole/src/main/frontend/src/app/storage/services/sessionStorageFactory.js
index 9ca7b0db7..da53cdfe9 100644
--- a/guacamole/src/main/frontend/src/app/storage/services/sessionStorageFactory.js
+++ b/guacamole/src/main/frontend/src/app/storage/services/sessionStorageFactory.js
@@ -70,11 +70,22 @@ angular.module('storage').factory('sessionStorageFactory', ['$injector', functio
         if (typeof template === 'function')
             getter = template;
 
-        // Otherwise, always create a deep copy
-        else
-            getter = function getCopy() {
-                return angular.copy(template);
+        // Otherwise, create and maintain a deep copy (automatically cached to
+        // avoid "infdig" errors)
+        else {
+            var cached = angular.copy(template);
+            getter = function getIndependentCopy() {
+
+                // Reset to template only if changed externally, such that
+                // session storage values can be safely used in scope watches
+                // even if not logged in
+                if (!_.isEqual(cached, template))
+                    cached = angular.copy(template);
+
+                return cached;
+
             };
+        }
 
         /**
          * The current value of this storage, or undefined if not yet set.

From f61f016fdf2207a3be9ccda405dc1cba664099a7 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 27 Feb 2023 12:30:05 -0800
Subject: [PATCH 107/289] GUACAMOLE-1744: Provide REST API mechanism for
 testing session validity.

NOTE: This test must not have the effect of resetting a session's last
accessed time, or periodic validity tests will erroneously act as
session keep-alives.
---
 .../app/auth/service/authenticationService.js | 37 ++++++++++++++
 .../apache/guacamole/GuacamoleSession.java    | 49 ++++++++++++++-----
 .../rest/auth/HashTokenSessionMap.java        | 12 ++---
 .../rest/session/SessionResource.java         | 12 +++++
 4 files changed, 92 insertions(+), 18 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
index ce44b184c..8a867cea5 100644
--- a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
+++ b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
@@ -261,6 +261,43 @@ angular.module('auth').factory('authenticationService', ['$injector',
 
     };
 
+    /**
+     * Determines whether the session associated with a particular token is
+     * still valid, without performing an operation that would result in that
+     * session being marked as active. If no token is provided, the session of
+     * the current user is checked.
+     *
+     * @param {string} [token]
+     *     The authentication token to pass with the "Guacamole-Token" header.
+     *     If omitted, and the user is logged in, the user's current
+     *     authentication token will be used.
+     *
+     * @returns {Promise.<!boolean>}
+     *     A promise that resolves with the boolean value "true" if the session
+     *     is valid, and resolves with the boolean value "false" otherwise,
+     *     including if an error prevents session validity from being
+     *     determined. The promise is never rejected.
+     */
+    service.getValidity = function getValidity(token) {
+
+        // NOTE: Because this is a HEAD request, we will not receive a JSON
+        // response body. We will only have a simple yes/no regarding whether
+        // the auth token can be expected to be usable.
+        return service.request({
+            method: 'HEAD',
+            url: 'api/session'
+        }, token)
+
+        .then(function sessionIsValid() {
+            return true;
+        })
+
+        ['catch'](function sessionIsNotValid() {
+            return false;
+        });
+
+    };
+
     /**
      * Makes a request to revoke an authentication token using the token REST
      * API endpoint, returning a promise that succeeds only if the token was
diff --git a/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java b/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java
index 0458639d1..5bf0371b3 100644
--- a/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java
+++ b/guacamole/src/main/java/org/apache/guacamole/GuacamoleSession.java
@@ -99,36 +99,42 @@ public class GuacamoleSession {
     }
 
     /**
-     * Returns the authenticated user associated with this session.
+     * Returns the authenticated user associated with this session. Invoking
+     * this function automatically updates this session's last access time.
      *
      * @return
      *     The authenticated user associated with this session.
      */
     public AuthenticatedUser getAuthenticatedUser() {
+        this.access();
         return authenticatedUser;
     }
 
     /**
      * Replaces the authenticated user associated with this session with the
-     * given authenticated user.
+     * given authenticated user. Invoking this function automatically updates
+     * this session's last access time.
      *
      * @param authenticatedUser
      *     The authenticated user to associated with this session.
      */
     public void setAuthenticatedUser(AuthenticatedUser authenticatedUser) {
+        this.access();
         this.authenticatedUser = authenticatedUser;
     }
 
     /**
      * Returns a list of all UserContexts associated with this session. Each
      * AuthenticationProvider currently loaded by Guacamole may provide its own
-     * UserContext for any successfully-authenticated user.
+     * UserContext for any successfully-authenticated user. Invoking this
+     * function automatically updates this session's last access time.
      *
      * @return
      *     An unmodifiable list of all UserContexts associated with this
      *     session.
      */
     public List<DecoratedUserContext> getUserContexts() {
+        this.access();
         return Collections.unmodifiableList(userContexts);
     }
 
@@ -136,6 +142,8 @@ public class GuacamoleSession {
      * Returns true if all user contexts associated with this session are
      * valid, or false if any user context is not valid. If a session is not
      * valid, it may no longer be used, and invalidate() should be invoked.
+     * Invoking this function does not affect the last access time of this
+     * session.
      *
      * @return
      *     true if all user contexts associated with this session are
@@ -151,7 +159,8 @@ public class GuacamoleSession {
     /**
      * Returns the UserContext associated with this session that originated
      * from the AuthenticationProvider with the given identifier. If no such
-     * UserContext exists, an exception is thrown.
+     * UserContext exists, an exception is thrown. Invoking this function
+     * automatically updates this session's last access time.
      *
      * @param authProviderIdentifier
      *     The unique identifier of the AuthenticationProvider that created the
@@ -188,20 +197,24 @@ public class GuacamoleSession {
 
     /**
      * Replaces all UserContexts associated with this session with the given
-     * List of UserContexts.
+     * List of UserContexts. Invoking this function automatically updates this
+     * session's last access time.
      *
      * @param userContexts
      *     The List of UserContexts to associate with this session.
      */
     public void setUserContexts(List<DecoratedUserContext> userContexts) {
+        this.access();
         this.userContexts = userContexts;
     }
     
     /**
-     * Returns whether this session has any associated active tunnels.
+     * Returns whether this session has any associated active tunnels. Invoking
+     * this function does not affect the last access time of this session.
      *
-     * @return true if this session has any associated active tunnels,
-     *         false otherwise.
+     * @return
+     *     true if this session has any associated active tunnels, false
+     *     otherwise.
      */
     public boolean hasTunnels() {
         return !tunnels.isEmpty();
@@ -214,10 +227,14 @@ public class GuacamoleSession {
      * session. A tunnel need not be present here to be used by the user
      * associated with this session, but tunnels not in this set will not
      * be taken into account when determining whether a session is in use.
+     * Invoking this function automatically updates this session's last access
+     * time.
      *
-     * @return A map of all active tunnels associated with this session.
+     * @return
+     *     A map of all active tunnels associated with this session.
      */
     public Map<String, UserTunnel> getTunnels() {
+        this.access();
         return tunnels;
     }
 
@@ -228,16 +245,23 @@ public class GuacamoleSession {
      * @param tunnel The tunnel to associate with this session.
      */
     public void addTunnel(UserTunnel tunnel) {
+        this.access();
         tunnels.put(tunnel.getUUID().toString(), tunnel);
     }
 
     /**
      * Disassociates the tunnel having the given UUID from this session.
+     * Invoking this function automatically updates this session's last access
+     * time.
      *
-     * @param uuid The UUID of the tunnel to disassociate from this session.
-     * @return true if the tunnel existed and was removed, false otherwise.
+     * @param uuid
+     *     The UUID of the tunnel to disassociate from this session.
+     *
+     * @return
+     *     true if the tunnel existed and was removed, false otherwise.
      */
     public boolean removeTunnel(String uuid) {
+        this.access();
         return tunnels.remove(uuid) != null;
     }
 
@@ -251,7 +275,8 @@ public class GuacamoleSession {
     /**
      * Returns the time this session was last accessed, as the number of
      * milliseconds since midnight January 1, 1970 GMT. Session access must
-     * be explicitly marked through calls to the access() function.
+     * be explicitly marked through calls to the access() function. Invoking
+     * this function does not affect the last access time of this session.
      *
      * @return The time this session was last accessed.
      */
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
index 15d11eb62..cabbb78ee 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/HashTokenSessionMap.java
@@ -208,12 +208,12 @@ public class HashTokenSessionMap implements TokenSessionMap {
         if (authToken == null)
             return null;
 
-        // Update the last access time and return the GuacamoleSession
-        GuacamoleSession session = sessionMap.get(authToken);
-        if (session != null)
-            session.access();
-
-        return session;
+        // Return the GuacamoleSession having the given auth token (NOTE: We
+        // do not update the access time here, as it is necessary to be able
+        // to retrieve and check the session without causing that session to
+        // be marked as active. Instead, those updates occur as needed when
+        // functions within the GuacamoleSession are invoked.)
+        return sessionMap.get(authToken);
 
     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/session/SessionResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/session/SessionResource.java
index 6116c3785..adf8ed687 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/session/SessionResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/session/SessionResource.java
@@ -24,6 +24,7 @@ import com.google.inject.assistedinject.AssistedInject;
 import javax.inject.Inject;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.DELETE;
+import javax.ws.rs.HEAD;
 import javax.ws.rs.Path;
 import javax.ws.rs.PathParam;
 import javax.ws.rs.Produces;
@@ -184,4 +185,15 @@ public class SessionResource {
 
     }
 
+    /**
+     * Tests whether this session resource represented a valid session at the
+     * time it was created. This function always succeeds. It is possible for
+     * an HTTP request aimed at this operation to fail, but that failure occurs
+     * further up the chain when locating the session.
+     */
+    @HEAD
+    public void checkValidity() {
+        // Do nothing
+    }
+
 }

From d10c35396e97f5603aafacc7eb9f738ba0eb951b Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 27 Feb 2023 12:31:51 -0800
Subject: [PATCH 108/289] GUACAMOLE-1744: Automatically reset UI if session is
 no longer valid.

---
 .../app/index/controllers/indexController.js  | 72 +++++++++++++++++--
 1 file changed, 65 insertions(+), 7 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/index/controllers/indexController.js b/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
index 77f67db2f..232e0495d 100644
--- a/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
+++ b/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
@@ -23,14 +23,30 @@
 angular.module('index').controller('indexController', ['$scope', '$injector',
         function indexController($scope, $injector) {
 
+    /**
+     * The number of milliseconds that should elapse between client-side
+     * session checks. This DOES NOT impact whether a session expires at all;
+     * such checks will always be server-side. This only affects how quickly
+     * the client-side view can recognize that a user's session has expired
+     * absent any action taken by the user.
+     *
+     * @type {!number}
+     */
+    const SESSION_VALIDITY_RECHECK_INTERVAL = 15000;
+
+    // Required types
+    const ManagedClientState = $injector.get('ManagedClientState');
+
     // Required services
-    const $document         = $injector.get('$document');
-    const $location         = $injector.get('$location');
-    const $route            = $injector.get('$route');
-    const $window           = $injector.get('$window');
-    const clipboardService  = $injector.get('clipboardService');
-    const guacNotification  = $injector.get('guacNotification');
-    const guacClientManager = $injector.get('guacClientManager');
+    const $document              = $injector.get('$document');
+    const $interval              = $injector.get('$interval');
+    const $location              = $injector.get('$location');
+    const $route                 = $injector.get('$route');
+    const $window                = $injector.get('$window');
+    const authenticationService  = $injector.get('authenticationService');
+    const clipboardService       = $injector.get('clipboardService');
+    const guacNotification       = $injector.get('guacNotification');
+    const guacClientManager      = $injector.get('guacClientManager');
 
     /**
      * The error that prevents the current page from rendering at all. If no
@@ -202,6 +218,48 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
         keyboard.reset();
     };
 
+    /**
+     * Returns whether the current user has at least one active connection
+     * running within the current tab.
+     *
+     * @returns {!boolean}
+     *     true if the current user has at least one active connection running
+     *     in the current browser tab, false otherwise.
+     */
+    var hasActiveTunnel = function hasActiveTunnel() {
+
+        var clients = guacClientManager.getManagedClients();
+        for (var id in clients) {
+
+            switch (clients[id].clientState.connectionState) {
+                case ManagedClientState.ConnectionState.CONNECTING:
+                case ManagedClientState.ConnectionState.WAITING:
+                case ManagedClientState.ConnectionState.CONNECTED:
+                    return true;
+            }
+
+        }
+
+        return false;
+
+    };
+
+    // If we're logged in and not connected to anything, periodically check
+    // whether the current session is still valid. If the session has expired,
+    // refresh the auth state to reshow the login screen (rather than wait for
+    // the user to take some action and discover that they are not logged in
+    // after all). There is no need to do this if a connection is active as
+    // that connection activity will already automatically check session
+    // validity.
+    $interval(function cleanUpViewIfSessionInvalid() {
+        if ($scope.applicationState === ApplicationState.READY && !hasActiveTunnel()) {
+            authenticationService.getValidity().then(function validityDetermined(valid) {
+                if (!valid)
+                    $scope.reAuthenticate();
+            });
+        }
+    }, SESSION_VALIDITY_RECHECK_INTERVAL);
+
     // Release all keys upon form submission (there may not be corresponding
     // keyup events for key presses involved in submitting a form)
     $document.on('submit', function formSubmitted() {

From 2c15f3d21ffb2bbb2c304daf892efb34be1f32a7 Mon Sep 17 00:00:00 2001
From: Alex Leitner <leitnersalex@gmail.com>
Date: Wed, 22 Feb 2023 18:47:29 +0000
Subject: [PATCH 109/289] GUACAMOLE-1740: Don't display clipboard contents in
 the clipboard editor until it is focused on.

---
 .../app/clipboard/directives/guacClipboard.js | 22 +++++++++++++++++--
 .../src/app/clipboard/styles/clipboard.css    | 13 +++++++++--
 .../clipboard/templates/guacClipboard.html    |  5 ++++-
 .../main/frontend/src/translations/en.json    |  1 +
 .../main/frontend/src/translations/ja.json    |  3 ++-
 5 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/clipboard/directives/guacClipboard.js b/guacamole/src/main/frontend/src/app/clipboard/directives/guacClipboard.js
index f89494c4c..789756bd8 100644
--- a/guacamole/src/main/frontend/src/app/clipboard/directives/guacClipboard.js
+++ b/guacamole/src/main/frontend/src/app/clipboard/directives/guacClipboard.js
@@ -49,11 +49,29 @@ angular.module('clipboard').directive('guacClipboard', ['$injector',
 
         /**
          * The DOM element which will contain the clipboard contents within the
-         * user interface provided by this directive.
+         * user interface provided by this directive. We populate the clipboard
+         * editor via this DOM element rather than updating a model so that we
+         * are prepared for future support of rich text contents.
          *
          * @type Element
          */
-        var element = $element[0];
+        var element = $element[0].querySelectorAll('.clipboard.active')[0];
+
+        /**
+         * When isActive is set to true then the Clipboard data will be
+         * displayed in the Clipboard Editor. When false, the Clipboard Editor
+         * will not be displayed with Clipboard data.
+         *
+         * @type Boolean
+         */
+        $scope.isActive = false;
+
+        /**
+         * Updates clipboard editor to be active.
+         */
+        $scope.setActive = function setActive() {
+            $scope.isActive = true;
+        };
 
         /**
          * Rereads the contents of the clipboard field, updating the
diff --git a/guacamole/src/main/frontend/src/app/clipboard/styles/clipboard.css b/guacamole/src/main/frontend/src/app/clipboard/styles/clipboard.css
index 91fb328bb..d71287ac7 100644
--- a/guacamole/src/main/frontend/src/app/clipboard/styles/clipboard.css
+++ b/guacamole/src/main/frontend/src/app/clipboard/styles/clipboard.css
@@ -31,8 +31,6 @@
     width: 100%;
     height: 2in;
     white-space: pre;
-    font-size: 1em;
-    overflow: auto;
     padding: 0.25em;
 }
 
@@ -59,3 +57,14 @@
     white-space: pre;
     overflow: hidden;
 }
+
+.active {
+    overflow: auto;
+    font-size: 1em;
+}
+
+.inactive {
+    overflow: hidden;
+    font-size: 0.9em;
+    opacity: 0.5;
+}
diff --git a/guacamole/src/main/frontend/src/app/clipboard/templates/guacClipboard.html b/guacamole/src/main/frontend/src/app/clipboard/templates/guacClipboard.html
index b860f0319..4e1ebda8e 100644
--- a/guacamole/src/main/frontend/src/app/clipboard/templates/guacClipboard.html
+++ b/guacamole/src/main/frontend/src/app/clipboard/templates/guacClipboard.html
@@ -1 +1,4 @@
-<textarea class="clipboard"></textarea>
+<div>
+    <textarea ng-show="isActive" class="clipboard active"></textarea>
+    <textarea ng-show="!isActive" class="clipboard inactive" ng-focus="setActive()">{{'CLIENT.TEXT_CLIPBOARD_AWAITING_FOCUS' | translate}}</textarea>
+</div>
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index d93861927..450a455bb 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -162,6 +162,7 @@
         "TEXT_USER_LEFT"                  : "{USERNAME} has left the connection.",
         "TEXT_RECONNECT_COUNTDOWN"        : "Reconnecting in {REMAINING} {REMAINING, plural, one{second} other{seconds}}...",
         "TEXT_FILE_TRANSFER_PROGRESS"     : "{PROGRESS} {UNIT, select, b{B} kb{KB} mb{MB} gb{GB} other{}}",
+        "TEXT_CLIPBOARD_AWAITING_FOCUS"   : "Click to view clipboard data...",
 
         "URL_OSK_LAYOUT" : "layouts/en-us-qwerty.json"
 
diff --git a/guacamole/src/main/frontend/src/translations/ja.json b/guacamole/src/main/frontend/src/translations/ja.json
index a26d589d0..e4c2ad0c4 100644
--- a/guacamole/src/main/frontend/src/translations/ja.json
+++ b/guacamole/src/main/frontend/src/translations/ja.json
@@ -132,7 +132,8 @@
         "TEXT_CLIENT_STATUS_DISCONNECTED" : "切断されました。",
         "TEXT_CLIENT_STATUS_UNSTABLE"     : "Guacamoleサーバへのネットワーク接続が不安定です。",
         "TEXT_CLIENT_STATUS_WAITING"      : "Guacamoleサーバに接続しました。応答を待っています",
-        "TEXT_RECONNECT_COUNTDOWN"        : "再接続しています... {REMAINING} {REMAINING, plural, one{second} other{seconds}}..."
+        "TEXT_RECONNECT_COUNTDOWN"        : "再接続しています... {REMAINING} {REMAINING, plural, one{second} other{seconds}}...",
+        "TEXT_CLIPBOARD_AWAITING_FOCUS"   : "クリックをしてコピー/カットされたテキストが表示されます..."
 
     },
 

From 5b8170eee447dc8a81814a1a02ba9962e59842ab Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 28 Feb 2023 11:01:42 -0800
Subject: [PATCH 110/289] GUACAMOLE-1744: Clean up UI only if user is not
 logged in.

---
 .../main/frontend/src/app/index/controllers/indexController.js  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/app/index/controllers/indexController.js b/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
index 232e0495d..52c9d5853 100644
--- a/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
+++ b/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
@@ -252,7 +252,7 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
     // that connection activity will already automatically check session
     // validity.
     $interval(function cleanUpViewIfSessionInvalid() {
-        if ($scope.applicationState === ApplicationState.READY && !hasActiveTunnel()) {
+        if (!!authenticationService.getCurrentToken() && !hasActiveTunnel()) {
             authenticationService.getValidity().then(function validityDetermined(valid) {
                 if (!valid)
                     $scope.reAuthenticate();

From 1015df6b47279f34c0dc53de8a6e73288cd19997 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 17 Jan 2023 10:42:53 -0800
Subject: [PATCH 111/289] GUACAMOLE-839: Move nonce-generation service to
 internal common SSO library.

---
 .../main/java/org/apache/guacamole/auth/sso}/NonceService.java  | 2 +-
 .../guacamole/auth/openid/AuthenticationProviderService.java    | 2 +-
 .../auth/openid/OpenIDAuthenticationProviderModule.java         | 2 +-
 .../guacamole/auth/openid/token/TokenValidationService.java     | 1 +
 4 files changed, 4 insertions(+), 3 deletions(-)
 rename extensions/guacamole-auth-sso/modules/{guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token => guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso}/NonceService.java (98%)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/NonceService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
similarity index 98%
rename from extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/NonceService.java
rename to extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
index 778112a76..7c41dd9d6 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/NonceService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-package org.apache.guacamole.auth.openid.token;
+package org.apache.guacamole.auth.sso;
 
 import com.google.inject.Singleton;
 import java.math.BigInteger;
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java
index 23ac815dc..e83ca092e 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java
@@ -29,9 +29,9 @@ import java.util.Set;
 import javax.servlet.http.HttpServletRequest;
 import javax.ws.rs.core.UriBuilder;
 import org.apache.guacamole.auth.openid.conf.ConfigurationService;
-import org.apache.guacamole.auth.openid.token.NonceService;
 import org.apache.guacamole.auth.openid.token.TokenValidationService;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.sso.NonceService;
 import org.apache.guacamole.auth.sso.SSOAuthenticationProviderService;
 import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
 import org.apache.guacamole.form.Field;
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java
index dde4ef2a6..ba1bf74b3 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java
@@ -21,7 +21,7 @@ package org.apache.guacamole.auth.openid;
 
 import com.google.inject.AbstractModule;
 import org.apache.guacamole.auth.openid.conf.ConfigurationService;
-import org.apache.guacamole.auth.openid.token.NonceService;
+import org.apache.guacamole.auth.sso.NonceService;
 import org.apache.guacamole.auth.openid.token.TokenValidationService;
 
 /**
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
index 72200df3c..b9c2add2a 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
@@ -26,6 +26,7 @@ import java.util.List;
 import java.util.Set;
 import org.apache.guacamole.auth.openid.conf.ConfigurationService;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.sso.NonceService;
 import org.jose4j.jwk.HttpsJwks;
 import org.jose4j.jwt.JwtClaims;
 import org.jose4j.jwt.MalformedClaimException;

From f2c7d746ea75a6cf4985090bbb324fa40d055873 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 26 Jan 2023 09:43:49 -0800
Subject: [PATCH 112/289] GUACAMOLE-839: Move authentication session management
 service to internal common SSO library.

---
 .../auth/sso/AuthenticationSession.java       | 58 ++++++++++++++++++
 .../sso}/AuthenticationSessionManager.java    | 56 +++++-------------
 .../auth/sso}/IdentifierGenerator.java        | 25 ++++++--
 .../guacamole/auth/sso/NonceService.java      | 18 +++---
 .../saml/AuthenticationProviderService.java   |  4 +-
 .../SAMLAuthenticationProviderModule.java     |  6 +-
 .../acs/AssertionConsumerServiceResource.java |  4 +-
 ...on.java => SAMLAuthenticationSession.java} | 28 ++++-----
 .../acs/SAMLAuthenticationSessionManager.java | 59 +++++++++++++++++++
 .../guacamole/auth/saml/acs/SAMLService.java  | 14 ++---
 10 files changed, 188 insertions(+), 84 deletions(-)
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSession.java
 rename extensions/guacamole-auth-sso/modules/{guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs => guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso}/AuthenticationSessionManager.java (72%)
 rename extensions/guacamole-auth-sso/modules/{guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs => guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso}/IdentifierGenerator.java (66%)
 rename extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/{AuthenticationSession.java => SAMLAuthenticationSession.java} (77%)
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSessionManager.java

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSession.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSession.java
new file mode 100644
index 000000000..89d75df70
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSession.java
@@ -0,0 +1,58 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.sso;
+
+/**
+ * Representation of an in-progress authentication attempt.
+ */
+public class AuthenticationSession {
+
+    /**
+     * The absolute point in time after which this authentication session is
+     * invalid. This value is a UNIX epoch timestamp, as may be returned by
+     * {@link System#currentTimeMillis()}.
+     */
+    private final long expirationTimestamp;
+
+    /**
+     * Creates a new AuthenticationSession representing an in-progress
+     * authentication attempt.
+     *
+     * @param expires
+     *     The number of milliseconds that may elapse before this session must
+     *     be considered invalid.
+     */
+    public AuthenticationSession(long expires) {
+        this.expirationTimestamp = System.currentTimeMillis() + expires;
+    }
+
+    /**
+     * Returns whether this authentication session is still valid (has not yet
+     * expired).
+     *
+     * @return
+     *     true if this authentication session is still valid, false if it has
+     *     expired.
+     */
+    public boolean isValid() {
+        return System.currentTimeMillis() < expirationTimestamp;
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AuthenticationSessionManager.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
similarity index 72%
rename from extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AuthenticationSessionManager.java
rename to extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
index 2e55d2cfc..7050c98be 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AuthenticationSessionManager.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-package org.apache.guacamole.auth.saml.acs;
+package org.apache.guacamole.auth.sso;
 
 import com.google.common.base.Predicates;
 import com.google.inject.Inject;
@@ -29,14 +29,17 @@ import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 
 /**
- * Manager service that temporarily stores SAML authentication attempts while
+ * Manager service that temporarily stores a user's authentication status while
  * the authentication flow is underway. Authentication attempts are represented
  * as temporary authentication sessions, allowing authentication attempts to
- * span multiple requests and redirects. Invalid or stale authentication
+ * span multiple requests, redirects, etc. Invalid or stale authentication
  * sessions are automatically purged from storage.
+ *
+ * @param <T>
+ *     The type of sessions managed by this session manager.
  */
 @Singleton
-public class AuthenticationSessionManager {
+public class AuthenticationSessionManager<T extends AuthenticationSession> {
 
     /**
      * Generator of arbitrary, unique, unpredictable identifiers.
@@ -48,8 +51,7 @@ public class AuthenticationSessionManager {
      * Map of authentication session identifiers to their associated
      * {@link AuthenticationSession}.
      */
-    private final ConcurrentMap<String, AuthenticationSession> sessions =
-        new ConcurrentHashMap<>();
+    private final ConcurrentMap<String, T> sessions = new ConcurrentHashMap<>();
 
     /**
      * Executor service which runs the periodic cleanup task
@@ -59,7 +61,7 @@ public class AuthenticationSessionManager {
 
     /**
      * Creates a new AuthenticationSessionManager that manages in-progress
-     * SAML authentication attempts. Invalid, stale sessions are automatically
+     * authentication attempts. Invalid, stale sessions are automatically
      * cleaned up.
      */
     public AuthenticationSessionManager() {
@@ -82,10 +84,10 @@ public class AuthenticationSessionManager {
      *     was invoked, or null if the session is no longer valid or no such
      *     value was returned by defer().
      */
-    public AuthenticationSession resume(String identifier) {
+    public T resume(String identifier) {
 
         if (identifier != null) {
-            AuthenticationSession session = sessions.remove(identifier);
+            T session = sessions.remove(identifier);
             if (session != null && session.isValid())
                 return session;
         }
@@ -94,32 +96,6 @@ public class AuthenticationSessionManager {
 
     }
 
-    /**
-     * Returns the identity finally asserted by the SAML IdP at the end of the
-     * authentication process represented by the authentication session with
-     * the given identifier. If there is no such authentication session, or no
-     * valid identity has been asserted by the SAML IdP for that session, null
-     * is returned.
-     *
-     * @param identifier
-     *     The unique string returned by the call to defer(). For convenience,
-     *     this value may safely be null.
-     *
-     * @return
-     *     The identity finally asserted by the SAML IdP at the end of the
-     *     authentication process represented by the authentication session
-     *     with the given identifier, or null if there is no such identity.
-     */
-    public AssertedIdentity getIdentity(String identifier) {
-
-        AuthenticationSession session = resume(identifier);
-        if (session != null)
-            return session.getIdentity();
-
-        return null;
-
-    }
-
     /**
      * Defers the Guacamole side of authentication for the user having the
      * given authentication session such that it may be later resumed through a
@@ -129,14 +105,14 @@ public class AuthenticationSessionManager {
      * This method will automatically generate a new identifier.
      *
      * @param session
-     *     The {@link AuthenticationSession} representing the in-progress SAML
+     *     The {@link AuthenticationSession} representing the in-progress
      *     authentication attempt.
      *
      * @return
      *     A unique and unpredictable string that may be used to represent the
      *     given session when calling resume().
      */
-    public String defer(AuthenticationSession session) {
+    public String defer(T session) {
         String identifier = idGenerator.generateIdentifier();
         sessions.put(identifier, session);
         return identifier;
@@ -152,20 +128,20 @@ public class AuthenticationSessionManager {
      * or similar unique identifier.
      *
      * @param session
-     *     The {@link AuthenticationSession} representing the in-progress SAML
+     *     The {@link AuthenticationSession} representing the in-progress
      *     authentication attempt.
      *
      * @param identifier
      *     A unique and unpredictable string that may be used to represent the
      *     given session when calling resume().
      */
-    public void defer(AuthenticationSession session, String identifier) {
+    public void defer(T session, String identifier) {
         sessions.put(identifier, session);
     }
 
     /**
      * Shuts down the executor service that periodically removes all invalid
-     * authentication sessions. This must be invoked when the SAML extension is
+     * authentication sessions. This must be invoked when the auth extension is
      * shut down in order to avoid resource leaks.
      */
     public void shutdown() {
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/IdentifierGenerator.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/IdentifierGenerator.java
similarity index 66%
rename from extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/IdentifierGenerator.java
rename to extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/IdentifierGenerator.java
index a2a3aae6a..799b31b13 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/IdentifierGenerator.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/IdentifierGenerator.java
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-package org.apache.guacamole.auth.saml.acs;
+package org.apache.guacamole.auth.sso;
 
 import com.google.common.io.BaseEncoding;
 import com.google.inject.Singleton;
@@ -26,7 +26,7 @@ import java.security.SecureRandom;
 /**
  * Generator of unique and unpredictable identifiers. Each generated identifier
  * is an arbitrary, random string produced using a cryptographically-secure
- * random number generator and consists of at least 256 bits.
+ * random number generator.
  */
 @Singleton
 public class IdentifierGenerator {
@@ -43,10 +43,27 @@ public class IdentifierGenerator {
      * number generator.
      *
      * @return
-     *     A unique and unpredictable identifier.
+     *     A unique and unpredictable identifier with at least 256 bits of
+     *     entropy.
      */
     public String generateIdentifier() {
-        byte[] bytes = new byte[33];
+        return generateIdentifier(256);
+    }
+
+    /**
+     * Generates a unique and unpredictable identifier having at least the
+     * given number of bits of entropy. The resulting identifier may have more
+     * than the number of bits required.
+     *
+     * @param minBits
+     *     The number of bits of entropy that the identifier should contain.
+     *
+     * @return
+     *     A unique and unpredictable identifier with at least the given number
+     *     of bits of entropy.
+     */
+    public String generateIdentifier(int minBits) {
+        byte[] bytes = new byte[(minBits + 23) / 24 * 3]; // Round up to nearest multiple of 3 bytes, as base64 encodes blocks of 3 bytes at a time
         secureRandom.nextBytes(bytes);
         return BaseEncoding.base64().encode(bytes);
     }
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
index 7c41dd9d6..88fff881b 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
@@ -19,9 +19,8 @@
 
 package org.apache.guacamole.auth.sso;
 
+import com.google.inject.Inject;
 import com.google.inject.Singleton;
-import java.math.BigInteger;
-import java.security.SecureRandom;
 import java.util.Iterator;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
@@ -33,23 +32,28 @@ import java.util.concurrent.ConcurrentHashMap;
 public class NonceService {
 
     /**
-     * Cryptographically-secure random number generator for generating the
-     * required nonce.
+     * Generator of arbitrary, unique, unpredictable identifiers.
      */
-    private final SecureRandom random = new SecureRandom();
+    @Inject
+    private IdentifierGenerator idGenerator;
 
     /**
      * Map of all generated nonces to their corresponding expiration timestamps.
      * This Map must be periodically swept of expired nonces to avoid growing
      * without bound.
      */
-    private final Map<String, Long> nonces = new ConcurrentHashMap<String, Long>();
+    private final Map<String, Long> nonces = new ConcurrentHashMap<>();
 
     /**
      * The timestamp of the last expired nonce sweep.
      */
     private long lastSweep = System.currentTimeMillis();
 
+    /**
+     * The minimum number of bits of entropy to include in each nonce.
+     */
+    private static final int NONCE_BITS = 128;
+
     /**
      * The minimum amount of time to wait between sweeping expired nonces from
      * the Map.
@@ -102,7 +106,7 @@ public class NonceService {
         sweepExpiredNonces();
 
         // Generate and store nonce, along with expiration timestamp
-        String nonce = new BigInteger(130, random).toString(32);
+        String nonce = idGenerator.generateIdentifier(NONCE_BITS);
         nonces.put(nonce, System.currentTimeMillis() + maxAge);
         return nonce;
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java
index cdd53dec6..982028f16 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java
@@ -28,7 +28,7 @@ import javax.servlet.http.HttpServletRequest;
 import org.apache.guacamole.auth.saml.user.SAMLAuthenticatedUser;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.auth.saml.acs.AssertedIdentity;
-import org.apache.guacamole.auth.saml.acs.AuthenticationSessionManager;
+import org.apache.guacamole.auth.saml.acs.SAMLAuthenticationSessionManager;
 import org.apache.guacamole.auth.saml.acs.SAMLService;
 import org.apache.guacamole.auth.sso.SSOAuthenticationProviderService;
 import org.apache.guacamole.form.Field;
@@ -61,7 +61,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
      * Manager of active SAML authentication attempts.
      */
     @Inject
-    private AuthenticationSessionManager sessionManager;
+    private SAMLAuthenticationSessionManager sessionManager;
 
     /**
      * Service for processing SAML requests/responses.
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java
index 3c7300baa..7c7dd49ed 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java
@@ -22,8 +22,7 @@ package org.apache.guacamole.auth.saml;
 import com.google.inject.AbstractModule;
 import org.apache.guacamole.auth.saml.conf.ConfigurationService;
 import org.apache.guacamole.auth.saml.acs.AssertionConsumerServiceResource;
-import org.apache.guacamole.auth.saml.acs.AuthenticationSessionManager;
-import org.apache.guacamole.auth.saml.acs.IdentifierGenerator;
+import org.apache.guacamole.auth.saml.acs.SAMLAuthenticationSessionManager;
 import org.apache.guacamole.auth.saml.acs.SAMLService;
 
 /**
@@ -34,9 +33,8 @@ public class SAMLAuthenticationProviderModule extends AbstractModule {
     @Override
     protected void configure() {
         bind(AssertionConsumerServiceResource.class);
-        bind(AuthenticationSessionManager.class);
         bind(ConfigurationService.class);
-        bind(IdentifierGenerator.class);
+        bind(SAMLAuthenticationSessionManager.class);
         bind(SAMLService.class);
     }
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AssertionConsumerServiceResource.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AssertionConsumerServiceResource.java
index e316b3868..7aadc73f5 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AssertionConsumerServiceResource.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AssertionConsumerServiceResource.java
@@ -56,7 +56,7 @@ public class AssertionConsumerServiceResource extends SSOResource {
      * Manager of active SAML authentication attempts.
      */
     @Inject
-    private AuthenticationSessionManager sessionManager;
+    private SAMLAuthenticationSessionManager sessionManager;
 
     /**
      * Service for processing SAML requests/responses.
@@ -107,7 +107,7 @@ public class AssertionConsumerServiceResource extends SSOResource {
         try {
 
             // Validate and parse identity asserted by SAML IdP
-            AuthenticationSession session = saml.processResponse(
+            SAMLAuthenticationSession session = saml.processResponse(
                     consumedRequest.getRequestURL().toString(),
                     relayState, samlResponse);
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AuthenticationSession.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSession.java
similarity index 77%
rename from extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AuthenticationSession.java
rename to extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSession.java
index b73bc7adb..bbd74e2a9 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/AuthenticationSession.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSession.java
@@ -19,17 +19,12 @@
 
 package org.apache.guacamole.auth.saml.acs;
 
+import org.apache.guacamole.auth.sso.AuthenticationSession;
+
 /**
  * Representation of an in-progress SAML authentication attempt.
  */
-public class AuthenticationSession {
-
-    /**
-     * The absolute point in time after which this authentication session is
-     * invalid. This value is a UNIX epoch timestamp, as may be returned by
-     * {@link System#currentTimeMillis()}.
-     */
-    private final long expirationTimestamp;
+public class SAMLAuthenticationSession extends AuthenticationSession {
 
     /**
      * The request ID of the SAML request associated with the authentication
@@ -55,24 +50,21 @@ public class AuthenticationSession {
      *     The number of milliseconds that may elapse before this session must
      *     be considered invalid.
      */
-    public AuthenticationSession(String requestId, long expires) {
-        this.expirationTimestamp = System.currentTimeMillis() + expires;
+    public SAMLAuthenticationSession(String requestId, long expires) {
+        super(expires);
         this.requestId = requestId;
     }
 
     /**
-     * Returns whether this authentication session is still valid (has not yet
-     * expired). If an identity has been asserted by the SAML IdP, this
+     * {@inheritDoc}
+     *
+     * <p>If an identity has been asserted by the SAML IdP, this
      * considers also whether the SAML response asserting that identity has
      * expired.
-     *
-     * @return
-     *     true if this authentication session is still valid, false if it has
-     *     expired.
      */
+    @Override
     public boolean isValid() {
-        return System.currentTimeMillis() < expirationTimestamp
-                && (identity == null || identity.isValid());
+        return super.isValid() && (identity == null || identity.isValid());
     }
 
     /**
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSessionManager.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSessionManager.java
new file mode 100644
index 000000000..4adf82f2c
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSessionManager.java
@@ -0,0 +1,59 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.saml.acs;
+
+import com.google.inject.Singleton;
+import org.apache.guacamole.auth.sso.AuthenticationSessionManager;
+
+/**
+ * Manager service that temporarily stores SAML authentication attempts while
+ * the authentication flow is underway.
+ */
+@Singleton
+public class SAMLAuthenticationSessionManager
+        extends AuthenticationSessionManager<SAMLAuthenticationSession> {
+
+    /**
+     * Returns the identity finally asserted by the SAML IdP at the end of the
+     * authentication process represented by the authentication session with
+     * the given identifier. If there is no such authentication session, or no
+     * valid identity has been asserted by the SAML IdP for that session, null
+     * is returned.
+     *
+     * @param identifier
+     *     The unique string returned by the call to defer(). For convenience,
+     *     this value may safely be null.
+     *
+     * @return
+     *     The identity finally asserted by the SAML IdP at the end of the
+     *     authentication process represented by the authentication session
+     *     with the given identifier, or null if there is no such identity.
+     */
+    public AssertedIdentity getIdentity(String identifier) {
+
+        SAMLAuthenticationSession session = resume(identifier);
+        if (session != null)
+            return session.getIdentity();
+
+        return null;
+
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java
index c3357eefb..2fe6da4c8 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java
@@ -22,7 +22,6 @@ package org.apache.guacamole.auth.saml.acs;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import com.onelogin.saml2.Auth;
-import com.onelogin.saml2.authn.AuthnRequest;
 import com.onelogin.saml2.authn.AuthnRequestParams;
 import com.onelogin.saml2.authn.SamlResponse;
 import com.onelogin.saml2.exception.SettingsException;
@@ -37,6 +36,7 @@ import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleSecurityException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.auth.saml.conf.ConfigurationService;
+import org.apache.guacamole.auth.sso.IdentifierGenerator;
 import org.xml.sax.SAXException;
 
 /**
@@ -56,7 +56,7 @@ public class SAMLService {
      * Manager of active SAML authentication attempts.
      */
     @Inject
-    private AuthenticationSessionManager sessionManager;
+    private SAMLAuthenticationSessionManager sessionManager;
 
     /**
      * Generator of arbitrary, unique, unpredictable identifiers.
@@ -99,7 +99,7 @@ public class SAMLService {
 
             // Create a new authentication session to represent this attempt while
             // it is in progress, using the request ID that was just issued
-            AuthenticationSession session = new AuthenticationSession(
+            SAMLAuthenticationSession session = new SAMLAuthenticationSession(
                     auth.getLastRequestId(),
                     confService.getAuthenticationTimeout() * 60000L);
 
@@ -127,7 +127,7 @@ public class SAMLService {
 
     /**
      * Processes the given SAML response, as received by the SAML ACS endpoint
-     * at the given URL, producing an {@link AuthenticationSession} that now
+     * at the given URL, producing an {@link SAMLAuthenticationSession} that now
      * includes a valid assertion of the user's identity. If the SAML response
      * is invalid in any way, an exception is thrown.
      *
@@ -148,7 +148,7 @@ public class SAMLService {
      *     given URL.
      *
      * @return
-     *     The {@link AuthenticationSession} associated with the in-progress
+     *     The {@link SAMLAuthenticationSession} associated with the in-progress
      *     authentication attempt, now associated with the {@link AssertedIdentity}
      *     representing the identity of the user asserted by the SAML IdP.
      *
@@ -157,14 +157,14 @@ public class SAMLService {
      *     information required to validate or decrypt the response cannot be
      *     read.
      */
-    public AuthenticationSession processResponse(String url, String relayState,
+    public SAMLAuthenticationSession processResponse(String url, String relayState,
             String encodedResponse) throws GuacamoleException {
 
         if (relayState == null)
             throw new GuacamoleSecurityException("\"RelayState\" value "
                     + "is missing from SAML response.");
 
-        AuthenticationSession session = sessionManager.resume(relayState);
+        SAMLAuthenticationSession session = sessionManager.resume(relayState);
         if (session == null)
             throw new GuacamoleSecurityException("\"RelayState\" value "
                     + "included with SAML response is not valid.");

From 841190df5aa1b081abc30670c2b66c5f0c58972c Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 26 Jan 2023 10:24:08 -0800
Subject: [PATCH 113/289] GUACAMOLE-839: Generate case-insensitive nonce values
 that can safely be used in domains.

---
 .../auth/sso/IdentifierGenerator.java         | 45 ++++++++++++++++---
 .../guacamole/auth/sso/NonceService.java      | 11 +++--
 2 files changed, 47 insertions(+), 9 deletions(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/IdentifierGenerator.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/IdentifierGenerator.java
index 799b31b13..82538c6a9 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/IdentifierGenerator.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/IdentifierGenerator.java
@@ -21,6 +21,7 @@ package org.apache.guacamole.auth.sso;
 
 import com.google.common.io.BaseEncoding;
 import com.google.inject.Singleton;
+import java.math.BigInteger;
 import java.security.SecureRandom;
 
 /**
@@ -40,7 +41,8 @@ public class IdentifierGenerator {
     /**
      * Generates a unique and unpredictable identifier. Each identifier is at
      * least 256-bit and produced using a cryptographically-secure random
-     * number generator.
+     * number generator. The identifier may contain characters that differ only
+     * in case.
      *
      * @return
      *     A unique and unpredictable identifier with at least 256 bits of
@@ -53,7 +55,8 @@ public class IdentifierGenerator {
     /**
      * Generates a unique and unpredictable identifier having at least the
      * given number of bits of entropy. The resulting identifier may have more
-     * than the number of bits required.
+     * than the number of bits required. The identifier may contain characters
+     * that differ only in case.
      *
      * @param minBits
      *     The number of bits of entropy that the identifier should contain.
@@ -63,9 +66,41 @@ public class IdentifierGenerator {
      *     of bits of entropy.
      */
     public String generateIdentifier(int minBits) {
-        byte[] bytes = new byte[(minBits + 23) / 24 * 3]; // Round up to nearest multiple of 3 bytes, as base64 encodes blocks of 3 bytes at a time
-        secureRandom.nextBytes(bytes);
-        return BaseEncoding.base64().encode(bytes);
+        return generateIdentifier(minBits, true);
+    }
+
+    /**
+     * Generates a unique and unpredictable identifier having at least the
+     * given number of bits of entropy. The resulting identifier may have more
+     * than the number of bits required. The identifier may contain characters
+     * that differ only in case.
+     *
+     * @param minBits
+     *     The number of bits of entropy that the identifier should contain.
+     *
+     * @param caseSensitive
+     *     Whether identifiers are permitted to contain characters that vary
+     *     by case. If false, all characters that may vary by case will be
+     *     lowercase, and the generated identifier will be longer.
+     *
+     * @return
+     *     A unique and unpredictable identifier with at least the given number
+     *     of bits of entropy.
+     */
+    public String generateIdentifier(int minBits, boolean caseSensitive) {
+
+        // Generate a base64 identifier if we're allowed to vary by case
+        if (caseSensitive) {
+            int minBytes = (minBits + 23) / 24 * 3; // Round up to nearest multiple of 3 bytes, as base64 encodes blocks of 3 bytes at a time
+            byte[] bytes = new byte[minBytes];
+            secureRandom.nextBytes(bytes);
+            return BaseEncoding.base64().encode(bytes);
+        }
+
+        // Generate base32 identifiers if we cannot vary by case
+        minBits = (minBits + 4) / 5 * 5; // Round up to nearest multiple of 5 bits, as base32 encodes 5 bits at a time
+        return new BigInteger(minBits, secureRandom).toString(32);
+
     }
 
 }
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
index 88fff881b..a06340653 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
@@ -22,11 +22,13 @@ package org.apache.guacamole.auth.sso;
 import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import java.util.Iterator;
+import java.util.Locale;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 
 /**
  * Service for generating and validating single-use random tokens (nonces).
+ * Each generated nonce is at least 128 bits and case-insensitive.
  */
 @Singleton
 public class NonceService {
@@ -98,7 +100,8 @@ public class NonceService {
      *     valid, in milliseconds.
      *
      * @return
-     *     A cryptographically-secure nonce value.
+     *     A cryptographically-secure nonce value. Generated nonces are at
+     *     least 128-bit and are case-insensitive.
      */
     public String generate(long maxAge) {
 
@@ -106,7 +109,7 @@ public class NonceService {
         sweepExpiredNonces();
 
         // Generate and store nonce, along with expiration timestamp
-        String nonce = idGenerator.generateIdentifier(NONCE_BITS);
+        String nonce = idGenerator.generateIdentifier(NONCE_BITS, false);
         nonces.put(nonce, System.currentTimeMillis() + maxAge);
         return nonce;
 
@@ -119,7 +122,7 @@ public class NonceService {
      * invalidates that nonce.
      *
      * @param nonce
-     *     The nonce value to test.
+     *     The nonce value to test. Comparisons are case-insensitive.
      *
      * @return
      *     true if the provided nonce is valid, false otherwise.
@@ -127,7 +130,7 @@ public class NonceService {
     public boolean isValid(String nonce) {
 
         // Remove nonce, verifying whether it was present at all
-        Long expires = nonces.remove(nonce);
+        Long expires = nonces.remove(nonce.toLowerCase(Locale.US));
         if (expires == null)
             return false;
 

From e51d548995ba0ecee9cff4e4fe2ce1368d1fd5b5 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 26 Jan 2023 11:30:51 -0800
Subject: [PATCH 114/289] GUACAMOLE-839: Ensure each NonceService instance has
 its own context (will not validate the nonces of other contexts).

---
 .../main/java/org/apache/guacamole/auth/sso/NonceService.java  | 2 --
 .../auth/openid/OpenIDAuthenticationProviderModule.java        | 3 ++-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
index a06340653..5eb1e4b5d 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
@@ -20,7 +20,6 @@
 package org.apache.guacamole.auth.sso;
 
 import com.google.inject.Inject;
-import com.google.inject.Singleton;
 import java.util.Iterator;
 import java.util.Locale;
 import java.util.Map;
@@ -30,7 +29,6 @@ import java.util.concurrent.ConcurrentHashMap;
  * Service for generating and validating single-use random tokens (nonces).
  * Each generated nonce is at least 128 bits and case-insensitive.
  */
-@Singleton
 public class NonceService {
 
     /**
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java
index ba1bf74b3..2fce2a719 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/OpenIDAuthenticationProviderModule.java
@@ -20,6 +20,7 @@
 package org.apache.guacamole.auth.openid;
 
 import com.google.inject.AbstractModule;
+import com.google.inject.Scopes;
 import org.apache.guacamole.auth.openid.conf.ConfigurationService;
 import org.apache.guacamole.auth.sso.NonceService;
 import org.apache.guacamole.auth.openid.token.TokenValidationService;
@@ -32,7 +33,7 @@ public class OpenIDAuthenticationProviderModule extends AbstractModule {
     @Override
     protected void configure() {
         bind(ConfigurationService.class);
-        bind(NonceService.class);
+        bind(NonceService.class).in(Scopes.SINGLETON);
         bind(TokenValidationService.class);
     }
 

From 2e8cf82234e7cd4741229387ecdc36dc79e58e38 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 26 Jan 2023 11:31:55 -0800
Subject: [PATCH 115/289] GUACAMOLE-839: As with NonceService, ensure each auth
 session manager instance has its own context and will not validate the
 sessions of other session managers.

---
 .../apache/guacamole/auth/sso/AuthenticationSessionManager.java | 2 --
 1 file changed, 2 deletions(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
index 7050c98be..da530f61b 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
@@ -21,7 +21,6 @@ package org.apache.guacamole.auth.sso;
 
 import com.google.common.base.Predicates;
 import com.google.inject.Inject;
-import com.google.inject.Singleton;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.Executors;
@@ -38,7 +37,6 @@ import java.util.concurrent.TimeUnit;
  * @param <T>
  *     The type of sessions managed by this session manager.
  */
-@Singleton
 public class AuthenticationSessionManager<T extends AuthenticationSession> {
 
     /**

From 6bf0b8cf631bded9def46084b9113a4f5e2d232c Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 26 Jan 2023 11:35:44 -0800
Subject: [PATCH 116/289] GUACAMOLE-839: Allow testing of null nonce values.

---
 .../java/org/apache/guacamole/auth/sso/NonceService.java   | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
index 5eb1e4b5d..5717794fd 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
@@ -120,13 +120,18 @@ public class NonceService {
      * invalidates that nonce.
      *
      * @param nonce
-     *     The nonce value to test. Comparisons are case-insensitive.
+     *     The nonce value to test. This value may be null, which will be
+     *     considered an invalid nonce. Comparisons are case-insensitive.
      *
      * @return
      *     true if the provided nonce is valid, false otherwise.
      */
     public boolean isValid(String nonce) {
 
+        // All null nonces are invalid.
+        if (nonce == null)
+            return false;
+
         // Remove nonce, verifying whether it was present at all
         Long expires = nonces.remove(nonce.toLowerCase(Locale.US));
         if (expires == null)

From e2a6947ff6413fd0e165000687ca6802e31372a0 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 26 Jan 2023 17:18:12 -0800
Subject: [PATCH 117/289] GUACAMOLE-839: Implement base support for SSO using
 SSL/TLS authentication (certificates / smart cards).

---
 .../src/main/resources/translations/en.json   |   5 +
 .../modules/guacamole-auth-sso-ssl/.gitignore |   3 +
 .../modules/guacamole-auth-sso-ssl/.ratignore |   1 +
 .../modules/guacamole-auth-sso-ssl/pom.xml    |  74 ++++
 .../ssl/AuthenticationProviderService.java    | 413 ++++++++++++++++++
 .../auth/ssl/SSLAuthenticationProvider.java   |  49 +++
 .../ssl/SSLAuthenticationProviderModule.java  |  39 ++
 .../auth/ssl/SSLAuthenticationSession.java    |  65 +++
 .../ssl/SSLAuthenticationSessionManager.java  |  61 +++
 .../auth/ssl/conf/ConfigurationService.java   | 325 ++++++++++++++
 .../conf/WildcardURIGuacamoleProperty.java    |  66 +++
 .../src/main/resources/guac-manifest.json     |  33 ++
 .../main/resources/html/sso-provider-ssl.html |   4 +
 extensions/guacamole-auth-sso/pom.xml         |   1 +
 14 files changed, 1139 insertions(+)
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/.gitignore
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/.ratignore
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProvider.java
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/WildcardURIGuacamoleProperty.java
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/en.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/en.json
index 859301568..902b7aff1 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/en.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/en.json
@@ -12,6 +12,10 @@
         "NAME" : "SAML SSO Backend"
     },
 
+    "DATA_SOURCE_SSL" : {
+        "NAME" : "SSL/TLS SSO Backend"
+    },
+
     "LOGIN" : {
         "FIELD_HEADER_ID_TOKEN"      : "",
         "FIELD_HEADER_STATE"         : "",
@@ -20,6 +24,7 @@
         "NAME_IDP_CAS"               : "CAS",
         "NAME_IDP_OPENID"            : "OpenID",
         "NAME_IDP_SAML"              : "SAML",
+        "NAME_IDP_SSL"               : "Certificate / Smart Card",
         "SECTION_HEADER_SSO_OPTIONS" : "Sign in with:"
     }
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/.gitignore b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/.gitignore
new file mode 100644
index 000000000..30eb48707
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/.gitignore
@@ -0,0 +1,3 @@
+*~
+target/
+src/main/resources/generated/
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/.ratignore b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/.ratignore
new file mode 100644
index 000000000..da318d12f
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/.ratignore
@@ -0,0 +1 @@
+src/main/resources/html/*.html
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
new file mode 100644
index 000000000..a107e6b7f
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
+                        http://maven.apache.org/maven-v4_0_0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.apache.guacamole</groupId>
+    <artifactId>guacamole-auth-sso-ssl</artifactId>
+    <packaging>jar</packaging>
+    <version>1.5.0</version>
+    <name>guacamole-auth-sso-ssl</name>
+    <url>http://guacamole.apache.org/</url>
+
+    <parent>
+        <groupId>org.apache.guacamole</groupId>
+        <artifactId>guacamole-auth-sso</artifactId>
+        <version>1.5.0</version>
+        <relativePath>../../</relativePath>
+    </parent>
+
+    <dependencies>
+
+        <!-- Guacamole Extension API -->
+        <dependency>
+            <groupId>org.apache.guacamole</groupId>
+            <artifactId>guacamole-ext</artifactId>
+        </dependency>
+
+        <!-- Core SSO support -->
+        <dependency>
+            <groupId>org.apache.guacamole</groupId>
+            <artifactId>guacamole-auth-sso-base</artifactId>
+        </dependency>
+
+        <!-- Guice -->
+        <dependency>
+            <groupId>com.google.inject</groupId>
+            <artifactId>guice</artifactId>
+        </dependency>
+
+        <!-- Java servlet API -->
+        <dependency>
+            <groupId>javax.servlet</groupId>
+            <artifactId>servlet-api</artifactId>
+        </dependency>
+
+        <!-- JAX-RS Annotations -->
+        <dependency>
+            <groupId>javax.ws.rs</groupId>
+            <artifactId>jsr311-api</artifactId>
+        </dependency>
+
+    </dependencies>
+
+</project>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
new file mode 100644
index 000000000..16414688e
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
@@ -0,0 +1,413 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ssl;
+
+import com.google.inject.Inject;
+import com.google.inject.Provider;
+import com.google.inject.Singleton;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.UnsupportedEncodingException;
+import java.net.URI;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.security.Principal;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.concurrent.TimeUnit;
+import javax.naming.InvalidNameException;
+import javax.naming.ldap.LdapName;
+import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.core.UriBuilder;
+import org.apache.guacamole.GuacamoleClientException;
+import org.apache.guacamole.auth.ssl.conf.ConfigurationService;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.auth.sso.NonceService;
+import org.apache.guacamole.auth.sso.SSOAuthenticationProviderService;
+import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
+import org.apache.guacamole.form.Field;
+import org.apache.guacamole.form.RedirectField;
+import org.apache.guacamole.language.TranslatableMessage;
+import org.apache.guacamole.net.auth.Credentials;
+import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
+import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
+import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
+
+/**
+ * Service that authenticates Guacamole users using SSL/TLS authentication
+ * provided by an external SSL termination service.
+ */
+@Singleton
+public class AuthenticationProviderService implements SSOAuthenticationProviderService {
+
+    /**
+     * Service for retrieving configuration information.
+     */
+    @Inject
+    private ConfigurationService confService;
+
+    /**
+     * Service for validating and generating unique nonce values. Here, these
+     * nonces are used specifically for generating unique domains.
+     */
+    @Inject
+    private NonceService subdomainNonceService;
+
+    /**
+     * Session manager for generating and maintaining unique tokens to
+     * represent the authentication flow of a user who has only partially
+     * authenticated. Here, these tokens represent a user that has been
+     * validated by SSL termination and allow the Guacamole instance that
+     * doesn't require SSL/TLS authentication to retrieve the user's identity
+     * and complete the authentication process.
+     */
+    @Inject
+    private SSLAuthenticationSessionManager sessionManager;
+
+    /**
+     * Provider for AuthenticatedUser objects.
+     */
+    @Inject
+    private Provider<SSOAuthenticatedUser> authenticatedUserProvider;
+
+    /**
+     * The string value that the SSL termination service uses for its client
+     * verification header to represent that the client certificate has been
+     * verified.
+     */
+    private static final String CLIENT_VERIFIED_HEADER_SUCCESS_VALUE = "SUCCESS";
+
+    /**
+     * The name of the query parameter containing the temporary session token
+     * representing the current state of an in-progress authentication attempt.
+     */
+    private static final String AUTH_SESSION_PARAMETER_NAME = "state";
+
+    /**
+     * Decodes the provided URL-encoded string as UTF-8, returning the result.
+     *
+     * @param value
+     *     The URL-encoded string to decode.
+     *
+     * @return
+     *     The decoded string.
+     *
+     * @throws GuacamoleException
+     *     If the provided value is not a value URL-encoded string.
+     */
+    private byte[] decode(String value) throws GuacamoleException {
+        try {
+            return URLDecoder.decode(value, StandardCharsets.UTF_8.name())
+                    .getBytes(StandardCharsets.UTF_8);
+        }
+        catch (IllegalArgumentException e) {
+            throw new GuacamoleClientException("Invalid URL-encoded value.", e);
+        }
+        catch (UnsupportedEncodingException e) {
+            // This should never happen, as UTF-8 is a standard charset that
+            // the JVM is required to support
+            throw new UnsupportedOperationException("Unexpected lack of UTF-8 support.", e);
+        }
+    }
+
+    /**
+     * Authenticates a user using HTTP headers containing that user's verified
+     * X.509 certificate. It is assumed that this certificate is being passed
+     * to Guacamole from an SSL termination service that has already verified
+     * that this certificate is valid and authorized for access to that
+     * Guacamole instance.
+     *
+     * @param credentials
+     *     The credentials received by Guacamole in the authentication request.
+     *
+     * @param certificate
+     *     The raw bytes of the X.509 certificate retrieved from the request.
+     *
+     * @return
+     *     A new SSOAuthenticatedUser representing the identity of the user
+     *     asserted by the SSL termination service via that user's X.509
+     *     certificate.
+     *
+     * @throws GuacamoleException
+     *     If the provided X.509 certificate is not valid or cannot be parsed.
+     *     It is expected that the SSL termination service will already have
+     *     validated the certificate; this function validates only the
+     *     certificate timestamps.
+     */
+    private SSOAuthenticatedUser authenticateUser(Credentials credentials,
+            byte[] certificate) throws GuacamoleException {
+
+        // Parse and re-verify certificate is valid with respect to timestamps
+        X509Certificate cert;
+        try (InputStream input = new ByteArrayInputStream(certificate)) {
+
+            CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
+            cert = (X509Certificate) certFactory.generateCertificate(input);
+
+            // Verify certificate is valid (it should be given pre-validation
+            // from SSL termination, but it's worth rechecking for sanity)
+            cert.checkValidity();
+
+        }
+        catch (CertificateException e) {
+            throw new GuacamoleClientException("The X.509 certificate "
+                    + "presented is not valid.", e);
+        }
+        catch (IOException e) {
+            throw new GuacamoleServerException("Provided X.509 certificate "
+                    + "could not be read.", e);
+        }
+
+        // Extract user's DN from their X.509 certificate
+        LdapName dn;
+        try {
+            Principal principal = cert.getSubjectX500Principal();
+            dn = new LdapName(principal.getName());
+        }
+        catch (InvalidNameException e) {
+            throw new GuacamoleClientException("The X.509 certificate "
+                    + "presented does not contain a valid subject DN.", e);
+        }
+
+        // Verify DN actually contains components
+        int numComponents = dn.size();
+        if (numComponents < 1)
+            throw new GuacamoleClientException("The X.509 certificate "
+                    + "presented contains an empty subject DN.");
+
+        // Simply use first component of DN as username (TODO: Enforce
+        // requirements on the attribute providing the username and the base DN,
+        // and consider using components following the username to determine
+        // group memberships)
+        String username = dn.getRdn(numComponents - 1).getValue().toString();
+
+        SSOAuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
+        authenticatedUser.init(username, credentials,
+                Collections.emptySet(), Collections.emptyMap());
+        return authenticatedUser;
+
+    }
+
+    /**
+     * Processes the given HTTP request, returning the identity represented by
+     * the auth session token present in that request. If no such token is
+     * present, or the token does not represent a valid identity, null is
+     * returned.
+     *
+     * @param request
+     *     The HTTP request to process.
+     *
+     * @return
+     *     The identity represented by the auth session token in the request,
+     *     or null if there is no such token or the token does not represent a
+     *     valid identity.
+     */
+    private SSOAuthenticatedUser processIdentity(HttpServletRequest request) {
+        String state = request.getParameter(AUTH_SESSION_PARAMETER_NAME);
+        return sessionManager.getIdentity(state);
+    }
+
+    /**
+     * Processes the X.509 certificate in the headers of the given HTTP
+     * request, returning an authentication session token representing the
+     * identity in that certificate. If the certificate is invalid or not
+     * present, null is returned.
+     *
+     * @param credentials
+     *     The credentials submitted in the HTTP request being processed.
+     *
+     * @param request
+     *     The HTTP request to process.
+     *
+     * @return
+     *     An authentication session token representing the identity in the
+     *     certificate in the given HTTP request, or null if the request does
+     *     not contain a valid certificate.
+     *
+     * @throws GuacamoleException
+     *     If any configuration parameters related to retrieving certificates
+     *     from HTTP request cannot be parsed.
+     */
+    private String processCertificate(Credentials credentials,
+            HttpServletRequest request) throws GuacamoleException {
+
+        // Verify that SSL termination has already verified the certificate
+        String verified = request.getHeader(confService.getClientVerifiedHeader());
+        if (!CLIENT_VERIFIED_HEADER_SUCCESS_VALUE.equals(verified))
+            return null;
+
+        String certificate = request.getHeader(confService.getClientCertificateHeader());
+        if (certificate == null)
+            return null;
+
+        SSOAuthenticatedUser authenticatedUser = authenticateUser(credentials, decode(certificate));
+        long validityDuration = TimeUnit.MINUTES.toMillis(confService.getMaxTokenValidity());
+        return sessionManager.defer(new SSLAuthenticationSession(authenticatedUser, validityDuration));
+
+    }
+
+    /**
+     * Redirects the current user back to the main URL of the Guacamole
+     * instance to continue the authentication process after having identified
+     * themselves using SSL/TLS client authentication.
+     *
+     * @param token
+     *     The authentication session token generated for the current user's
+     *     identity.
+     *
+     * @throws GuacamoleException
+     *     To redirect the user to the main URL of the Guacamole instance.
+     */
+    private void resumeAuthenticationAtRedirectURI(String token)
+            throws GuacamoleException {
+
+        URI redirectURI = UriBuilder.fromUri(confService.getRedirectURI())
+                .queryParam(AUTH_SESSION_PARAMETER_NAME, token)
+                .build();
+
+        // Request that the provided credentials, now tokenized, be
+        // resubmitted in that tokenized form to the original host for
+        // authentication
+        throw new GuacamoleInsufficientCredentialsException("Please "
+                + "resubmit your tokenized credentials using the "
+                + "following URI.",
+            new CredentialsInfo(Arrays.asList(new Field[] {
+                new RedirectField(AUTH_SESSION_PARAMETER_NAME, redirectURI,
+                        new TranslatableMessage("LOGIN.INFO_IDP_REDIRECT_PENDING"))
+            }))
+        );
+
+    }
+
+    @Override
+    public SSOAuthenticatedUser authenticateUser(Credentials credentials)
+            throws GuacamoleException {
+
+        //
+        // Overall flow:
+        //
+        // 1) Unauthenticated user is given a temporary auth session token
+        //    and redirected to the SSL termination instance that provides
+        //    SSL client auth. This redirect uses a unique and temporary
+        //    subdomain to ensure each SSL client auth attempt is fresh and
+        //    does not use cached auth details.
+        //
+        // 2) Unauthenticated user with a temporary auth session token
+        //    is validated by SSL termination, with that SSL termination
+        //    adding HTTP headers containing the validated certificate to the
+        //    user's HTTP request.
+        //
+        // 3) If valid, the user is assigned a temporary token and redirected
+        //    back to the original URL. That temporary token is accepted by
+        //    this extension at the original URL as proof of the user's
+        //    identity.
+        //
+        // NOTE: All SSL termination endpoints in front of Guacamole MUST
+        // be configured to drop these headers from any inbound requests
+        // or users may be able to assert arbitrary identities, since this
+        // extension does not validate anything but the certificate timestamps.
+        // It relies purely on SSL termination to validate that the certificate
+        // was signed by the expected CA.
+        //
+
+        // We can't authenticate using SSL/TLS client auth unless there's an
+        // associated HTTP request
+        HttpServletRequest request = credentials.getRequest();
+        if (request == null)
+            return null;
+
+        // We MUST have the domain associated with the request to ensure we
+        // always get fresh SSL sessions when validating client certificates
+        String host = request.getHeader("Host");
+        if (host == null)
+            return null;
+
+        //
+        // Handle only auth session tokens at the main redirect URI, using the
+        // pre-verified information from those tokens to determine user
+        // identity.
+        //
+
+        String redirectHost = confService.getRedirectURI().getHost();
+        if (host.equals(redirectHost)) {
+
+            SSOAuthenticatedUser user = processIdentity(request);
+            if (user != null)
+                return user;
+
+            // Redirect unauthenticated requests to the endpoint requiring
+            // SSL client auth to request identity verification
+            throw new GuacamoleInvalidCredentialsException("Invalid login.",
+                new CredentialsInfo(Arrays.asList(new Field[] {
+                    new RedirectField(AUTH_SESSION_PARAMETER_NAME, getLoginURI(), // <-- Each call to getLoginURI() produces a unique subdomain that is valid only for ONE use (see below)
+                            new TranslatableMessage("LOGIN.INFO_IDP_REDIRECT_PENDING"))
+                }))
+            );
+
+        }
+
+        //
+        // Process certificates only at valid single-use subdomains dedicated
+        // to client authentication, redirecting back to the main redirect URI
+        // for final authentication if that processing is successful.
+        //
+        // NOTE: This is CRITICAL. If unique subdomains are not generated and
+        // tied to strictly one authentication attempt, then those subdomains
+        // could be reused by a user on a shared machine to assume the cached
+        // credentials of another user that used that machine earlier. The
+        // browser and/or OS may cache the certificate so that it can be reused
+        // for future SSL sessions to that same domain. Here, we ensure each
+        // generated domain is unique and only valid for certificate processing
+        // ONCE. The domain may still be valid with DNS, but will no longer be
+        // usable for certificate authentication.
+        //
+
+        else if (subdomainNonceService.isValid(confService.getClientAuthenticationSubdomain(host))) {
+            String token = processCertificate(credentials, request);
+            if (token != null)
+                resumeAuthenticationAtRedirectURI(token);
+        }
+
+        // All other requests are not allowed - refuse to authenticate
+        throw new GuacamoleClientException("Direct authentication against "
+                + "this endpoint is not valid without first requesting to "
+                + "authenticate at the primary URL of this Guacamole "
+                + "instance.");
+
+    }
+
+    @Override
+    public URI getLoginURI() throws GuacamoleException {
+        long validityDuration = TimeUnit.MINUTES.toMillis(confService.getMaxDomainValidity());
+        String uniqueSubdomain = subdomainNonceService.generate(validityDuration);
+        return confService.getClientAuthenticationURI(uniqueSubdomain);
+    }
+
+    @Override
+    public void shutdown() {
+        sessionManager.shutdown();
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProvider.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProvider.java
new file mode 100644
index 000000000..6b01858ef
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProvider.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ssl;
+
+import org.apache.guacamole.auth.sso.SSOAuthenticationProvider;
+import org.apache.guacamole.auth.sso.SSOResource;
+
+/**
+ * Guacamole authentication backend which authenticates users using SSL/TLS
+ * client authentication provided by some external SSL termination system. This
+ * SSL termination system must be configured to provide access to this same
+ * instance of Guacamole and must have both a wildcard certificate and wildcard
+ * DNS. No storage for connections is provided - only authentication. Storage
+ * must be provided by some other extension.
+ */
+public class SSLAuthenticationProvider extends SSOAuthenticationProvider {
+
+    /**
+     * Creates a new SSLAuthenticationProvider that authenticates users against
+     * an external SSL termination system using SSL/TLS client authentication.
+     */
+    public SSLAuthenticationProvider() {
+        super(AuthenticationProviderService.class, SSOResource.class,
+                new SSLAuthenticationProviderModule());
+    }
+
+    @Override
+    public String getIdentifier() {
+        return "ssl";
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
new file mode 100644
index 000000000..56e50bd75
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ssl;
+
+import com.google.inject.AbstractModule;
+import org.apache.guacamole.auth.ssl.conf.ConfigurationService;
+import org.apache.guacamole.auth.sso.NonceService;
+
+/**
+ * Guice module which configures injections specific to SSO using SSL/TLS
+ * client authentication.
+ */
+public class SSLAuthenticationProviderModule extends AbstractModule {
+
+    @Override
+    protected void configure() {
+        bind(ConfigurationService.class);
+        bind(NonceService.class);
+        bind(SSLAuthenticationSessionManager.class);
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java
new file mode 100644
index 000000000..e2e0d4c43
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ssl;
+
+import org.apache.guacamole.auth.sso.AuthenticationSession;
+import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
+
+/**
+ * Representation of an in-progress SSL/TLS authentication attempt.
+ */
+public class SSLAuthenticationSession extends AuthenticationSession {
+
+    /**
+     * The identity asserted by the external SSL termination service.
+     */
+    private final SSOAuthenticatedUser identity;
+
+    /**
+     * Creates a new AuthenticationSession representing an in-progress SSL/TLS
+     * authentication attempt.
+     *
+     * @param identity
+     *     The identity asserted by the external SSL termination service. This
+     *     MAY NOT be null.
+     *
+     * @param expires
+     *     The number of milliseconds that may elapse before this session must
+     *     be considered invalid.
+     */
+    public SSLAuthenticationSession(SSOAuthenticatedUser identity, long expires) {
+        super(expires);
+        this.identity = identity;
+    }
+
+    /**
+     * Returns the identity asserted by the external SSL termination service.
+     * As authentication will have completed with respect to the SSL
+     * termination service by the time this session is created, this will
+     * always be non-null.
+     *
+     * @return
+     *     The identity asserted by the external SSL termination service.
+     */
+    public SSOAuthenticatedUser getIdentity() {
+        return identity;
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java
new file mode 100644
index 000000000..3200cae3d
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ssl;
+
+import com.google.inject.Singleton;
+import org.apache.guacamole.auth.sso.AuthenticationSessionManager;
+import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
+
+/**
+ * Manager service that temporarily stores SSL/TLS authentication attempts
+ * while the authentication flow is underway.
+ */
+@Singleton
+public class SSLAuthenticationSessionManager
+        extends AuthenticationSessionManager<SSLAuthenticationSession> {
+
+    /**
+     * Returns the identity asserted by the external SSL termination service at
+     * the end of the authentication process represented by the authentication
+     * session with the given identifier. If there is no such authentication
+     * session, or no valid identity has been asserted for that session, null
+     * is returned.
+     *
+     * @param identifier
+     *     The unique string returned by the call to defer(). For convenience,
+     *     this value may safely be null.
+     *
+     * @return
+     *     The identity asserted by the external SSL termination service at the
+     *     end of the authentication process represented by the authentication
+     *     session with the given identifier, or null if there is no such
+     *     identity.
+     */
+    public SSOAuthenticatedUser getIdentity(String identifier) {
+
+        SSLAuthenticationSession session = resume(identifier);
+        if (session != null)
+            return session.getIdentity();
+
+        return null;
+
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java
new file mode 100644
index 000000000..074ee093b
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java
@@ -0,0 +1,325 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ssl.conf;
+
+import com.google.inject.Inject;
+import java.net.URI;
+import javax.ws.rs.core.UriBuilder;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.environment.Environment;
+import org.apache.guacamole.properties.IntegerGuacamoleProperty;
+import org.apache.guacamole.properties.StringGuacamoleProperty;
+import org.apache.guacamole.properties.URIGuacamoleProperty;
+
+/**
+ * Service for retrieving configuration information regarding SSO using SSL/TLS
+ * authentication.
+ */
+public class ConfigurationService {
+
+    /**
+     * The default name of the header to use to retrieve the URL-encoded client
+     * certificate from an HTTP request received from an SSL termination
+     * service providing SSL/TLS client authentication.
+     */
+    private static String DEFAULT_CLIENT_CERTIFICATE_HEADER = "X-Client-Certificate";
+
+    /**
+     * The default name of the header to use to retrieve the verification
+     * status of the certificate an HTTP request received from an SSL
+     * termination service providing SSL/TLS client authentication.
+     */
+    private static String DEFAULT_CLIENT_VERIFIED_HEADER = "X-Client-Verified";
+
+    /**
+     * The default amount of time that a temporary authentication token for
+     * SSL/TLS authentication may remain valid, in minutes.
+     */
+    private static int DEFAULT_MAX_TOKEN_VALIDITY = 5;
+
+    /**
+     * The default amount of time that the temporary, unique subdomain
+     * generated for SSL/TLS authentication may remain valid, in minutes.
+     */
+    private static int DEFAULT_MAX_DOMAIN_VALIDITY = 5;
+
+    /**
+     * The property representing the URI that should be used to authenticate
+     * users with SSL/TLS client authentication. This must be a URI that points
+     * to THIS instance of Guacamole, but behind SSL termination that requires
+     * SSL/TLS client authentication.
+     */
+    private static final WildcardURIGuacamoleProperty SSL_CLIENT_AUTH_URI =
+            new WildcardURIGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "ssl-client-auth-uri"; }
+
+    };
+
+    /**
+     * The property representing the URI of this instance without SSL/TLS
+     * client authentication required. This must be a URI that points
+     * to THIS instance of Guacamole, but behind SSL termination that DOES NOT
+     * require or request SSL/TLS client authentication.
+     */
+    private static final URIGuacamoleProperty SSL_REDIRECT_URI =
+            new URIGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "ssl-redirect-uri"; }
+
+    };
+
+    /**
+     * The property representing the name of the header to use to retrieve the
+     * URL-encoded client certificate from an HTTP request received from an
+     * SSL termination service providing SSL/TLS client authentication.
+     */
+    private static final StringGuacamoleProperty SSL_CLIENT_CERTIFICATE_HEADER =
+            new StringGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "ssl-client-certificate-header"; }
+
+    };
+
+    /**
+     * The property representing the name of the header to use to retrieve the
+     * verification status of the certificate an HTTP request received from an
+     * SSL termination service providing SSL/TLS client authentication. This
+     * value of this header must be "SUCCESS" (all uppercase) if the
+     * certificate was successfully verified.
+     */
+    private static final StringGuacamoleProperty SSL_CLIENT_VERIFIED_HEADER =
+            new StringGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "ssl-client-verified-header"; }
+
+    };
+
+    /**
+     * The property representing the amount of time that a temporary
+     * authentication token for SSL/TLS authentication may remain valid, in
+     * minutes. This token is used to represent the user's asserted identity
+     * after it has been verified by the SSL termination service. This interval
+     * must be long enough to allow for network delays in redirecting the user
+     * back to the main Guacamole URL, but short enough that unused tokens do
+     * not consume unnecessary server resources and cannot potentially be
+     * guessed while the token is still valid. These tokens are 256-bit secure
+     * random values.
+     */
+    private static final IntegerGuacamoleProperty SSL_MAX_TOKEN_VALIDITY =
+            new IntegerGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "ssl-max-token-validity"; }
+
+    };
+
+    /**
+     * The property representing the amount of time that the temporary, unique
+     * subdomain generated for SSL/TLS authentication may remain valid, in
+     * minutes. This subdomain is used to ensure each SSL/TLS authentication
+     * attempt is fresh and does not potentially reuse a previous
+     * authentication attempt that was cached by the browser or OS. This
+     * interval must be long enough to allow for network delays in redirecting
+     * the user to the SSL termination service enforcing SSL/TLS
+     * authentication, but short enough that an unused domain does not consume
+     * unnecessary server resources and cannot potentially be guessed while
+     * that subdomain is still valid. These subdomains are 128-bit secure
+     * random values.
+     */
+    private static final IntegerGuacamoleProperty SSL_MAX_DOMAIN_VALIDITY =
+            new IntegerGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "ssl-max-domain-validity"; }
+
+    };
+
+    /**
+     * The Guacamole server environment.
+     */
+    @Inject
+    private Environment environment;
+
+    /**
+     * Returns a URI that should be used to authenticate users with SSL/TLS
+     * client authentication. The returned URI will consist of the configured
+     * client authentication URI with the wildcard portion ("*.") replaced with
+     * the given subdomain.
+     *
+     * @param subdomain
+     *     The subdomain that should replace the wildcard portion of the
+     *     configured client authentication URI.
+     *
+     * @return
+     *     A URI that should be used to authenticate users with SSL/TLS
+     *     client authentication.
+     *
+     * @throws GuacamoleException
+     *     If the required property for configuring the client authentication
+     *     URI is missing or cannot be parsed.
+     */
+    public URI getClientAuthenticationURI(String subdomain) throws GuacamoleException {
+
+        URI authURI = environment.getRequiredProperty(SSL_CLIENT_AUTH_URI);
+        String baseHostname = authURI.getHost();
+
+        // Add provided subdomain to auth URI
+        return UriBuilder.fromUri(authURI)
+                .host(subdomain + "." + baseHostname)
+                .build();
+
+    }
+
+    /**
+     * Given a hostname that was used by a user for SSL/TLS client
+     * authentication, returns the subdomain at the beginning of that hostname.
+     * If the hostname does not match the pattern of hosts represented by the
+     * configured client authentication URI, null is returned.
+     *
+     * @param hostname
+     *     The hostname to extract the subdomain from.
+     *
+     * @return
+     *     The subdomain at the beginning of the provided hostname, if that
+     *     hostname matches the pattern of hosts represented by the
+     *     configured client authentication URI, or null otherwise.
+     *
+     * @throws GuacamoleException
+     *     If the required property for configuring the client authentication
+     *     URI is missing or cannot be parsed.
+     */
+    public String getClientAuthenticationSubdomain(String hostname) throws GuacamoleException {
+
+        URI authURI = environment.getRequiredProperty(SSL_CLIENT_AUTH_URI);
+        String baseHostname = authURI.getHost();
+
+        // Verify the first domain component is at least one character in
+        // length
+        int firstPeriod = hostname.indexOf('.');
+        if (firstPeriod <= 0)
+            return null;
+
+        // Verify domain matches the configured auth URI except for the leading
+        // subdomain
+        if (!hostname.regionMatches(true, firstPeriod + 1, baseHostname, 0, baseHostname.length()))
+            return null;
+
+        // Extract subdomain
+        return hostname.substring(0, firstPeriod);
+
+    }
+
+    /**
+     * Returns the URI of this instance without SSL/TLS client authentication
+     * required.
+     *
+     * @return
+     *     The URI of this instance without SSL/TLS client authentication
+     *     required.
+     *
+     * @throws GuacamoleException
+     *     If the required property for configuring the redirect URI is missing
+     *     or cannot be parsed.
+     */
+    public URI getRedirectURI() throws GuacamoleException {
+        return environment.getRequiredProperty(SSL_REDIRECT_URI);
+    }
+
+    /**
+     * Returns the name of the header to use to retrieve the URL-encoded client
+     * certificate from an HTTP request received from an SSL termination
+     * service providing SSL/TLS client authentication.
+     *
+     * @return
+     *     The name of the header to use to retrieve the URL-encoded client
+     *     certificate from an HTTP request received from an SSL termination
+     *     service providing SSL/TLS client authentication.
+     *
+     * @throws GuacamoleException
+     *     If the property for configuring the client certificate header cannot
+     *     be parsed.
+     */
+    public String getClientCertificateHeader() throws GuacamoleException {
+        return environment.getProperty(SSL_CLIENT_CERTIFICATE_HEADER, DEFAULT_CLIENT_CERTIFICATE_HEADER);
+    }
+
+    /**
+     * Returns the name of the header to use to retrieve the verification
+     * status of the certificate an HTTP request received from an SSL
+     * termination service providing SSL/TLS client authentication.
+     *
+     * @return
+     *     The name of the header to use to retrieve the verification
+     *     status of the certificate an HTTP request received from an SSL
+     *     termination service providing SSL/TLS client authentication.
+     *
+     * @throws GuacamoleException
+     *     If the property for configuring the client verification header
+     *     cannot be parsed.
+     */
+    public String getClientVerifiedHeader() throws GuacamoleException {
+        return environment.getProperty(SSL_CLIENT_VERIFIED_HEADER, DEFAULT_CLIENT_VERIFIED_HEADER);
+    }
+
+    /**
+     * Returns the maximum amount of time that the token generated by the
+     * Guacamole server representing current SSL authentication state should
+     * remain valid, in minutes. This imposes an upper limit on the amount of
+     * time any particular authentication request can result in successful
+     * authentication within Guacamole when SSL/TLS client authentication is
+     * configured. By default, this will be 5.
+     *
+     * @return
+     *     The maximum amount of time that an SSL authentication token
+     *     generated by the Guacamole server should remain valid, in minutes.
+     *
+     * @throws GuacamoleException
+     *     If guacamole.properties cannot be parsed.
+     */
+    public int getMaxTokenValidity() throws GuacamoleException {
+        return environment.getProperty(SSL_MAX_TOKEN_VALIDITY, DEFAULT_MAX_TOKEN_VALIDITY);
+    }
+
+    /**
+     * Returns the maximum amount of time that a unique client authentication
+     * subdomain generated by the Guacamole server should remain valid, in
+     * minutes. This imposes an upper limit on the amount of time any
+     * particular authentication request can result in successful
+     * authentication within Guacamole when SSL/TLS client authentication is
+     * configured. By default, this will be 5.
+     *
+     * @return
+     *     The maximum amount of time that a unique client authentication
+     *     subdomain generated by the Guacamole server should remain valid, in
+     *     minutes.
+     *
+     * @throws GuacamoleException
+     *     If guacamole.properties cannot be parsed.
+     */
+    public int getMaxDomainValidity() throws GuacamoleException {
+        return environment.getProperty(SSL_MAX_DOMAIN_VALIDITY, DEFAULT_MAX_DOMAIN_VALIDITY);
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/WildcardURIGuacamoleProperty.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/WildcardURIGuacamoleProperty.java
new file mode 100644
index 000000000..d237d8031
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/WildcardURIGuacamoleProperty.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ssl.conf;
+
+import java.net.URI;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.properties.URIGuacamoleProperty;
+
+/**
+ * A GuacamoleProperty whose value is a wildcard URI. The behavior of this
+ * property is identical to URIGuacamoleProperty except that it verifies a
+ * wildcard hostname prefix ("*.") is present and strips that prefix from the
+ * parsed URI.
+ */
+public abstract class WildcardURIGuacamoleProperty extends URIGuacamoleProperty {
+
+    /**
+     * Regular expression that broadly matches URIs that contain wildcards in
+     * their hostname. This regular expression is NOT strict and will match
+     * invalid URIs. It is only strict enough to recognize a wildcard hostname
+     * prefix.
+     */
+    private static final Pattern WILDCARD_URI_PATTERN = Pattern.compile("([^:]+://(?:[^@]+@)?)\\*\\.(.*)");
+
+    @Override
+    public URI parseValue(String value) throws GuacamoleException {
+
+        // Verify wildcard prefix is present
+        Matcher matcher = WILDCARD_URI_PATTERN.matcher(value);
+        if (matcher.matches()) {
+
+            // Strip wildcard prefix from URI and verify a valid hostname is
+            // still present
+            URI uri = super.parseValue(matcher.group(1) + matcher.group(2));
+            if (uri.getHost() != null)
+                return uri;
+
+        }
+
+        // All other values are not valid wildcard URIs
+        throw new GuacamoleServerException("Value \"" + value
+            + "\" is not a valid wildcard URI.");
+
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
new file mode 100644
index 000000000..30c8a1c99
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
@@ -0,0 +1,33 @@
+{
+
+    "guacamoleVersion" : "1.5.0",
+
+    "name"      : "SSL Authentication Extension",
+    "namespace" : "ssl",
+
+    "authProviders" : [
+        "org.apache.guacamole.auth.ssl.SSLAuthenticationProvider"
+    ],
+
+    "css" : [
+        "styles/sso-providers.css"
+    ],
+
+    "html" : [
+        "html/sso-providers.html",
+        "html/sso-provider-ssl.html"
+    ],
+
+    "translations" : [
+        "translations/ca.json",
+        "translations/de.json",
+        "translations/en.json",
+        "translations/fr.json",
+        "translations/ja.json",
+        "translations/ko.json",
+        "translations/pt.json",
+        "translations/ru.json",
+        "translations/zh.json"
+    ]
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html
new file mode 100644
index 000000000..b6c510931
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html
@@ -0,0 +1,4 @@
+<meta name="after-children" content=".login-ui .sso-provider-list:last-child">
+<li class="sso-provider sso-provider-ssl"><a href="api/ext/ssl/login">{{
+    'LOGIN.NAME_IDP_SSL' | translate
+}}</a></li>
diff --git a/extensions/guacamole-auth-sso/pom.xml b/extensions/guacamole-auth-sso/pom.xml
index 04ffe842f..99632e4c3 100644
--- a/extensions/guacamole-auth-sso/pom.xml
+++ b/extensions/guacamole-auth-sso/pom.xml
@@ -49,6 +49,7 @@
         <module>modules/guacamole-auth-sso-cas</module>
         <module>modules/guacamole-auth-sso-openid</module>
         <module>modules/guacamole-auth-sso-saml</module>
+        <module>modules/guacamole-auth-sso-ssl</module>
 
     </modules>
 

From 9177cac3cc641d561f4c817b721348355943e812 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Fri, 27 Jan 2023 12:40:02 -0800
Subject: [PATCH 118/289] GUACAMOLE-839: Allow authenticationService to affect
 login screen even if not invoked by login screen.

---
 .../app/auth/service/authenticationService.js | 71 ++++++++++-----
 .../src/app/login/directives/login.js         | 88 +++++++++----------
 2 files changed, 94 insertions(+), 65 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
index 8a867cea5..a2faa90ff 100644
--- a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
+++ b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
@@ -18,25 +18,45 @@
  */
 
 /**
- * A service for authenticating a user against the REST API.
+ * A service for authenticating a user against the REST API. Invoking the
+ * authenticate() or login() functions of this service will automatically
+ * affect the login dialog, if visible.
  *
- * This service broadcasts two events on $rootScope depending on the result of
- * authentication operations: 'guacLogin' if authentication was successful and
- * a new token was created, and 'guacLogout' if an existing token is being
- * destroyed or replaced. Both events will be passed the related token as their
- * sole parameter.
+ * This service broadcasts events on $rootScope depending on the status and
+ * result of authentication operations:
  *
- * If a login attempt results in an existing token being replaced, 'guacLogout'
- * will be broadcast first for the token being replaced, followed by
- * 'guacLogin' for the new token.
- * 
- * Failed logins may also result in guacInsufficientCredentials or
- * guacInvalidCredentials events, if the provided credentials were rejected for
- * being insufficient or invalid respectively. Both events will be provided
- * the set of parameters originally given to authenticate() and the error that
- * rejected the credentials. The Error object provided will contain set of
- * expected credentials returned by the REST endpoint. This set of credentials
- * will be in the form of a Field array.
+ *  "guacLoginPending"
+ *      An authentication request was submitted and we are awaiting the result.
+ *      This event receives an object containing the HTTP parameters submitted
+ *      as its sole parameter.
+ *
+ *  "guacLogin"
+ *      Authentication was successful and a new token was created. This event
+ *      receives the authentication token as its sole parameter.
+ *
+ *  "guacLogout"
+ *      An existing token is being destroyed. This event receives the
+ *      authentication token as its sole parameter. If the existing token for
+ *      the current session is being replaced without destroying that session,
+ *      this event is not fired.
+ *
+ *  "guacLoginFailed"
+ *      An authentication request has failed for any reason. This event is
+ *      broadcast before any other events that are specific to the nature of
+ *      the failure, and may be used to detect login failures in lieu of those
+ *      events. This event receives two parameters: the HTTP parameters
+ *      submitted and the Error object received from the REST endpoint.
+ *
+ *  "guacInsufficientCredentials"
+ *      An authentication request failed because additional credentials are
+ *      needed before the request can be processed. This event receives two
+ *      parameters: the HTTP parameters submitted and the Error object received
+ *      from the REST endpoint.
+ *
+ *  "guacInvalidCredentials"
+ *      An authentication request failed because the credentials provided are
+ *      invalid. This event receives two parameters: the HTTP parameters
+ *      submitted and the Error object received from the REST endpoint.
  */
 angular.module('auth').factory('authenticationService', ['$injector',
         function authenticationService($injector) {
@@ -141,7 +161,8 @@ angular.module('auth').factory('authenticationService', ['$injector',
      * and given arbitrary parameters, returning a promise that succeeds only
      * if the authentication operation was successful. The resulting
      * authentication data can be retrieved later via getCurrentToken() or
-     * getCurrentUsername().
+     * getCurrentUsername(). Invoking this function will affect the UI,
+     * including the login screen if visible.
      * 
      * The provided parameters can be virtually any object, as each property
      * will be sent as an HTTP parameter in the authentication request.
@@ -159,6 +180,9 @@ angular.module('auth').factory('authenticationService', ['$injector',
      */
     service.authenticate = function authenticate(parameters) {
 
+        // Notify that a fresh authentication request is being submitted
+        $rootScope.$broadcast('guacLoginPending', parameters);
+
         // Attempt authentication
         return requestService({
             method: 'POST',
@@ -202,6 +226,10 @@ angular.module('auth').factory('authenticationService', ['$injector',
         // If authentication fails, propogate failure to returned promise
         ['catch'](requestService.createErrorCallback(function authenticationFailed(error) {
 
+            // Notify of generic login failure, for any event consumers that
+            // wish to handle all types of failures at once
+            $rootScope.$broadcast('guacLoginFailed', parameters, error);
+
             // Request credentials if provided credentials were invalid
             if (error.type === Error.Type.INVALID_CREDENTIALS) {
                 $rootScope.$broadcast('guacInvalidCredentials', parameters, error);
@@ -321,7 +349,8 @@ angular.module('auth').factory('authenticationService', ['$injector',
      * with a username and password, ignoring any currently-stored token, 
      * returning a promise that succeeds only if the login operation was
      * successful. The resulting authentication data can be retrieved later
-     * via getCurrentToken() or getCurrentUsername().
+     * via getCurrentToken() or getCurrentUsername(). Invoking this function
+     * will affect the UI, including the login screen if visible.
      * 
      * @param {String} username
      *     The username to log in with.
@@ -342,7 +371,9 @@ angular.module('auth').factory('authenticationService', ['$injector',
     /**
      * Makes a request to logout a user using the token REST API endpoint,
      * returning a promise that succeeds only if the logout operation was
-     * successful.
+     * successful. Invoking this function will affect the UI, causing the
+     * visible components of the application to be replaced with a status
+     * message noting that the user has been logged out.
      * 
      * @returns {Promise}
      *     A promise which succeeds only if the logout operation was
diff --git a/guacamole/src/main/frontend/src/app/login/directives/login.js b/guacamole/src/main/frontend/src/app/login/directives/login.js
index b7967d798..80ce00fe4 100644
--- a/guacamole/src/main/frontend/src/app/login/directives/login.js
+++ b/guacamole/src/main/frontend/src/app/login/directives/login.js
@@ -177,51 +177,7 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
          * authentication service, redirecting to the main view if successful.
          */
         $scope.login = function login() {
-
-            // Authentication is now in progress
-            $scope.submitted = true;
-
-            // Start with cleared status
-            $scope.loginError = null;
-
-            // Attempt login once existing session is destroyed
-            authenticationService.authenticate($scope.enteredValues)
-
-            // Retry route upon success (entered values will be cleared only
-            // after route change has succeeded as this can take time)
-            .then(function loginSuccessful() {
-                $route.reload();
-            })
-
-            // Reset upon failure
-            ['catch'](requestService.createErrorCallback(function loginFailed(error) {
-
-                // Initial submission is complete and has failed
-                $scope.submitted = false;
-
-                // Clear out passwords if the credentials were rejected for any reason
-                if (error.type !== Error.Type.INSUFFICIENT_CREDENTIALS) {
-
-                    // Flag generic error for invalid login
-                    if (error.type === Error.Type.INVALID_CREDENTIALS)
-                        $scope.loginError = {
-                            'key' : 'LOGIN.ERROR_INVALID_LOGIN'
-                        };
-
-                    // Display error if anything else goes wrong
-                    else
-                        $scope.loginError = error.translatableMessage;
-
-                    // Reset all remaining fields to default values, but
-                    // preserve any usernames
-                    angular.forEach($scope.remainingFields, function clearEnteredValueIfPassword(field) {
-                        if (field.type !== Field.Type.USERNAME && field.name in $scope.enteredValues)
-                            $scope.enteredValues[field.name] = DEFAULT_FIELD_VALUE;
-                    });
-                }
-
-            }));
-
+            authenticationService.authenticate($scope.enteredValues)['catch'](requestService.IGNORE);
         };
 
         /**
@@ -244,6 +200,48 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
 
         };
 
+        // Update UI to reflect in-progress auth status (clear any previous
+        // errors, flag as pending)
+        $rootScope.$on('guacLoginPending', function loginSuccessful() {
+            $scope.submitted = true;
+            $scope.loginError = null;
+        });
+
+        // Retry route upon success (entered values will be cleared only
+        // after route change has succeeded as this can take time)
+        $rootScope.$on('guacLogin', function loginSuccessful() {
+            $route.reload();
+        });
+
+        // Reset upon failure
+        $rootScope.$on('guacLoginFailed', function loginFailed(event, parameters, error) {
+
+            // Initial submission is complete and has failed
+            $scope.submitted = false;
+
+            // Clear out passwords if the credentials were rejected for any reason
+            if (error.type !== Error.Type.INSUFFICIENT_CREDENTIALS) {
+
+                // Flag generic error for invalid login
+                if (error.type === Error.Type.INVALID_CREDENTIALS)
+                    $scope.loginError = {
+                        'key' : 'LOGIN.ERROR_INVALID_LOGIN'
+                    };
+
+                // Display error if anything else goes wrong
+                else
+                    $scope.loginError = error.translatableMessage;
+
+                // Reset all remaining fields to default values, but
+                // preserve any usernames
+                angular.forEach($scope.remainingFields, function clearEnteredValueIfPassword(field) {
+                    if (field.type !== Field.Type.USERNAME && field.name in $scope.enteredValues)
+                        $scope.enteredValues[field.name] = DEFAULT_FIELD_VALUE;
+                });
+            }
+
+        });
+
         // Reset state after authentication and routing have succeeded
         $rootScope.$on('$routeChangeSuccess', function routeChanged() {
             $scope.enteredValues = {};

From b6ce4776258ba5366a852b6dc950fb55306c28b1 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Fri, 27 Jan 2023 13:49:18 -0800
Subject: [PATCH 119/289] GUACAMOLE-839: Support deferred retrieval of
 authentication parameters.

---
 .../app/auth/service/authenticationService.js | 86 +++++++++++--------
 1 file changed, 50 insertions(+), 36 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
index a2faa90ff..88143a740 100644
--- a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
+++ b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
@@ -26,9 +26,11 @@
  * result of authentication operations:
  *
  *  "guacLoginPending"
- *      An authentication request was submitted and we are awaiting the result.
- *      This event receives an object containing the HTTP parameters submitted
- *      as its sole parameter.
+ *      An authentication request is being submitted and we are awaiting the
+ *      result. The request may not yet have been submitted if the parameters
+ *      for that request are not ready. This event receives a promise that
+ *      resolves with the HTTP parameters that were ultimately submitted as its
+ *      sole parameter.
  *
  *  "guacLogin"
  *      Authentication was successful and a new token was created. This event
@@ -66,6 +68,7 @@ angular.module('auth').factory('authenticationService', ['$injector',
     var Error                = $injector.get('Error');
 
     // Required services
+    var $q                  = $injector.get('$q');
     var $rootScope          = $injector.get('$rootScope');
     var localStorageService = $injector.get('localStorageService');
     var requestService      = $injector.get('requestService');
@@ -172,58 +175,69 @@ angular.module('auth').factory('authenticationService', ['$injector',
      * 
      * If a token is provided, it will be reused if possible.
      * 
-     * @param {Object} parameters 
-     *     Arbitrary parameters to authenticate with.
+     * @param {Object|Promise} parameters
+     *     Arbitrary parameters to authenticate with. If a Promise is provided,
+     *     that Promise must resolve with the parameters to be submitted when
+     *     those parameters are available, and any error will be handled as if
+     *     from the authentication endpoint of the REST API itself.
      *
      * @returns {Promise}
      *     A promise which succeeds only if the login operation was successful.
      */
     service.authenticate = function authenticate(parameters) {
 
-        // Notify that a fresh authentication request is being submitted
+        // Coerce received parameters object into a Promise, if it isn't
+        // already a Promise
+        parameters = $q.resolve(parameters);
+
+        // Notify that a fresh authentication request is underway
         $rootScope.$broadcast('guacLoginPending', parameters);
 
-        // Attempt authentication
-        return requestService({
-            method: 'POST',
-            url: 'api/tokens',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded'
-            },
-            data: $.param(parameters)
-        })
+        // Attempt authentication after auth parameters are available ...
+        return parameters.then(function requestParametersReady(requestParams) {
 
-        // If authentication succeeds, handle received auth data
-        .then(function authenticationSuccessful(data) {
+            return requestService({
+                method: 'POST',
+                url: 'api/tokens',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded'
+                },
+                data: $.param(requestParams)
+            })
 
-            var currentToken = service.getCurrentToken();
+            // ... if authentication succeeds, handle received auth data ...
+            .then(function authenticationSuccessful(data) {
 
-            // If a new token was received, ensure the old token is invalidated,
-            // if any, and notify listeners of the new token
-            if (data.authToken !== currentToken) {
+                var currentToken = service.getCurrentToken();
+
+                // If a new token was received, ensure the old token is invalidated,
+                // if any, and notify listeners of the new token
+                if (data.authToken !== currentToken) {
+
+                    // If an old token existed, request that the token be revoked
+                    if (currentToken) {
+                        service.revokeToken(currentToken).catch(angular.noop);
+                    }
+
+                    // Notify of login and new token
+                    setAuthenticationResult(new AuthenticationResult(data));
+                    $rootScope.$broadcast('guacLogin', data.authToken);
 
-                // If an old token existed, request that the token be revoked
-                if (currentToken) {
-                    service.revokeToken(currentToken).catch(angular.noop);
                 }
 
-                // Notify of login and new token
-                setAuthenticationResult(new AuthenticationResult(data));
-                $rootScope.$broadcast('guacLogin', data.authToken);
+                // Update cached authentication result, even if the token remains
+                // the same
+                else
+                    setAuthenticationResult(new AuthenticationResult(data));
 
-            }
+                // Authentication was successful
+                return data;
 
-            // Update cached authentication result, even if the token remains
-            // the same
-            else
-                setAuthenticationResult(new AuthenticationResult(data));
-
-            // Authentication was successful
-            return data;
+            });
 
         })
 
-        // If authentication fails, propogate failure to returned promise
+        // ... if authentication fails, propogate failure to returned promise
         ['catch'](requestService.createErrorCallback(function authenticationFailed(error) {
 
             // Notify of generic login failure, for any event consumers that

From 38f1360dec7e00ba4fededfa40001d0a4b02e86a Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Fri, 27 Jan 2023 16:38:45 -0800
Subject: [PATCH 120/289] GUACAMOLE-839: Ensure SSL/TLS client auth failures
 are reflected in the Guacamole UI.

---
 .../sso/AuthenticationSessionManager.java     |  14 +
 .../modules/guacamole-auth-sso-ssl/pom.xml    |  50 +++
 .../ssl/AuthenticationProviderService.java    | 296 ++--------------
 .../auth/ssl/OpaqueAuthenticationResult.java  |  65 ++++
 .../auth/ssl/SSLAuthenticationProvider.java   |   3 +-
 .../ssl/SSLAuthenticationProviderModule.java  |   3 +-
 .../auth/ssl/SSLAuthenticationSession.java    |   7 +-
 .../ssl/SSLAuthenticationSessionManager.java  |   3 +-
 .../ssl/SSLClientAuthenticationResource.java  | 332 ++++++++++++++++++
 .../auth/ssl/conf/ConfigurationService.java   |  84 ++++-
 .../main/resources/directives/guacSslAuth.js  |  68 ++++
 .../src/main/resources/guac-manifest.json     |   2 +
 .../main/resources/html/sso-provider-ssl.html |   2 +-
 .../src/main/resources/license.txt            |  18 +
 .../src/main/resources/sslModule.js           |  29 ++
 15 files changed, 681 insertions(+), 295 deletions(-)
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/OpaqueAuthenticationResult.java
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/directives/guacSslAuth.js
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/license.txt
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/sslModule.js

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
index da530f61b..3261228b8 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
@@ -68,6 +68,20 @@ public class AuthenticationSessionManager<T extends AuthenticationSession> {
         }, 1, 1, TimeUnit.MINUTES);
     }
 
+    /**
+     * Generates a cryptographically-secure value identical in form to the
+     * session tokens generated by {@link #defer(org.apache.guacamole.auth.sso.AuthenticationSession)}
+     * but invalid. The returned value is indistinguishable from a valid token,
+     * but is not a valid token.
+     *
+     * @return
+     *     An invalid token value that is indistinguishable from a valid
+     *     token.
+     */
+    public String generateInvalid() {
+        return idGenerator.generateIdentifier();
+    }
+
     /**
      * Resumes the Guacamole side of the authentication process that was
      * previously deferred through a call to defer(). Once invoked, the
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
index a107e6b7f..c6542ae56 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
@@ -37,6 +37,56 @@
         <relativePath>../../</relativePath>
     </parent>
 
+    <build>
+        <plugins>
+
+            <!-- JS/CSS Minification Plugin -->
+            <plugin>
+                <groupId>com.github.buckelieg</groupId>
+                <artifactId>minify-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>default-cli</id>
+                        <configuration>
+                            <charset>UTF-8</charset>
+
+                            <webappSourceDir>${basedir}/src/main/resources</webappSourceDir>
+                            <webappTargetDir>${project.build.directory}/classes</webappTargetDir>
+
+                            <jsSourceDir>/</jsSourceDir>
+                            <jsTargetDir>/</jsTargetDir>
+                            <jsFinalFile>ssl.js</jsFinalFile>
+
+                            <jsSourceFiles>
+                                <jsSourceFile>license.txt</jsSourceFile>
+                            </jsSourceFiles>
+
+                            <jsSourceIncludes>
+                                <jsSourceInclude>**/*.js</jsSourceInclude>
+                            </jsSourceIncludes>
+
+                            <!-- Do not minify and include tests -->
+                            <jsSourceExcludes>
+                                <jsSourceExclude>**/*.test.js</jsSourceExclude>
+                            </jsSourceExcludes>
+                            <jsEngine>CLOSURE</jsEngine>
+
+                            <!-- Disable warnings for JSDoc annotations -->
+                            <closureWarningLevels>
+                                <misplacedTypeAnnotation>OFF</misplacedTypeAnnotation>
+                                <nonStandardJsDocs>OFF</nonStandardJsDocs>
+                            </closureWarningLevels>
+
+                        </configuration>
+                        <goals>
+                            <goal>minify</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+
+        </plugins>
+    </build>
     <dependencies>
 
         <!-- Guacamole Extension API -->
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
index 16414688e..bc311de47 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
@@ -22,38 +22,16 @@ package org.apache.guacamole.auth.ssl;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
 import com.google.inject.Singleton;
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.UnsupportedEncodingException;
 import java.net.URI;
-import java.net.URLDecoder;
-import java.nio.charset.StandardCharsets;
-import java.security.Principal;
-import java.security.cert.CertificateException;
-import java.security.cert.CertificateFactory;
-import java.security.cert.X509Certificate;
-import java.util.Arrays;
 import java.util.Collections;
-import java.util.concurrent.TimeUnit;
-import javax.naming.InvalidNameException;
-import javax.naming.ldap.LdapName;
 import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.core.UriBuilder;
 import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.auth.ssl.conf.ConfigurationService;
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.GuacamoleServerException;
-import org.apache.guacamole.auth.sso.NonceService;
+import org.apache.guacamole.GuacamoleResourceNotFoundException;
 import org.apache.guacamole.auth.sso.SSOAuthenticationProviderService;
 import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
-import org.apache.guacamole.form.Field;
-import org.apache.guacamole.form.RedirectField;
-import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.net.auth.Credentials;
-import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
-import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
-import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
 
 /**
  * Service that authenticates Guacamole users using SSL/TLS authentication
@@ -68,13 +46,6 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
     @Inject
     private ConfigurationService confService;
 
-    /**
-     * Service for validating and generating unique nonce values. Here, these
-     * nonces are used specifically for generating unique domains.
-     */
-    @Inject
-    private NonceService subdomainNonceService;
-
     /**
      * Session manager for generating and maintaining unique tokens to
      * represent the authentication flow of a user who has only partially
@@ -92,124 +63,12 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
     @Inject
     private Provider<SSOAuthenticatedUser> authenticatedUserProvider;
 
-    /**
-     * The string value that the SSL termination service uses for its client
-     * verification header to represent that the client certificate has been
-     * verified.
-     */
-    private static final String CLIENT_VERIFIED_HEADER_SUCCESS_VALUE = "SUCCESS";
-
     /**
      * The name of the query parameter containing the temporary session token
      * representing the current state of an in-progress authentication attempt.
      */
     private static final String AUTH_SESSION_PARAMETER_NAME = "state";
 
-    /**
-     * Decodes the provided URL-encoded string as UTF-8, returning the result.
-     *
-     * @param value
-     *     The URL-encoded string to decode.
-     *
-     * @return
-     *     The decoded string.
-     *
-     * @throws GuacamoleException
-     *     If the provided value is not a value URL-encoded string.
-     */
-    private byte[] decode(String value) throws GuacamoleException {
-        try {
-            return URLDecoder.decode(value, StandardCharsets.UTF_8.name())
-                    .getBytes(StandardCharsets.UTF_8);
-        }
-        catch (IllegalArgumentException e) {
-            throw new GuacamoleClientException("Invalid URL-encoded value.", e);
-        }
-        catch (UnsupportedEncodingException e) {
-            // This should never happen, as UTF-8 is a standard charset that
-            // the JVM is required to support
-            throw new UnsupportedOperationException("Unexpected lack of UTF-8 support.", e);
-        }
-    }
-
-    /**
-     * Authenticates a user using HTTP headers containing that user's verified
-     * X.509 certificate. It is assumed that this certificate is being passed
-     * to Guacamole from an SSL termination service that has already verified
-     * that this certificate is valid and authorized for access to that
-     * Guacamole instance.
-     *
-     * @param credentials
-     *     The credentials received by Guacamole in the authentication request.
-     *
-     * @param certificate
-     *     The raw bytes of the X.509 certificate retrieved from the request.
-     *
-     * @return
-     *     A new SSOAuthenticatedUser representing the identity of the user
-     *     asserted by the SSL termination service via that user's X.509
-     *     certificate.
-     *
-     * @throws GuacamoleException
-     *     If the provided X.509 certificate is not valid or cannot be parsed.
-     *     It is expected that the SSL termination service will already have
-     *     validated the certificate; this function validates only the
-     *     certificate timestamps.
-     */
-    private SSOAuthenticatedUser authenticateUser(Credentials credentials,
-            byte[] certificate) throws GuacamoleException {
-
-        // Parse and re-verify certificate is valid with respect to timestamps
-        X509Certificate cert;
-        try (InputStream input = new ByteArrayInputStream(certificate)) {
-
-            CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
-            cert = (X509Certificate) certFactory.generateCertificate(input);
-
-            // Verify certificate is valid (it should be given pre-validation
-            // from SSL termination, but it's worth rechecking for sanity)
-            cert.checkValidity();
-
-        }
-        catch (CertificateException e) {
-            throw new GuacamoleClientException("The X.509 certificate "
-                    + "presented is not valid.", e);
-        }
-        catch (IOException e) {
-            throw new GuacamoleServerException("Provided X.509 certificate "
-                    + "could not be read.", e);
-        }
-
-        // Extract user's DN from their X.509 certificate
-        LdapName dn;
-        try {
-            Principal principal = cert.getSubjectX500Principal();
-            dn = new LdapName(principal.getName());
-        }
-        catch (InvalidNameException e) {
-            throw new GuacamoleClientException("The X.509 certificate "
-                    + "presented does not contain a valid subject DN.", e);
-        }
-
-        // Verify DN actually contains components
-        int numComponents = dn.size();
-        if (numComponents < 1)
-            throw new GuacamoleClientException("The X.509 certificate "
-                    + "presented contains an empty subject DN.");
-
-        // Simply use first component of DN as username (TODO: Enforce
-        // requirements on the attribute providing the username and the base DN,
-        // and consider using components following the username to determine
-        // group memberships)
-        String username = dn.getRdn(numComponents - 1).getValue().toString();
-
-        SSOAuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
-        authenticatedUser.init(username, credentials,
-                Collections.emptySet(), Collections.emptyMap());
-        return authenticatedUser;
-
-    }
-
     /**
      * Processes the given HTTP request, returning the identity represented by
      * the auth session token present in that request. If no such token is
@@ -224,80 +83,17 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
      *     or null if there is no such token or the token does not represent a
      *     valid identity.
      */
-    private SSOAuthenticatedUser processIdentity(HttpServletRequest request) {
+    private SSOAuthenticatedUser processIdentity(Credentials credentials, HttpServletRequest request) {
+
         String state = request.getParameter(AUTH_SESSION_PARAMETER_NAME);
-        return sessionManager.getIdentity(state);
-    }
-
-    /**
-     * Processes the X.509 certificate in the headers of the given HTTP
-     * request, returning an authentication session token representing the
-     * identity in that certificate. If the certificate is invalid or not
-     * present, null is returned.
-     *
-     * @param credentials
-     *     The credentials submitted in the HTTP request being processed.
-     *
-     * @param request
-     *     The HTTP request to process.
-     *
-     * @return
-     *     An authentication session token representing the identity in the
-     *     certificate in the given HTTP request, or null if the request does
-     *     not contain a valid certificate.
-     *
-     * @throws GuacamoleException
-     *     If any configuration parameters related to retrieving certificates
-     *     from HTTP request cannot be parsed.
-     */
-    private String processCertificate(Credentials credentials,
-            HttpServletRequest request) throws GuacamoleException {
-
-        // Verify that SSL termination has already verified the certificate
-        String verified = request.getHeader(confService.getClientVerifiedHeader());
-        if (!CLIENT_VERIFIED_HEADER_SUCCESS_VALUE.equals(verified))
+        String username = sessionManager.getIdentity(state);
+        if (username == null)
             return null;
 
-        String certificate = request.getHeader(confService.getClientCertificateHeader());
-        if (certificate == null)
-            return null;
-
-        SSOAuthenticatedUser authenticatedUser = authenticateUser(credentials, decode(certificate));
-        long validityDuration = TimeUnit.MINUTES.toMillis(confService.getMaxTokenValidity());
-        return sessionManager.defer(new SSLAuthenticationSession(authenticatedUser, validityDuration));
-
-    }
-
-    /**
-     * Redirects the current user back to the main URL of the Guacamole
-     * instance to continue the authentication process after having identified
-     * themselves using SSL/TLS client authentication.
-     *
-     * @param token
-     *     The authentication session token generated for the current user's
-     *     identity.
-     *
-     * @throws GuacamoleException
-     *     To redirect the user to the main URL of the Guacamole instance.
-     */
-    private void resumeAuthenticationAtRedirectURI(String token)
-            throws GuacamoleException {
-
-        URI redirectURI = UriBuilder.fromUri(confService.getRedirectURI())
-                .queryParam(AUTH_SESSION_PARAMETER_NAME, token)
-                .build();
-
-        // Request that the provided credentials, now tokenized, be
-        // resubmitted in that tokenized form to the original host for
-        // authentication
-        throw new GuacamoleInsufficientCredentialsException("Please "
-                + "resubmit your tokenized credentials using the "
-                + "following URI.",
-            new CredentialsInfo(Arrays.asList(new Field[] {
-                new RedirectField(AUTH_SESSION_PARAMETER_NAME, redirectURI,
-                        new TranslatableMessage("LOGIN.INFO_IDP_REDIRECT_PENDING"))
-            }))
-        );
+        SSOAuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
+        authenticatedUser.init(username, credentials,
+                Collections.emptySet(), Collections.emptyMap());
+        return authenticatedUser;
 
     }
 
@@ -308,21 +104,22 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
         //
         // Overall flow:
         //
-        // 1) Unauthenticated user is given a temporary auth session token
-        //    and redirected to the SSL termination instance that provides
-        //    SSL client auth. This redirect uses a unique and temporary
-        //    subdomain to ensure each SSL client auth attempt is fresh and
-        //    does not use cached auth details.
+        // 1) An unauthenticated user makes a GET request to
+        //    ".../api/ext/ssl/identity". After a series of redirects
+        //    intended to prevent that identity from being inadvertently
+        //    cached and inherited by future authentication attempts on the
+        //    same client machine, an external SSL termination service requests
+        //    and validates the user's certificate, those details are passed
+        //    back to Guacamole via HTTP headers, and Guacamole produces a JSON
+        //    response containing an opaque state value.
         //
-        // 2) Unauthenticated user with a temporary auth session token
-        //    is validated by SSL termination, with that SSL termination
-        //    adding HTTP headers containing the validated certificate to the
-        //    user's HTTP request.
+        // 2) The user (still unauthenticated) resubmits the opaque state
+        //    value from the received JSON as the "state" parameter of a
+        //    standard Guacamole authentication request (".../api/tokens").
         //
-        // 3) If valid, the user is assigned a temporary token and redirected
-        //    back to the original URL. That temporary token is accepted by
-        //    this extension at the original URL as proof of the user's
-        //    identity.
+        // 3) If the certificate received was valid, the user is authenticated
+        //    according to the identity asserted by that certificate. If not,
+        //    authentication is refused.
         //
         // NOTE: All SSL termination endpoints in front of Guacamole MUST
         // be configured to drop these headers from any inbound requests
@@ -345,50 +142,13 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
             return null;
 
         //
-        // Handle only auth session tokens at the main redirect URI, using the
+        // Handle only auth session tokens at the primary URI, using the
         // pre-verified information from those tokens to determine user
         // identity.
         //
 
-        String redirectHost = confService.getRedirectURI().getHost();
-        if (host.equals(redirectHost)) {
-
-            SSOAuthenticatedUser user = processIdentity(request);
-            if (user != null)
-                return user;
-
-            // Redirect unauthenticated requests to the endpoint requiring
-            // SSL client auth to request identity verification
-            throw new GuacamoleInvalidCredentialsException("Invalid login.",
-                new CredentialsInfo(Arrays.asList(new Field[] {
-                    new RedirectField(AUTH_SESSION_PARAMETER_NAME, getLoginURI(), // <-- Each call to getLoginURI() produces a unique subdomain that is valid only for ONE use (see below)
-                            new TranslatableMessage("LOGIN.INFO_IDP_REDIRECT_PENDING"))
-                }))
-            );
-
-        }
-
-        //
-        // Process certificates only at valid single-use subdomains dedicated
-        // to client authentication, redirecting back to the main redirect URI
-        // for final authentication if that processing is successful.
-        //
-        // NOTE: This is CRITICAL. If unique subdomains are not generated and
-        // tied to strictly one authentication attempt, then those subdomains
-        // could be reused by a user on a shared machine to assume the cached
-        // credentials of another user that used that machine earlier. The
-        // browser and/or OS may cache the certificate so that it can be reused
-        // for future SSL sessions to that same domain. Here, we ensure each
-        // generated domain is unique and only valid for certificate processing
-        // ONCE. The domain may still be valid with DNS, but will no longer be
-        // usable for certificate authentication.
-        //
-
-        else if (subdomainNonceService.isValid(confService.getClientAuthenticationSubdomain(host))) {
-            String token = processCertificate(credentials, request);
-            if (token != null)
-                resumeAuthenticationAtRedirectURI(token);
-        }
+        if (confService.isPrimaryHostname(host))
+            return processIdentity(credentials, request);
 
         // All other requests are not allowed - refuse to authenticate
         throw new GuacamoleClientException("Direct authentication against "
@@ -400,9 +160,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
 
     @Override
     public URI getLoginURI() throws GuacamoleException {
-        long validityDuration = TimeUnit.MINUTES.toMillis(confService.getMaxDomainValidity());
-        String uniqueSubdomain = subdomainNonceService.generate(validityDuration);
-        return confService.getClientAuthenticationURI(uniqueSubdomain);
+        throw new GuacamoleResourceNotFoundException("No such resource.");
     }
 
     @Override
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/OpaqueAuthenticationResult.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/OpaqueAuthenticationResult.java
new file mode 100644
index 000000000..66020f20a
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/OpaqueAuthenticationResult.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.guacamole.auth.ssl;
+
+/**
+ * REST API response that reports the result of attempting to authenticate the
+ * user using SSL/TLS client authentication. The information within this
+ * result is intentionally opaque and must be resubmitted in a separate
+ * authentication request for authentication to finally succeed or fail.
+ */
+public class OpaqueAuthenticationResult {
+
+    /**
+     * An arbitrary value representing the result of authenticating the
+     * current user.
+     */
+    private final String state;
+
+    /**
+     * Creates a new OpaqueAuthenticationResult containing the given opaque
+     * state value. Successful authentication results must be indistinguishable
+     * from unsuccessful results with respect to this value. Only using this
+     * value within ANOTHER authentication attempt can determine whether
+     * authentication is successful.
+     *
+     * @param state
+     *     An arbitrary value representing the result of authenticating the
+     *     current user.
+     */
+    public OpaqueAuthenticationResult(String state) {
+        this.state = state;
+    }
+
+    /**
+     * Returns an arbitrary value representing the result of authenticating the
+     * current user. This value may be resubmitted as the "state" parameter of
+     * an authentication request beneath the primary URI of the web application
+     * to finalize the authentication procedure and determine whether the
+     * operation has succeeded or failed.
+     *
+     * @return
+     *     An arbitrary value representing the result of authenticating the
+     *     current user.
+     */
+    public String getState() {
+        return state;
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProvider.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProvider.java
index 6b01858ef..2458c1a44 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProvider.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProvider.java
@@ -20,7 +20,6 @@
 package org.apache.guacamole.auth.ssl;
 
 import org.apache.guacamole.auth.sso.SSOAuthenticationProvider;
-import org.apache.guacamole.auth.sso.SSOResource;
 
 /**
  * Guacamole authentication backend which authenticates users using SSL/TLS
@@ -37,7 +36,7 @@ public class SSLAuthenticationProvider extends SSOAuthenticationProvider {
      * an external SSL termination system using SSL/TLS client authentication.
      */
     public SSLAuthenticationProvider() {
-        super(AuthenticationProviderService.class, SSOResource.class,
+        super(AuthenticationProviderService.class, SSLClientAuthenticationResource.class,
                 new SSLAuthenticationProviderModule());
     }
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
index 56e50bd75..46eeaa94f 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
@@ -20,6 +20,7 @@
 package org.apache.guacamole.auth.ssl;
 
 import com.google.inject.AbstractModule;
+import com.google.inject.Scopes;
 import org.apache.guacamole.auth.ssl.conf.ConfigurationService;
 import org.apache.guacamole.auth.sso.NonceService;
 
@@ -32,7 +33,7 @@ public class SSLAuthenticationProviderModule extends AbstractModule {
     @Override
     protected void configure() {
         bind(ConfigurationService.class);
-        bind(NonceService.class);
+        bind(NonceService.class).in(Scopes.SINGLETON);
         bind(SSLAuthenticationSessionManager.class);
     }
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java
index e2e0d4c43..4a4c9ce8f 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java
@@ -20,7 +20,6 @@
 package org.apache.guacamole.auth.ssl;
 
 import org.apache.guacamole.auth.sso.AuthenticationSession;
-import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
 
 /**
  * Representation of an in-progress SSL/TLS authentication attempt.
@@ -30,7 +29,7 @@ public class SSLAuthenticationSession extends AuthenticationSession {
     /**
      * The identity asserted by the external SSL termination service.
      */
-    private final SSOAuthenticatedUser identity;
+    private final String identity;
 
     /**
      * Creates a new AuthenticationSession representing an in-progress SSL/TLS
@@ -44,7 +43,7 @@ public class SSLAuthenticationSession extends AuthenticationSession {
      *     The number of milliseconds that may elapse before this session must
      *     be considered invalid.
      */
-    public SSLAuthenticationSession(SSOAuthenticatedUser identity, long expires) {
+    public SSLAuthenticationSession(String identity, long expires) {
         super(expires);
         this.identity = identity;
     }
@@ -58,7 +57,7 @@ public class SSLAuthenticationSession extends AuthenticationSession {
      * @return
      *     The identity asserted by the external SSL termination service.
      */
-    public SSOAuthenticatedUser getIdentity() {
+    public String getIdentity() {
         return identity;
     }
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java
index 3200cae3d..fc1b0842f 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java
@@ -21,7 +21,6 @@ package org.apache.guacamole.auth.ssl;
 
 import com.google.inject.Singleton;
 import org.apache.guacamole.auth.sso.AuthenticationSessionManager;
-import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
 
 /**
  * Manager service that temporarily stores SSL/TLS authentication attempts
@@ -48,7 +47,7 @@ public class SSLAuthenticationSessionManager
      *     session with the given identifier, or null if there is no such
      *     identity.
      */
-    public SSOAuthenticatedUser getIdentity(String identifier) {
+    public String getIdentity(String identifier) {
 
         SSLAuthenticationSession session = resume(identifier);
         if (session != null)
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
new file mode 100644
index 000000000..4c99394f5
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
@@ -0,0 +1,332 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.guacamole.auth.ssl;
+
+import com.google.inject.Inject;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.UnsupportedEncodingException;
+import java.net.URI;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.security.Principal;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.List;
+import java.util.concurrent.TimeUnit;
+import javax.naming.InvalidNameException;
+import javax.naming.ldap.LdapName;
+import javax.ws.rs.GET;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.HeaderParam;
+import javax.ws.rs.Path;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.HttpHeaders;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.UriBuilder;
+import org.apache.guacamole.GuacamoleClientException;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleResourceNotFoundException;
+import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.auth.ssl.conf.ConfigurationService;
+import org.apache.guacamole.auth.sso.NonceService;
+import org.apache.guacamole.auth.sso.SSOResource;
+
+/**
+ * REST API resource that allows the user to retrieve an opaque state value
+ * representing their identity as determined by SSL/TLS client authentication.
+ * The opaque value may represent a valid identity or an authentication
+ * failure, and must be resubmitted within a normal Guacamole authentication
+ * request to finalize the authentication process.
+ */
+public class SSLClientAuthenticationResource extends SSOResource {
+
+    /**
+     * The string value that the SSL termination service uses for its client
+     * verification header to represent that the client certificate has been
+     * verified.
+     */
+    private static final String CLIENT_VERIFIED_HEADER_SUCCESS_VALUE = "SUCCESS";
+
+    /**
+     * Service for retrieving configuration information.
+     */
+    @Inject
+    private ConfigurationService confService;
+
+    /**
+     * Session manager for generating and maintaining unique tokens to
+     * represent the authentication flow of a user who has only partially
+     * authenticated. Here, these tokens represent a user that has been
+     * validated by SSL termination and allow the Guacamole instance that
+     * doesn't require SSL/TLS authentication to retrieve the user's identity
+     * and complete the authentication process.
+     */
+    @Inject
+    private SSLAuthenticationSessionManager sessionManager;
+
+    /**
+     * Service for validating and generating unique nonce values. Here, these
+     * nonces are used specifically for generating unique domains.
+     */
+    @Inject
+    private NonceService subdomainNonceService;
+
+    /**
+     * Retrieves a single value from the HTTP header having the given name. If
+     * there are multiple HTTP headers present with this name, the first
+     * matching header in the request is used. If there are no such headers in
+     * the request, null is returned.
+     *
+     * @param headers
+     *     The HTTP headers present in the request.
+     *
+     * @param name
+     *     The name of the header to retrieve.
+     *
+     * @return
+     *     The first value of the HTTP header having the given name, or null if
+     *     there is no such header.
+     */
+    private String getHeader(HttpHeaders headers, String name) {
+
+        List<String> values = headers.getRequestHeader(name);
+        if (values.isEmpty())
+            return null;
+
+        return values.get(0);
+
+    }
+
+    /**
+     * Decodes the provided URL-encoded string as UTF-8, returning the result.
+     *
+     * @param value
+     *     The URL-encoded string to decode.
+     *
+     * @return
+     *     The decoded string.
+     *
+     * @throws GuacamoleException
+     *     If the provided value is not a value URL-encoded string.
+     */
+    private byte[] decode(String value) throws GuacamoleException {
+        try {
+            return URLDecoder.decode(value, StandardCharsets.UTF_8.name())
+                    .getBytes(StandardCharsets.UTF_8);
+        }
+        catch (IllegalArgumentException e) {
+            throw new GuacamoleClientException("Invalid URL-encoded value.", e);
+        }
+        catch (UnsupportedEncodingException e) {
+            // This should never happen, as UTF-8 is a standard charset that
+            // the JVM is required to support
+            throw new UnsupportedOperationException("Unexpected lack of UTF-8 support.", e);
+        }
+    }
+
+    /**
+     * Authenticates a user using HTTP headers containing that user's verified
+     * X.509 certificate. It is assumed that this certificate is being passed
+     * to Guacamole from an SSL termination service that has already verified
+     * that this certificate is valid and authorized for access to that
+     * Guacamole instance.
+     *
+     * @param certificate
+     *     The raw bytes of the X.509 certificate retrieved from the request.
+     *
+     * @return
+     *     A new SSOAuthenticatedUser representing the identity of the user
+     *     asserted by the SSL termination service via that user's X.509
+     *     certificate.
+     *
+     * @throws GuacamoleException
+     *     If the provided X.509 certificate is not valid or cannot be parsed.
+     *     It is expected that the SSL termination service will already have
+     *     validated the certificate; this function validates only the
+     *     certificate timestamps.
+     */
+    public String getUsername(byte[] certificate) throws GuacamoleException {
+
+        // Parse and re-verify certificate is valid with respect to timestamps
+        X509Certificate cert;
+        try (InputStream input = new ByteArrayInputStream(certificate)) {
+
+            CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
+            cert = (X509Certificate) certFactory.generateCertificate(input);
+
+            // Verify certificate is valid (it should be given pre-validation
+            // from SSL termination, but it's worth rechecking for sanity)
+            cert.checkValidity();
+
+        }
+        catch (CertificateException e) {
+            throw new GuacamoleClientException("The X.509 certificate "
+                    + "presented is not valid.", e);
+        }
+        catch (IOException e) {
+            throw new GuacamoleServerException("Provided X.509 certificate "
+                    + "could not be read.", e);
+        }
+
+        // Extract user's DN from their X.509 certificate
+        LdapName dn;
+        try {
+            Principal principal = cert.getSubjectX500Principal();
+            dn = new LdapName(principal.getName());
+        }
+        catch (InvalidNameException e) {
+            throw new GuacamoleClientException("The X.509 certificate "
+                    + "presented does not contain a valid subject DN.", e);
+        }
+
+        // Verify DN actually contains components
+        int numComponents = dn.size();
+        if (numComponents < 1)
+            throw new GuacamoleClientException("The X.509 certificate "
+                    + "presented contains an empty subject DN.");
+
+        // Simply use first component of DN as username (TODO: Enforce
+        // requirements on the attribute providing the username and the base DN,
+        // and consider using components following the username to determine
+        // group memberships)
+        return dn.getRdn(numComponents - 1).getValue().toString();
+
+    }
+
+    /**
+     * Processes the X.509 certificate in the headers of the given HTTP
+     * request, returning an authentication session token representing the
+     * identity in that certificate. If the certificate is invalid or not
+     * present, null is returned.
+     *
+     * @param credentials
+     *     The credentials submitted in the HTTP request being processed.
+     *
+     * @param request
+     *     The HTTP request to process.
+     *
+     * @return
+     *     An authentication session token representing the identity in the
+     *     certificate in the given HTTP request, or null if the request does
+     *     not contain a valid certificate.
+     *
+     * @throws GuacamoleException
+     *     If any configuration parameters related to retrieving certificates
+     *     from HTTP request cannot be parsed.
+     */
+    private String processCertificate(HttpHeaders headers) throws GuacamoleException {
+
+        //
+        // NOTE: A result with an associated state is ALWAYS returned by
+        // processCertificate(), even if the request does not actually contain
+        // a valid certificate. This is by design and ensures that the nature
+        // of a certificate (valid vs. invalid) cannot be determined except
+        // via Guacamole's authentication endpoint, thus allowing auth failure
+        // hooks to consider attempts to use invalid certificates as auth
+        // failures.
+        //
+
+        // Verify that SSL termination has already verified the certificate
+        String verified = getHeader(headers, confService.getClientVerifiedHeader());
+        if (!CLIENT_VERIFIED_HEADER_SUCCESS_VALUE.equals(verified))
+            return sessionManager.generateInvalid();
+
+        String certificate = getHeader(headers, confService.getClientCertificateHeader());
+        if (certificate == null)
+            return sessionManager.generateInvalid();
+
+        String username = getUsername(decode(certificate));
+        long validityDuration = TimeUnit.MINUTES.toMillis(confService.getMaxTokenValidity());
+        return sessionManager.defer(new SSLAuthenticationSession(username, validityDuration));
+
+    }
+
+    /**
+     * Attempts to authenticate the current user using SSL/TLS client
+     * authentication, returning an opaque value that represents their
+     * authenticated status. If necessary, the user is first redirected to a
+     * unique endpoint that supports SSL/TLS client authentication.
+     *
+     * @param headers
+     *     All HTTP headers submitted in the user's authentication request.
+     *
+     * @param host
+     *     The hostname that the user specified in their HTTP request.
+     *
+     * @return
+     *     A Response containing an opaque value representing the user's
+     *     authenticated status, or a Response redirecting the user to a
+     *     unique endpoint that can provide this.
+     *
+     * @throws GuacamoleException
+     *     If any required configuration information is missing or cannot be
+     *     parsed, or if the request was not received at a valid subdomain.
+     */
+    @GET
+    @Path("identity")
+    public Response authenticateClient(@Context HttpHeaders headers,
+            @HeaderParam("Host") String host) throws GuacamoleException {
+
+        // Redirect any requests to the domain that does NOT require SSL/TLS
+        // client authentication to the same endpoint at a domain that does
+        // require SSL/TLS authentication
+        String subdomain = confService.getClientAuthenticationSubdomain(host);
+        if (subdomain == null) {
+
+            long validityDuration = TimeUnit.MINUTES.toMillis(confService.getMaxDomainValidity());
+            String uniqueSubdomain = subdomainNonceService.generate(validityDuration);
+
+            URI clientAuthURI = UriBuilder.fromUri(confService.getClientAuthenticationURI(uniqueSubdomain))
+                    .path("api/ext/ssl/identity")
+                    .build();
+
+            return Response.seeOther(clientAuthURI).build();
+
+        }
+
+        //
+        // Process certificates only at valid single-use subdomains dedicated
+        // to client authentication, redirecting back to the main redirect URI
+        // for final authentication if that processing is successful.
+        //
+        // NOTE: This is CRITICAL. If unique subdomains are not generated and
+        // tied to strictly one authentication attempt, then those subdomains
+        // could be reused by a user on a shared machine to assume the cached
+        // credentials of another user that used that machine earlier. The
+        // browser and/or OS may cache the certificate so that it can be reused
+        // for future SSL sessions to that same domain. Here, we ensure each
+        // generated domain is unique and only valid for certificate processing
+        // ONCE. The domain may still be valid with DNS, but will no longer be
+        // usable for certificate authentication.
+        //
+
+        if (subdomainNonceService.isValid(subdomain))
+            return Response.ok(new OpaqueAuthenticationResult(processCertificate(headers)))
+                    .header("Access-Control-Allow-Origin", confService.getPrimaryOrigin().toString())
+                    .type(MediaType.APPLICATION_JSON)
+                    .build();
+
+        throw new GuacamoleResourceNotFoundException("No such resource.");
+
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java
index 074ee093b..3f57bd864 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java
@@ -21,8 +21,10 @@ package org.apache.guacamole.auth.ssl.conf;
 
 import com.google.inject.Inject;
 import java.net.URI;
+import java.net.URISyntaxException;
 import javax.ws.rs.core.UriBuilder;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.properties.IntegerGuacamoleProperty;
 import org.apache.guacamole.properties.StringGuacamoleProperty;
@@ -80,11 +82,11 @@ public class ConfigurationService {
      * to THIS instance of Guacamole, but behind SSL termination that DOES NOT
      * require or request SSL/TLS client authentication.
      */
-    private static final URIGuacamoleProperty SSL_REDIRECT_URI =
+    private static final URIGuacamoleProperty SSL_PRIMARY_URI =
             new URIGuacamoleProperty() {
 
         @Override
-        public String getName() { return "ssl-redirect-uri"; }
+        public String getName() { return "ssl-primary-uri"; }
 
     };
 
@@ -121,11 +123,10 @@ public class ConfigurationService {
      * authentication token for SSL/TLS authentication may remain valid, in
      * minutes. This token is used to represent the user's asserted identity
      * after it has been verified by the SSL termination service. This interval
-     * must be long enough to allow for network delays in redirecting the user
-     * back to the main Guacamole URL, but short enough that unused tokens do
-     * not consume unnecessary server resources and cannot potentially be
-     * guessed while the token is still valid. These tokens are 256-bit secure
-     * random values.
+     * must be long enough to allow for network delays in receiving the token,
+     * but short enough that unused tokens do not consume unnecessary server
+     * resources and cannot potentially be guessed while the token is still
+     * valid. These tokens are 256-bit secure random values.
      */
     private static final IntegerGuacamoleProperty SSL_MAX_TOKEN_VALIDITY =
             new IntegerGuacamoleProperty() {
@@ -141,12 +142,12 @@ public class ConfigurationService {
      * minutes. This subdomain is used to ensure each SSL/TLS authentication
      * attempt is fresh and does not potentially reuse a previous
      * authentication attempt that was cached by the browser or OS. This
-     * interval must be long enough to allow for network delays in redirecting
-     * the user to the SSL termination service enforcing SSL/TLS
-     * authentication, but short enough that an unused domain does not consume
-     * unnecessary server resources and cannot potentially be guessed while
-     * that subdomain is still valid. These subdomains are 128-bit secure
-     * random values.
+     * interval must be long enough to allow for network delays in
+     * authenticating the user with the SSL termination service that enforces
+     * SSL/TLS client authentication, but short enough that an unused domain
+     * does not consume unnecessary server resources and cannot potentially be
+     * guessed while that subdomain is still valid. These subdomains are
+     * 128-bit secure random values.
      */
     private static final IntegerGuacamoleProperty SSL_MAX_DOMAIN_VALIDITY =
             new IntegerGuacamoleProperty() {
@@ -212,6 +213,11 @@ public class ConfigurationService {
      */
     public String getClientAuthenticationSubdomain(String hostname) throws GuacamoleException {
 
+        // Any hostname that matches the explicitly-specific primary URI is not
+        // a client auth subdomain
+        if (isPrimaryHostname(hostname))
+            return null;
+
         URI authURI = environment.getRequiredProperty(SSL_CLIENT_AUTH_URI);
         String baseHostname = authURI.getHost();
 
@@ -240,11 +246,57 @@ public class ConfigurationService {
      *     required.
      *
      * @throws GuacamoleException
-     *     If the required property for configuring the redirect URI is missing
+     *     If the required property for configuring the primary URI is missing
      *     or cannot be parsed.
      */
-    public URI getRedirectURI() throws GuacamoleException {
-        return environment.getRequiredProperty(SSL_REDIRECT_URI);
+    public URI getPrimaryURI() throws GuacamoleException {
+        return environment.getRequiredProperty(SSL_PRIMARY_URI);
+    }
+
+    /**
+     * Returns the HTTP request origin for requests originating from this
+     * instance via the primary URI (as returned by {@link #getPrimaryURI()}.
+     * This value is essentially the same as the primary URI but with only the
+     * scheme, host, and port present.
+     *
+     * @return
+     *     The HTTP request origin for requests originating from this instance
+     *     via the primary URI.
+     *
+     * @throws GuacamoleException
+     *     If the required property for configuring the primary URI is missing
+     *     or cannot be parsed.
+     */
+    public URI getPrimaryOrigin() throws GuacamoleException {
+        URI primaryURI = getPrimaryURI();
+        try {
+            return new URI(primaryURI.getScheme(), null, primaryURI.getHost(), primaryURI.getPort(), null, null, null);
+        }
+        catch (URISyntaxException e) {
+            throw new GuacamoleServerException("Request origin could not be "
+                    + "derived from the configured primary URI.", e);
+        }
+    }
+
+    /**
+     * Returns whether the given hostname is the same as the hostname in the
+     * primary URI (as returned by {@link #getPrimaryURI()}. Hostnames are
+     * case-insensitive.
+     *
+     * @param hostname
+     *     The hostname to test.
+     *
+     * @return
+     *     true if the hostname is the same as the hostname in the primary URI,
+     *     false otherwise.
+     *
+     * @throws GuacamoleException
+     *     If the required property for configuring the primary URI is missing
+     *     or cannot be parsed.
+     */
+    public boolean isPrimaryHostname(String hostname) throws GuacamoleException {
+        URI primaryURI = getPrimaryURI();
+        return hostname.equalsIgnoreCase(primaryURI.getHost());
     }
 
     /**
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/directives/guacSslAuth.js b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/directives/guacSslAuth.js
new file mode 100644
index 000000000..82e5c8b6d
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/directives/guacSslAuth.js
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * A directive which automatically attempts to log the current user in using
+ * SSL/TLS client authentication when the associated element is clicked.
+ */
+angular.module('element').directive('guacSslAuth', ['$injector', function guacSslAuth($injector) {
+
+    // Required services
+    var requestService        = $injector.get('requestService');
+    var authenticationService = $injector.get('authenticationService');
+
+    var directive = {
+        restrict: 'A'
+    };
+
+    directive.link = function linkGuacSslAuth($scope, $element) {
+
+        /**
+         * The element which will register the click.
+         *
+         * @type Element
+         */
+        const element = $element[0];
+
+        // Attempt SSL/TLS client authentication upon click
+        element.addEventListener('click', function elementClicked() {
+
+            // Transform SSL/TLS identity into an opaque "state" value and
+            // attempt authentication using that value
+            authenticationService.authenticate(
+                requestService({
+                    method: 'GET',
+                    headers : {
+                        'Cache-Control' : undefined, // Avoid sending headers that would result in a pre-flight OPTIONS request for CORS
+                        'Pragma'        : undefined
+                    },
+                    url: 'api/ext/ssl/identity'
+                })
+                .then(function identityRetrieved(data) {
+                    return { 'state' : data.state || '' };
+                })
+            )['catch'](requestService.IGNORE);
+
+        });
+
+    };
+
+    return directive;
+
+}]);
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
index 30c8a1c99..7b8099427 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
@@ -13,6 +13,8 @@
         "styles/sso-providers.css"
     ],
 
+    "js" : [ "ssl.min.js" ],
+
     "html" : [
         "html/sso-providers.html",
         "html/sso-provider-ssl.html"
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html
index b6c510931..8798eed2d 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html
@@ -1,4 +1,4 @@
 <meta name="after-children" content=".login-ui .sso-provider-list:last-child">
-<li class="sso-provider sso-provider-ssl"><a href="api/ext/ssl/login">{{
+<li class="sso-provider sso-provider-ssl"><a guac-ssl-auth href="">{{
     'LOGIN.NAME_IDP_SSL' | translate
 }}</a></li>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/license.txt b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/license.txt
new file mode 100644
index 000000000..042f3ce1f
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/license.txt
@@ -0,0 +1,18 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/sslModule.js b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/sslModule.js
new file mode 100644
index 000000000..2e3f844ef
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/sslModule.js
@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * The module for code implementing SSO using SSL/TLS client authentication.
+ */
+angular.module('guacSsoSsl', [
+    'auth',
+    'rest'
+]);
+
+// Ensure the guacSsoSsl module is loaded along with the rest of the app
+angular.module('index').requires.push('guacSsoSsl');

From 82553265121ff4df4f52b1eb71f850893b7a22b2 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 30 Jan 2023 16:29:04 -0800
Subject: [PATCH 121/289] GUACAMOLE-839: Move SSL/TLS client auth logic to
 separate service.

---
 .../main/resources/directives/guacSslAuth.js  | 21 +------
 .../resources/services/clientAuthService.js   | 58 +++++++++++++++++++
 2 files changed, 60 insertions(+), 19 deletions(-)
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/services/clientAuthService.js

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/directives/guacSslAuth.js b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/directives/guacSslAuth.js
index 82e5c8b6d..49347127a 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/directives/guacSslAuth.js
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/directives/guacSslAuth.js
@@ -24,8 +24,7 @@
 angular.module('element').directive('guacSslAuth', ['$injector', function guacSslAuth($injector) {
 
     // Required services
-    var requestService        = $injector.get('requestService');
-    var authenticationService = $injector.get('authenticationService');
+    var clientAuthService = $injector.get('clientAuthService');
 
     var directive = {
         restrict: 'A'
@@ -42,23 +41,7 @@ angular.module('element').directive('guacSslAuth', ['$injector', function guacSs
 
         // Attempt SSL/TLS client authentication upon click
         element.addEventListener('click', function elementClicked() {
-
-            // Transform SSL/TLS identity into an opaque "state" value and
-            // attempt authentication using that value
-            authenticationService.authenticate(
-                requestService({
-                    method: 'GET',
-                    headers : {
-                        'Cache-Control' : undefined, // Avoid sending headers that would result in a pre-flight OPTIONS request for CORS
-                        'Pragma'        : undefined
-                    },
-                    url: 'api/ext/ssl/identity'
-                })
-                .then(function identityRetrieved(data) {
-                    return { 'state' : data.state || '' };
-                })
-            )['catch'](requestService.IGNORE);
-
+            clientAuthService.authenticate();
         });
 
     };
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/services/clientAuthService.js b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/services/clientAuthService.js
new file mode 100644
index 000000000..3bf9d9e86
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/services/clientAuthService.js
@@ -0,0 +1,58 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Service for authenticating a user using SSL/TLS client authentication.
+ */
+angular.module('guacSsoSsl').factory('clientAuthService', ['$injector',
+    function clientAuthServiceProvider($injector) {
+
+    // Required services
+    var requestService        = $injector.get('requestService');
+    var authenticationService = $injector.get('authenticationService');
+
+    var service = {};
+
+    /**
+     * Attempt to authenticate using a unique token obtained through SSL/TLS
+     * client authentication.
+     */
+    service.authenticate = function authenticate() {
+
+        // Transform SSL/TLS identity into an opaque "state" value and
+        // attempt authentication using that value
+        authenticationService.authenticate(
+            requestService({
+                method: 'GET',
+                headers : {
+                    'Cache-Control' : undefined, // Avoid sending headers that would result in a pre-flight OPTIONS request for CORS
+                    'Pragma'        : undefined
+                },
+                url: 'api/ext/ssl/identity'
+            })
+            .then(function identityRetrieved(data) {
+                return { 'state' : data.state || '' };
+            })
+        )['catch'](requestService.IGNORE);
+
+    };
+
+    return service;
+
+}]);

From 0b5b82cc486029e3759a33e9224e5ccc3923a039 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 21 Feb 2023 17:06:37 -0800
Subject: [PATCH 122/289] GUACAMOLE-839: Allow accepted subject DNs to be
 restricted via configuration.

---
 .../ssl/SSLClientAuthenticationResource.java  | 185 +++++++++++++-----
 .../auth/ssl/conf/ConfigurationService.java   |  63 ++++++
 .../ssl/conf/LdapNameGuacamoleProperty.java   |  50 +++++
 3 files changed, 247 insertions(+), 51 deletions(-)
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/LdapNameGuacamoleProperty.java

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
index 4c99394f5..21a2e0c25 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
@@ -34,6 +34,7 @@ import java.util.List;
 import java.util.concurrent.TimeUnit;
 import javax.naming.InvalidNameException;
 import javax.naming.ldap.LdapName;
+import javax.naming.ldap.Rdn;
 import javax.ws.rs.GET;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.HeaderParam;
@@ -45,10 +46,11 @@ import javax.ws.rs.core.UriBuilder;
 import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
-import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.auth.ssl.conf.ConfigurationService;
 import org.apache.guacamole.auth.sso.NonceService;
 import org.apache.guacamole.auth.sso.SSOResource;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * REST API resource that allows the user to retrieve an opaque state value
@@ -66,6 +68,25 @@ public class SSLClientAuthenticationResource extends SSOResource {
      */
     private static final String CLIENT_VERIFIED_HEADER_SUCCESS_VALUE = "SUCCESS";
 
+    /**
+     * The string value that the SSL termination service uses for its client
+     * verification header to represent that the client certificate is absent.
+     */
+    private static final String CLIENT_VERIFIED_HEADER_NONE_VALUE = "NONE";
+
+    /**
+     * The string prefix that the SSL termination service uses for its client
+     * verification header to represent that the client certificate has failed
+     * validation. The error message describing the nature of the failure is
+     * provided by the SSL termination service after this prefix.
+     */
+    private static final String CLIENT_VERIFIED_HEADER_FAILED_PREFIX = "FAILED:";
+
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(SSLClientAuthenticationResource.class);
+
     /**
      * Service for retrieving configuration information.
      */
@@ -143,6 +164,67 @@ public class SSLClientAuthenticationResource extends SSOResource {
         }
     }
 
+    /**
+     * Extracts a user's username from the X.509 subject name, which should be
+     * in LDAP DN format. If specific username attributes are configured, only
+     * those username attributes are used to determine the name. If a specific
+     * base DN is configured, only subject names that are formatted as LDAP DNs
+     * within that base DN will be accepted.
+     *
+     * @param name
+     *     The subject name to extract the username from.
+     *
+     * @return
+     *     The username of the user represented by the given subject name.
+     *
+     * @throws GuacamoleException
+     *     If any configuration parameters related to retrieving certificates
+     *     from HTTP request cannot be parsed, or if the provided subject name
+     *     cannot be parsed or is not acceptable (wrong base DN or wrong
+     *     username attribute).
+     */
+    public String getUsername(String name) throws GuacamoleException {
+
+        // Extract user's DN from their X.509 certificate
+        LdapName dn;
+        try {
+            dn = new LdapName(name);
+        }
+        catch (InvalidNameException e) {
+            throw new GuacamoleClientException("Subject \"" + name + "\" is "
+                    + "not a valid DN: " + e.getMessage(), e);
+        }
+
+        // Verify DN actually contains components
+        int numComponents = dn.size();
+        if (numComponents < 1)
+            throw new GuacamoleClientException("Subject DN is empty.");
+
+        // Verify DN is within configured base DN (if any)
+        LdapName baseDN = confService.getSubjectBaseDN();
+        if (baseDN != null && !(numComponents > baseDN.size() && dn.startsWith(baseDN)))
+            throw new GuacamoleClientException("Subject DN \"" + dn + "\" is "
+                    + "not within the configured base DN.");
+
+        // Retrieve the least significant attribute from the parsed DN - this
+        // will be the username
+        Rdn nameRdn = dn.getRdn(numComponents - 1);
+
+        // Verify that the username is specified with one of the allowed
+        // attributes
+        List<String> usernameAttributes = confService.getSubjectUsernameAttributes();
+        if (usernameAttributes != null && !usernameAttributes.stream().anyMatch(nameRdn.getType()::equalsIgnoreCase))
+            throw new GuacamoleClientException("Subject DN \"" + dn + "\" "
+                    + "does not contain an acceptable username attribute.");
+
+        // The DN is valid - extract the username from the least significant
+        // component
+        String username = nameRdn.getValue().toString();
+        logger.debug("Username \"{}\" extracted from subject DN \"{}\".", username, dn);
+        return username;
+
+    }
+
     /**
      * Authenticates a user using HTTP headers containing that user's verified
      * X.509 certificate. It is assumed that this certificate is being passed
@@ -154,15 +236,13 @@ public class SSLClientAuthenticationResource extends SSOResource {
      *     The raw bytes of the X.509 certificate retrieved from the request.
      *
      * @return
-     *     A new SSOAuthenticatedUser representing the identity of the user
-     *     asserted by the SSL termination service via that user's X.509
-     *     certificate.
+     *     The username of the user asserted by the SSL termination service via
+     *     that user's X.509 certificate.
      *
      * @throws GuacamoleException
-     *     If the provided X.509 certificate is not valid or cannot be parsed.
-     *     It is expected that the SSL termination service will already have
-     *     validated the certificate; this function validates only the
-     *     certificate timestamps.
+     *     If any configuration parameters related to retrieving certificates
+     *     from HTTP request cannot be parsed, or if the certificate is not
+     *     valid/present.
      */
     public String getUsername(byte[] certificate) throws GuacamoleException {
 
@@ -179,36 +259,15 @@ public class SSLClientAuthenticationResource extends SSOResource {
 
         }
         catch (CertificateException e) {
-            throw new GuacamoleClientException("The X.509 certificate "
-                    + "presented is not valid.", e);
+            throw new GuacamoleClientException("Certificate is not valid: " + e.getMessage(), e);
         }
         catch (IOException e) {
-            throw new GuacamoleServerException("Provided X.509 certificate "
-                    + "could not be read.", e);
+            throw new GuacamoleClientException("Certificate could not be read: " + e.getMessage(), e);
         }
 
         // Extract user's DN from their X.509 certificate
-        LdapName dn;
-        try {
-            Principal principal = cert.getSubjectX500Principal();
-            dn = new LdapName(principal.getName());
-        }
-        catch (InvalidNameException e) {
-            throw new GuacamoleClientException("The X.509 certificate "
-                    + "presented does not contain a valid subject DN.", e);
-        }
-
-        // Verify DN actually contains components
-        int numComponents = dn.size();
-        if (numComponents < 1)
-            throw new GuacamoleClientException("The X.509 certificate "
-                    + "presented contains an empty subject DN.");
-
-        // Simply use first component of DN as username (TODO: Enforce
-        // requirements on the attribute providing the username and the base DN,
-        // and consider using components following the username to determine
-        // group memberships)
-        return dn.getRdn(numComponents - 1).getValue().toString();
+        Principal principal = cert.getSubjectX500Principal();
+        return getUsername(principal.getName());
 
     }
 
@@ -216,7 +275,7 @@ public class SSLClientAuthenticationResource extends SSOResource {
      * Processes the X.509 certificate in the headers of the given HTTP
      * request, returning an authentication session token representing the
      * identity in that certificate. If the certificate is invalid or not
-     * present, null is returned.
+     * present, an invalid session token is returned.
      *
      * @param credentials
      *     The credentials submitted in the HTTP request being processed.
@@ -226,14 +285,10 @@ public class SSLClientAuthenticationResource extends SSOResource {
      *
      * @return
      *     An authentication session token representing the identity in the
-     *     certificate in the given HTTP request, or null if the request does
-     *     not contain a valid certificate.
-     *
-     * @throws GuacamoleException
-     *     If any configuration parameters related to retrieving certificates
-     *     from HTTP request cannot be parsed.
+     *     certificate in the given HTTP request, or an invalid session token
+     *     if no valid identity was asserted.
      */
-    private String processCertificate(HttpHeaders headers) throws GuacamoleException {
+    private String processCertificate(HttpHeaders headers) {
 
         //
         // NOTE: A result with an associated state is ALWAYS returned by
@@ -245,18 +300,46 @@ public class SSLClientAuthenticationResource extends SSOResource {
         // failures.
         //
 
-        // Verify that SSL termination has already verified the certificate
-        String verified = getHeader(headers, confService.getClientVerifiedHeader());
-        if (!CLIENT_VERIFIED_HEADER_SUCCESS_VALUE.equals(verified))
-            return sessionManager.generateInvalid();
+        try {
 
-        String certificate = getHeader(headers, confService.getClientCertificateHeader());
-        if (certificate == null)
-            return sessionManager.generateInvalid();
+            // Verify that SSL termination has already verified the certificate
+            String verified = getHeader(headers, confService.getClientVerifiedHeader());
+            if (verified != null && verified.startsWith(CLIENT_VERIFIED_HEADER_FAILED_PREFIX)) {
+                String message = verified.substring(CLIENT_VERIFIED_HEADER_FAILED_PREFIX.length());
+                throw new GuacamoleClientException("Client certificate did "
+                        + "not pass validation. SSL termination reports the "
+                        + "following failure: \"" + message + "\"");
+            }
+            else if (CLIENT_VERIFIED_HEADER_NONE_VALUE.equals(verified)) {
+                throw new GuacamoleClientException("No client certificate was presented.");
+            }
+            else if (!CLIENT_VERIFIED_HEADER_SUCCESS_VALUE.equals(verified)) {
+                throw new GuacamoleClientException("Client certificate did not pass validation.");
+            }
 
-        String username = getUsername(decode(certificate));
-        long validityDuration = TimeUnit.MINUTES.toMillis(confService.getMaxTokenValidity());
-        return sessionManager.defer(new SSLAuthenticationSession(username, validityDuration));
+            String certificate = getHeader(headers, confService.getClientCertificateHeader());
+            if (certificate == null)
+                throw new GuacamoleClientException("Client certificate missing from request.");
+
+            String username = getUsername(decode(certificate));
+            long validityDuration = TimeUnit.MINUTES.toMillis(confService.getMaxTokenValidity());
+            return sessionManager.defer(new SSLAuthenticationSession(username, validityDuration));
+
+        }
+        catch (GuacamoleClientException e) {
+            logger.warn("SSL/TLS client authentication attempt rejected: {}", e.getMessage());
+            logger.debug("SSL/TLS client authentication failed.", e);
+        }
+        catch (GuacamoleException e) {
+            logger.error("SSL/TLS client authentication attempt could not be processed: {}", e.getMessage());
+            logger.debug("SSL/TLS client authentication failed.", e);
+        }
+        catch (RuntimeException | Error e) {
+            logger.error("SSL/TLS client authentication attempt failed internally: {}", e.getMessage());
+            logger.debug("Internal failure processing SSL/TLS client authentication attempt.", e);
+        }
+
+        return sessionManager.generateInvalid();
 
     }
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java
index 3f57bd864..48fc86b65 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java
@@ -22,12 +22,15 @@ package org.apache.guacamole.auth.ssl.conf;
 import com.google.inject.Inject;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.util.List;
+import javax.naming.ldap.LdapName;
 import javax.ws.rs.core.UriBuilder;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.properties.IntegerGuacamoleProperty;
 import org.apache.guacamole.properties.StringGuacamoleProperty;
+import org.apache.guacamole.properties.StringListProperty;
 import org.apache.guacamole.properties.URIGuacamoleProperty;
 
 /**
@@ -136,6 +139,34 @@ public class ConfigurationService {
 
     };
 
+    /**
+     * The property defining the LDAP attribute or attributes that may be used
+     * to represent a username within the subject DN of a user's X.509
+     * certificate. If the least-significant attribute of the subject DN is not
+     * one of these attributes, the certificate will be rejected. By default,
+     * any attribute is accepted.
+     */
+    private static final StringListProperty SSL_SUBJECT_USERNAME_ATTRIBUTE =
+            new StringListProperty () {
+
+        @Override
+        public String getName() { return "ssl-subject-username-attribute"; }
+
+    };
+
+    /**
+     * The property defining the base DN containing all valid subject DNs. If
+     * specified, only certificates asserting subject DNs beneath this base DN
+     * will be accepted. By default, all DNs are accepted.
+     */
+    private static final LdapNameGuacamoleProperty SSL_SUBJECT_BASE_DN =
+            new LdapNameGuacamoleProperty () {
+
+        @Override
+        public String getName() { return "ssl-subject-base-dn"; }
+
+    };
+
     /**
      * The property representing the amount of time that the temporary, unique
      * subdomain generated for SSL/TLS authentication may remain valid, in
@@ -374,4 +405,36 @@ public class ConfigurationService {
         return environment.getProperty(SSL_MAX_DOMAIN_VALIDITY, DEFAULT_MAX_DOMAIN_VALIDITY);
     }
 
+    /**
+     * Returns the base DN that contains all valid subject DNs. If there is no
+     * such base DN (and all subject DNs are valid), null is returned.
+     *
+     * @return
+     *     The base DN that contains all valid subject DNs, or null if all
+     *     subject DNs are valid.
+     *
+     * @throws GuacamoleException
+     *     If the configured base DN cannot be read or is not a valid LDAP DN.
+     */
+    public LdapName getSubjectBaseDN() throws GuacamoleException {
+        return environment.getProperty(SSL_SUBJECT_BASE_DN);
+    }
+
+    /**
+     * Returns a list of all attributes that may be used to represent a user's
+     * username within their subject DN. If all attributes may be accepted,
+     * null is returned.
+     *
+     * @return
+     *     A list of all attributes that may be used to represent a user's
+     *     username within their subject DN, or null if any attribute may be
+     *     used.
+     *
+     * @throws GuacamoleException
+     *     If the configured set of username attributes cannot be read.
+     */
+    public List<String> getSubjectUsernameAttributes() throws GuacamoleException {
+        return environment.getProperty(SSL_SUBJECT_USERNAME_ATTRIBUTE);
+    }
+
 }
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/LdapNameGuacamoleProperty.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/LdapNameGuacamoleProperty.java
new file mode 100644
index 000000000..0299d0163
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/LdapNameGuacamoleProperty.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ssl.conf;
+
+import javax.naming.InvalidNameException;
+import javax.naming.ldap.LdapName;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.properties.GuacamoleProperty;
+
+/**
+ * A GuacamoleProperty whose value is an LDAP name, such as a distinguished
+ * name.
+ */
+public abstract class LdapNameGuacamoleProperty implements GuacamoleProperty<LdapName> {
+
+    @Override
+    public LdapName parseValue(String value) throws GuacamoleException {
+
+        if (value == null)
+            return null;
+
+        try {
+            return new LdapName(value);
+        }
+        catch (InvalidNameException e) {
+            throw new GuacamoleServerException("Value \"" + value
+                + "\" is not a valid LDAP name.", e);
+        }
+
+    }
+
+}

From 632df70162fef96ad35879a664707cc369c81be9 Mon Sep 17 00:00:00 2001
From: Michael Magill <mike@themagills.com>
Date: Wed, 1 Mar 2023 21:01:30 -0500
Subject: [PATCH 123/289] GUACAMOLE-1738: Update version of MySQL connector

GUACAMOLE-1738 Update version of MySQL connector used to resolve issue 1738 where it can no longer connect to the MySQL server using the new extension and old connector: https://issues.apache.org/jira/projects/GUACAMOLE/issues/GUACAMOLE-1738
---
 guacamole-docker/bin/build-guacamole.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole-docker/bin/build-guacamole.sh b/guacamole-docker/bin/build-guacamole.sh
index 6ffc86611..9c81041c7 100755
--- a/guacamole-docker/bin/build-guacamole.sh
+++ b/guacamole-docker/bin/build-guacamole.sh
@@ -94,7 +94,7 @@ tar -xzf extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-dist/target/
 #
 
 echo "Downloading MySQL Connector/J ..."
-curl -L "https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-java-5.1.46.tar.gz" | \
+curl -L "https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-8.0.32.tar.gz" | \
 tar -xz                        \
     -C "$DESTINATION/mysql/"   \
     --wildcards                \

From e0b59bfcd0997db3b5753ae5a5131916d562613b Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Thu, 2 Mar 2023 19:48:16 -0500
Subject: [PATCH 124/289] GUACAMOLE-1730: Fix missing comma
 guacamole-history-recording-storage guac-manifest.json

---
 .../src/main/resources/guac-manifest.json                       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/guacamole-history-recording-storage/src/main/resources/guac-manifest.json b/extensions/guacamole-history-recording-storage/src/main/resources/guac-manifest.json
index 64d04cdac..e933f9ceb 100644
--- a/extensions/guacamole-history-recording-storage/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-history-recording-storage/src/main/resources/guac-manifest.json
@@ -10,7 +10,7 @@
     ],
 
     "translations" : [
-        "translations/en.json"
+        "translations/en.json",
         "translations/pl.json"
     ]
 

From b9958fa3318423f4b98cec66f734bd10f31ac2c3 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Sun, 5 Mar 2023 21:36:54 -0800
Subject: [PATCH 125/289] GUACAMOLE-839: Include SSL/TLS auth support within
 SSO dist archive.

---
 .../modules/guacamole-auth-sso-dist/pom.xml              | 7 +++++++
 .../guacamole-auth-sso-dist/src/main/assembly/dist.xml   | 9 +++++++++
 2 files changed, 16 insertions(+)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
index f167b8c9b..7bbbd1f70 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
@@ -59,6 +59,13 @@
             <version>1.5.0</version>
         </dependency>
 
+        <!-- SSL Authentication Extension -->
+        <dependency>
+            <groupId>org.apache.guacamole</groupId>
+            <artifactId>guacamole-auth-sso-ssl</artifactId>
+            <version>1.5.0</version>
+        </dependency>
+
     </dependencies>
 
     <build>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/src/main/assembly/dist.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/src/main/assembly/dist.xml
index f122c8d0a..066da2956 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/src/main/assembly/dist.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/src/main/assembly/dist.xml
@@ -60,6 +60,15 @@
             </includes>
         </dependencySet>
 
+        <!-- SSL extension .jar -->
+        <dependencySet>
+            <outputDirectory>ssl</outputDirectory>
+            <useProjectArtifact>false</useProjectArtifact>
+            <includes>
+                <include>org.apache.guacamole:guacamole-auth-sso-ssl</include>
+            </includes>
+        </dependencySet>
+
     </dependencySets>
 
     <!-- Include extension licenses -->

From f31356c2f54740762f1b141af9013c9495c353b4 Mon Sep 17 00:00:00 2001
From: Alex Leitner <leitnersalex@gmail.com>
Date: Tue, 7 Mar 2023 18:31:45 +0000
Subject: [PATCH 126/289] GUACAMOLE-1740: Prevent collisions of clipboard
 inactive and active classes with other classes of the same name.

---
 .../src/main/frontend/src/app/clipboard/styles/clipboard.css  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/clipboard/styles/clipboard.css b/guacamole/src/main/frontend/src/app/clipboard/styles/clipboard.css
index d71287ac7..3bb602c7f 100644
--- a/guacamole/src/main/frontend/src/app/clipboard/styles/clipboard.css
+++ b/guacamole/src/main/frontend/src/app/clipboard/styles/clipboard.css
@@ -58,12 +58,12 @@
     overflow: hidden;
 }
 
-.active {
+#clipboard-settings .clipboard.active {
     overflow: auto;
     font-size: 1em;
 }
 
-.inactive {
+#clipboard-settings .clipboard.inactive {
     overflow: hidden;
     font-size: 0.9em;
     opacity: 0.5;

From d0574f8d82c47edc2cfe21225839deeceb52b8a3 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 7 Mar 2023 16:34:38 -0800
Subject: [PATCH 127/289] GUACAMOLE-839: Use BouncyCastle for retrieval of
 certificate details.

Java's build-in support for reading X.509 certificates does not deal
well with PIV certificates containing the username as a "serialNumber"
attribute. Rather than exposing the string value of that attribute, the
Java implementation exposes a byte array that does not fully match the
string value shown by a tool like OpenSSL.

BouncyCastle, on the other hand, _does_ match the output of OpenSSL, and
provides a predictable means of decoding the certificate.
---
 .../bouncycastle-pkix-fips-1.0.7/LICENSE      | 20 +++++++++++
 .../bouncycastle-pkix-fips-1.0.7/README       |  8 +++++
 .../dep-coordinates.txt                       |  1 +
 .../modules/guacamole-auth-sso-ssl/pom.xml    |  7 ++++
 .../ssl/SSLClientAuthenticationResource.java  | 36 +++++++++----------
 5 files changed, 54 insertions(+), 18 deletions(-)
 create mode 100644 doc/licenses/bouncycastle-pkix-fips-1.0.7/LICENSE
 create mode 100644 doc/licenses/bouncycastle-pkix-fips-1.0.7/README
 create mode 100644 doc/licenses/bouncycastle-pkix-fips-1.0.7/dep-coordinates.txt

diff --git a/doc/licenses/bouncycastle-pkix-fips-1.0.7/LICENSE b/doc/licenses/bouncycastle-pkix-fips-1.0.7/LICENSE
new file mode 100644
index 000000000..a02bc176b
--- /dev/null
+++ b/doc/licenses/bouncycastle-pkix-fips-1.0.7/LICENSE
@@ -0,0 +1,20 @@
+Copyright (c) 2000 - 2021 The Legion of the Bouncy Castle Inc.
+(https://www.bouncycastle.org)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/doc/licenses/bouncycastle-pkix-fips-1.0.7/README b/doc/licenses/bouncycastle-pkix-fips-1.0.7/README
new file mode 100644
index 000000000..b362257b8
--- /dev/null
+++ b/doc/licenses/bouncycastle-pkix-fips-1.0.7/README
@@ -0,0 +1,8 @@
+BouncyCastle PKIX APIs, FIPS Distribution (https://www.bouncycastle.org/fips-java)
+-----------------------------------------------------------------------
+
+    Version: 1.0.7
+    From: 'The Legion of Bouncy Castle' (https://www.bouncycastle.org)
+    License(s):
+        MIT (bundled/bouncycastle-pkix-fips-1.0.7/LICENSE)
+
diff --git a/doc/licenses/bouncycastle-pkix-fips-1.0.7/dep-coordinates.txt b/doc/licenses/bouncycastle-pkix-fips-1.0.7/dep-coordinates.txt
new file mode 100644
index 000000000..23ca14e38
--- /dev/null
+++ b/doc/licenses/bouncycastle-pkix-fips-1.0.7/dep-coordinates.txt
@@ -0,0 +1 @@
+org.bouncycastle:bcpkix-fips:jar:1.0.7
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
index c6542ae56..7ece6b40e 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
@@ -119,6 +119,13 @@
             <artifactId>jsr311-api</artifactId>
         </dependency>
 
+        <!-- Use FIPS variant of Bouncy Castle crypto library -->
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcpkix-fips</artifactId>
+            <version>1.0.7</version>
+        </dependency>
+
     </dependencies>
 
 </project>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
index 21a2e0c25..75a190d35 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
@@ -19,17 +19,14 @@
 package org.apache.guacamole.auth.ssl;
 
 import com.google.inject.Inject;
-import java.io.ByteArrayInputStream;
 import java.io.IOException;
-import java.io.InputStream;
+import java.io.Reader;
+import java.io.StringReader;
 import java.io.UnsupportedEncodingException;
 import java.net.URI;
 import java.net.URLDecoder;
 import java.nio.charset.StandardCharsets;
-import java.security.Principal;
-import java.security.cert.CertificateException;
-import java.security.cert.CertificateFactory;
-import java.security.cert.X509Certificate;
+import java.util.Date;
 import java.util.List;
 import java.util.concurrent.TimeUnit;
 import javax.naming.InvalidNameException;
@@ -46,9 +43,14 @@ import javax.ws.rs.core.UriBuilder;
 import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
+import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.auth.ssl.conf.ConfigurationService;
 import org.apache.guacamole.auth.sso.NonceService;
 import org.apache.guacamole.auth.sso.SSOResource;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x500.style.RFC4519Style;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.openssl.PEMParser;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -247,27 +249,25 @@ public class SSLClientAuthenticationResource extends SSOResource {
     public String getUsername(byte[] certificate) throws GuacamoleException {
 
         // Parse and re-verify certificate is valid with respect to timestamps
-        X509Certificate cert;
-        try (InputStream input = new ByteArrayInputStream(certificate)) {
+        X509CertificateHolder cert;
+        try (Reader reader = new StringReader(new String(certificate, StandardCharsets.UTF_8))) {
 
-            CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
-            cert = (X509Certificate) certFactory.generateCertificate(input);
+            PEMParser parser = new PEMParser(reader);
+            cert = (X509CertificateHolder) parser.readObject();
 
             // Verify certificate is valid (it should be given pre-validation
             // from SSL termination, but it's worth rechecking for sanity)
-            cert.checkValidity();
+            if (!cert.isValidOn(new Date()))
+                throw new GuacamoleClientException("Certificate has expired.");
 
         }
-        catch (CertificateException e) {
-            throw new GuacamoleClientException("Certificate is not valid: " + e.getMessage(), e);
-        }
         catch (IOException e) {
-            throw new GuacamoleClientException("Certificate could not be read: " + e.getMessage(), e);
+            throw new GuacamoleServerException("Certificate could not be read: " + e.getMessage(), e);
         }
 
-        // Extract user's DN from their X.509 certificate
-        Principal principal = cert.getSubjectX500Principal();
-        return getUsername(principal.getName());
+        // Extract user's DN from their X.509 certificate in LDAP (RFC 4919) format
+        X500Name subject = X500Name.getInstance(RFC4519Style.INSTANCE, cert.getSubject());
+        return getUsername(subject.toString());
 
     }
 

From 9f8bb71b0ef7cb41b7042456f2571c7882bbb03e Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 7 Mar 2023 16:37:00 -0800
Subject: [PATCH 128/289] GUACAMOLE-839: Correct JavaDoc for parameters of
 getUsername().

---
 .../auth/ssl/SSLClientAuthenticationResource.java     | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
index 75a190d35..583f2caa9 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
@@ -272,16 +272,13 @@ public class SSLClientAuthenticationResource extends SSOResource {
     }
 
     /**
-     * Processes the X.509 certificate in the headers of the given HTTP
-     * request, returning an authentication session token representing the
+     * Processes the X.509 certificate in the given set of HTTP request
+     * headers, returning an authentication session token representing the
      * identity in that certificate. If the certificate is invalid or not
      * present, an invalid session token is returned.
      *
-     * @param credentials
-     *     The credentials submitted in the HTTP request being processed.
-     *
-     * @param request
-     *     The HTTP request to process.
+     * @param headers
+     *     The headers of the HTTP request to process.
      *
      * @return
      *     An authentication session token representing the identity in the

From 82073a5976715933a5d1085b8a6a9b057936efd9 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 7 Mar 2023 16:38:51 -0800
Subject: [PATCH 129/289] GUACAMOLE-839: Correct typo in JavaDoc of decode() -
 "valid", not "value".

---
 .../guacamole/auth/ssl/SSLClientAuthenticationResource.java     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
index 583f2caa9..787bf3e52 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
@@ -149,7 +149,7 @@ public class SSLClientAuthenticationResource extends SSOResource {
      *     The decoded string.
      *
      * @throws GuacamoleException
-     *     If the provided value is not a value URL-encoded string.
+     *     If the provided value is not a valid URL-encoded string.
      */
     private byte[] decode(String value) throws GuacamoleException {
         try {

From 6424b063f28c7de7526b792b3ea1a0ae946ef9b2 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 8 Mar 2023 09:34:26 -0800
Subject: [PATCH 130/289] GUACAMOLE-839: Correct WildcardURIGuacamoleProperty
 to correctly handle missing (null) properties.

---
 .../guacamole/auth/ssl/conf/WildcardURIGuacamoleProperty.java  | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/WildcardURIGuacamoleProperty.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/WildcardURIGuacamoleProperty.java
index d237d8031..ab08ee308 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/WildcardURIGuacamoleProperty.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/WildcardURIGuacamoleProperty.java
@@ -45,6 +45,9 @@ public abstract class WildcardURIGuacamoleProperty extends URIGuacamoleProperty
     @Override
     public URI parseValue(String value) throws GuacamoleException {
 
+        if (value == null)
+            return null;
+
         // Verify wildcard prefix is present
         Matcher matcher = WILDCARD_URI_PATTERN.matcher(value);
         if (matcher.matches()) {

From f98901f933a6601dc9865d61e8423cd0cebaed02 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 8 Mar 2023 09:34:52 -0800
Subject: [PATCH 131/289] GUACAMOLE-839: Add sanity checks around parsed PEM
 data, which may indeed be null.

---
 .../auth/ssl/SSLClientAuthenticationResource.java | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
index 787bf3e52..984a68f34 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java
@@ -253,7 +253,20 @@ public class SSLClientAuthenticationResource extends SSOResource {
         try (Reader reader = new StringReader(new String(certificate, StandardCharsets.UTF_8))) {
 
             PEMParser parser = new PEMParser(reader);
-            cert = (X509CertificateHolder) parser.readObject();
+            Object object = parser.readObject();
+
+            // Verify received data is indeed an X.509 certificate
+            if (object == null || !(object instanceof X509CertificateHolder))
+                throw new GuacamoleClientException("Certificate did not "
+                        + "contain an X.509 certificate.");
+
+            // Verify sanity of received certificate (there should be only
+            // one object here)
+            if (parser.readObject() != null)
+                throw new GuacamoleClientException("Certificate contains "
+                        + "more than a single X.509 certificate.");
+
+            cert = (X509CertificateHolder) object;
 
             // Verify certificate is valid (it should be given pre-validation
             // from SSL termination, but it's worth rechecking for sanity)

From d5e19d5e76bd574d81dc8e126a08d3014663c9ec Mon Sep 17 00:00:00 2001
From: Niubbo75 <a.sironi@soluzioni-informatiche.org>
Date: Mon, 8 Aug 2022 14:26:41 +0200
Subject: [PATCH 132/289] GUACAMOLE-1612: Update and correct Italian
 Translations for Guacamole Client

---
 .../src/main/resources/translations/it.json   |   5 -
 .../src/main/resources/translations/it.json   |   1 -
 .../src/main/resources/translations/it.json   |  15 --
 .../src/main/resources/translations/it.json   |   4 -
 .../main/frontend/src/translations/it.json    | 212 +++++++++---------
 5 files changed, 106 insertions(+), 131 deletions(-)

diff --git a/extensions/guacamole-auth-duo/src/main/resources/translations/it.json b/extensions/guacamole-auth-duo/src/main/resources/translations/it.json
index a16710c7c..d7bb5a7c1 100644
--- a/extensions/guacamole-auth-duo/src/main/resources/translations/it.json
+++ b/extensions/guacamole-auth-duo/src/main/resources/translations/it.json
@@ -1,11 +1,6 @@
 {
 
-    "DATA_SOURCE_DUO" : {
-        "NAME" : "Duo TFA Backend"
-    },
-
     "LOGIN" : {
-        "FIELD_HEADER_GUAC_DUO_SIGNED_RESPONSE" : "",
         "INFO_DUO_VALIDATION_CODE_INCORRECT"    : "Codice di convalida Duo errato.",
         "INFO_DUO_AUTH_REQUIRED"                : "Si prega di autenticarsi con Duo per continuare."
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/it.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/it.json
index c4a4e0305..092e9cfbd 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/it.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/it.json
@@ -2,7 +2,6 @@
 
     "LOGIN" : {
 
-        "ERROR_PASSWORD_BLANK"    : "@:APP.ERROR_PASSWORD_BLANK",
         "ERROR_PASSWORD_SAME"     : "La nuova password deve essere diversa dalla password scaduta.",
         "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
         "ERROR_NOT_VALID"         : "Questo account utente non è attualmente valido.",
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/it.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/it.json
index 246029367..bafa8c347 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/it.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/it.json
@@ -1,21 +1,6 @@
 {
 
-    "DATA_SOURCE_CAS" : {
-        "NAME" : "CAS SSO Backend"
-    },
-
-    "DATA_SOURCE_OPENID" : {
-        "NAME" : "OpenID SSO Backend"
-    },
-
-    "DATA_SOURCE_SAML" : {
-        "NAME" : "SAML SSO Backend"
-    },
-
     "LOGIN" : {
-        "FIELD_HEADER_ID_TOKEN"      : "",
-        "FIELD_HEADER_STATE"         : "",
-        "FIELD_HEADER_TICKET"        : "",
         "INFO_IDP_REDIRECT_PENDING"  : "Attendi, reindirizzamento al provider di identità...",
         "NAME_IDP_CAS"               : "CAS",
         "NAME_IDP_OPENID"            : "OpenID",
diff --git a/extensions/guacamole-auth-totp/src/main/resources/translations/it.json b/extensions/guacamole-auth-totp/src/main/resources/translations/it.json
index 97b30f469..a2fa7903b 100644
--- a/extensions/guacamole-auth-totp/src/main/resources/translations/it.json
+++ b/extensions/guacamole-auth-totp/src/main/resources/translations/it.json
@@ -4,10 +4,6 @@
         "NAME" : "TOTP TFA Backend"
     },
 
-    "LOGIN" : {
-        "FIELD_HEADER_GUAC_TOTP" : ""
-    },
-
     "TOTP" : {
 
         "ACTION_HIDE_DETAILS" : "Nascondere",
diff --git a/guacamole/src/main/frontend/src/translations/it.json b/guacamole/src/main/frontend/src/translations/it.json
index 64aad1f8a..7dbf24db7 100644
--- a/guacamole/src/main/frontend/src/translations/it.json
+++ b/guacamole/src/main/frontend/src/translations/it.json
@@ -62,10 +62,10 @@
         "ERROR_CLIENT_303"     : "Non hai i permessi per accedere a questa connessione. Se ne hai bisogno, chiedi ai tuoi amministratori di sistema di aggiungerti agli utenti abilitati.",
         "ERROR_CLIENT_308"     : "Il server Guacamole ha chiuso la connessione perchè il tuo browser non ha risposto per troppo tempo e sembrava essersi disconnesso. Solitamente la causa è un problema di rete, ad esempio un segnale wifi instabile o una connesisone molto lenta. Controlla la tua rete e riprova.",
         "ERROR_CLIENT_31D"     : "Il server Guacamole rifiuta l'accesso alla connessione perchè hai raggiunto il limite massimo di connessioni simultanee per singolo utente. Chiudi una o più connessioni e riprova.",
-        "ERROR_CLIENT_DEFAULT" : "Si è verificato un errore interno sul server Guacamole, e la connessione è stata terminata. Se il problema persiste avvisa il tuo amministratore di sistema o controlla i file di log.",
+        "ERROR_CLIENT_DEFAULT" : "Si è verificato un errore interno sul server Guacamole, la connessione è stata terminata. Se il problema persiste avvisa il tuo amministratore di sistema o controlla i file di log.",
 
         "ERROR_TUNNEL_201"     : "Il server Guacamole ha rifiutato questa connessione perchè ci sono troppe connessioni attive. Attendi qualche minuto e riprova.",
-        "ERROR_TUNNEL_202"     : "La connessione è stata chiusa dal server is taking too long to respond.Solitamente la causa è un problema di rete, ad esempio un segnale wifi instabile o una connesisone molto lenta. Controlla la tua rete e riprova.",
+        "ERROR_TUNNEL_202"     : "La connessione è stata chiusa dal server perché ci vuole troppo tempo per rispondere. Solitamente la causa è un problema di rete, ad esempio un segnale wifi instabile o una connesisone molto lenta. Controlla la tua rete e riprova.",
         "ERROR_TUNNEL_203"     : "Si è verificato un errore sul server e la connessione è stata chiusa. Riprova o contatta il tuo amministratore di sistema.",
         "ERROR_TUNNEL_204"     : "La connessione richiesta non esiste. Controlla il nome della connessione e riprova. Grazie.",
         "ERROR_TUNNEL_205"     : "Questa connessione è già in uso, non sono possibili accessi concorrenti. Riprova più tardi. Grazie.",
@@ -80,7 +80,7 @@
         "ERROR_UPLOAD_202"     : "Trasferimento annullato: il desktop remoto risponde troppo lentamente. Per favore riprova o contatta il tuo amministratore di sistema.",
         "ERROR_UPLOAD_203"     : "Il desktop remoto ha incontrato un errore durante il trasferimento. Per favore riprova o contatta il tuo amministratore di sistema.",
         "ERROR_UPLOAD_204"     : "La destinazione del file non esiste. Controlla che la destinazione esista e riprova.",
-        "ERROR_UPLOAD_205"     : "La destinazione del file non è bloccata. Per favore attendi che ogni processo in corso sia termianto e riprova.",
+        "ERROR_UPLOAD_205"     : "La destinazione del file è bloccata. Per favore attendi che ogni processo in corso sia terminato e riprova.",
         "ERROR_UPLOAD_301"     : "Non hai i permessi per caricare i file perchè non hai fatto il login. Inserisci nome utente e password e riprova.",
         "ERROR_UPLOAD_303"     : "Non hai i permessi per caricare i file. Se ti serve questa funzionalità contatta il tuo amministratore di sistema.",
         "ERROR_UPLOAD_308"     : "Il trasferimento di file si è fermato. Solitamente la causa è un problema di rete, ad esempio un segnale wifi instabile o una connesisone molto lenta. Controlla la tua rete e riprova.",
@@ -91,7 +91,7 @@
 
         "HELP_CLIPBOARD"           : "Il testo copiato/tagliato appare qui. I cambiamenti effettuati al testo qui sotto saranno riportati negli appunti remoti.",
         "HELP_INPUT_METHOD_NONE"   : "Non c'è nessun metodo di immissione. L'input da tastiera è accettato da una tastiera fisica connessa.",
-        "HELP_INPUT_METHOD_OSK"    : "Mostra e accetta input dalla tastiera su schermo. La tastiera su schermo ti permette di scrivere combinazioni di tasti altrimenti mipossibli (ad esempio Ctrl-Alt-Canc).",
+        "HELP_INPUT_METHOD_OSK"    : "Mostra e accetta input dalla tastiera su schermo. La tastiera su schermo ti permette di scrivere combinazioni di tasti altrimenti impossibli (ad esempio Ctrl-Alt-Canc).",
         "HELP_INPUT_METHOD_TEXT"   : "Abilita la battitura di testo ed emula gli eventi da tastiera basati sul testo battuto. Questo è necessario per tablet e smartphone che non hanno una tastiera fisica.",
         "HELP_MOUSE_MODE"          : "Determina come si deve comportare il mouse remoto in base al touch.",
         "HELP_MOUSE_MODE_ABSOLUTE" : "Tap to click. Il click è sostituito dal tocco.",
@@ -130,8 +130,8 @@
 
     "FORM" : {
 
-        "HELP_SHOW_PASSWORD" : "Click to show password",
-        "HELP_HIDE_PASSWORD" : "Click to hide password"
+        "HELP_SHOW_PASSWORD" : "Fare clic per mostrare la password",
+        "HELP_HIDE_PASSWORD" : "Fare clic per nascondere la password"
 
     },
 
@@ -160,7 +160,7 @@
 
         "ERROR_INVALID_LOGIN" : "Nome utente e/o password errati.",
 
-        "FIELD_HEADER_USERNAME" : "Username",
+        "FIELD_HEADER_USERNAME" : "Nome utente",
         "FIELD_HEADER_PASSWORD" : "Password"
 
     },
@@ -176,9 +176,9 @@
         "DIALOG_HEADER_CONFIRM_DELETE" : "Elimina connessione",
         "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
 
-        "FIELD_HEADER_LOCATION" : "Location:",
-        "FIELD_HEADER_NAME"     : "Name:",
-        "FIELD_HEADER_PROTOCOL" : "Protocol:",
+        "FIELD_HEADER_LOCATION" : "Posizione:",
+        "FIELD_HEADER_NAME"     : "Nome:",
+        "FIELD_HEADER_PROTOCOL" : "Protocollo:",
 
         "FORMAT_HISTORY_START" : "@:APP.FORMAT_DATE_TIME_PRECISE",
 
@@ -190,8 +190,8 @@
         "SECTION_HEADER_HISTORY"         : "Cronologia di utilizzo",
         "SECTION_HEADER_PARAMETERS"      : "Parametri",
 
-        "TABLE_HEADER_HISTORY_USERNAME" : "Username",
-        "TABLE_HEADER_HISTORY_START"    : "Start Time",
+        "TABLE_HEADER_HISTORY_USERNAME" : "Nome utente",
+        "TABLE_HEADER_HISTORY_START"    : "Ora di inizio",
         "TABLE_HEADER_HISTORY_DURATION" : "Durata",
 
         "TEXT_CONFIRM_DELETE"   : "Le Connessioni non possono essere ripristinate dopo la loro eliminazione. Sei sicuro di volere eliminare questa connessione?"
@@ -208,7 +208,7 @@
         "DIALOG_HEADER_CONFIRM_DELETE" : "Elimina Gruppo di Connesisoni",
         "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
 
-        "FIELD_HEADER_LOCATION" : "Location:",
+        "FIELD_HEADER_LOCATION" : "Posizione:",
         "FIELD_HEADER_NAME"     : "Nome:",
         "FIELD_HEADER_TYPE"     : "Tipo:",
 
@@ -231,7 +231,7 @@
 
         "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
-        "FIELD_HEADER_NAME" : "Name:",
+        "FIELD_HEADER_NAME" : "Nome:",
 
         "SECTION_HEADER_PARAMETERS" : "Parametri"
 
@@ -257,7 +257,7 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "Crea un ruppo di connessioni:",
         "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
         "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
-        "FIELD_HEADER_USERNAME"                      : "Username:",
+        "FIELD_HEADER_USERNAME"                      : "Nome utente:",
         
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
@@ -271,44 +271,44 @@
     
     "PROTOCOL_RDP" : {
 
-        "FIELD_HEADER_COLOR_DEPTH"     : "Color depth:",
-        "FIELD_HEADER_CONSOLE"         : "Administrator console:",
-        "FIELD_HEADER_CONSOLE_AUDIO"   : "Support audio in console:",
+        "FIELD_HEADER_COLOR_DEPTH"     : "Profondità di colore:",
+        "FIELD_HEADER_CONSOLE"         : "Console amministratore:",
+        "FIELD_HEADER_CONSOLE_AUDIO"   : "Supporta l'audio nella console:",
         "FIELD_HEADER_CLIENT_NAME"     : "Client name:",
-        "FIELD_HEADER_DISABLE_AUDIO"   : "Disable audio:",
-        "FIELD_HEADER_DISABLE_AUTH"    : "Disable authentication:",
-        "FIELD_HEADER_DOMAIN"          : "Domain:",
-        "FIELD_HEADER_DPI"             : "Resolution (DPI):",
+        "FIELD_HEADER_DISABLE_AUDIO"   : "Disattiva audio:",
+        "FIELD_HEADER_DISABLE_AUTH"    : "Disabilita autenticazione:",
+        "FIELD_HEADER_DOMAIN"          : "Dominio:",
+        "FIELD_HEADER_DPI"             : "Risoluzione (DPI):",
         "FIELD_HEADER_DRIVE_PATH"      : "Drive path:",
-        "FIELD_HEADER_ENABLE_DESKTOP_COMPOSITION" : "Enable desktop composition (Aero):",
-        "FIELD_HEADER_ENABLE_DRIVE"               : "Enable drive:",
-        "FIELD_HEADER_ENABLE_FONT_SMOOTHING"      : "Enable font smoothing (ClearType):",
-        "FIELD_HEADER_ENABLE_FULL_WINDOW_DRAG"    : "Enable full-window drag:",
-        "FIELD_HEADER_ENABLE_MENU_ANIMATIONS"     : "Enable menu animations:",
-        "FIELD_HEADER_ENABLE_PRINTING"            : "Enable printing:",
-        "FIELD_HEADER_ENABLE_SFTP"                : "Enable SFTP:",
-        "FIELD_HEADER_ENABLE_THEMING"             : "Enable theming:",
-        "FIELD_HEADER_ENABLE_WALLPAPER"           : "Enable wallpaper:",
-        "FIELD_HEADER_HEIGHT"          : "Height:",
-        "FIELD_HEADER_HOSTNAME"        : "Hostname:",
-        "FIELD_HEADER_IGNORE_CERT"     : "Ignore server certificate:",
-        "FIELD_HEADER_INITIAL_PROGRAM" : "Initial program:",
+        "FIELD_HEADER_ENABLE_DESKTOP_COMPOSITION" : "Abilita composizione desktop (Aero):",
+        "FIELD_HEADER_ENABLE_DRIVE"               : "Abilita drive:",
+        "FIELD_HEADER_ENABLE_FONT_SMOOTHING"      : "Abilita l'arrotondamento dei caratteri (ClearType):",
+        "FIELD_HEADER_ENABLE_FULL_WINDOW_DRAG"    : "Abilita il trascinamento della finestra intera:",
+        "FIELD_HEADER_ENABLE_MENU_ANIMATIONS"     : "Abilita le animazioni del menu:",
+        "FIELD_HEADER_ENABLE_PRINTING"            : "Abilita la stampa:",
+        "FIELD_HEADER_ENABLE_SFTP"                : "Abilita SFTP:",
+        "FIELD_HEADER_ENABLE_THEMING"             : "Abilita temi:",
+        "FIELD_HEADER_ENABLE_WALLPAPER"           : "Abilita sfondo:",
+        "FIELD_HEADER_HEIGHT"          : "Altezza:",
+        "FIELD_HEADER_HOSTNAME"        : "Nome host:",
+        "FIELD_HEADER_IGNORE_CERT"     : "Ignora certificato server:",
+        "FIELD_HEADER_INITIAL_PROGRAM" : "Programma iniziale:",
         "FIELD_HEADER_PASSWORD"        : "Password:",
-        "FIELD_HEADER_PORT"            : "Port:",
-        "FIELD_HEADER_REMOTE_APP_ARGS" : "Parameters:",
-        "FIELD_HEADER_REMOTE_APP_DIR"  : "Working directory:",
-        "FIELD_HEADER_REMOTE_APP"      : "Program:",
-        "FIELD_HEADER_SECURITY"        : "Security mode:",
-        "FIELD_HEADER_SERVER_LAYOUT"   : "Keyboard layout:",
-        "FIELD_HEADER_SFTP_HOSTNAME"   : "Hostname:",
+        "FIELD_HEADER_PORT"            : "Porta:",
+        "FIELD_HEADER_REMOTE_APP_ARGS" : "Parametri:",
+        "FIELD_HEADER_REMOTE_APP_DIR"  : "Directory di lavoro:",
+        "FIELD_HEADER_REMOTE_APP"      : "Programma:",
+        "FIELD_HEADER_SECURITY"        : "Modalità di sicurezza:",
+        "FIELD_HEADER_SERVER_LAYOUT"   : "Layout della tastiera:",
+        "FIELD_HEADER_SFTP_HOSTNAME"   : "Nome host:",
         "FIELD_HEADER_SFTP_PASSPHRASE" : "Passphrase:",
         "FIELD_HEADER_SFTP_PASSWORD"   : "Password:",
-        "FIELD_HEADER_SFTP_PORT"       : "Port:",
-        "FIELD_HEADER_SFTP_PRIVATE_KEY" : "Private key:",
-        "FIELD_HEADER_SFTP_USERNAME"   : "Username:",        
-        "FIELD_HEADER_STATIC_CHANNELS" : "Static channel names:",
-        "FIELD_HEADER_USERNAME"        : "Username:",
-        "FIELD_HEADER_WIDTH"           : "Width:",        
+        "FIELD_HEADER_SFTP_PORT"       : "Porta:",
+        "FIELD_HEADER_SFTP_PRIVATE_KEY" : "Chiave privata:",
+        "FIELD_HEADER_SFTP_USERNAME"   : "Nome utente:",        
+        "FIELD_HEADER_STATIC_CHANNELS" : "Nomi dei canali statici:",
+        "FIELD_HEADER_USERNAME"        : "Nome utente:",
+        "FIELD_HEADER_WIDTH"           : "Larghezza:",        
 
         "FIELD_OPTION_COLOR_DEPTH_16"    : "Low color (16-bit)",
         "FIELD_OPTION_COLOR_DEPTH_24"    : "True color (24-bit)",
@@ -316,7 +316,7 @@
         "FIELD_OPTION_COLOR_DEPTH_8"     : "256 color",
         "FIELD_OPTION_COLOR_DEPTH_EMPTY" : "",
 
-        "FIELD_OPTION_SECURITY_ANY"   : "Any",
+        "FIELD_OPTION_SECURITY_ANY"   : "Qualsiasi",
         "FIELD_OPTION_SECURITY_EMPTY" : "",
         "FIELD_OPTION_SECURITY_NLA"   : "NLA (Network Level Authentication)",
         "FIELD_OPTION_SECURITY_RDP"   : "RDP encryption",
@@ -327,19 +327,19 @@
         "FIELD_OPTION_SERVER_LAYOUT_EN_US_QWERTY" : "US English (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_FAILSAFE"     : "Unicode",
         "FIELD_OPTION_SERVER_LAYOUT_FR_FR_AZERTY" : "French (Azerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_IT_IT_QWERTY" : "Italian (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_IT_IT_QWERTY" : "Italiana (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polacca (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Swedish (Qwerty)",
 
         "NAME" : "RDP",
 
-        "SECTION_HEADER_AUTHENTICATION"     : "Authentication",
-        "SECTION_HEADER_BASIC_PARAMETERS"   : "Basic Settings",
+        "SECTION_HEADER_AUTHENTICATION"     : "Autenticazione",
+        "SECTION_HEADER_BASIC_PARAMETERS"   : "Impostazioni di base",
         "SECTION_HEADER_CLIPBOARD"          : "Appunti",
-        "SECTION_HEADER_DEVICE_REDIRECTION" : "Device Redirection",
+        "SECTION_HEADER_DEVICE_REDIRECTION" : "Reindirizzamento del dispositivo",
         "SECTION_HEADER_DISPLAY"            : "Display",
         "SECTION_HEADER_NETWORK"            : "Network",
-        "SECTION_HEADER_PERFORMANCE"        : "Performance",
+        "SECTION_HEADER_PERFORMANCE"        : "Prestazione",
         "SECTION_HEADER_REMOTEAPP"          : "RemoteApp",
         "SECTION_HEADER_SFTP"               : "SFTP"
 
@@ -347,15 +347,15 @@
 
     "PROTOCOL_SSH" : {
 
-        "FIELD_HEADER_FONT_NAME"   : "Font name:",
-        "FIELD_HEADER_FONT_SIZE"   : "Font size:",
-        "FIELD_HEADER_ENABLE_SFTP" : "Enable SFTP:",
-        "FIELD_HEADER_HOSTNAME"    : "Hostname:",
-        "FIELD_HEADER_USERNAME"    : "Username:",
+        "FIELD_HEADER_FONT_NAME"   : "Nome carattere:",
+        "FIELD_HEADER_FONT_SIZE"   : "Dimensione del carattere:",
+        "FIELD_HEADER_ENABLE_SFTP" : "Abilita SFTP:",
+        "FIELD_HEADER_HOSTNAME"    : "Nome host:",
+        "FIELD_HEADER_USERNAME"    : "Nome utente:",
         "FIELD_HEADER_PASSWORD"    : "Password:",
         "FIELD_HEADER_PASSPHRASE"  : "Passphrase:",
-        "FIELD_HEADER_PORT"        : "Port:",
-        "FIELD_HEADER_PRIVATE_KEY" : "Private key:",
+        "FIELD_HEADER_PORT"        : "Porta:",
+        "FIELD_HEADER_PRIVATE_KEY" : "Chiave privata:",
 
         "FIELD_OPTION_FONT_SIZE_8"     : "8",
         "FIELD_OPTION_FONT_SIZE_9"     : "9",
@@ -375,7 +375,7 @@
 
         "NAME" : "SSH",
 
-        "SECTION_HEADER_AUTHENTICATION" : "Authentication",
+        "SECTION_HEADER_AUTHENTICATION" : "Autenticazione",
         "SECTION_HEADER_CLIPBOARD"      : "Appunti",
         "SECTION_HEADER_DISPLAY"        : "Display",
         "SECTION_HEADER_NETWORK"        : "Network",
@@ -385,13 +385,13 @@
 
     "PROTOCOL_TELNET" : {
 
-        "FIELD_HEADER_FONT_NAME"      : "Font name:",
-        "FIELD_HEADER_FONT_SIZE"      : "Font size:",
-        "FIELD_HEADER_HOSTNAME"       : "Hostname:",
-        "FIELD_HEADER_USERNAME"       : "Username:",
+        "FIELD_HEADER_FONT_NAME"      : "Nome carattere:",
+        "FIELD_HEADER_FONT_SIZE"      : "Dimensione del carattere:",
+        "FIELD_HEADER_HOSTNAME"       : "Nome host:",
+        "FIELD_HEADER_USERNAME"       : "Nome utente:",
         "FIELD_HEADER_PASSWORD"       : "Password:",
-        "FIELD_HEADER_PASSWORD_REGEX" : "Password regular expression:",
-        "FIELD_HEADER_PORT"           : "Port:",
+        "FIELD_HEADER_PASSWORD_REGEX" : "Espressione regolare della password:",
+        "FIELD_HEADER_PORT"           : "Porta:",
 
         "FIELD_OPTION_FONT_SIZE_8"     : "8",
         "FIELD_OPTION_FONT_SIZE_9"     : "9",
@@ -411,7 +411,7 @@
 
         "NAME" : "Telnet",
 
-        "SECTION_HEADER_AUTHENTICATION" : "Authentication",
+        "SECTION_HEADER_AUTHENTICATION" : "Autenticazione",
         "SECTION_HEADER_CLIPBOARD"      : "Appunti",
         "SECTION_HEADER_DISPLAY"        : "Display",
         "SECTION_HEADER_NETWORK"        : "Network"
@@ -420,25 +420,25 @@
 
     "PROTOCOL_VNC" : {
 
-        "FIELD_HEADER_AUDIO_SERVERNAME" : "Audio server name:",
-        "FIELD_HEADER_COLOR_DEPTH"      : "Color depth:",
-        "FIELD_HEADER_CURSOR"           : "Cursor:",
-        "FIELD_HEADER_DEST_HOST"        : "Destination host:",
-        "FIELD_HEADER_DEST_PORT"        : "Destination port:",
-        "FIELD_HEADER_ENABLE_AUDIO"     : "Enable audio:",
-        "FIELD_HEADER_ENABLE_SFTP"      : "Enable SFTP:",
-        "FIELD_HEADER_HOSTNAME"         : "Hostname:",
-        "FIELD_HEADER_USERNAME"         : "Username:",
+        "FIELD_HEADER_AUDIO_SERVERNAME" : "Nome del server audio:",
+        "FIELD_HEADER_COLOR_DEPTH"      : "Profondità di colore:",
+        "FIELD_HEADER_CURSOR"           : "Cursore:",
+        "FIELD_HEADER_DEST_HOST"        : "Host di destinazione:",
+        "FIELD_HEADER_DEST_PORT"        : "Porto di destinazione:",
+        "FIELD_HEADER_ENABLE_AUDIO"     : "Abilita audio:",
+        "FIELD_HEADER_ENABLE_SFTP"      : "Abilita SFTP:",
+        "FIELD_HEADER_HOSTNAME"         : "Nome host:",
+        "FIELD_HEADER_USERNAME"         : "Nome utente:",
         "FIELD_HEADER_PASSWORD"         : "Password:",
-        "FIELD_HEADER_PORT"             : "Port:",
-        "FIELD_HEADER_READ_ONLY"        : "Read-only:",
-        "FIELD_HEADER_SFTP_HOSTNAME"    : "Hostname:",
+        "FIELD_HEADER_PORT"             : "Porta:",
+        "FIELD_HEADER_READ_ONLY"        : "Sola lettura:",
+        "FIELD_HEADER_SFTP_HOSTNAME"    : "Nome host:",
         "FIELD_HEADER_SFTP_PASSPHRASE"  : "Passphrase:",
         "FIELD_HEADER_SFTP_PASSWORD"    : "Password:",
-        "FIELD_HEADER_SFTP_PORT"        : "Port:",
-        "FIELD_HEADER_SFTP_PRIVATE_KEY" : "Private key:",
-        "FIELD_HEADER_SFTP_USERNAME"    : "Username:",
-        "FIELD_HEADER_SWAP_RED_BLUE"    : "Swap red/blue components:",
+        "FIELD_HEADER_SFTP_PORT"        : "Porta:",
+        "FIELD_HEADER_SFTP_PRIVATE_KEY" : "Chiave privata:",
+        "FIELD_HEADER_SFTP_USERNAME"    : "Nome utente:",
+        "FIELD_HEADER_SWAP_RED_BLUE"    : "Scambia componenti rosso/blu:",
 
         "FIELD_OPTION_COLOR_DEPTH_8"     : "256 color",
         "FIELD_OPTION_COLOR_DEPTH_16"    : "Low color (16-bit)",
@@ -447,13 +447,13 @@
         "FIELD_OPTION_COLOR_DEPTH_EMPTY" : "",
 
         "FIELD_OPTION_CURSOR_EMPTY"  : "",
-        "FIELD_OPTION_CURSOR_LOCAL"  : "Local",
-        "FIELD_OPTION_CURSOR_REMOTE" : "Remote",
+        "FIELD_OPTION_CURSOR_LOCAL"  : "Locale",
+        "FIELD_OPTION_CURSOR_REMOTE" : "Remoto",
 
         "NAME" : "VNC",
 
         "SECTION_HEADER_AUDIO"          : "Audio",
-        "SECTION_HEADER_AUTHENTICATION" : "Authentication",
+        "SECTION_HEADER_AUTHENTICATION" : "Autenticazione",
         "SECTION_HEADER_CLIPBOARD"      : "Appunti",
         "SECTION_HEADER_DISPLAY"        : "Display",
         "SECTION_HEADER_NETWORK"        : "Network",
@@ -464,7 +464,7 @@
 
     "SETTINGS" : {
 
-        "SECTION_HEADER_SETTINGS" : "Settings"
+        "SECTION_HEADER_SETTINGS" : "Impostazioni"
 
     },
 
@@ -478,7 +478,7 @@
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
-        "HELP_CONNECTIONS"   : "Fai click o tap sulla connessione qui sotto per gestire quella connessione. In base al tuo livello di accesso, le connessioni possono essere craete, eliminate, e le relative proprietà (protocol, hostname, port, etc.) possono essere cambiate.",
+        "HELP_CONNECTIONS"   : "Fai click o tap sulla connessione qui sotto per gestire quella connessione. In base al tuo livello di accesso, le connessioni possono essere create, eliminate, e le relative proprietà (protocol, hostname, port, etc.) possono essere cambiate.",
         
         "INFO_ACTIVE_USER_COUNT" : "@:APP.INFO_ACTIVE_USER_COUNT",
 
@@ -495,9 +495,9 @@
         "INFO_CONNECTION_DURATION_UNKNOWN" : "--",
 
         "TABLE_HEADER_SESSION_CONNECTION_NAME" : "Nome della connessione",
-        "TABLE_HEADER_SESSION_STARTDATE"       : "Start Time",
+        "TABLE_HEADER_SESSION_STARTDATE"       : "Ora di inizio",
         "TABLE_HEADER_SESSION_DURATION"        : "Durata",
-        "TABLE_HEADER_SESSION_USERNAME"        : "Username"
+        "TABLE_HEADER_SESSION_USERNAME"        : "Nome utente"
 
     },
 
@@ -517,17 +517,17 @@
         "FIELD_HEADER_PASSWORD_OLD"       : "Password Attuale:",
         "FIELD_HEADER_PASSWORD_NEW"       : "Nuova Password:",
         "FIELD_HEADER_PASSWORD_NEW_AGAIN" : "Conferma Nuova Password:",
-        "FIELD_HEADER_USERNAME"           : "Username:",
+        "FIELD_HEADER_USERNAME"           : "Nome utente",
         
-        "HELP_DEFAULT_INPUT_METHOD" : "The default input method determines how keyboard events are received by Guacamole. Changing this setting may be necessary when using a mobile device, or when typing through an IME. This setting can be overridden on a per-connection basis within the Guacamole menu.",
-        "HELP_DEFAULT_MOUSE_MODE"   : "The default mouse emulation mode determines how the remote mouse will behave in new connections with respect to touches. This setting can be overridden on a per-connection basis within the Guacamole menu.",
+        "HELP_DEFAULT_INPUT_METHOD" : "Il metodo di input predefinito determina come gli eventi della tastiera vengono ricevuti da Guacamole. La modifica di questa impostazione potrebbe essere necessaria quando si utilizza un dispositivo mobile o quando si digita un IME. Questa impostazione può essere ignorata in base alla connessione all'interno del menu Guacamole.",
+        "HELP_DEFAULT_MOUSE_MODE"   : "La modalità di emulazione del mouse predefinita determina come si comporterà il mouse remoto nelle nuove connessioni rispetto ai tocchi. Questa impostazione può essere ignorata in base alla connessione all'interno del menu Guacamole.",
         "HELP_INPUT_METHOD_NONE"    : "@:CLIENT.HELP_INPUT_METHOD_NONE",
         "HELP_INPUT_METHOD_OSK"     : "@:CLIENT.HELP_INPUT_METHOD_OSK",
         "HELP_INPUT_METHOD_TEXT"    : "@:CLIENT.HELP_INPUT_METHOD_TEXT",
-        "HELP_LANGUAGE"             : "Select a different language below to change the language of all text within Guacamole. Available choices will depend on which languages are installed.",
+        "HELP_LANGUAGE"             : "Seleziona una lingua diversa di seguito per cambiare la lingua di tutto il testo all'interno di Guacamole. Le scelte disponibili dipenderanno dalle lingue installate.",
         "HELP_MOUSE_MODE_ABSOLUTE"  : "@:CLIENT.HELP_MOUSE_MODE_ABSOLUTE",
         "HELP_MOUSE_MODE_RELATIVE"  : "@:CLIENT.HELP_MOUSE_MODE_RELATIVE",
-        "HELP_UPDATE_PASSWORD"      : "Se desideri cambiare la tua password, inserisci la tua password attuale e sotto scriti quella che desideri come nuova password, clicca \"Modifica Password\". La modifica avrà effetto immediato.",
+        "HELP_UPDATE_PASSWORD"      : "Se desideri cambiare la tua password, inserisci la tua password attuale e sotto scrivi quella che desideri come nuova password, clicca \"Modifica Password\". La modifica avrà effetto immediato.",
 
         "INFO_PASSWORD_CHANGED" : "Password Modificata.",
 
@@ -535,8 +535,8 @@
         "NAME_INPUT_METHOD_OSK"  : "@:CLIENT.NAME_INPUT_METHOD_OSK",
         "NAME_INPUT_METHOD_TEXT" : "@:CLIENT.NAME_INPUT_METHOD_TEXT",
 
-        "SECTION_HEADER_DEFAULT_INPUT_METHOD" : "Default Input Method",
-        "SECTION_HEADER_DEFAULT_MOUSE_MODE"   : "Default Mouse Emulation Mode",
+        "SECTION_HEADER_DEFAULT_INPUT_METHOD" : "Metodo di immissione predefinito",
+        "SECTION_HEADER_DEFAULT_MOUSE_MODE"   : "Modalità di emulazione del mouse predefinita",
         "SECTION_HEADER_UPDATE_PASSWORD"      : "Modifica Password"
 
     },
@@ -552,11 +552,11 @@
 
         "FORMAT_DATE" : "@:APP.FORMAT_DATE_TIME_PRECISE",
 
-        "HELP_USERS" : "Click or tap on a user below to manage that user. Depending on your access level, users can be added and deleted, and their passwords can be changed.",
+        "HELP_USERS" : "Fare clic o toccare un utente di seguito per gestire quell'utente. A seconda del livello di accesso, gli utenti possono essere aggiunti ed eliminati e le loro password possono essere modificate.",
 
         "SECTION_HEADER_USERS"       : "Utenti",
 
-        "TABLE_HEADER_USERNAME" : "Username"
+        "TABLE_HEADER_USERNAME" : "Nome utente"
 
     },
     
@@ -564,7 +564,7 @@
         
         "ACTION_ACKNOWLEDGE" : "@:APP.ACTION_ACKNOWLEDGE",
         "ACTION_CANCEL"      : "@:APP.ACTION_CANCEL",
-        "ACTION_DELETE"      : "Termian Sessione",
+        "ACTION_DELETE"      : "Termina Sessione",
         
         "DIALOG_HEADER_CONFIRM_DELETE" : "Termina Sessione",
         "DIALOG_HEADER_ERROR"          : "@:APP.DIALOG_HEADER_ERROR",
@@ -573,18 +573,18 @@
         
         "FORMAT_STARTDATE" : "@:APP.FORMAT_DATE_TIME_PRECISE",
 
-        "HELP_SESSIONS" : "Questa pagina verrà popolata con connessioni attualmente attive. Le connessioni elencate e la possibilità di uccidere tali connessioni dipende dal tuo livello di accesso. Se desideri uccidere una o più sessioni, seleziona la casella accanto a quelle sessioni e fai clic su \"Uccidi sessioni \". L'uccisione di una sessione interromperà immediatamente l'utente dalla connessione associata.",
+        "HELP_SESSIONS" : "Questa pagina verrà popolata con connessioni attualmente attive. Le connessioni elencate e la possibilità di terminare tali connessioni dipende dal tuo livello di accesso. Se desideri terminare una o più sessioni, seleziona la casella accanto a quelle sessioni e fai clic su \"Termina sessione \". Terminando una sessione si disconnetterà immediatamente l'utente dalla connessione associata.",
         
         "INFO_NO_SESSIONS" : "Nessuna sessione attiva",
 
         "SECTION_HEADER_SESSIONS" : "Sessioni Attive",
         
-        "TABLE_HEADER_SESSION_USERNAME"        : "Username",
+        "TABLE_HEADER_SESSION_USERNAME"        : "Nome utente",
         "TABLE_HEADER_SESSION_STARTDATE"       : "Attivo da",
-        "TABLE_HEADER_SESSION_REMOTEHOST"      : "Remote host",
+        "TABLE_HEADER_SESSION_REMOTEHOST"      : "Host remoto",
         "TABLE_HEADER_SESSION_CONNECTION_NAME" : "Nome della connessione",
         
-        "TEXT_CONFIRM_DELETE" : "Sei sicuro di voler termianre la sessione selezionata? L'utente che sta utilizzando questa sessione sarà immediatamente disconnesso."
+        "TEXT_CONFIRM_DELETE" : "Sei sicuro di voler terminare la sessione selezionata? L'utente che sta utilizzando questa sessione sarà immediatamente disconnesso."
 
     },
 

From 4dbf35766ff47f266692969a4fae9b47c79221cc Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Mon, 13 Mar 2023 21:17:45 -0400
Subject: [PATCH 133/289] GUACAMOLE-1219: Add support for disabling TOTP for
 specific users and groups.

---
 .../guacamole/auth/totp/user/TOTPUser.java    |  12 +-
 .../auth/totp/user/TOTPUserContext.java       |  27 +++++
 .../totp/user/UserVerificationService.java    |  67 +++++++++++
 .../auth/totp/usergroup/TOTPUserGroup.java    | 104 ++++++++++++++++++
 .../src/main/resources/translations/en.json   |   9 ++
 5 files changed, 218 insertions(+), 1 deletion(-)
 create mode 100644 extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/usergroup/TOTPUserGroup.java

diff --git a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUser.java b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUser.java
index 0c6f567b8..e84b7543b 100644
--- a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUser.java
+++ b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUser.java
@@ -33,6 +33,12 @@ import org.apache.guacamole.net.auth.User;
  */
 public class TOTPUser extends DelegatingUser {
 
+    /**
+     * The name of the user attribute which disables the TOTP requirement
+     * for that specific user.
+     */
+    public static final String TOTP_KEY_DISABLED_ATTRIBUTE_NAME = "guac-totp-disabled";
+    
     /**
      * The name of the user attribute which stores the TOTP key.
      */
@@ -56,13 +62,14 @@ public class TOTPUser extends DelegatingUser {
      * The string value used by TOTP user attributes to represent the boolean
      * value "true".
      */
-    private static final String TRUTH_VALUE = "true";
+    public static final String TRUTH_VALUE = "true";
 
     /**
      * The form which contains all configurable properties for this user.
      */
     public static final Form TOTP_ENROLLMENT_STATUS = new Form("totp-enrollment-status",
             Arrays.asList(
+                    new BooleanField(TOTP_KEY_DISABLED_ATTRIBUTE_NAME, TRUTH_VALUE),
                     new BooleanField(TOTP_KEY_SECRET_GENERATED_ATTRIBUTE_NAME, TRUTH_VALUE),
                     new BooleanField(TOTP_KEY_CONFIRMED_ATTRIBUTE_NAME, TRUTH_VALUE)
             )
@@ -95,6 +102,9 @@ public class TOTPUser extends DelegatingUser {
 
         // Create independent, mutable copy of attributes
         Map<String, String> attributes = new HashMap<>(super.getAttributes());
+        
+        if (!attributes.containsKey(TOTP_KEY_DISABLED_ATTRIBUTE_NAME))
+            attributes.put(TOTP_KEY_DISABLED_ATTRIBUTE_NAME, null);
 
         // Replace secret key with simple boolean attribute representing
         // whether a key has been generated at all
diff --git a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUserContext.java b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUserContext.java
index a7a97b022..d3269e78a 100644
--- a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUserContext.java
+++ b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/TOTPUserContext.java
@@ -23,12 +23,14 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.HashSet;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.totp.usergroup.TOTPUserGroup;
 import org.apache.guacamole.form.Form;
 import org.apache.guacamole.net.auth.DecoratingDirectory;
 import org.apache.guacamole.net.auth.DelegatingUserContext;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.net.auth.UserContext;
+import org.apache.guacamole.net.auth.UserGroup;
 
 /**
  * TOTP-specific UserContext implementation which wraps the UserContext of
@@ -65,11 +67,36 @@ public class TOTPUserContext extends DelegatingUserContext {
         };
     }
     
+    @Override
+    public Directory<UserGroup> getUserGroupDirectory() throws GuacamoleException {
+        return new DecoratingDirectory<UserGroup>(super.getUserGroupDirectory()) {
+           
+            @Override
+            protected UserGroup decorate(UserGroup object) {
+                return new TOTPUserGroup(object);
+            }
+            
+            @Override
+            protected UserGroup undecorate(UserGroup object) {
+                assert(object instanceof TOTPUserGroup);
+                return ((TOTPUserGroup) object).getUndecorated();
+            }
+            
+        };
+    }
+    
     @Override
     public Collection<Form> getUserAttributes() {
         Collection<Form> userAttrs = new HashSet<>(super.getUserAttributes());
         userAttrs.add(TOTPUser.TOTP_ENROLLMENT_STATUS);
         return Collections.unmodifiableCollection(userAttrs);
     }
+    
+    @Override
+    public Collection<Form> getUserGroupAttributes() {
+        Collection<Form> userGroupAttrs = new HashSet<>(super.getUserGroupAttributes());
+        userGroupAttrs.add(TOTPUserGroup.TOTP_USER_GROUP_CONFIG);
+        return Collections.unmodifiableCollection(userGroupAttrs);
+    }
 
 }
diff --git a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/UserVerificationService.java b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/UserVerificationService.java
index 2fca74229..027a228cd 100644
--- a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/UserVerificationService.java
+++ b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/UserVerificationService.java
@@ -26,19 +26,23 @@ import java.security.InvalidKeyException;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Set;
 import javax.servlet.http.HttpServletRequest;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleSecurityException;
 import org.apache.guacamole.GuacamoleUnsupportedException;
 import org.apache.guacamole.auth.totp.conf.ConfigurationService;
 import org.apache.guacamole.auth.totp.form.AuthenticationCodeField;
+import org.apache.guacamole.auth.totp.usergroup.TOTPUserGroup;
 import org.apache.guacamole.form.Field;
 import org.apache.guacamole.language.TranslatableGuacamoleClientException;
 import org.apache.guacamole.language.TranslatableGuacamoleInsufficientCredentialsException;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Credentials;
+import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.net.auth.User;
 import org.apache.guacamole.net.auth.UserContext;
+import org.apache.guacamole.net.auth.UserGroup;
 import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
 import org.apache.guacamole.totp.TOTPGenerator;
 import org.slf4j.Logger;
@@ -203,6 +207,65 @@ public class UserVerificationService {
         return true;
 
     }
+    
+    /**
+     * Checks the user in question, via both UserContext and AuthenticatedUser,
+     * to see if TOTP has been disabled for this user, either directly or via
+     * membership in a group that has had TOTP marked as disabled.
+     * 
+     * @param context
+     *     The UserContext for the user being verified.
+     * 
+     * @param authenticatedUser
+     *     The AuthenticatedUser for the user being verified.
+     * 
+     * @return
+     *     True if TOTP access has been disabled for the user, otherwise
+     *     false.
+     * 
+     * @throws GuacamoleException
+     *     If the extension handling storage fails internally while attempting
+     *     to update the user.
+     */
+    private boolean totpDisabled(UserContext context,
+            AuthenticatedUser authenticatedUser)
+            throws GuacamoleException {
+        
+        // If TOTP is disabled for this user, return, allowing login to continue
+        Map<String, String> myAttributes = context.self().getAttributes();
+        if (myAttributes != null
+                && TOTPUser.TRUTH_VALUE.equals(myAttributes.get(TOTPUser.TOTP_KEY_DISABLED_ATTRIBUTE_NAME))) {
+
+            logger.warn("TOTP validation has been disabled for user \"{}\"",
+                    context.self().getIdentifier());
+            return true;
+
+        }
+        
+        // Check if any effective user groups have TOTP marked as disabled
+        Set<String> userGroups = authenticatedUser.getEffectiveUserGroups();
+        Directory<UserGroup> directoryGroups = context.getPrivileged().getUserGroupDirectory();
+        for (String userGroup : userGroups) {
+            UserGroup thisGroup = directoryGroups.get(userGroup);
+            if (thisGroup == null)
+                continue;
+            
+            Map<String, String> grpAttributes = thisGroup.getAttributes();
+            if (grpAttributes != null 
+                    && TOTPUserGroup.TRUTH_VALUE.equals(grpAttributes.get(TOTPUserGroup.TOTP_KEY_DISABLED_ATTRIBUTE_NAME))) {
+
+                logger.warn("TOTP validation will be bypassed for user \"{}\""
+                            + " because it has been disabled for group \"{}\"",
+                            context.self().getIdentifier(), userGroup);
+                return true;
+
+            }
+        }
+        
+        // TOTP has not been disabled
+        return false;
+        
+    }
 
     /**
      * Verifies the identity of the given user using TOTP. If a authentication
@@ -230,6 +293,10 @@ public class UserVerificationService {
         if (username.equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
             return;
 
+        // Check if TOTP has been disabled for this user
+        if (totpDisabled(context, authenticatedUser))
+            return;
+        
         // Ignore users which do not have an associated key
         UserTOTPKey key = getKey(context, username);
         if (key == null)
diff --git a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/usergroup/TOTPUserGroup.java b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/usergroup/TOTPUserGroup.java
new file mode 100644
index 000000000..5b6921bab
--- /dev/null
+++ b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/usergroup/TOTPUserGroup.java
@@ -0,0 +1,104 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.guacamole.auth.totp.usergroup;
+
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+import org.apache.guacamole.form.BooleanField;
+import org.apache.guacamole.form.Form;
+import org.apache.guacamole.net.auth.DelegatingUserGroup;
+import org.apache.guacamole.net.auth.UserGroup;
+
+/**
+ * A UserGroup that wraps another UserGroup implementation, decorating it with
+ * attributes that control TOTP configuration for users that are members of that
+ * group.
+ */
+public class TOTPUserGroup extends DelegatingUserGroup {
+    
+    /**
+     * The attribute associated with a group that disables the TOTP requirement
+     * for any users that are a member of that group, or are members of any
+     * groups that are members of this group.
+     */
+    public static final String TOTP_KEY_DISABLED_ATTRIBUTE_NAME = "guac-totp-disabled";
+    
+    /**
+     * The string value used by TOTP user attributes to represent the boolean
+     * value "true".
+     */
+    public static final String TRUTH_VALUE = "true";
+    
+    /**
+     * The form that contains fields for configuring TOTP for members of this
+     * group.
+     */
+    public static final Form TOTP_USER_GROUP_CONFIG = new Form("totp-user-group-config",
+            Arrays.asList(
+                    new BooleanField(TOTP_KEY_DISABLED_ATTRIBUTE_NAME, TRUTH_VALUE)
+            )
+    );
+    
+    /**
+     * Create a new instance of this user group implementation, wrapping the
+     * provided UserGroup.
+     * 
+     * @param userGroup 
+     *     The UserGroup to be wrapped.
+     */
+    public TOTPUserGroup(UserGroup userGroup) {
+        super(userGroup);
+    }
+    
+    /**
+     * Return the original UserGroup that this implementation is wrapping.
+     * 
+     * @return 
+     *     The original UserGroup that this implementation wraps.
+     */
+    public UserGroup getUndecorated() {
+        return getDelegateUserGroupGroup();
+    }
+    
+    /**
+     * Returns whether or not TOTP has been disabled for members of this group.
+     * 
+     * @return 
+     *     True if TOTP has been disabled for members of this group, otherwise
+     *     false.
+     */
+    public boolean totpDisabled() {
+        return (TRUTH_VALUE.equals(getAttributes().get(TOTP_KEY_DISABLED_ATTRIBUTE_NAME)));
+    }
+    
+    @Override
+    public Map<String, String> getAttributes() {
+        
+        // Create a mutable copy of the attributes
+        Map<String, String> attributes = new HashMap<>(super.getAttributes());
+        
+        if (!attributes.containsKey(TOTP_KEY_DISABLED_ATTRIBUTE_NAME))
+            attributes.put(TOTP_KEY_DISABLED_ATTRIBUTE_NAME, null);
+        
+        return attributes;
+        
+    }
+    
+}
diff --git a/extensions/guacamole-auth-totp/src/main/resources/translations/en.json b/extensions/guacamole-auth-totp/src/main/resources/translations/en.json
index 80bdaf06a..e9f4b7140 100644
--- a/extensions/guacamole-auth-totp/src/main/resources/translations/en.json
+++ b/extensions/guacamole-auth-totp/src/main/resources/translations/en.json
@@ -33,11 +33,20 @@
     
     "USER_ATTRIBUTES" : {
         
+        "FIELD_HEADER_GUAC_TOTP_DISABLED"      : "Disable TOTP:",
         "FIELD_HEADER_GUAC_TOTP_KEY_GENERATED" : "Secret key generated:",
         "FIELD_HEADER_GUAC_TOTP_KEY_CONFIRMED" : "Authentication device confirmed:",
         
         "SECTION_HEADER_TOTP_ENROLLMENT_STATUS" : "TOTP Enrollment Status"
         
+    },
+    
+    "USER_GROUP_ATTRIBUTES" : {
+        
+        "FIELD_HEADER_GUAC_TOTP_DISABLED" : "Disable TOTP:",
+        
+        "SECTION_HEADER_TOTP_USER_GROUP_CONFIG" : "TOTP Configuration"
+        
     }
 
 }

From c21ee0f8301c8b3ec134be2bf9f9243b59e7c3c1 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 22 Mar 2023 14:08:22 -0700
Subject: [PATCH 134/289] GUACAMOLE-1756: Display login failures regardless of
 whether the interactive login form was used.

---
 .../app/index/controllers/indexController.js  | 25 ++++++++++++++++
 .../index/styles/automatic-login-rejected.css | 30 +++++++++++++++++++
 guacamole/src/main/frontend/src/index.html    | 14 +++++++++
 3 files changed, 69 insertions(+)
 create mode 100644 guacamole/src/main/frontend/src/app/index/styles/automatic-login-rejected.css

diff --git a/guacamole/src/main/frontend/src/app/index/controllers/indexController.js b/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
index 52c9d5853..40cb9540d 100644
--- a/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
+++ b/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
@@ -35,6 +35,7 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
     const SESSION_VALIDITY_RECHECK_INTERVAL = 15000;
 
     // Required types
+    const Error              = $injector.get('Error');
     const ManagedClientState = $injector.get('ManagedClientState');
 
     // Required services
@@ -110,6 +111,11 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
      */
     var ApplicationState = {
 
+        /**
+         * A non-interactive authentication attempt failed.
+         */
+        AUTOMATIC_LOGIN_REJECTED : 'automaticLoginRejected',
+
         /**
          * The application has fully loaded but is awaiting credentials from
          * the user before proceeding.
@@ -323,6 +329,25 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
 
     });
 
+    // Alert user to authentication errors that occur in the absence of an
+    // interactive login form
+    $scope.$on('guacLoginFailed', function loginFailed(event, parameters, error) {
+
+        // All errors related to an interactive login form are handled elsewhere
+        if ($scope.applicationState === ApplicationState.AWAITING_CREDENTIALS
+                || error.type === Error.Type.INSUFFICIENT_CREDENTIALS
+                || error.type === Error.Type.INVALID_CREDENTIALS)
+            return;
+
+        $scope.applicationState = ApplicationState.AUTOMATIC_LOGIN_REJECTED;
+        $scope.page.title = 'APP.NAME';
+        $scope.page.bodyClassName = '';
+
+        $scope.reAuthenticating = false;
+        $scope.fatalError = error;
+
+    });
+
     // Replace absolutely all content with an error message if the page itself
     // cannot be displayed due to an error
     $scope.$on('guacFatalPageError', function fatalPageError(error) {
diff --git a/guacamole/src/main/frontend/src/app/index/styles/automatic-login-rejected.css b/guacamole/src/main/frontend/src/app/index/styles/automatic-login-rejected.css
new file mode 100644
index 000000000..d034f81f1
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/index/styles/automatic-login-rejected.css
@@ -0,0 +1,30 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+.automatic-login-rejected-modal guac-modal {
+    background: white;
+    z-index: 20;
+}
+
+.automatic-login-rejected-modal .notification {
+    display: inline-block;
+    max-width: 5in;
+    padding: 1em;
+    width: 100%;
+}
diff --git a/guacamole/src/main/frontend/src/index.html b/guacamole/src/main/frontend/src/index.html
index 7f007eb55..fd6337872 100644
--- a/guacamole/src/main/frontend/src/index.html
+++ b/guacamole/src/main/frontend/src/index.html
@@ -64,6 +64,20 @@
             </guac-modal>
         </div>
 
+        <!-- Authentication error without a corresponding login form -->
+        <div class="automatic-login-rejected-modal" ng-switch-when="automaticLoginRejected">
+            <guac-modal>
+                <div class="notification">
+                    <p translate="{{ fatalError.translatableMessage.key }}"
+                       translate-values="{{ fatalError.translatableMessage.variables }}"></p>
+                    <p>
+                        <button translate="APP.ACTION_LOGIN_AGAIN" ng-disabled="reAuthenticating"
+                                ng-click="reAuthenticate()"></button>
+                    </p>
+                </div>
+            </guac-modal>
+        </div>
+
         <!-- Login screen for logged-out users -->
         <guac-login ng-switch-when="awaitingCredentials"
                     help-text="loginHelpText"

From 7d5ec77adf7b5a86d85dccabc381783d53ca2393 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 23 Mar 2023 00:16:32 -0700
Subject: [PATCH 135/289] GUACAMOLE-1756: Clean up assignment of application
 state.

---
 .../app/index/controllers/indexController.js  | 36 ++++++++++---------
 1 file changed, 20 insertions(+), 16 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/index/controllers/indexController.js b/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
index 40cb9540d..2f472a6e2 100644
--- a/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
+++ b/guacamole/src/main/frontend/src/app/index/controllers/indexController.js
@@ -284,6 +284,22 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
 
     }, true);
 
+    /**
+     * Sets the current overall state of the client side of the
+     * application to the given value. Possible values are defined by
+     * {@link ApplicationState}. The title and class associated with the
+     * current page are automatically reset to the standard values applicable
+     * to the application as a whole (rather than any specific page).
+     *
+     * @param {!string} state
+     *     The state to assign, as defined by {@link ApplicationState}.
+     */
+    const setApplicationState = function setApplicationState(state) {
+        $scope.applicationState = state;
+        $scope.page.title = 'APP.NAME';
+        $scope.page.bodyClassName = '';
+    };
+
     /**
      * Navigates the user back to the root of the application (or reloads the
      * current route and controller if the user is already there), effectively
@@ -306,9 +322,7 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
     // Display login screen if a whole new set of credentials is needed
     $scope.$on('guacInvalidCredentials', function loginInvalid(event, parameters, error) {
 
-        $scope.applicationState = ApplicationState.AWAITING_CREDENTIALS;
-        $scope.page.title = 'APP.NAME';
-        $scope.page.bodyClassName = '';
+        setApplicationState(ApplicationState.AWAITING_CREDENTIALS);
 
         $scope.loginHelpText = null;
         $scope.acceptedCredentials = {};
@@ -319,9 +333,7 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
     // Prompt for remaining credentials if provided credentials were not enough
     $scope.$on('guacInsufficientCredentials', function loginInsufficient(event, parameters, error) {
 
-        $scope.applicationState = ApplicationState.AWAITING_CREDENTIALS;
-        $scope.page.title = 'APP.NAME';
-        $scope.page.bodyClassName = '';
+        setApplicationState(ApplicationState.AWAITING_CREDENTIALS);
 
         $scope.loginHelpText = error.translatableMessage;
         $scope.acceptedCredentials = parameters;
@@ -339,10 +351,7 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
                 || error.type === Error.Type.INVALID_CREDENTIALS)
             return;
 
-        $scope.applicationState = ApplicationState.AUTOMATIC_LOGIN_REJECTED;
-        $scope.page.title = 'APP.NAME';
-        $scope.page.bodyClassName = '';
-
+        setApplicationState(ApplicationState.AUTOMATIC_LOGIN_REJECTED);
         $scope.reAuthenticating = false;
         $scope.fatalError = error;
 
@@ -351,13 +360,8 @@ angular.module('index').controller('indexController', ['$scope', '$injector',
     // Replace absolutely all content with an error message if the page itself
     // cannot be displayed due to an error
     $scope.$on('guacFatalPageError', function fatalPageError(error) {
-
-        $scope.applicationState = ApplicationState.FATAL_ERROR;
-        $scope.page.title = 'APP.NAME';
-        $scope.page.bodyClassName = '';
-
+        setApplicationState(ApplicationState.FATAL_ERROR);
         $scope.fatalError = error;
-
     });
 
     // Replace the overall user interface with an informational message if the

From e6449d2c5756343ef8146e67ccfeef43ad9d268b Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 23 Mar 2023 12:30:17 -0700
Subject: [PATCH 136/289] GUACAMOLE-1757: Ensure SSO provider list is added to
 login UI only once.

---
 .../src/main/resources/html/sso-providers.html              | 2 +-
 .../src/main/resources/styles/sso-providers.css             | 6 ------
 .../src/main/resources/html/sso-provider-cas.html           | 2 +-
 .../src/main/resources/html/sso-provider-openid.html        | 2 +-
 .../src/main/resources/html/sso-provider-saml.html          | 2 +-
 .../src/main/resources/html/sso-provider-ssl.html           | 2 +-
 6 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/html/sso-providers.html b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/html/sso-providers.html
index d089ea292..309d1bb7b 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/html/sso-providers.html
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/html/sso-providers.html
@@ -1,4 +1,4 @@
-<meta name="after" content=".login-ui .login-dialog-middle">
+<meta name="after" content=".login-ui .login-dialog-middle:not(:has(~ .sso-providers))">
 <div class="sso-providers">
     {{ 'LOGIN.SECTION_HEADER_SSO_OPTIONS' | translate }}
     <ul class="sso-provider-list"></ul>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/styles/sso-providers.css b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/styles/sso-providers.css
index 0a97446ec..5f8b49ae6 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/styles/sso-providers.css
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/styles/sso-providers.css
@@ -24,12 +24,6 @@
     bottom: 0;
     left: 0;
 
-    display: none;
-
-}
-
-.login-ui .sso-providers:last-child {
-    display: block;
 }
 
 .sso-providers ul {
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/resources/html/sso-provider-cas.html b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/resources/html/sso-provider-cas.html
index 348da10fa..6fcf14e59 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/resources/html/sso-provider-cas.html
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/resources/html/sso-provider-cas.html
@@ -1,4 +1,4 @@
-<meta name="after-children" content=".login-ui .sso-provider-list:last-child">
+<meta name="after-children" content=".login-ui .sso-provider-list">
 <li class="sso-provider sso-provider-cas"><a href="api/ext/cas/login">{{
     'LOGIN.NAME_IDP_CAS' | translate
 }}</a></li>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/html/sso-provider-openid.html b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/html/sso-provider-openid.html
index 0da260f96..5325e63ea 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/html/sso-provider-openid.html
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/resources/html/sso-provider-openid.html
@@ -1,4 +1,4 @@
-<meta name="after-children" content=".login-ui .sso-provider-list:last-child">
+<meta name="after-children" content=".login-ui .sso-provider-list">
 <li class="sso-provider sso-provider-openid"><a href="api/ext/openid/login">{{
     'LOGIN.NAME_IDP_OPENID' | translate
 }}</a></li>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/html/sso-provider-saml.html b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/html/sso-provider-saml.html
index 93a770434..734f7f41a 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/html/sso-provider-saml.html
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/html/sso-provider-saml.html
@@ -1,4 +1,4 @@
-<meta name="after-children" content=".login-ui .sso-provider-list:last-child">
+<meta name="after-children" content=".login-ui .sso-provider-list">
 <li class="sso-provider sso-provider-saml"><a href="api/ext/saml/login">{{
     'LOGIN.NAME_IDP_SAML' | translate
 }}</a></li>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html
index 8798eed2d..d9a3db85d 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/html/sso-provider-ssl.html
@@ -1,4 +1,4 @@
-<meta name="after-children" content=".login-ui .sso-provider-list:last-child">
+<meta name="after-children" content=".login-ui .sso-provider-list">
 <li class="sso-provider sso-provider-ssl"><a guac-ssl-auth href="">{{
     'LOGIN.NAME_IDP_SSL' | translate
 }}</a></li>

From 0db69594cd5c4d3a3a2ffc637075676b916ad702 Mon Sep 17 00:00:00 2001
From: Victor Cleaner <Vict0rC@users.noreply.github.com>
Date: Fri, 24 Mar 2023 18:52:51 +0100
Subject: [PATCH 137/289] GUACAMOLE-1758: Updated czech translation

GUACAMOLE-1758: Updated czech translation
---
 .../main/frontend/src/translations/cs.json    | 27 +++++++++++++------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/guacamole/src/main/frontend/src/translations/cs.json b/guacamole/src/main/frontend/src/translations/cs.json
index c02e13c69..67df484e7 100644
--- a/guacamole/src/main/frontend/src/translations/cs.json
+++ b/guacamole/src/main/frontend/src/translations/cs.json
@@ -58,6 +58,7 @@
 
         "ACTION_ACKNOWLEDGE"               : "@:APP.ACTION_ACKNOWLEDGE",
         "ACTION_CANCEL"                    : "@:APP.ACTION_CANCEL",
+        "ACTION_CLEAR_CLIENT_MESSAGES"     : "Vyčistit",
         "ACTION_CLEAR_COMPLETED_TRANSFERS" : "Vyčistit",
         "ACTION_CONTINUE"                  : "@:APP.ACTION_CONTINUE",
         "ACTION_DISCONNECT"                : "Odpojit",
@@ -123,8 +124,9 @@
         "HELP_MOUSE_MODE_RELATIVE" : "Přetažením myši posuňte ukazatel myši a klepněte na tlačítko. Kliknutí nastane v místě ukazatele.",
         "HELP_SHARE_LINK"          : "Aktuální připojení je sdíleno a může k němu přistupovat kdokoli s následujícím {LINKS, plural, one{odkazem} other{odkazy}}:",
 
-        "INFO_CONNECTION_SHARED" : "Toto připojení je nyní sdíleno.",
-        "INFO_NO_FILE_TRANSFERS" : "Žádné přenosy souborů.",
+        "INFO_ANONYMOUS_USER_COUNT" : "Anonymní{COUNT, plural, one{} other{ (#)}}",
+        "INFO_CONNECTION_SHARED"    : "Toto připojení je nyní sdíleno.",
+        "INFO_NO_FILE_TRANSFERS"    : "Žádné přenosy souborů.",
 
         "NAME_INPUT_METHOD_NONE"   : "Žádné",
         "NAME_INPUT_METHOD_OSK"    : "Na obrazovce, klávesnice",
@@ -136,21 +138,28 @@
         "NAME_MOUSE_MODE_ABSOLUTE" : "Dotyková obrazovka",
         "NAME_MOUSE_MODE_RELATIVE" : "Touchpad",
 
-        "SECTION_HEADER_CLIPBOARD"      : "Schránka",
-        "SECTION_HEADER_DEVICES"        : "Zařízení",
-        "SECTION_HEADER_DISPLAY"        : "Zobrazení",
-        "SECTION_HEADER_FILE_TRANSFERS" : "Přenos souborů",
-        "SECTION_HEADER_INPUT_METHOD"   : "Metoda vstupu",
-        "SECTION_HEADER_MOUSE_MODE"     : "Mód emulace myši",
+        "SECTION_HEADER_CLIENT_MESSAGES" : "Zprávy",
+        "SECTION_HEADER_CLIPBOARD"       : "Schránka",
+        "SECTION_HEADER_DEVICES"         : "Zařízení",
+        "SECTION_HEADER_DISPLAY"         : "Zobrazení",
+        "SECTION_HEADER_FILE_TRANSFERS"  : "Přenos souborů",
+        "SECTION_HEADER_INPUT_METHOD"    : "Metoda vstupu",
+        
+        "SECTION_HEADER_MOUSE_MODE"      : "Mód emulace myši",
 
+        "TEXT_ANONYMOUS_USER_JOINED"      : "K připojení se připojil anonymní uživatel.",
+        "TEXT_ANONYMOUS_USER_LEFT"        : "Anonymní uživatel opustil připojení.",
         "TEXT_ZOOM_AUTO_FIT"              : "Automaticky přizpůsobit prohlížeč oknu",
         "TEXT_CLIENT_STATUS_IDLE"         : "Nečinný",
         "TEXT_CLIENT_STATUS_CONNECTING"   : "Připojuji ke Guacamole...",
         "TEXT_CLIENT_STATUS_DISCONNECTED" : "Byl jste odpojen.",
         "TEXT_CLIENT_STATUS_UNSTABLE"     : "Síťové spojení ke  Guacamole serveru se zdá nestabilní.",
         "TEXT_CLIENT_STATUS_WAITING"      : "Připojen ke Guacamole. Čekání na odpověď...",
+        "TEXT_USER_JOINED"                : "{USERNAME} se připojil ke spojení.",
+        "TEXT_USER_LEFT"                  : "{USERNAME} opustil spojení.",
         "TEXT_RECONNECT_COUNTDOWN"        : "Znovu připojuji  {REMAINING} {REMAINING, plural, one{sekundu} other{sekund}}...",
         "TEXT_FILE_TRANSFER_PROGRESS"     : "{PROGRESS} {UNIT, select, b{B} kb{KB} mb{MB} gb{GB} other{}}",
+        "TEXT_CLIPBOARD_AWAITING_FOCUS"   : "Kliknutím zobrazíte obsah schránky...",
 
         "URL_OSK_LAYOUT" : "layouts/en-us-qwerty.json"
 
@@ -914,6 +923,7 @@
 
         "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
         "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
+        "ACTION_SAVE"               : "@:APP.ACTION_SAVE",
         "ACTION_UPDATE_PASSWORD"    : "@:APP.ACTION_UPDATE_PASSWORD",
 
         "DIALOG_HEADER_ERROR"    : "@:APP.DIALOG_HEADER_ERROR",
@@ -940,6 +950,7 @@
         "HELP_UPDATE_PASSWORD"      : "Pokud chcete změnit heslo, zadejte své aktuální heslo a níže požadované nové heslo a klikněte na tlačítko „Aktualizovat heslo“. Změna se projeví okamžitě.",
 
         "INFO_PASSWORD_CHANGED" : "Heslo bylo změněno.",
+        "INFO_PREFERENCE_ATTRIBUTES_CHANGED" : "Uživatelská nastavení uložena.",
 
         "NAME_INPUT_METHOD_NONE" : "@:CLIENT.NAME_INPUT_METHOD_NONE",
         "NAME_INPUT_METHOD_OSK"  : "@:CLIENT.NAME_INPUT_METHOD_OSK",

From 08e5938493e50abdfa54bbbe1c6a944d96db6cf8 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 28 Mar 2023 13:09:05 -0700
Subject: [PATCH 138/289] GUACAMOLE-839: Redirect user to proper URI for
 SSL/TLS client auth (rather than just refuse).

---
 .../src/main/resources/translations/en.json   |  1 +
 .../ssl/AuthenticationProviderService.java    | 21 +++++++++++++------
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/en.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/en.json
index 902b7aff1..085414b94 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/en.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/resources/translations/en.json
@@ -21,6 +21,7 @@
         "FIELD_HEADER_STATE"         : "",
         "FIELD_HEADER_TICKET"        : "",
         "INFO_IDP_REDIRECT_PENDING"  : "Please wait, redirecting to identity provider...",
+        "INFO_REDIRECT_PENDING"      : "Please wait while you are redirected...",
         "NAME_IDP_CAS"               : "CAS",
         "NAME_IDP_OPENID"            : "OpenID",
         "NAME_IDP_SAML"              : "SAML",
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
index bc311de47..807df0cae 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
@@ -23,15 +23,20 @@ import com.google.inject.Inject;
 import com.google.inject.Provider;
 import com.google.inject.Singleton;
 import java.net.URI;
+import java.util.Arrays;
 import java.util.Collections;
 import javax.servlet.http.HttpServletRequest;
-import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.auth.ssl.conf.ConfigurationService;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
 import org.apache.guacamole.auth.sso.SSOAuthenticationProviderService;
 import org.apache.guacamole.auth.sso.user.SSOAuthenticatedUser;
+import org.apache.guacamole.form.Field;
+import org.apache.guacamole.form.RedirectField;
+import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.net.auth.Credentials;
+import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
+import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
 
 /**
  * Service that authenticates Guacamole users using SSL/TLS authentication
@@ -150,11 +155,15 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
         if (confService.isPrimaryHostname(host))
             return processIdentity(credentials, request);
 
-        // All other requests are not allowed - refuse to authenticate
-        throw new GuacamoleClientException("Direct authentication against "
-                + "this endpoint is not valid without first requesting to "
-                + "authenticate at the primary URL of this Guacamole "
-                + "instance.");
+        // All other requests are not allowed - redirect to proper hostname
+        throw new GuacamoleInvalidCredentialsException("Authentication is "
+                + "only allowed against the primary URL of this Guacamole "
+                + "instance.",
+            new CredentialsInfo(Arrays.asList(new Field[] {
+                new RedirectField("primaryURI", confService.getPrimaryURI(),
+                        new TranslatableMessage("LOGIN.INFO_REDIRECT_PENDING"))
+            }))
+        );
 
     }
 

From 45955b67e078e645645b02ca8c451b77881ff59c Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 21 Mar 2023 18:00:35 +0000
Subject: [PATCH 139/289] GUACAMOLE-1754: Run docker build for PR CI.

---
 .github/workflows/pr-build.yml | 29 +++++++++++++++++++++++++++++
 .ratignore                     |  1 +
 2 files changed, 30 insertions(+)
 create mode 100644 .github/workflows/pr-build.yml

diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
new file mode 100644
index 000000000..a7733ca50
--- /dev/null
+++ b/.github/workflows/pr-build.yml
@@ -0,0 +1,29 @@
+name: Pull request CI build
+
+# Run build for all pull requests
+on:
+  pull_request:
+
+# Limit to only one build for a given PR source branch at a time,
+# cancelling any in-progress builds
+concurrency:
+  group: guacamole-client-pr-${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+
+  docker_build:
+    name: Run docker build
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Check out code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Build Docker container
+        shell: sh
+        run: |
+          docker build --pull --no-cache --force-rm .
diff --git a/.ratignore b/.ratignore
index c3f1957cd..d46e96082 100644
--- a/.ratignore
+++ b/.ratignore
@@ -1,3 +1,4 @@
+.github/**
 CONTRIBUTING
 doc/licenses/*/**/*
 doc/**/html/*.html

From f079e87f27c4ea6c9c2f8cf52ba36541f5fbfff6 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Mon, 3 Apr 2023 19:46:48 -0400
Subject: [PATCH 140/289] GUACAMOLE-1642: Add support for specifying the VNC
 encodings parameter.

---
 .../main/resources/org/apache/guacamole/protocols/vnc.json    | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
index a14b3dd26..525e1958e 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
@@ -57,6 +57,10 @@
                     "name"    : "force-lossless",
                     "type"    : "BOOLEAN",
                     "options" : [ "true" ]
+                },
+                {
+                    "name" : "encodings",
+                    "type" : "TEXT"
                 }
             ]
         },

From de3a1f5ec6c7809f83b424d3f78c7420d608cb34 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 4 Apr 2023 09:10:13 -0700
Subject: [PATCH 141/289] GUACAMOLE-839: Omit properties added by AngularJS
 core from auth request parameters.

---
 .../frontend/src/app/auth/service/authenticationService.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
index 88143a740..af5a9ab6c 100644
--- a/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
+++ b/guacamole/src/main/frontend/src/app/auth/service/authenticationService.js
@@ -196,6 +196,13 @@ angular.module('auth').factory('authenticationService', ['$injector',
         // Attempt authentication after auth parameters are available ...
         return parameters.then(function requestParametersReady(requestParams) {
 
+            // Strip any properties that are from AngularJS core, such as the
+            // '$$state' property added by $q. Properties added by AngularJS
+            // core will have a '$' prefix. The '$$state' property is
+            // particularly problematic, as it is self-referential and explodes
+            // the stack when fed to $.param().
+            requestParams = _.omitBy(requestParams, (value, key) => key.startsWith('$'));
+
             return requestService({
                 method: 'POST',
                 url: 'api/tokens',

From 97e99d6fe37a3dcaa4725c7dcf25a3d72768a107 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 18 Jan 2023 21:59:01 +0000
Subject: [PATCH 142/289] GUACAMOLE-926: Create directory infrastructure for
 batch creation.

---
 .../net/auth/AtomicDirectoryOperation.java    |  57 ++++++++
 .../apache/guacamole/net/auth/Directory.java  |  85 ++++++++++-
 .../DirectoryOperationException.java          |  12 ++
 .../rest/directory/DirectoryResource.java     | 134 +++++++++++++++---
 4 files changed, 265 insertions(+), 23 deletions(-)
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AtomicDirectoryOperation.java
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryOperationException.java

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AtomicDirectoryOperation.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AtomicDirectoryOperation.java
new file mode 100644
index 000000000..1d5e196eb
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AtomicDirectoryOperation.java
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.auth;
+
+import org.apache.guacamole.GuacamoleException;
+
+/**
+ * An operation that should be attempted atomically when passed to
+ * {@link Directory#tryAtomically()}, if atomic operations are supported by
+ * the Directory.
+ */
+public interface AtomicDirectoryOperation<ObjectType extends Identifiable>  {
+
+    /**
+     * Attempt the operation atomically. If the Directory does not support
+     * atomic operations, the atomic flag will be set to false. If the atomic
+     * flag is set to true, the provided directory is guaranteed to perform
+     * the operations within this function atomically. Atomicity of the
+     * provided directory outside this function, or of the directory invoking
+     * this function are not guaranteed.
+     *
+     * NOTE: If atomicity is required for this operation, a GuacamoleException
+     * may be thrown by this function before any changes are made, ensuring the
+     * operation will only ever be performed atomically.
+     *
+     * @param atomic
+     *     True if the provided directory is guaranteed to peform the operation
+     *     atomically within the context of this function.
+     *
+     * @param directory
+     *     A directory that will perform the operation atomically if the atomic
+     *     flag is set to true. If the flag is false, the directory may still
+     *     be used, though atomicity is not guaranteed.
+     *
+     * @throws GuacamoleException
+     *     If an issue occurs during the operation.
+     */
+    void executeOperation(boolean atomic, Directory<ObjectType> directory)
+            throws GuacamoleException;
+}
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java
index ba1e1522d..ac76fae9d 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java
@@ -20,6 +20,7 @@
 package org.apache.guacamole.net.auth;
 
 import java.util.Collection;
+import java.util.Iterator;
 import java.util.Set;
 import org.apache.guacamole.GuacamoleException;
 
@@ -198,6 +199,29 @@ public interface Directory<ObjectType extends Identifiable> {
     void add(ObjectType object)
             throws GuacamoleException;
 
+    /**
+     * Adds the given objects to the overall set. If new identifiers are
+     * created for any of the the added objects, the identifiers will be
+     * automatically assigned via setIdentifier().
+     *
+     * @param objects
+     *     The objects to add.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while adding any of the objects, or if adding
+     *     the objects is not allowed.
+     */
+    default void add(Collection<ObjectType> objects)
+            throws GuacamoleException {
+
+        // Add each object individually by default
+        Iterator<ObjectType> iterator = objects.iterator();
+        while (iterator.hasNext()) {
+            add(iterator.next());
+        }
+
+    }
+
     /**
      * Updates the stored object with the data contained in the given object.
      *
@@ -209,14 +233,73 @@ public interface Directory<ObjectType extends Identifiable> {
     void update(ObjectType object)
             throws GuacamoleException;
 
+    /**
+     * Updates the stored objects with the data contained in the given objects.
+     *
+     * @param objects The objects which will supply the data for the update.
+     *
+     * @throws GuacamoleException If an error occurs while updating the objects,
+     *                            or if updating an object is not allowed.
+     */
+    default void update(Collection<ObjectType> objects)
+            throws GuacamoleException {
+
+        // Update each object individually by default
+        Iterator<ObjectType> iterator = objects.iterator();
+        while (iterator.hasNext()) {
+            update(iterator.next());
+        }
+
+    }
+
     /**
      * Removes the object with the given identifier from the overall set.
      *
      * @param identifier The identifier of the object to remove.
      *
      * @throws GuacamoleException If an error occurs while removing the object,
-     *                            or if removing object is not allowed.
+     *                            or if removing the object is not allowed.
      */
     void remove(String identifier) throws GuacamoleException;
 
+    /**
+     * Removes all object with any of the given identifier from the overall set.
+     *
+     * @param identifiers The identifiers of the objects to remove.
+     *
+     * @throws GuacamoleException If an error occurs while removing an object,
+     *                            or if removing an object is not allowed.
+     */
+    default void remove(Collection<String> identifiers)
+            throws GuacamoleException {
+
+        // Remove each object individually by default
+        Iterator<String> iterator = identifiers.iterator();
+        while (iterator.hasNext()) {
+            remove(iterator.next());
+        }
+
+    }
+
+    /**
+     * Attempt to perform the provided operation atomically if possible. If the
+     * operation can be performed atomically, the atomic flag will be set to
+     * true, and the directory passed to the provided operation callback will
+     * peform directory operations atomically within the operation callback.
+     *
+     * @param operation
+     *     The directory operation that should be performed atomically.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs during execution of the provided operation.
+     */
+    default void tryAtomically(AtomicDirectoryOperation<ObjectType> operation)
+            throws GuacamoleException {
+
+        // By default, perform the operation non-atomically. If atomic operation
+        // is supported by an implementation, it must be implemented there.
+        operation.executeOperation(false, this);
+
+    }
+
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryOperationException.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryOperationException.java
new file mode 100644
index 000000000..3a88d4270
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryOperationException.java
@@ -0,0 +1,12 @@
+package org.apache.guacamole.rest.directory;
+
+import org.apache.guacamole.GuacamoleException;
+
+public class DirectoryOperationException<InternalType> extends GuacamoleException {
+
+    public DirectoryOperationException(String message) {
+        super(message);
+    }
+
+
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index 50d428528..8aa464bd0 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -19,8 +19,10 @@
 
 package org.apache.guacamole.rest.directory;
 
+import java.util.ArrayList;
 import java.util.Collection;
 import java.util.HashMap;
+import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
 import javax.inject.Inject;
@@ -37,6 +39,7 @@ import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
 import org.apache.guacamole.GuacamoleUnsupportedException;
+import org.apache.guacamole.net.auth.AtomicDirectoryOperation;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Directory;
@@ -341,6 +344,17 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
         return resourceFactory;
     }
 
+
+    private InternalType filterAndTranslate(ExternalType object)
+            throws GuacamoleException {
+
+        // Filter and sanitize the external object
+        translator.filterExternalObject(userContext, object);
+
+        // Translate to the internal type
+        return translator.toInternalObject(object);
+    }
+
     /**
      * Returns a map of all objects available within this DirectoryResource,
      * filtering the returned map by the given permission, if specified.
@@ -386,45 +400,122 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
     /**
      * Applies the given object patches, updating the underlying directory
-     * accordingly. This operation currently only supports deletion of objects
-     * through the "remove" patch operation. The path of each patch operation is
-     * of the form "/ID" where ID is the identifier of the object being
-     * modified.
+     * accordingly. This operation supports addition, update, and removal of
+     * objects through the "add", "replace", and "remove" patch operation.
+     * The path of each patch operation is of the form "/ID" where ID is the
+     * identifier of the object being modified. In the case of object creation,
+     * the identifier is ignored, as the identifier will be automatically
+     * provided. This operation is atomic.
      *
      * @param patches
      *     The patches to apply for this request.
      *
      * @throws GuacamoleException
-     *     If an error occurs while deleting the objects.
+     *     If an error occurs while adding, updating, or removing objects.
      */
     @PATCH
-    public void patchObjects(List<APIPatch<String>> patches)
+    public void patchObjects(List<APIPatch<ExternalType>> patches)
             throws GuacamoleException {
 
-        // Apply each operation specified within the patch
-        for (APIPatch<String> patch : patches) {
+        // Objects will be add, updated, and removed atomically
+        Collection<InternalType> objectsToAdd = new ArrayList<>();
+        Collection<InternalType> objectsToUpdate = new ArrayList<>();
+        Collection<String> identifiersToRemove = new ArrayList<>();
 
-            // Only remove is supported
-            if (patch.getOp() != APIPatch.Operation.remove)
-                throw new GuacamoleUnsupportedException("Only the \"remove\" "
-                        + "operation is supported.");
+        // Apply each operation specified within the patch
+        for (APIPatch<ExternalType> patch : patches) {
 
             // Retrieve and validate path
             String path = patch.getPath();
             if (!path.startsWith("/"))
                 throw new GuacamoleClientException("Patch paths must start with \"/\".");
 
-            // Remove specified object
-            String identifier = path.substring(1);
-            try {
-                directory.remove(identifier);
-                fireDirectorySuccessEvent(DirectoryEvent.Operation.REMOVE, identifier, null);
+            // Append each provided object to the list, to be added atomically
+            if(patch.getOp() == APIPatch.Operation.add) {
+
+                // Filter/sanitize object contents
+                InternalType internal = filterAndTranslate(patch.getValue());
+
+                // Add to the list of objects to create
+                objectsToAdd.add(internal);
             }
-            catch (GuacamoleException | RuntimeException | Error e) {
-                fireDirectoryFailureEvent(DirectoryEvent.Operation.REMOVE, identifier, null, e);
-                throw e;
+
+            // Append each provided object to the list, to be updated atomically
+            else if (patch.getOp() == APIPatch.Operation.replace) {
+
+                // Filter/sanitize object contents
+                InternalType internal = filterAndTranslate(patch.getValue());
+
+                // Add to the list of objects to update
+                objectsToUpdate.add(internal);
             }
 
+            // Append each identifier to the list, to be removed atomically
+            else if (patch.getOp() == APIPatch.Operation.remove) {
+
+                String identifier = path.substring(1);
+                identifiersToRemove.add(identifier);
+
+            }
+
+        }
+
+        // Perform all requested operations atomically
+        directory.tryAtomically(new AtomicDirectoryOperation<InternalType>() {
+
+            @Override
+            public void executeOperation(boolean atomic, Directory<InternalType> directory)
+                    throws GuacamoleException {
+
+                // If the underlying directory implentation does not support
+                // atomic operations, abort the patch operation. This REST
+                // endpoint requires that operations be performed atomically.
+                if (!atomic)
+                    throw new GuacamoleUnsupportedException(
+                            "Atomic operations are not supported. " +
+                            "The patch cannot be executed.");
+
+                // First, create every object from the patch
+                directory.add(objectsToAdd);
+
+                // Next, update every object from the patch
+                directory.update(objectsToUpdate);
+
+                // Finally, remove every object from the patch
+                directory.remove(identifiersToRemove);
+
+            }
+
+        });
+
+        // Fire directory success events for each created object
+        Iterator<InternalType> addedIterator = objectsToAdd.iterator();
+        while (addedIterator.hasNext()) {
+
+            InternalType internal = addedIterator.next();
+            fireDirectorySuccessEvent(
+                    DirectoryEvent.Operation.ADD, internal.getIdentifier(), internal);
+
+        }
+
+        // Fire directory success events for each updated object
+        Iterator<InternalType> updatedIterator = objectsToUpdate.iterator();
+        while (updatedIterator.hasNext()) {
+
+            InternalType internal = updatedIterator.next();
+            fireDirectorySuccessEvent(
+                    DirectoryEvent.Operation.UPDATE, internal.getIdentifier(), internal);
+
+        }
+
+        // Fire directory success events for each removed object
+        Iterator<String> removedIterator = identifiersToRemove.iterator();
+        while (removedIterator.hasNext()) {
+
+            String identifier = removedIterator.next();
+            fireDirectorySuccessEvent(
+                    DirectoryEvent.Operation.UPDATE, identifier, null);
+
         }
 
     }
@@ -453,8 +544,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
             throw new GuacamoleClientException("Data must be submitted when creating objects.");
 
         // Filter/sanitize object contents
-        translator.filterExternalObject(userContext, object);
-        InternalType internal = translator.toInternalObject(object);
+        InternalType internal = filterAndTranslate(object);
 
         // Create the new object within the directory
         try {

From 65074385e1e3d0df715ad95475a364b623eeeb52 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 18 Jan 2023 23:57:02 +0000
Subject: [PATCH 143/289] GUACAMOLE-926: Set JDBC to batch mode and just do
 operations one at a time.

---
 .../JDBCAuthenticationProviderModule.java     |   6 +
 .../ActiveConnectionDirectory.java            |   6 +-
 .../auth/jdbc/base/JDBCDirectory.java         |  44 ++++
 .../jdbc/connection/ConnectionDirectory.java  |   6 +-
 .../ConnectionGroupDirectory.java             |   6 +-
 .../SharingProfileDirectory.java              |   6 +-
 .../auth/jdbc/user/UserDirectory.java         |   6 +-
 .../jdbc/usergroup/UserGroupDirectory.java    |   6 +-
 .../apache/guacamole/net/auth/Directory.java  |  62 ------
 .../DirectoryOperationException.java          |  12 --
 .../rest/directory/DirectoryResource.java     | 204 +++++++++++-------
 11 files changed, 188 insertions(+), 176 deletions(-)
 create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/JDBCDirectory.java
 delete mode 100644 guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryOperationException.java

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
index 5ae0ea53f..7b735bdf4 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
@@ -45,6 +45,7 @@ import org.apache.guacamole.auth.jdbc.security.SaltService;
 import org.apache.guacamole.auth.jdbc.security.SecureRandomSaltService;
 import org.apache.guacamole.auth.jdbc.permission.SystemPermissionService;
 import org.apache.guacamole.auth.jdbc.user.UserService;
+import org.apache.ibatis.session.ExecutorType;
 import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
 import org.apache.guacamole.auth.jdbc.permission.ConnectionGroupPermissionMapper;
 import org.apache.guacamole.auth.jdbc.permission.ConnectionGroupPermissionService;
@@ -126,6 +127,11 @@ public class JDBCAuthenticationProviderModule extends MyBatisModule {
         // Transaction factory
         bindTransactionFactoryType(JdbcTransactionFactory.class);
         
+        // Set the JDBC Auth provider to use batch execution when possible
+        bindConfigurationSetting(configuration -> {
+            configuration.setDefaultExecutorType(ExecutorType.BATCH);
+        });
+
         // Add MyBatis mappers
         addMapperClass(ConnectionMapper.class);
         addMapperClass(ConnectionGroupMapper.class);
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java
index b0d6324aa..28510b738 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionDirectory.java
@@ -25,16 +25,14 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.Set;
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.jdbc.base.RestrictedObject;
+import org.apache.guacamole.auth.jdbc.base.JDBCDirectory;
 import org.apache.guacamole.net.auth.ActiveConnection;
-import org.apache.guacamole.net.auth.Directory;
 
 /**
  * Implementation of a Directory which contains all currently-active
  * connections.
  */
-public class ActiveConnectionDirectory extends RestrictedObject
-    implements Directory<ActiveConnection> {
+public class ActiveConnectionDirectory extends JDBCDirectory<ActiveConnection> {
 
     /**
      * Service for retrieving and manipulating active connections.
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/JDBCDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/JDBCDirectory.java
new file mode 100644
index 000000000..fcba2f678
--- /dev/null
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/JDBCDirectory.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.jdbc.base;
+
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.net.auth.AtomicDirectoryOperation;
+import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.net.auth.Identifiable;
+import org.mybatis.guice.transactional.Transactional;
+
+/**
+ * An implementation of Directory that uses database transactions to guarantee
+ * atomicity for any operations supplied to tryAtomically().
+ */
+public abstract class JDBCDirectory<ObjectType extends Identifiable>
+        extends RestrictedObject implements Directory<ObjectType>  {
+
+    @Transactional
+    public void tryAtomically(AtomicDirectoryOperation<ObjectType> operation)
+            throws GuacamoleException {
+
+        // Execute the operation atomically - the @Transactional annotation
+        // specifies that the entire operation will be performed in a transaction
+        operation.executeOperation(true, this);
+
+    }
+}
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
index 52a127df4..3e364f509 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
@@ -25,17 +25,15 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.Set;
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.jdbc.base.RestrictedObject;
+import org.apache.guacamole.auth.jdbc.base.JDBCDirectory;
 import org.apache.guacamole.net.auth.Connection;
-import org.apache.guacamole.net.auth.Directory;
 import org.mybatis.guice.transactional.Transactional;
 
 /**
  * Implementation of the Connection Directory which is driven by an underlying,
  * arbitrary database.
  */
-public class ConnectionDirectory extends RestrictedObject
-    implements Directory<Connection> {
+public class ConnectionDirectory extends JDBCDirectory<Connection> {
 
     /**
      * Service for managing connection objects.
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java
index 9f3930597..2e21dc21d 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupDirectory.java
@@ -25,17 +25,15 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.Set;
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.jdbc.base.RestrictedObject;
+import org.apache.guacamole.auth.jdbc.base.JDBCDirectory;
 import org.apache.guacamole.net.auth.ConnectionGroup;
-import org.apache.guacamole.net.auth.Directory;
 import org.mybatis.guice.transactional.Transactional;
 
 /**
  * Implementation of the ConnectionGroup Directory which is driven by an
  * underlying, arbitrary database.
  */
-public class ConnectionGroupDirectory extends RestrictedObject
-    implements Directory<ConnectionGroup> {
+public class ConnectionGroupDirectory extends JDBCDirectory<ConnectionGroup> {
 
     /**
      * Service for managing connection group objects.
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java
index 632557052..4035ff03f 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileDirectory.java
@@ -24,8 +24,7 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.Set;
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.jdbc.base.RestrictedObject;
-import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.auth.jdbc.base.JDBCDirectory;
 import org.apache.guacamole.net.auth.SharingProfile;
 import org.mybatis.guice.transactional.Transactional;
 
@@ -33,8 +32,7 @@ import org.mybatis.guice.transactional.Transactional;
  * Implementation of the SharingProfile Directory which is driven by an
  * underlying, arbitrary database.
  */
-public class SharingProfileDirectory extends RestrictedObject
-    implements Directory<SharingProfile> {
+public class SharingProfileDirectory extends JDBCDirectory<SharingProfile> {
 
     /**
      * Service for managing sharing profile objects.
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java
index dffd8e2ec..72d5a4f30 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserDirectory.java
@@ -25,8 +25,7 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.Set;
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.jdbc.base.RestrictedObject;
-import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.auth.jdbc.base.JDBCDirectory;
 import org.apache.guacamole.net.auth.User;
 import org.mybatis.guice.transactional.Transactional;
 
@@ -34,8 +33,7 @@ import org.mybatis.guice.transactional.Transactional;
  * Implementation of the User Directory which is driven by an underlying,
  * arbitrary database.
  */
-public class UserDirectory extends RestrictedObject
-    implements Directory<User> {
+public class UserDirectory extends JDBCDirectory<User> {
 
     /**
      * Service for managing user objects.
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java
index 911b8521f..c6bb89572 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupDirectory.java
@@ -24,8 +24,7 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.Set;
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.jdbc.base.RestrictedObject;
-import org.apache.guacamole.net.auth.Directory;
+import org.apache.guacamole.auth.jdbc.base.JDBCDirectory;
 import org.apache.guacamole.net.auth.UserGroup;
 import org.mybatis.guice.transactional.Transactional;
 
@@ -33,8 +32,7 @@ import org.mybatis.guice.transactional.Transactional;
  * Implementation of the UserGroup Directory which is driven by an underlying,
  * arbitrary database.
  */
-public class UserGroupDirectory extends RestrictedObject
-    implements Directory<UserGroup> {
+public class UserGroupDirectory extends JDBCDirectory<UserGroup> {
 
     /**
      * Service for managing user group objects.
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java
index ac76fae9d..bc5c52afa 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Directory.java
@@ -20,7 +20,6 @@
 package org.apache.guacamole.net.auth;
 
 import java.util.Collection;
-import java.util.Iterator;
 import java.util.Set;
 import org.apache.guacamole.GuacamoleException;
 
@@ -199,29 +198,6 @@ public interface Directory<ObjectType extends Identifiable> {
     void add(ObjectType object)
             throws GuacamoleException;
 
-    /**
-     * Adds the given objects to the overall set. If new identifiers are
-     * created for any of the the added objects, the identifiers will be
-     * automatically assigned via setIdentifier().
-     *
-     * @param objects
-     *     The objects to add.
-     *
-     * @throws GuacamoleException
-     *     If an error occurs while adding any of the objects, or if adding
-     *     the objects is not allowed.
-     */
-    default void add(Collection<ObjectType> objects)
-            throws GuacamoleException {
-
-        // Add each object individually by default
-        Iterator<ObjectType> iterator = objects.iterator();
-        while (iterator.hasNext()) {
-            add(iterator.next());
-        }
-
-    }
-
     /**
      * Updates the stored object with the data contained in the given object.
      *
@@ -233,25 +209,6 @@ public interface Directory<ObjectType extends Identifiable> {
     void update(ObjectType object)
             throws GuacamoleException;
 
-    /**
-     * Updates the stored objects with the data contained in the given objects.
-     *
-     * @param objects The objects which will supply the data for the update.
-     *
-     * @throws GuacamoleException If an error occurs while updating the objects,
-     *                            or if updating an object is not allowed.
-     */
-    default void update(Collection<ObjectType> objects)
-            throws GuacamoleException {
-
-        // Update each object individually by default
-        Iterator<ObjectType> iterator = objects.iterator();
-        while (iterator.hasNext()) {
-            update(iterator.next());
-        }
-
-    }
-
     /**
      * Removes the object with the given identifier from the overall set.
      *
@@ -262,25 +219,6 @@ public interface Directory<ObjectType extends Identifiable> {
      */
     void remove(String identifier) throws GuacamoleException;
 
-    /**
-     * Removes all object with any of the given identifier from the overall set.
-     *
-     * @param identifiers The identifiers of the objects to remove.
-     *
-     * @throws GuacamoleException If an error occurs while removing an object,
-     *                            or if removing an object is not allowed.
-     */
-    default void remove(Collection<String> identifiers)
-            throws GuacamoleException {
-
-        // Remove each object individually by default
-        Iterator<String> iterator = identifiers.iterator();
-        while (iterator.hasNext()) {
-            remove(iterator.next());
-        }
-
-    }
-
     /**
      * Attempt to perform the provided operation atomically if possible. If the
      * operation can be performed atomically, the atomic flag will be set to
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryOperationException.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryOperationException.java
deleted file mode 100644
index 3a88d4270..000000000
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryOperationException.java
+++ /dev/null
@@ -1,12 +0,0 @@
-package org.apache.guacamole.rest.directory;
-
-import org.apache.guacamole.GuacamoleException;
-
-public class DirectoryOperationException<InternalType> extends GuacamoleException {
-
-    public DirectoryOperationException(String message) {
-        super(message);
-    }
-
-
-}
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index 8aa464bd0..412068a96 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -417,49 +417,6 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
     public void patchObjects(List<APIPatch<ExternalType>> patches)
             throws GuacamoleException {
 
-        // Objects will be add, updated, and removed atomically
-        Collection<InternalType> objectsToAdd = new ArrayList<>();
-        Collection<InternalType> objectsToUpdate = new ArrayList<>();
-        Collection<String> identifiersToRemove = new ArrayList<>();
-
-        // Apply each operation specified within the patch
-        for (APIPatch<ExternalType> patch : patches) {
-
-            // Retrieve and validate path
-            String path = patch.getPath();
-            if (!path.startsWith("/"))
-                throw new GuacamoleClientException("Patch paths must start with \"/\".");
-
-            // Append each provided object to the list, to be added atomically
-            if(patch.getOp() == APIPatch.Operation.add) {
-
-                // Filter/sanitize object contents
-                InternalType internal = filterAndTranslate(patch.getValue());
-
-                // Add to the list of objects to create
-                objectsToAdd.add(internal);
-            }
-
-            // Append each provided object to the list, to be updated atomically
-            else if (patch.getOp() == APIPatch.Operation.replace) {
-
-                // Filter/sanitize object contents
-                InternalType internal = filterAndTranslate(patch.getValue());
-
-                // Add to the list of objects to update
-                objectsToUpdate.add(internal);
-            }
-
-            // Append each identifier to the list, to be removed atomically
-            else if (patch.getOp() == APIPatch.Operation.remove) {
-
-                String identifier = path.substring(1);
-                identifiersToRemove.add(identifier);
-
-            }
-
-        }
-
         // Perform all requested operations atomically
         directory.tryAtomically(new AtomicDirectoryOperation<InternalType>() {
 
@@ -475,48 +432,139 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                             "Atomic operations are not supported. " +
                             "The patch cannot be executed.");
 
-                // First, create every object from the patch
-                directory.add(objectsToAdd);
 
-                // Next, update every object from the patch
-                directory.update(objectsToUpdate);
+                // Keep a list of all objects that have been successfully
+                // added, updated, or removed
+                Collection<InternalType> addedObjects = new ArrayList<>();
+                Collection<InternalType> updatedObjects = new ArrayList<>();
+                Collection<String> removedIdentifiers = new ArrayList<>();
 
-                // Finally, remove every object from the patch
-                directory.remove(identifiersToRemove);
+                // True if any operation in the patch failed. Any failure will
+                // fail the request, though won't result in immediate stoppage
+                // since more errors may yet be uncovered.
+                boolean failed = false;
+
+                // Apply each operation specified within the patch
+                for (APIPatch<ExternalType> patch : patches) {
+
+                    // Retrieve and validate path
+                    String path = patch.getPath();
+                    if (!path.startsWith("/"))
+                        throw new GuacamoleClientException("Patch paths must start with \"/\".");
+
+                    if(patch.getOp() == APIPatch.Operation.add) {
+
+                        // Filter/sanitize object contents
+                        InternalType internal = filterAndTranslate(patch.getValue());
+
+                        try {
+
+                            // Attempt to add the new object
+                            directory.add(internal);
+
+                            // Add the object to the list if addition was successful
+                            addedObjects.add(internal);
+
+                        }
+                        catch (GuacamoleException | RuntimeException | Error e) {
+                            fireDirectoryFailureEvent(
+                                    DirectoryEvent.Operation.ADD,
+                                    internal.getIdentifier(), internal, e);
+
+                            // TODO: Save the error for later inclusion in a big JSON error response
+                            failed = true;
+                        }
+
+                    }
+
+                    else if (patch.getOp() == APIPatch.Operation.replace) {
+
+                        // Filter/sanitize object contents
+                        InternalType internal = filterAndTranslate(patch.getValue());
+
+                        try {
+
+                            // Attempt to update the object
+                            directory.update(internal);
+
+                            // Add the object to the list if the update was successful
+                            updatedObjects.add(internal);
+                        }
+                        catch (GuacamoleException | RuntimeException | Error e) {
+                            fireDirectoryFailureEvent(
+                                    DirectoryEvent.Operation.UPDATE,
+                                    internal.getIdentifier(), internal, e);
+
+                            // TODO: Save the error for later inclusion in a big JSON error response
+                            failed = true;
+                        }
+                    }
+
+                    // Append each identifier to the list, to be removed atomically
+                    else if (patch.getOp() == APIPatch.Operation.remove) {
+
+                        String identifier = path.substring(1);
+
+                        try {
+
+                            // Attempt to remove the object
+                            directory.remove(identifier);
+
+                            // Add the object to the list if the removal was successful
+                            removedIdentifiers.add(identifier);
+                        }
+                        catch (GuacamoleException | RuntimeException | Error e) {
+                            fireDirectoryFailureEvent(
+                                    DirectoryEvent.Operation.UPDATE, identifier, null, e);
+
+                            // TODO: Save the error for later inclusion in a big JSON error response
+                            failed = true;
+                        }
+                    }
+
+                }
+
+                // If any operation failed, fail now
+                if (failed) {
+                    throw new GuacamoleClientException(
+                            "oh noes the patch batch failed");
+                }
+
+                // Fire directory success events for each created object
+                Iterator<InternalType> addedIterator = addedObjects.iterator();
+                while (addedIterator.hasNext()) {
+
+                    InternalType internal = addedIterator.next();
+                    fireDirectorySuccessEvent(
+                            DirectoryEvent.Operation.ADD, internal.getIdentifier(), internal);
+
+                }
+
+                // Fire directory success events for each updated object
+                Iterator<InternalType> updatedIterator = updatedObjects.iterator();
+                while (updatedIterator.hasNext()) {
+
+                    InternalType internal = updatedIterator.next();
+                    fireDirectorySuccessEvent(
+                            DirectoryEvent.Operation.UPDATE, internal.getIdentifier(), internal);
+
+                }
+
+                // Fire directory success events for each removed object
+                Iterator<String> removedIterator = removedIdentifiers.iterator();
+                while (removedIterator.hasNext()) {
+
+                    String identifier = removedIterator.next();
+                    fireDirectorySuccessEvent(
+                            DirectoryEvent.Operation.UPDATE, identifier, null);
+
+                }
 
             }
 
         });
 
-        // Fire directory success events for each created object
-        Iterator<InternalType> addedIterator = objectsToAdd.iterator();
-        while (addedIterator.hasNext()) {
-
-            InternalType internal = addedIterator.next();
-            fireDirectorySuccessEvent(
-                    DirectoryEvent.Operation.ADD, internal.getIdentifier(), internal);
-
-        }
-
-        // Fire directory success events for each updated object
-        Iterator<InternalType> updatedIterator = objectsToUpdate.iterator();
-        while (updatedIterator.hasNext()) {
-
-            InternalType internal = updatedIterator.next();
-            fireDirectorySuccessEvent(
-                    DirectoryEvent.Operation.UPDATE, internal.getIdentifier(), internal);
-
-        }
-
-        // Fire directory success events for each removed object
-        Iterator<String> removedIterator = identifiersToRemove.iterator();
-        while (removedIterator.hasNext()) {
-
-            String identifier = removedIterator.next();
-            fireDirectorySuccessEvent(
-                    DirectoryEvent.Operation.UPDATE, identifier, null);
-
-        }
+        // TODO: JSON response with failures or success
 
     }
 

From 7d1d5cdf1338f86043b54dd1e00012495923a238 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 19 Jan 2023 00:45:38 +0000
Subject: [PATCH 144/289] GUACAMOLE-926: Success / Error handling in REST API.

---
 .../src/main/java/org/apache/guacamole/rest/APIError.java     | 2 ++
 .../apache/guacamole/rest/directory/DirectoryResource.java    | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java b/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java
index 846e2930e..0d925d04f 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java
@@ -202,6 +202,8 @@ public class APIError {
             this.translatableMessage = translatable.getTranslatableMessage();
         }
 
+        // TODO: Handle patch exceptions, need a bunch of JSON saying which things failed
+
         // Use generic translation string if message is not translated
         else
             this.translatableMessage = new TranslatableMessage(UNTRANSLATED_MESSAGE_KEY,
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index 412068a96..9ca71dba0 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -564,7 +564,9 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
         });
 
-        // TODO: JSON response with failures or success
+        // TODO: JSON response indicating which things were changed
+        // NOTE: IDs are assigned at creation time so a user of the API
+        // needs this response if they want to be able to actually use them
 
     }
 

From 9cdbe0fb36aeb97e951c57c72c81004ca9ccc2d4 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 23 Jan 2023 23:40:48 +0000
Subject: [PATCH 145/289] GUACAMOLE-926: Improve response plumbing through to
 user.

---
 .../jdbc/connection/ConnectionDirectory.java  |  15 +-
 .../net/auth/DelegatingDirectory.java         |   6 +
 .../org/apache/guacamole/rest/APIError.java   |  27 +++-
 .../rest/directory/DirectoryResource.java     | 142 +++++++++++++++---
 .../identifier/RelatedObjectSetResource.java  |   2 +-
 .../rest/{ => jsonpatch}/APIPatch.java        |   6 +-
 .../rest/jsonpatch/APIPatchError.java         |  71 +++++++++
 .../jsonpatch/APIPatchFailureException.java   |  66 ++++++++
 .../rest/jsonpatch/APIPatchOutcome.java       | 110 ++++++++++++++
 .../rest/jsonpatch/APIPatchResponse.java      |  56 +++++++
 .../rest/jsonpatch/package-info.java          |  24 +++
 .../permission/PermissionSetResource.java     |   2 +-
 12 files changed, 497 insertions(+), 30 deletions(-)
 rename guacamole/src/main/java/org/apache/guacamole/rest/{ => jsonpatch}/APIPatch.java (93%)
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchError.java
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchFailureException.java
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchOutcome.java
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchResponse.java
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/package-info.java

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
index 3e364f509..775628889 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
@@ -68,8 +68,19 @@ public class ConnectionDirectory extends JDBCDirectory<Connection> {
     @Override
     @Transactional
     public void update(Connection object) throws GuacamoleException {
-        ModeledConnection connection = (ModeledConnection) object;
-        connectionService.updateObject(getCurrentUser(), connection);
+
+        // If the provided connection is already an internal type, update
+        // using the internal method
+        if (object instanceof ModeledConnection) {
+            ModeledConnection connection = (ModeledConnection) object;
+            connectionService.updateObject(getCurrentUser(), connection);
+        }
+
+        // If the type is not already the expected internal type, use the
+        // external update method
+        else {
+            connectionService.updateExternalObject(getCurrentUser(), object);
+        }
     }
 
     @Override
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingDirectory.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingDirectory.java
index 0a9046c01..cc19847c1 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingDirectory.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingDirectory.java
@@ -90,4 +90,10 @@ public class DelegatingDirectory<ObjectType extends Identifiable>
         directory.remove(identifier);
     }
 
+    @Override
+    public void tryAtomically(AtomicDirectoryOperation<ObjectType> operation)
+            throws GuacamoleException {
+        directory.tryAtomically(operation);
+    }
+
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java b/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java
index 0d925d04f..63b55289b 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java
@@ -21,6 +21,8 @@ package org.apache.guacamole.rest;
 
 import java.util.Collection;
 import java.util.Collections;
+import java.util.List;
+
 import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
@@ -31,6 +33,8 @@ import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.net.auth.credentials.GuacamoleCredentialsException;
 import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
 import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
+import org.apache.guacamole.rest.jsonpatch.APIPatchFailureException;
+import org.apache.guacamole.rest.jsonpatch.APIPatchOutcome;
 import org.apache.guacamole.tunnel.GuacamoleStreamException;
 
 /**
@@ -71,6 +75,12 @@ public class APIError {
      */
     private final Collection<Field> expected;
 
+    /**
+     * The outcome of each patch in the associated request, if this was a
+     * JSON Patch request. Otherwise null.
+     */
+    private List<APIPatchOutcome> patches = null;
+
     /**
      * The type of error that occurred.
      */
@@ -202,13 +212,14 @@ public class APIError {
             this.translatableMessage = translatable.getTranslatableMessage();
         }
 
-        // TODO: Handle patch exceptions, need a bunch of JSON saying which things failed
-
         // Use generic translation string if message is not translated
         else
             this.translatableMessage = new TranslatableMessage(UNTRANSLATED_MESSAGE_KEY,
                     Collections.singletonMap(UNTRANSLATED_MESSAGE_VARIABLE_NAME, this.message));
 
+        if (exception instanceof APIPatchFailureException)
+            this.patches = ((APIPatchFailureException) exception).getPatches();
+
     }
 
     /**
@@ -245,6 +256,18 @@ public class APIError {
         return expected;
     }
 
+    /**
+     * Return the outcome for every patch in the request, if the request was
+     * a JSON patch request. Otherwise, null.
+     *
+     * @return
+     *     The outcome for every patch if responding to a JSON Patch request,
+     *     otherwise null.
+     */
+    public List<APIPatchOutcome> getPatches() {
+        return patches;
+    }
+
     /**
      * Returns a human-readable error message describing the error that
      * occurred.
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index 9ca71dba0..0b4e476bd 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -53,8 +53,12 @@ import org.apache.guacamole.net.auth.permission.SystemPermissionSet;
 import org.apache.guacamole.net.event.DirectoryEvent;
 import org.apache.guacamole.net.event.DirectoryFailureEvent;
 import org.apache.guacamole.net.event.DirectorySuccessEvent;
-import org.apache.guacamole.rest.APIPatch;
 import org.apache.guacamole.rest.event.ListenerService;
+import org.apache.guacamole.rest.jsonpatch.APIPatch;
+import org.apache.guacamole.rest.jsonpatch.APIPatchError;
+import org.apache.guacamole.rest.jsonpatch.APIPatchFailureException;
+import org.apache.guacamole.rest.jsonpatch.APIPatchOutcome;
+import org.apache.guacamole.rest.jsonpatch.APIPatchResponse;
 
 /**
  * A REST resource which abstracts the operations available on all Guacamole
@@ -344,7 +348,20 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
         return resourceFactory;
     }
 
-
+    /**
+     * Filter and sanitize the provided external object, translate to the
+     * internal type, and return the translated internal object.
+     *
+     * @param object
+     *     The external object to filter and translate.
+     *
+     * @return
+     *     The filtered and translated internal object.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while filtering or translating the external
+     *     object.
+     */
     private InternalType filterAndTranslate(ExternalType object)
             throws GuacamoleException {
 
@@ -412,11 +429,22 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
      *
      * @throws GuacamoleException
      *     If an error occurs while adding, updating, or removing objects.
+     *
+     * @return
+     *     A response describing the outcome of each patch. Only the identifier
+     *     of each patched object will be included in the response, not the
+     *     full object.
      */
     @PATCH
-    public void patchObjects(List<APIPatch<ExternalType>> patches)
+    public APIPatchResponse patchObjects(List<APIPatch<ExternalType>> patches)
             throws GuacamoleException {
 
+        // An outcome for each patch included in the request. This list
+        // may include both success and failure responses, though the
+        // presense of any failure would indicated that the entire
+        // request has failed and no changes have been made.
+        List<APIPatchOutcome> patchOutcomes = new ArrayList<>();
+
         // Perform all requested operations atomically
         directory.tryAtomically(new AtomicDirectoryOperation<InternalType>() {
 
@@ -432,13 +460,16 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                             "Atomic operations are not supported. " +
                             "The patch cannot be executed.");
 
-
                 // Keep a list of all objects that have been successfully
                 // added, updated, or removed
                 Collection<InternalType> addedObjects = new ArrayList<>();
                 Collection<InternalType> updatedObjects = new ArrayList<>();
                 Collection<String> removedIdentifiers = new ArrayList<>();
 
+                // A list of all responses associated with the successful
+                // creation of new objects
+                List<APIPatchOutcome> creationSuccesses = new ArrayList<>();
+
                 // True if any operation in the patch failed. Any failure will
                 // fail the request, though won't result in immediate stoppage
                 // since more errors may yet be uncovered.
@@ -465,14 +496,33 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                             // Add the object to the list if addition was successful
                             addedObjects.add(internal);
 
+                            // Add a success outcome describing the object creation
+                            APIPatchOutcome response = new APIPatchOutcome(
+                                    patch.getOp(), internal.getIdentifier(), path);
+                            patchOutcomes.add(response);
+                            creationSuccesses.add(response);
+
                         }
+
                         catch (GuacamoleException | RuntimeException | Error e) {
+                            failed = true;
                             fireDirectoryFailureEvent(
                                     DirectoryEvent.Operation.ADD,
                                     internal.getIdentifier(), internal, e);
 
-                            // TODO: Save the error for later inclusion in a big JSON error response
-                            failed = true;
+                            /*
+                             * If the failure represents an understood issue,
+                             * create a failure outcome for this failed patch.
+                             */
+                            if (e instanceof GuacamoleException)
+                                patchOutcomes.add(new APIPatchError(
+                                        patch.getOp(), null, path,
+                                        ((GuacamoleException) e).getMessage()));
+
+                            // If an unexpected failure occurs, fall through to the
+                            // standard API error handling
+                            else
+                                throw e;
                         }
 
                     }
@@ -489,14 +539,33 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                             // Add the object to the list if the update was successful
                             updatedObjects.add(internal);
+
+                            // Add a success outcome describing the object update
+                            APIPatchOutcome response = new APIPatchOutcome(
+                                    patch.getOp(), internal.getIdentifier(), path);
+                            patchOutcomes.add(response);
+                            creationSuccesses.add(response);
                         }
+
                         catch (GuacamoleException | RuntimeException | Error e) {
+                            failed = true;
                             fireDirectoryFailureEvent(
                                     DirectoryEvent.Operation.UPDATE,
                                     internal.getIdentifier(), internal, e);
 
-                            // TODO: Save the error for later inclusion in a big JSON error response
-                            failed = true;
+                            /*
+                             * If the failure represents an understood issue,
+                             * create a failure outcome for this failed patch.
+                             */
+                            if (e instanceof GuacamoleException)
+                                patchOutcomes.add(new APIPatchError(
+                                        patch.getOp(), internal.getIdentifier(), path,
+                                        ((GuacamoleException) e).getMessage()));
+
+                            // If an unexpected failure occurs, fall through to the
+                            // standard API error handling
+                            else
+                                throw e;
                         }
                     }
 
@@ -512,22 +581,51 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                             // Add the object to the list if the removal was successful
                             removedIdentifiers.add(identifier);
+
+                            // Add a success outcome describing the object removal
+                            APIPatchOutcome response = new APIPatchOutcome(
+                                    patch.getOp(), identifier, path);
+                            patchOutcomes.add(response);
+                            creationSuccesses.add(response);
                         }
                         catch (GuacamoleException | RuntimeException | Error e) {
-                            fireDirectoryFailureEvent(
-                                    DirectoryEvent.Operation.UPDATE, identifier, null, e);
-
-                            // TODO: Save the error for later inclusion in a big JSON error response
                             failed = true;
+                            fireDirectoryFailureEvent(
+                                    DirectoryEvent.Operation.REMOVE,
+                                    identifier, null, e);
+
+                            /*
+                             * If the failure represents an understood issue,
+                             * create a failure outcome for this failed patch.
+                             */
+                            if (e instanceof GuacamoleException)
+                                patchOutcomes.add(new APIPatchError(
+                                        patch.getOp(), identifier, path,
+                                        ((GuacamoleException) e).getMessage()));
+
+                            // If an unexpected failure occurs, fall through to the
+                            // standard API error handling
+                            else
+                                throw e;
                         }
                     }
 
                 }
 
-                // If any operation failed, fail now
+                // If any operation failed
                 if (failed) {
-                    throw new GuacamoleClientException(
-                            "oh noes the patch batch failed");
+
+                    // Any identifiers for objects created during this request
+                    // will no longer be valid, since the creation of those
+                    // objects will be rolled back.
+                    creationSuccesses.forEach(
+                            response -> response.clearIdentifier());
+
+                    // Return an error response, including any failures that
+                    // caused the failure of any patch in the request
+                    throw new APIPatchFailureException(
+                            "The provided patches failed to apply.", patchOutcomes);
+
                 }
 
                 // Fire directory success events for each created object
@@ -536,7 +634,8 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                     InternalType internal = addedIterator.next();
                     fireDirectorySuccessEvent(
-                            DirectoryEvent.Operation.ADD, internal.getIdentifier(), internal);
+                            DirectoryEvent.Operation.ADD,
+                            internal.getIdentifier(), internal);
 
                 }
 
@@ -546,7 +645,8 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                     InternalType internal = updatedIterator.next();
                     fireDirectorySuccessEvent(
-                            DirectoryEvent.Operation.UPDATE, internal.getIdentifier(), internal);
+                            DirectoryEvent.Operation.UPDATE,
+                            internal.getIdentifier(), internal);
 
                 }
 
@@ -556,7 +656,8 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                     String identifier = removedIterator.next();
                     fireDirectorySuccessEvent(
-                            DirectoryEvent.Operation.UPDATE, identifier, null);
+                            DirectoryEvent.Operation.UPDATE,
+                            identifier, null);
 
                 }
 
@@ -564,9 +665,8 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
         });
 
-        // TODO: JSON response indicating which things were changed
-        // NOTE: IDs are assigned at creation time so a user of the API
-        // needs this response if they want to be able to actually use them
+        // Return a list of outcomes, one for each patch in the request
+        return new APIPatchResponse(patchOutcomes);
 
     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/identifier/RelatedObjectSetResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/identifier/RelatedObjectSetResource.java
index 77b0b4091..7703be3cf 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/identifier/RelatedObjectSetResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/identifier/RelatedObjectSetResource.java
@@ -29,7 +29,7 @@ import javax.ws.rs.core.MediaType;
 import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.net.auth.RelatedObjectSet;
-import org.apache.guacamole.rest.APIPatch;
+import org.apache.guacamole.rest.jsonpatch.APIPatch;
 
 /**
  * A REST resource which abstracts the operations available on arbitrary sets
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/APIPatch.java b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatch.java
similarity index 93%
rename from guacamole/src/main/java/org/apache/guacamole/rest/APIPatch.java
rename to guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatch.java
index 28ff788a5..9f9268513 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/APIPatch.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatch.java
@@ -17,11 +17,11 @@
  * under the License.
  */
 
-package org.apache.guacamole.rest;
+package org.apache.guacamole.rest.jsonpatch;
 
 /**
- * An object for representing the body of a HTTP PATCH method.
- * See https://tools.ietf.org/html/rfc6902
+ * An object for representing an entry within the body of a
+ * JSON PATCH request. See https://tools.ietf.org/html/rfc6902
  *
  * @param <T>
  *     The type of object being patched.
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchError.java b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchError.java
new file mode 100644
index 000000000..85d28a714
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchError.java
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.rest.jsonpatch;
+
+import org.apache.guacamole.rest.jsonpatch.APIPatch.Operation;
+
+/**
+ * A failure outcome associated with a particular patch within a JSON Patch
+ * request. This status indicates that a particular patch failed to apply,
+ * and includes the error describing the failure, along with the operation and
+ * path from the original patch, and the identifier of the object
+ * referenced by the original patch.
+ */
+public class APIPatchError extends APIPatchOutcome {
+
+    /**
+     * The error associated with the submitted patch.
+     */
+    private final String error;
+
+    /**
+     * Create a failure status associated with a submitted patch from a JSON
+     * patch API request.
+     *
+     * @param op
+     *     The operation requested by the failed patch.
+     *
+     * @param identifier
+     *     The identifier of the object associated with the failed patch. If
+     *     the patch failed to create a new object, this will be null.
+     *
+     * @param path
+     *     The patch from the failed patch.
+     *
+     * @param error
+     *     The error message associated with the failure that prevented the
+     *     patch from applying.
+     */
+    public APIPatchError(
+            Operation op, String identifier, String path, String error) {
+        super(op, identifier, path);
+        this.error = error;
+    }
+
+    /**
+     * Return the error associated with the patch failure.
+     *
+     * @return
+     *     The error associated with the patch failure.
+     */
+    public String getError() {
+        return error;
+    }
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchFailureException.java b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchFailureException.java
new file mode 100644
index 000000000..fa40bffc6
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchFailureException.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.rest.jsonpatch;
+
+import java.util.List;
+
+import org.apache.guacamole.GuacamoleClientException;
+
+/**
+ * An exception describing a failure to apply the patches from a JSON Patch
+ * request. A list of outcomes is included, one for each patch in the request.
+ */
+public class APIPatchFailureException extends GuacamoleClientException {
+
+    /**
+     * A list of outcomes, each one corresponding to a patch in the request
+     * corresponding to this response. This may include a mix of successes and
+     * failures. Any failure will result in a failure of the entire request
+     * since JSON Patch requests are handled atomically.
+     */
+    public final List<APIPatchOutcome> patches;
+
+    /**
+     * Create a new patch request failure with the provided list of outcomes
+     * for individual patches.
+     *
+     * @param message
+     *     A human-readable message describing the overall request failure.
+     *
+     * @param patches
+     *     A list of patch outcomes, one for each patch in the request
+     *     associated with this response.
+     */
+    public APIPatchFailureException(
+            String message, List<APIPatchOutcome> patches) {
+
+        super(message );
+        this.patches = patches;
+    }
+
+    /**
+     * Return the outcome for each patch in the request corresponding to this
+     * response.
+     */
+    public List<APIPatchOutcome> getPatches() {
+        return patches;
+    }
+
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchOutcome.java b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchOutcome.java
new file mode 100644
index 000000000..245664cbc
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchOutcome.java
@@ -0,0 +1,110 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.rest.jsonpatch;
+
+import org.apache.guacamole.rest.jsonpatch.APIPatch.Operation;
+
+/**
+ * A successful outcome associated with a particular patch within a JSON Patch
+ * request. The outcome contains the operation requested by the original patch,
+ * the path from the original patch, and the identifier of the object corresponding
+ * to the value from the original patch.
+ *
+ * The purpose of this class is to present a relatively lightweight outcome for
+ * the user who submitted the Patch request. Rather than including the full
+ * contents of the value, only the identifier is included, allowing the user to
+ * determine the identifier of any newly-created objects as part of the request.
+ *
+ */
+public class APIPatchOutcome {
+
+    /**
+     * The requested operation for the patch corresponding to this outcome.
+     */
+    private final Operation op;
+
+    /**
+     * The identifier for the value in patch corresponding to this outcome.
+     * If the value in the patch was null, this identifier should also be null.
+     */
+    private String identifier;
+
+    /**
+     * The path for the patch corresponding to this outcome.
+     */
+    private final String path;
+
+    /**
+     * Create an outcome associated with a submitted patch, as part of a JSON
+     * patch API request.
+     *
+     * @param op
+     * @param identifier
+     * @param path
+     */
+    public APIPatchOutcome(Operation op, String identifier, String path) {
+        this.op = op;
+        this.identifier = identifier;
+        this.path = path;
+    }
+
+    /**
+     * Clear the identifier associated with this patch outcome. This must
+     * be done when an identifier in a outcome refers to a temporary object
+     * that was rolled back during processing of a request.
+     */
+    public void clearIdentifier() {
+        this.identifier = null;
+    }
+
+    /**
+     * Returns the requested operation for the patch corresponding to this
+     * outcome.
+     *
+     * @return
+     *     The requested operation for the patch corresponding to this outcome.
+     */
+    public Operation getOp() {
+        return op;
+    }
+
+    /**
+     * Returns the path for the patch corresponding to this outcome.
+     *
+     * @return
+     *     The path for the patch corresponding to this outcome.
+     */
+    public String getPath() {
+        return path;
+    }
+
+    /**
+     * Returns the identifier for the value in patch corresponding to this
+     * outcome, or null if the value in the patch was null.
+     *
+     * @return
+     *     The identifier for the value in patch corresponding to this
+     *     outcome, or null if the value was null.
+     */
+    public String getIdentifier() {
+        return identifier;
+    }
+
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchResponse.java b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchResponse.java
new file mode 100644
index 000000000..21096a2bc
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchResponse.java
@@ -0,0 +1,56 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.rest.jsonpatch;
+
+import java.util.List;
+
+/**
+ * A REST response describing the successful application of a JSON PATCH
+ * request to a directory. This consists of a list of outcomes, one for each
+ * patch within the request, in the same order.
+ */
+public class APIPatchResponse {
+
+    /**
+     * A list of outcomes, each one corresponding to a patch in the request
+     * corresponding to this response.
+     */
+    public final List<APIPatchOutcome> patches;
+
+    /**
+     * Create a new patch response with the provided list of outcomes for
+     * individual patches.
+     *
+     * @param patches
+     *     A list of patch outcomes, one for each patch in the request
+     *     associated with this response.
+     */
+    public APIPatchResponse(List<APIPatchOutcome> patches) {
+        this.patches = patches;
+    }
+
+    /**
+     * Return the outcome for each patch in the request corresponding to this
+     * response.
+     */
+    public List<APIPatchOutcome> getPatches() {
+        return patches;
+    }
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/package-info.java b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/package-info.java
new file mode 100644
index 000000000..b5f824f63
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/package-info.java
@@ -0,0 +1,24 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Classes related to JSON Patch HTTP requests or responses.
+ * See https://www.rfc-editor.org/rfc/rfc6902.
+ */
+package org.apache.guacamole.rest.jsonpatch;
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/permission/PermissionSetResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/permission/PermissionSetResource.java
index 38b337e0e..62f4d0ed9 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/permission/PermissionSetResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/permission/PermissionSetResource.java
@@ -31,7 +31,7 @@ import org.apache.guacamole.net.auth.Permissions;
 import org.apache.guacamole.net.auth.permission.ObjectPermission;
 import org.apache.guacamole.net.auth.permission.Permission;
 import org.apache.guacamole.net.auth.permission.SystemPermission;
-import org.apache.guacamole.rest.APIPatch;
+import org.apache.guacamole.rest.jsonpatch.APIPatch;
 
 /**
  * A REST resource which abstracts the operations available on the permissions

From e6bd12ee4c80b895ec00af81738f005ed254b3f5 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 24 Jan 2023 01:23:55 +0000
Subject: [PATCH 146/289] GUACAMOLE-926: Allow JDBC extensions to accept
 identifiers from user for update.

---
 .../ActiveConnectionService.java              |  8 +++++
 .../jdbc/base/DirectoryObjectService.java     | 18 ++++++++++++
 .../base/ModeledDirectoryObjectService.java   | 14 +++++++++
 .../guacamole/auth/jdbc/base/ObjectModel.java | 29 ++++++++++++++++++-
 .../jdbc/connection/ConnectionDirectory.java  | 11 ++++---
 .../auth/jdbc/connection/ConnectionModel.java |  5 ----
 .../jdbc/connection/ConnectionService.java    |  7 ++++-
 .../connectiongroup/ConnectionGroupModel.java |  6 ----
 .../ConnectionGroupService.java               |  7 ++++-
 .../sharingprofile/SharingProfileModel.java   |  6 ----
 .../sharingprofile/SharingProfileService.java |  7 ++++-
 .../guacamole/auth/jdbc/user/UserService.java |  4 +++
 .../auth/jdbc/usergroup/UserGroupService.java |  4 +++
 .../rest/directory/DirectoryResource.java     | 16 ++++++++++
 14 files changed, 115 insertions(+), 27 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionService.java
index 046cee1e2..80c75dbbb 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionService.java
@@ -166,6 +166,14 @@ public class ActiveConnectionService
 
     }
 
+    @Override
+    public void updateExternalObject(ModeledAuthenticatedUser user, ActiveConnection object) throws GuacamoleException {
+
+        // Updating active connections is not implemented
+        throw new GuacamoleSecurityException("Permission denied.");
+
+    }
+
     /**
      * Retrieve the permission set for the specified user that relates
      * to access to active connections.
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/DirectoryObjectService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/DirectoryObjectService.java
index 590e01e9f..29d40cc49 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/DirectoryObjectService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/DirectoryObjectService.java
@@ -116,6 +116,24 @@ public interface DirectoryObjectService<InternalType, ExternalType> {
     void deleteObject(ModeledAuthenticatedUser user, String identifier)
         throws GuacamoleException;
 
+    /**
+     * Updates the object corresponding to the given external representation,
+     * applying any changes that have been made. If no such object exists,
+     * this function has no effect.
+     *
+     * @param user
+     *     The user updating the object.
+     *
+     * @param object
+     *     The external object to apply updates from.
+     *
+     * @throws GuacamoleException
+     *     If the user lacks permission to update the object, or an error
+     *     occurs while updating the object.
+     */
+    void updateExternalObject(ModeledAuthenticatedUser user, ExternalType object)
+            throws GuacamoleException;
+
     /**
      * Updates the given object, applying any changes that have been made. If
      * no such object exists, this function has no effect.
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java
index 80bc7eb5c..75c25926b 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java
@@ -511,6 +511,20 @@ public abstract class ModeledDirectoryObjectService<InternalType extends Modeled
 
     }
 
+    @Override
+    @Transactional
+    public void updateExternalObject(ModeledAuthenticatedUser user, ExternalType object)
+        throws GuacamoleException {
+
+        // Convert to the internal type
+        InternalType internalObject = getObjectInstance(
+                user, getModelInstance(user, object));
+
+        // Delegate to the standard internal update functionality
+        updateObject(user, internalObject);
+
+    }
+
     @Override
     public Set<String> getIdentifiers(ModeledAuthenticatedUser user)
         throws GuacamoleException {
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ObjectModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ObjectModel.java
index c3052b1b4..69eb1fd36 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ObjectModel.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ObjectModel.java
@@ -21,6 +21,8 @@ package org.apache.guacamole.auth.jdbc.base;
 
 import java.util.Collection;
 
+import org.apache.guacamole.GuacamoleException;
+
 /**
  * Object representation of a Guacamole object, such as a user or connection,
  * as represented in the database.
@@ -75,7 +77,7 @@ public abstract class ObjectModel {
      *
      * @return
      *     The ID of this object in the database, or null if this object was
-     *     not retrieved from the database.
+     *     not retrieved from or intended to update the database.
      */
     public Integer getObjectID() {
         return objectID;
@@ -91,6 +93,31 @@ public abstract class ObjectModel {
         this.objectID = objectID;
     }
 
+    /**
+     * Given a text identifier, attempt to convert to an integer database ID.
+     * If the identifier is valid, the database ID will be set to this value.
+     * Otherwise, a GuacamoleException will be thrown.
+     *
+     * @param identifier
+     *     The identifier to convert to an integer and set on the database
+     *     model, if valid.
+     *
+     * @throws GuacamoleException
+     *     If the provided identifier is not a valid integer.
+     */
+    public void setObjectID(String identifier) throws GuacamoleException {
+
+        // Try to convert the provided identifier to an integer ID
+        try {
+            setObjectID(Integer.parseInt(identifier));
+        }
+
+        catch (NumberFormatException e) {
+            throw new GuacamoleException(
+                    "Database identifiers must be integers.");
+        }
+    }
+
     /**
      * Returns a map of attribute name/value pairs for all attributes associated
      * with this model which do not have explicit mappings to actual model
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
index 775628889..b2f3e2bea 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
@@ -71,16 +71,15 @@ public class ConnectionDirectory extends JDBCDirectory<Connection> {
 
         // If the provided connection is already an internal type, update
         // using the internal method
-        if (object instanceof ModeledConnection) {
-            ModeledConnection connection = (ModeledConnection) object;
-            connectionService.updateObject(getCurrentUser(), connection);
-        }
+        if (object instanceof ModeledConnection)
+            connectionService.updateObject(
+                getCurrentUser(), (ModeledConnection) object);
 
         // If the type is not already the expected internal type, use the
         // external update method
-        else {
+        else
             connectionService.updateExternalObject(getCurrentUser(), object);
-        }
+
     }
 
     @Override
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java
index da454025d..03413650b 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java
@@ -387,9 +387,4 @@ public class ConnectionModel extends ChildObjectModel {
 
     }
 
-    @Override
-    public void setIdentifier(String identifier) {
-        throw new UnsupportedOperationException("Connection identifiers are derived from IDs. They cannot be set.");
-    }
-
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionService.java
index b3ed89ce8..cdf2afb76 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionService.java
@@ -110,14 +110,19 @@ public class ConnectionService extends ModeledChildDirectoryObjectService<Modele
 
     @Override
     protected ConnectionModel getModelInstance(ModeledAuthenticatedUser currentUser,
-            final Connection object) {
+            final Connection object) throws GuacamoleException {
 
         // Create new ModeledConnection backed by blank model
         ConnectionModel model = new ConnectionModel();
         ModeledConnection connection = getObjectInstance(currentUser, model);
 
+        // If the provided connection has an identifier, set it on the model
+        if (object.getIdentifier() != null)
+            model.setObjectID(object.getIdentifier());
+
         // Set model contents through ModeledConnection, copying the provided connection
         connection.setParentIdentifier(object.getParentIdentifier());
+        connection.setIdentifier(object.getIdentifier());
         connection.setName(object.getName());
         connection.setConfiguration(object.getConfiguration());
         connection.setAttributes(object.getAttributes());
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java
index d58cc9b2e..ebad3383f 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java
@@ -266,10 +266,4 @@ public class ConnectionGroupModel extends ChildObjectModel {
         return id.toString();
 
     }
-
-    @Override
-    public void setIdentifier(String identifier) {
-        throw new UnsupportedOperationException("Connection group identifiers are derived from IDs. They cannot be set.");
-    }
-
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java
index dbf7793ec..11771032a 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java
@@ -92,14 +92,19 @@ public class ConnectionGroupService extends ModeledChildDirectoryObjectService<M
 
     @Override
     protected ConnectionGroupModel getModelInstance(ModeledAuthenticatedUser currentUser,
-            final ConnectionGroup object) {
+            final ConnectionGroup object) throws GuacamoleException {
 
         // Create new ModeledConnectionGroup backed by blank model
         ConnectionGroupModel model = new ConnectionGroupModel();
         ModeledConnectionGroup connectionGroup = getObjectInstance(currentUser, model);
 
+        // If the provided connection has an identifier, set it on the model
+        if (object.getIdentifier() != null)
+            model.setObjectID(object.getIdentifier());
+
         // Set model contents through ModeledConnectionGroup, copying the provided connection group
         connectionGroup.setParentIdentifier(object.getParentIdentifier());
+        connectionGroup.setIdentifier(object.getIdentifier());
         connectionGroup.setName(object.getName());
         connectionGroup.setType(object.getType());
         connectionGroup.setAttributes(object.getAttributes());
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileModel.java
index 375282da8..bdffb2fdf 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileModel.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileModel.java
@@ -71,10 +71,4 @@ public class SharingProfileModel extends ChildObjectModel {
 
     }
 
-    @Override
-    public void setIdentifier(String identifier) {
-        throw new UnsupportedOperationException("Sharing profile identifiers "
-                + "are derived from IDs. They cannot be set.");
-    }
-
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileService.java
index 4ca492c84..afab47c25 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileService.java
@@ -90,15 +90,20 @@ public class SharingProfileService
 
     @Override
     protected SharingProfileModel getModelInstance(ModeledAuthenticatedUser currentUser,
-            final SharingProfile object) {
+            final SharingProfile object) throws GuacamoleException {
 
         // Create new ModeledSharingProfile backed by blank model
         SharingProfileModel model = new SharingProfileModel();
         ModeledSharingProfile sharingProfile = getObjectInstance(currentUser, model);
 
+        // If the provided connection has an identifier, set it on the model
+        if (object.getIdentifier() != null)
+            model.setObjectID(object.getIdentifier());
+
         // Set model contents through ModeledSharingProfile, copying the
         // provided sharing profile
         sharingProfile.setPrimaryConnectionIdentifier(object.getPrimaryConnectionIdentifier());
+        sharingProfile.setIdentifier(object.getIdentifier());
         sharingProfile.setName(object.getName());
         sharingProfile.setParameters(object.getParameters());
         sharingProfile.setAttributes(object.getAttributes());
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
index 161976ce4..0cf206f04 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
@@ -202,6 +202,10 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
         UserModel model = new UserModel();
         ModeledUser user = getObjectInstance(currentUser, model);
 
+        // If the provided connection has an identifier, set it on the model
+        if (object.getIdentifier() != null)
+            model.setObjectID(object.getIdentifier());
+
         // Set model contents through ModeledUser, copying the provided user
         user.setIdentifier(object.getIdentifier());
         user.setPassword(object.getPassword());
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupService.java
index 3c42572ce..81f6a3afa 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupService.java
@@ -107,6 +107,10 @@ public class UserGroupService extends ModeledDirectoryObjectService<ModeledUserG
         UserGroupModel model = new UserGroupModel();
         ModeledUserGroup group = getObjectInstance(currentUser, model);
 
+        // If the provided connection has an identifier, set it on the model
+        if (object.getIdentifier() != null)
+            model.setObjectID(object.getIdentifier());
+
         // Set model contents through ModeledUser, copying the provided group
         group.setIdentifier(object.getIdentifier());
         group.setAttributes(object.getAttributes());
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index 0b4e476bd..e27fa1596 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -534,6 +534,22 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                         try {
 
+                            // Set the model to the supplied identifier from the PATH
+                            String identifier = path.substring(1);
+
+                            if (identifier == null)
+                                throw new GuacamoleClientException(
+                                        "An identifier is required when updating.");
+
+                            // If there's an identiifer provided in the value,
+                            // make sure it matches the one from the path
+                            String valueId = internal.getIdentifier();
+                            if (valueId != null && !valueId.equals(identifier))
+                                throw new GuacamoleClientException(
+                                        "Identifier mismatch between path and value.");
+
+                            internal.setIdentifier(identifier);
+
                             // Attempt to update the object
                             directory.update(internal);
 

From ec33c81f1aed65b38ec251657739c7ee54a09c82 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 24 Jan 2023 19:20:03 +0000
Subject: [PATCH 147/289] GUACAMOLE-926: Parse YAML, CSV, JSON on frontend and
 submit to API.

---
 doc/licenses/base64-js-1.5.1/LICENSE          |   22 +
 doc/licenses/base64-js-1.5.1/README           |    8 +
 .../base64-js-1.5.1/dep-coordinates.txt       |    1 +
 doc/licenses/buffer-4.9.2/LICENSE             |   21 +
 doc/licenses/buffer-4.9.2/README              |    7 +
 doc/licenses/buffer-4.9.2/dep-coordinates.txt |    1 +
 doc/licenses/core-util-is-1.0.3/LICENSE       |   19 +
 doc/licenses/core-util-is-1.0.3/README        |    7 +
 .../core-util-is-1.0.3/dep-coordinates.txt    |    1 +
 doc/licenses/csv-6.2.5/LICENSE                |   21 +
 doc/licenses/csv-6.2.5/README                 |    7 +
 doc/licenses/csv-6.2.5/dep-coordinates.txt    |    2 +
 doc/licenses/events-3.3.0/LICENSE             |   22 +
 doc/licenses/events-3.3.0/README              |    7 +
 doc/licenses/events-3.3.0/dep-coordinates.txt |    1 +
 doc/licenses/ieee754-1.2.1/LICENSE            |   11 +
 doc/licenses/ieee754-1.2.1/README             |    7 +
 .../ieee754-1.2.1/dep-coordinates.txt         |    1 +
 doc/licenses/inherits-2.0.4/LICENSE           |   15 +
 doc/licenses/inherits-2.0.4/README            |    8 +
 .../inherits-2.0.4/dep-coordinates.txt        |    1 +
 doc/licenses/isarray-1.0.0/LICENSE            |   21 +
 doc/licenses/isarray-1.0.0/README             |    8 +
 .../isarray-1.0.0/dep-coordinates.txt         |    1 +
 .../process-nextick-args-2.0.1/README         |    8 +
 .../dep-coordinates.txt                       |    1 +
 .../process-nextick-args-2.0.1/license.md     |   19 +
 doc/licenses/readable-stream-2.3.7/LICENSE    |   47 +
 doc/licenses/readable-stream-2.3.7/README     |    8 +
 .../readable-stream-2.3.7/dep-coordinates.txt |    1 +
 doc/licenses/safe-buffer-5.1.2/LICENSE        |   21 +
 doc/licenses/safe-buffer-5.1.2/README         |    8 +
 .../safe-buffer-5.1.2/dep-coordinates.txt     |    1 +
 doc/licenses/setimmediate-1.0.5/LICENSE.txt   |   20 +
 doc/licenses/setimmediate-1.0.5/README        |    8 +
 .../setimmediate-1.0.5/dep-coordinates.txt    |    1 +
 doc/licenses/stream-browserify-2.0.2/LICENSE  |   20 +
 doc/licenses/stream-browserify-2.0.2/README   |    8 +
 .../dep-coordinates.txt                       |    1 +
 doc/licenses/string_decoder-1.1.1/LICENSE     |   47 +
 doc/licenses/string_decoder-1.1.1/README      |    8 +
 .../string_decoder-1.1.1/dep-coordinates.txt  |    1 +
 .../timers-browserify-2.0.12/LICENSE.md       |   23 +
 doc/licenses/timers-browserify-2.0.12/README  |    8 +
 .../dep-coordinates.txt                       |    1 +
 doc/licenses/util-deprecate-1.0.2/LICENSE     |   24 +
 doc/licenses/util-deprecate-1.0.2/README      |    8 +
 .../util-deprecate-1.0.2/dep-coordinates.txt  |    1 +
 guacamole/src/main/frontend/package-lock.json | 3907 ++++++++++++++++-
 guacamole/src/main/frontend/package.json      |    7 +-
 .../src/app/index/config/indexRouteConfig.js  |    9 +
 .../app/rest/services/connectionService.js    |   40 +
 .../src/app/rest/types/RelatedObjectPatch.js  |    2 +-
 .../connectionHistoryPlayerController.js      |    2 +-
 .../importConnectionsController.js            |   78 +
 .../controllers/settingsController.js         |    2 +-
 .../services/connectionImportParseService.js  |  355 ++
 .../src/app/settings/styles/buttons.css       |   10 +-
 .../templates/settingsConnections.html        |    4 +
 .../settings/templates/settingsImport.html    |   11 +
 .../src/app/settings/types/ParseError.js      |   59 +
 .../action-icons/guac-monitor-add-many.svg    |   77 +
 .../main/frontend/src/translations/en.json    |   10 +-
 guacamole/src/main/frontend/webpack.config.js |   16 +
 64 files changed, 5093 insertions(+), 9 deletions(-)
 create mode 100644 doc/licenses/base64-js-1.5.1/LICENSE
 create mode 100644 doc/licenses/base64-js-1.5.1/README
 create mode 100644 doc/licenses/base64-js-1.5.1/dep-coordinates.txt
 create mode 100644 doc/licenses/buffer-4.9.2/LICENSE
 create mode 100644 doc/licenses/buffer-4.9.2/README
 create mode 100644 doc/licenses/buffer-4.9.2/dep-coordinates.txt
 create mode 100644 doc/licenses/core-util-is-1.0.3/LICENSE
 create mode 100644 doc/licenses/core-util-is-1.0.3/README
 create mode 100644 doc/licenses/core-util-is-1.0.3/dep-coordinates.txt
 create mode 100644 doc/licenses/csv-6.2.5/LICENSE
 create mode 100644 doc/licenses/csv-6.2.5/README
 create mode 100644 doc/licenses/csv-6.2.5/dep-coordinates.txt
 create mode 100644 doc/licenses/events-3.3.0/LICENSE
 create mode 100644 doc/licenses/events-3.3.0/README
 create mode 100644 doc/licenses/events-3.3.0/dep-coordinates.txt
 create mode 100644 doc/licenses/ieee754-1.2.1/LICENSE
 create mode 100644 doc/licenses/ieee754-1.2.1/README
 create mode 100644 doc/licenses/ieee754-1.2.1/dep-coordinates.txt
 create mode 100644 doc/licenses/inherits-2.0.4/LICENSE
 create mode 100644 doc/licenses/inherits-2.0.4/README
 create mode 100644 doc/licenses/inherits-2.0.4/dep-coordinates.txt
 create mode 100644 doc/licenses/isarray-1.0.0/LICENSE
 create mode 100644 doc/licenses/isarray-1.0.0/README
 create mode 100644 doc/licenses/isarray-1.0.0/dep-coordinates.txt
 create mode 100644 doc/licenses/process-nextick-args-2.0.1/README
 create mode 100644 doc/licenses/process-nextick-args-2.0.1/dep-coordinates.txt
 create mode 100644 doc/licenses/process-nextick-args-2.0.1/license.md
 create mode 100644 doc/licenses/readable-stream-2.3.7/LICENSE
 create mode 100644 doc/licenses/readable-stream-2.3.7/README
 create mode 100644 doc/licenses/readable-stream-2.3.7/dep-coordinates.txt
 create mode 100644 doc/licenses/safe-buffer-5.1.2/LICENSE
 create mode 100644 doc/licenses/safe-buffer-5.1.2/README
 create mode 100644 doc/licenses/safe-buffer-5.1.2/dep-coordinates.txt
 create mode 100644 doc/licenses/setimmediate-1.0.5/LICENSE.txt
 create mode 100644 doc/licenses/setimmediate-1.0.5/README
 create mode 100644 doc/licenses/setimmediate-1.0.5/dep-coordinates.txt
 create mode 100644 doc/licenses/stream-browserify-2.0.2/LICENSE
 create mode 100644 doc/licenses/stream-browserify-2.0.2/README
 create mode 100644 doc/licenses/stream-browserify-2.0.2/dep-coordinates.txt
 create mode 100644 doc/licenses/string_decoder-1.1.1/LICENSE
 create mode 100644 doc/licenses/string_decoder-1.1.1/README
 create mode 100644 doc/licenses/string_decoder-1.1.1/dep-coordinates.txt
 create mode 100644 doc/licenses/timers-browserify-2.0.12/LICENSE.md
 create mode 100644 doc/licenses/timers-browserify-2.0.12/README
 create mode 100644 doc/licenses/timers-browserify-2.0.12/dep-coordinates.txt
 create mode 100644 doc/licenses/util-deprecate-1.0.2/LICENSE
 create mode 100644 doc/licenses/util-deprecate-1.0.2/README
 create mode 100644 doc/licenses/util-deprecate-1.0.2/dep-coordinates.txt
 create mode 100644 guacamole/src/main/frontend/src/app/settings/controllers/importConnectionsController.js
 create mode 100644 guacamole/src/main/frontend/src/app/settings/services/connectionImportParseService.js
 create mode 100644 guacamole/src/main/frontend/src/app/settings/templates/settingsImport.html
 create mode 100644 guacamole/src/main/frontend/src/app/settings/types/ParseError.js
 create mode 100644 guacamole/src/main/frontend/src/images/action-icons/guac-monitor-add-many.svg

diff --git a/doc/licenses/base64-js-1.5.1/LICENSE b/doc/licenses/base64-js-1.5.1/LICENSE
new file mode 100644
index 000000000..9143d4cd6
--- /dev/null
+++ b/doc/licenses/base64-js-1.5.1/LICENSE
@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Jameson Little
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+Footer
diff --git a/doc/licenses/base64-js-1.5.1/README b/doc/licenses/base64-js-1.5.1/README
new file mode 100644
index 000000000..6cacd8fc3
--- /dev/null
+++ b/doc/licenses/base64-js-1.5.1/README
@@ -0,0 +1,8 @@
+base64-js (https://github.com/beatgammit/base64-js)
+---------------------------------------------
+
+    Version: 1.5.1
+    From: 'Jameson Little' (https://github.com/beatgammit/)
+    License(s):
+        MIT (bundled/base640-js-1.5.1/LICENSE)
+
diff --git a/doc/licenses/base64-js-1.5.1/dep-coordinates.txt b/doc/licenses/base64-js-1.5.1/dep-coordinates.txt
new file mode 100644
index 000000000..1d66ee817
--- /dev/null
+++ b/doc/licenses/base64-js-1.5.1/dep-coordinates.txt
@@ -0,0 +1 @@
+base64-js:1.5.1
diff --git a/doc/licenses/buffer-4.9.2/LICENSE b/doc/licenses/buffer-4.9.2/LICENSE
new file mode 100644
index 000000000..d6bf75dcf
--- /dev/null
+++ b/doc/licenses/buffer-4.9.2/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) Feross Aboukhadijeh, and other contributors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/doc/licenses/buffer-4.9.2/README b/doc/licenses/buffer-4.9.2/README
new file mode 100644
index 000000000..7caad56c9
--- /dev/null
+++ b/doc/licenses/buffer-4.9.2/README
@@ -0,0 +1,7 @@
+buffer (https://github.com/feross/buffer)
+---------------------------------------------
+
+    Version: 4.9.2
+    From: 'Feross Aboukhadijeh' (https://github.com/feross)
+    License(s):
+        MIT (bundled/buffer-4.9.2/LICENSE)
diff --git a/doc/licenses/buffer-4.9.2/dep-coordinates.txt b/doc/licenses/buffer-4.9.2/dep-coordinates.txt
new file mode 100644
index 000000000..30f193d0a
--- /dev/null
+++ b/doc/licenses/buffer-4.9.2/dep-coordinates.txt
@@ -0,0 +1 @@
+buffer:4.9.2
diff --git a/doc/licenses/core-util-is-1.0.3/LICENSE b/doc/licenses/core-util-is-1.0.3/LICENSE
new file mode 100644
index 000000000..d8d7f9437
--- /dev/null
+++ b/doc/licenses/core-util-is-1.0.3/LICENSE
@@ -0,0 +1,19 @@
+Copyright Node.js contributors. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.
diff --git a/doc/licenses/core-util-is-1.0.3/README b/doc/licenses/core-util-is-1.0.3/README
new file mode 100644
index 000000000..411c1f1e9
--- /dev/null
+++ b/doc/licenses/core-util-is-1.0.3/README
@@ -0,0 +1,7 @@
+core-util-is (https://github.com/isaacs/core-util-is)
+---------------------------------------------
+
+    Version: 1.0.3
+    From: 'isaacs' (https://github.com/isaacs)
+    License(s):
+        MIT (bundled/core-util-is-1.0.3/LICENSE)
diff --git a/doc/licenses/core-util-is-1.0.3/dep-coordinates.txt b/doc/licenses/core-util-is-1.0.3/dep-coordinates.txt
new file mode 100644
index 000000000..f4b1c7a8f
--- /dev/null
+++ b/doc/licenses/core-util-is-1.0.3/dep-coordinates.txt
@@ -0,0 +1 @@
+core-util-is:1.0.3
diff --git a/doc/licenses/csv-6.2.5/LICENSE b/doc/licenses/csv-6.2.5/LICENSE
new file mode 100644
index 000000000..918eaf05a
--- /dev/null
+++ b/doc/licenses/csv-6.2.5/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2010 Adaltas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/doc/licenses/csv-6.2.5/README b/doc/licenses/csv-6.2.5/README
new file mode 100644
index 000000000..5fb35fae4
--- /dev/null
+++ b/doc/licenses/csv-6.2.5/README
@@ -0,0 +1,7 @@
+node-csv (https://github.com/adaltas/node-csv)
+---------------------------------------------
+
+    Version: 6.2.5
+    From: 'adaltas' (https://github.com/adaltas)
+    License(s):
+        MIT (bundled/csv-6.2.5/LICENSE)
diff --git a/doc/licenses/csv-6.2.5/dep-coordinates.txt b/doc/licenses/csv-6.2.5/dep-coordinates.txt
new file mode 100644
index 000000000..dc0f22695
--- /dev/null
+++ b/doc/licenses/csv-6.2.5/dep-coordinates.txt
@@ -0,0 +1,2 @@
+csv:6.2.5
+csv-parse:5.3.3
diff --git a/doc/licenses/events-3.3.0/LICENSE b/doc/licenses/events-3.3.0/LICENSE
new file mode 100644
index 000000000..52ed3b0a6
--- /dev/null
+++ b/doc/licenses/events-3.3.0/LICENSE
@@ -0,0 +1,22 @@
+MIT
+
+Copyright Joyent, Inc. and other Node contributors.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to permit
+persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/doc/licenses/events-3.3.0/README b/doc/licenses/events-3.3.0/README
new file mode 100644
index 000000000..274b952ab
--- /dev/null
+++ b/doc/licenses/events-3.3.0/README
@@ -0,0 +1,7 @@
+events (https://github.com/browserify/events)
+---------------------------------------------
+
+    Version: 3.3.0
+    From: 'browserify' (https://github.com/browserify)
+    License(s):
+        MIT (bundled/events-3.3.0/LICENSE)
diff --git a/doc/licenses/events-3.3.0/dep-coordinates.txt b/doc/licenses/events-3.3.0/dep-coordinates.txt
new file mode 100644
index 000000000..f644fcc1b
--- /dev/null
+++ b/doc/licenses/events-3.3.0/dep-coordinates.txt
@@ -0,0 +1 @@
+events:3.3.0
diff --git a/doc/licenses/ieee754-1.2.1/LICENSE b/doc/licenses/ieee754-1.2.1/LICENSE
new file mode 100644
index 000000000..5aac82c78
--- /dev/null
+++ b/doc/licenses/ieee754-1.2.1/LICENSE
@@ -0,0 +1,11 @@
+Copyright 2008 Fair Oaks Labs, Inc.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/doc/licenses/ieee754-1.2.1/README b/doc/licenses/ieee754-1.2.1/README
new file mode 100644
index 000000000..06d856f16
--- /dev/null
+++ b/doc/licenses/ieee754-1.2.1/README
@@ -0,0 +1,7 @@
+ieee754 (https://github.com/feross/ieee754)
+---------------------------------------------
+
+    Version: 1.2.1
+    From: 'Feross Aboukhadijeh' (https://github.com/feross)
+    License(s):
+        MIT (bundled/ieee754-1.2.1/LICENSE)
diff --git a/doc/licenses/ieee754-1.2.1/dep-coordinates.txt b/doc/licenses/ieee754-1.2.1/dep-coordinates.txt
new file mode 100644
index 000000000..4fb7d7765
--- /dev/null
+++ b/doc/licenses/ieee754-1.2.1/dep-coordinates.txt
@@ -0,0 +1 @@
+ieee754:1.2.1
diff --git a/doc/licenses/inherits-2.0.4/LICENSE b/doc/licenses/inherits-2.0.4/LICENSE
new file mode 100644
index 000000000..052085c43
--- /dev/null
+++ b/doc/licenses/inherits-2.0.4/LICENSE
@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
diff --git a/doc/licenses/inherits-2.0.4/README b/doc/licenses/inherits-2.0.4/README
new file mode 100644
index 000000000..9d0b40126
--- /dev/null
+++ b/doc/licenses/inherits-2.0.4/README
@@ -0,0 +1,8 @@
+inherits (https://github.com/isaacs/inherits)
+---------------------------------------------
+
+    Version: 2.0.4
+    From: 'Isaac Z. Schlueter' (https://github.com/isaacs)
+    License(s):
+        ISC (bundled/inherits-2.0.4/LICENSE)
+
diff --git a/doc/licenses/inherits-2.0.4/dep-coordinates.txt b/doc/licenses/inherits-2.0.4/dep-coordinates.txt
new file mode 100644
index 000000000..4a17c13e3
--- /dev/null
+++ b/doc/licenses/inherits-2.0.4/dep-coordinates.txt
@@ -0,0 +1 @@
+inherits:2.0.4
diff --git a/doc/licenses/isarray-1.0.0/LICENSE b/doc/licenses/isarray-1.0.0/LICENSE
new file mode 100644
index 000000000..de3226673
--- /dev/null
+++ b/doc/licenses/isarray-1.0.0/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2013 Julian Gruber <julian@juliangruber.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/doc/licenses/isarray-1.0.0/README b/doc/licenses/isarray-1.0.0/README
new file mode 100644
index 000000000..3fde38c8c
--- /dev/null
+++ b/doc/licenses/isarray-1.0.0/README
@@ -0,0 +1,8 @@
+isarray (https://github.com/juliangruber/isarray)
+---------------------------------------------
+
+    Version: 1.0.0
+    From: 'Julian Gruber' (https://github.com/juliangruber)
+    License(s):
+        MIT (bundled/isarray-1.0.0/LICENSE)
+
diff --git a/doc/licenses/isarray-1.0.0/dep-coordinates.txt b/doc/licenses/isarray-1.0.0/dep-coordinates.txt
new file mode 100644
index 000000000..d444bdbd9
--- /dev/null
+++ b/doc/licenses/isarray-1.0.0/dep-coordinates.txt
@@ -0,0 +1 @@
+isarray:1.0.0
diff --git a/doc/licenses/process-nextick-args-2.0.1/README b/doc/licenses/process-nextick-args-2.0.1/README
new file mode 100644
index 000000000..d7c0f6b3b
--- /dev/null
+++ b/doc/licenses/process-nextick-args-2.0.1/README
@@ -0,0 +1,8 @@
+process-nextick-args (https://github.com/calvinmetcalf/process-nextick-args)
+---------------------------------------------
+
+    Version: 2.0.1
+    From: 'Calvin Metcalf' (https://github.com/calvinmetcalf)
+    License(s):
+        MIT (bundled/process-nextick-args-2.0.1/LICENSE)
+
diff --git a/doc/licenses/process-nextick-args-2.0.1/dep-coordinates.txt b/doc/licenses/process-nextick-args-2.0.1/dep-coordinates.txt
new file mode 100644
index 000000000..7c68c4b48
--- /dev/null
+++ b/doc/licenses/process-nextick-args-2.0.1/dep-coordinates.txt
@@ -0,0 +1 @@
+process-nextick-args:2.0.1
diff --git a/doc/licenses/process-nextick-args-2.0.1/license.md b/doc/licenses/process-nextick-args-2.0.1/license.md
new file mode 100644
index 000000000..c67e3532b
--- /dev/null
+++ b/doc/licenses/process-nextick-args-2.0.1/license.md
@@ -0,0 +1,19 @@
+# Copyright (c) 2015 Calvin Metcalf
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+**THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.**
diff --git a/doc/licenses/readable-stream-2.3.7/LICENSE b/doc/licenses/readable-stream-2.3.7/LICENSE
new file mode 100644
index 000000000..2873b3b2e
--- /dev/null
+++ b/doc/licenses/readable-stream-2.3.7/LICENSE
@@ -0,0 +1,47 @@
+Node.js is licensed for use as follows:
+
+"""
+Copyright Node.js contributors. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.
+"""
+
+This license applies to parts of Node.js originating from the
+https://github.com/joyent/node repository:
+
+"""
+Copyright Joyent, Inc. and other Node contributors. All rights reserved.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.
+"""
diff --git a/doc/licenses/readable-stream-2.3.7/README b/doc/licenses/readable-stream-2.3.7/README
new file mode 100644
index 000000000..cb58f728b
--- /dev/null
+++ b/doc/licenses/readable-stream-2.3.7/README
@@ -0,0 +1,8 @@
+readable-stream (https://github.com/nodejs/readable-stream)
+---------------------------------------------
+
+    Version: 2.3.7
+    From: 'Node.js' (https://github.com/nodejs)
+    License(s):
+        MIT (bundled/readable-stream-2.3.7/LICENSE)
+
diff --git a/doc/licenses/readable-stream-2.3.7/dep-coordinates.txt b/doc/licenses/readable-stream-2.3.7/dep-coordinates.txt
new file mode 100644
index 000000000..f645a21bb
--- /dev/null
+++ b/doc/licenses/readable-stream-2.3.7/dep-coordinates.txt
@@ -0,0 +1 @@
+readable-stream:2.3.7
diff --git a/doc/licenses/safe-buffer-5.1.2/LICENSE b/doc/licenses/safe-buffer-5.1.2/LICENSE
new file mode 100644
index 000000000..0c068ceec
--- /dev/null
+++ b/doc/licenses/safe-buffer-5.1.2/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) Feross Aboukhadijeh
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/doc/licenses/safe-buffer-5.1.2/README b/doc/licenses/safe-buffer-5.1.2/README
new file mode 100644
index 000000000..26cf5dc2f
--- /dev/null
+++ b/doc/licenses/safe-buffer-5.1.2/README
@@ -0,0 +1,8 @@
+safe-buffer (https://github.com/feross/safe-buffer)
+---------------------------------------------
+
+    Version: 5.1.2
+    From: 'Feross Aboukhadijeh' (https://github.com/feross)
+    License(s):
+        MIT (bundled/safe-buffer-5.1.2/LICENSE)
+
diff --git a/doc/licenses/safe-buffer-5.1.2/dep-coordinates.txt b/doc/licenses/safe-buffer-5.1.2/dep-coordinates.txt
new file mode 100644
index 000000000..594ab08c8
--- /dev/null
+++ b/doc/licenses/safe-buffer-5.1.2/dep-coordinates.txt
@@ -0,0 +1 @@
+safe-buffer:5.1.2
diff --git a/doc/licenses/setimmediate-1.0.5/LICENSE.txt b/doc/licenses/setimmediate-1.0.5/LICENSE.txt
new file mode 100644
index 000000000..32b20de6a
--- /dev/null
+++ b/doc/licenses/setimmediate-1.0.5/LICENSE.txt
@@ -0,0 +1,20 @@
+Copyright (c) 2012 Barnesandnoble.com, llc, Donavon West, and Domenic Denicola
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/doc/licenses/setimmediate-1.0.5/README b/doc/licenses/setimmediate-1.0.5/README
new file mode 100644
index 000000000..0fe5638ee
--- /dev/null
+++ b/doc/licenses/setimmediate-1.0.5/README
@@ -0,0 +1,8 @@
+setImmediate.js (https://github.com/YuzuJS/setImmediate)
+---------------------------------------------
+
+    Version: 1.0.5
+    From: 'Yuzu (by Barnes & Noble Education)' (https://github.com/YuzuJS)
+    License(s):
+        MIT (bundled/setimmediate-1.0.5/LICENSE)
+
diff --git a/doc/licenses/setimmediate-1.0.5/dep-coordinates.txt b/doc/licenses/setimmediate-1.0.5/dep-coordinates.txt
new file mode 100644
index 000000000..d2111b4e0
--- /dev/null
+++ b/doc/licenses/setimmediate-1.0.5/dep-coordinates.txt
@@ -0,0 +1 @@
+setimmediate:1.0.5
diff --git a/doc/licenses/stream-browserify-2.0.2/LICENSE b/doc/licenses/stream-browserify-2.0.2/LICENSE
new file mode 100644
index 000000000..3e7d0c01e
--- /dev/null
+++ b/doc/licenses/stream-browserify-2.0.2/LICENSE
@@ -0,0 +1,20 @@
+MIT License
+
+Copyright (c) James Halliday
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/doc/licenses/stream-browserify-2.0.2/README b/doc/licenses/stream-browserify-2.0.2/README
new file mode 100644
index 000000000..8ab34a47f
--- /dev/null
+++ b/doc/licenses/stream-browserify-2.0.2/README
@@ -0,0 +1,8 @@
+stream-browserify (https://github.com/browserify/stream-browserify)
+---------------------------------------------
+
+    Version: 2.0.2
+    From: 'browserify' (https://github.com/browserify)
+    License(s):
+        MIT (bundled/stream-browserify-2.0.2/LICENSE)
+
diff --git a/doc/licenses/stream-browserify-2.0.2/dep-coordinates.txt b/doc/licenses/stream-browserify-2.0.2/dep-coordinates.txt
new file mode 100644
index 000000000..7bc88e94d
--- /dev/null
+++ b/doc/licenses/stream-browserify-2.0.2/dep-coordinates.txt
@@ -0,0 +1 @@
+stream-browserify:2.0.2
diff --git a/doc/licenses/string_decoder-1.1.1/LICENSE b/doc/licenses/string_decoder-1.1.1/LICENSE
new file mode 100644
index 000000000..2873b3b2e
--- /dev/null
+++ b/doc/licenses/string_decoder-1.1.1/LICENSE
@@ -0,0 +1,47 @@
+Node.js is licensed for use as follows:
+
+"""
+Copyright Node.js contributors. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.
+"""
+
+This license applies to parts of Node.js originating from the
+https://github.com/joyent/node repository:
+
+"""
+Copyright Joyent, Inc. and other Node contributors. All rights reserved.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.
+"""
diff --git a/doc/licenses/string_decoder-1.1.1/README b/doc/licenses/string_decoder-1.1.1/README
new file mode 100644
index 000000000..a64b3299f
--- /dev/null
+++ b/doc/licenses/string_decoder-1.1.1/README
@@ -0,0 +1,8 @@
+string_decoder (https://github.com/nodejs/string_decoder)
+---------------------------------------------
+
+    Version: 1.1.1
+    From: 'Node.js' (https://github.com/nodejs)
+    License(s):
+        MIT (bundled/string_decoder-1.1.1/LICENSE)
+
diff --git a/doc/licenses/string_decoder-1.1.1/dep-coordinates.txt b/doc/licenses/string_decoder-1.1.1/dep-coordinates.txt
new file mode 100644
index 000000000..bbdc75db5
--- /dev/null
+++ b/doc/licenses/string_decoder-1.1.1/dep-coordinates.txt
@@ -0,0 +1 @@
+string_decoder:1.1.1
diff --git a/doc/licenses/timers-browserify-2.0.12/LICENSE.md b/doc/licenses/timers-browserify-2.0.12/LICENSE.md
new file mode 100644
index 000000000..f2bdf520a
--- /dev/null
+++ b/doc/licenses/timers-browserify-2.0.12/LICENSE.md
@@ -0,0 +1,23 @@
+# timers-browserify
+
+This project uses the [MIT](http://jryans.mit-license.org/) license:
+
+    Copyright © 2012 J. Ryan Stinnett <jryans@gmail.com>
+
+    Permission is hereby granted, free of charge, to any person obtaining a
+    copy of this software and associated documentation files (the “Software”),
+    to deal in the Software without restriction, including without limitation
+    the rights to use, copy, modify, merge, publish, distribute, sublicense,
+    and/or sell copies of the Software, and to permit persons to whom the
+    Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+    DEALINGS IN THE SOFTWARE.
diff --git a/doc/licenses/timers-browserify-2.0.12/README b/doc/licenses/timers-browserify-2.0.12/README
new file mode 100644
index 000000000..0e1eb4e8a
--- /dev/null
+++ b/doc/licenses/timers-browserify-2.0.12/README
@@ -0,0 +1,8 @@
+timers-browserify (https://github.com/browserify/timers-browserify)
+---------------------------------------------
+
+    Version: 2.0.12
+    From: 'browserify' (https://github.com/browserify)
+    License(s):
+        MIT (bundled/timers-browserify-2.0.12/LICENSE)
+
diff --git a/doc/licenses/timers-browserify-2.0.12/dep-coordinates.txt b/doc/licenses/timers-browserify-2.0.12/dep-coordinates.txt
new file mode 100644
index 000000000..b1dfbee66
--- /dev/null
+++ b/doc/licenses/timers-browserify-2.0.12/dep-coordinates.txt
@@ -0,0 +1 @@
+timers-browserify:2.0.12
diff --git a/doc/licenses/util-deprecate-1.0.2/LICENSE b/doc/licenses/util-deprecate-1.0.2/LICENSE
new file mode 100644
index 000000000..6a60e8c22
--- /dev/null
+++ b/doc/licenses/util-deprecate-1.0.2/LICENSE
@@ -0,0 +1,24 @@
+(The MIT License)
+
+Copyright (c) 2014 Nathan Rajlich <nathan@tootallnate.net>
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
diff --git a/doc/licenses/util-deprecate-1.0.2/README b/doc/licenses/util-deprecate-1.0.2/README
new file mode 100644
index 000000000..93844707b
--- /dev/null
+++ b/doc/licenses/util-deprecate-1.0.2/README
@@ -0,0 +1,8 @@
+util-deprecate (https://github.com/TooTallNate/util-deprecate)
+---------------------------------------------
+
+    Version: 1.0.2
+    From: 'Nathan Rajlich' (https://github.com/TooTallNate)
+    License(s):
+        MIT (bundled/util-deprecate-1.0.2/LICENSE)
+
diff --git a/doc/licenses/util-deprecate-1.0.2/dep-coordinates.txt b/doc/licenses/util-deprecate-1.0.2/dep-coordinates.txt
new file mode 100644
index 000000000..f8c30242a
--- /dev/null
+++ b/doc/licenses/util-deprecate-1.0.2/dep-coordinates.txt
@@ -0,0 +1 @@
+util-deprecate:1.0.2
diff --git a/guacamole/src/main/frontend/package-lock.json b/guacamole/src/main/frontend/package-lock.json
index a9f041274..32b9bee38 100644
--- a/guacamole/src/main/frontend/package-lock.json
+++ b/guacamole/src/main/frontend/package-lock.json
@@ -12,14 +12,19 @@
                 "angular-translate": "^2.19.0",
                 "angular-translate-interpolation-messageformat": "^2.19.0",
                 "angular-translate-loader-static-files": "^2.19.0",
-                "blob-polyfill": "^7.0.20220408",
+                "blob-polyfill": ">=7.0.20220408",
+                "csv": "^6.2.5",
                 "datalist-polyfill": "^1.25.1",
                 "file-saver": "^2.0.5",
                 "jquery": "^3.6.4",
                 "jstz": "^2.1.1",
-                "lodash": "^4.17.21"
+                "lodash": "^4.17.21",
+                "yaml": "^2.2.1"
             },
             "devDependencies": {
+                "@babel/core": "^7.20.12",
+                "@babel/preset-env": "^7.20.2",
+                "babel-loader": "^8.3.0",
                 "clean-webpack-plugin": "^4.0.0",
                 "closure-webpack-plugin": "^2.6.1",
                 "copy-webpack-plugin": "^5.1.2",
@@ -34,6 +39,1797 @@
                 "webpack-cli": "^4.10.0"
             }
         },
+        "node_modules/@ampproject/remapping": {
+            "version": "2.2.0",
+            "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.2.0.tgz",
+            "integrity": "sha512-qRmjj8nj9qmLTQXXmaR1cck3UXSRMPrbsLJAasZpF+t3riI71BXed5ebIOYwQntykeZuhjsdweEc9BxH5Jc26w==",
+            "dev": true,
+            "dependencies": {
+                "@jridgewell/gen-mapping": "^0.1.0",
+                "@jridgewell/trace-mapping": "^0.3.9"
+            },
+            "engines": {
+                "node": ">=6.0.0"
+            }
+        },
+        "node_modules/@babel/code-frame": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.18.6.tgz",
+            "integrity": "sha512-TDCmlK5eOvH+eH7cdAFlNXeVJqWIQ7gW9tY1GJIpUtFb6CmjVyq2VM3u71bOyR8CRihcCgMUYoDNyLXao3+70Q==",
+            "dev": true,
+            "dependencies": {
+                "@babel/highlight": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/compat-data": {
+            "version": "7.20.10",
+            "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.20.10.tgz",
+            "integrity": "sha512-sEnuDPpOJR/fcafHMjpcpGN5M2jbUGUHwmuWKM/YdPzeEDJg8bgmbcWQFUfE32MQjti1koACvoPVsDe8Uq+idg==",
+            "dev": true,
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/core": {
+            "version": "7.20.12",
+            "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.20.12.tgz",
+            "integrity": "sha512-XsMfHovsUYHFMdrIHkZphTN/2Hzzi78R08NuHfDBehym2VsPDL6Zn/JAD/JQdnRvbSsbQc4mVaU1m6JgtTEElg==",
+            "dev": true,
+            "dependencies": {
+                "@ampproject/remapping": "^2.1.0",
+                "@babel/code-frame": "^7.18.6",
+                "@babel/generator": "^7.20.7",
+                "@babel/helper-compilation-targets": "^7.20.7",
+                "@babel/helper-module-transforms": "^7.20.11",
+                "@babel/helpers": "^7.20.7",
+                "@babel/parser": "^7.20.7",
+                "@babel/template": "^7.20.7",
+                "@babel/traverse": "^7.20.12",
+                "@babel/types": "^7.20.7",
+                "convert-source-map": "^1.7.0",
+                "debug": "^4.1.0",
+                "gensync": "^1.0.0-beta.2",
+                "json5": "^2.2.2",
+                "semver": "^6.3.0"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/babel"
+            }
+        },
+        "node_modules/@babel/core/node_modules/debug": {
+            "version": "4.3.4",
+            "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
+            "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+            "dev": true,
+            "dependencies": {
+                "ms": "2.1.2"
+            },
+            "engines": {
+                "node": ">=6.0"
+            },
+            "peerDependenciesMeta": {
+                "supports-color": {
+                    "optional": true
+                }
+            }
+        },
+        "node_modules/@babel/core/node_modules/json5": {
+            "version": "2.2.3",
+            "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+            "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+            "dev": true,
+            "bin": {
+                "json5": "lib/cli.js"
+            },
+            "engines": {
+                "node": ">=6"
+            }
+        },
+        "node_modules/@babel/core/node_modules/ms": {
+            "version": "2.1.2",
+            "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+            "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+            "dev": true
+        },
+        "node_modules/@babel/core/node_modules/semver": {
+            "version": "6.3.0",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+            "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+            "dev": true,
+            "bin": {
+                "semver": "bin/semver.js"
+            }
+        },
+        "node_modules/@babel/generator": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.20.7.tgz",
+            "integrity": "sha512-7wqMOJq8doJMZmP4ApXTzLxSr7+oO2jroJURrVEp6XShrQUObV8Tq/D0NCcoYg2uHqUrjzO0zwBjoYzelxK+sw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/types": "^7.20.7",
+                "@jridgewell/gen-mapping": "^0.3.2",
+                "jsesc": "^2.5.1"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/generator/node_modules/@jridgewell/gen-mapping": {
+            "version": "0.3.2",
+            "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
+            "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+            "dev": true,
+            "dependencies": {
+                "@jridgewell/set-array": "^1.0.1",
+                "@jridgewell/sourcemap-codec": "^1.4.10",
+                "@jridgewell/trace-mapping": "^0.3.9"
+            },
+            "engines": {
+                "node": ">=6.0.0"
+            }
+        },
+        "node_modules/@babel/generator/node_modules/jsesc": {
+            "version": "2.5.2",
+            "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
+            "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
+            "dev": true,
+            "bin": {
+                "jsesc": "bin/jsesc"
+            },
+            "engines": {
+                "node": ">=4"
+            }
+        },
+        "node_modules/@babel/helper-annotate-as-pure": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.18.6.tgz",
+            "integrity": "sha512-duORpUiYrEpzKIop6iNbjnwKLAKnJ47csTyRACyEmWj0QdUrm5aqNJGHSSEQSUAvNW0ojX0dOmK9dZduvkfeXA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/types": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-builder-binary-assignment-operator-visitor": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.18.9.tgz",
+            "integrity": "sha512-yFQ0YCHoIqarl8BCRwBL8ulYUaZpz3bNsA7oFepAzee+8/+ImtADXNOmO5vJvsPff3qi+hvpkY/NYBTrBQgdNw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-explode-assignable-expression": "^7.18.6",
+                "@babel/types": "^7.18.9"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-compilation-targets": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.20.7.tgz",
+            "integrity": "sha512-4tGORmfQcrc+bvrjb5y3dG9Mx1IOZjsHqQVUz7XCNHO+iTmqxWnVg3KRygjGmpRLJGdQSKuvFinbIb0CnZwHAQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/compat-data": "^7.20.5",
+                "@babel/helper-validator-option": "^7.18.6",
+                "browserslist": "^4.21.3",
+                "lru-cache": "^5.1.1",
+                "semver": "^6.3.0"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0"
+            }
+        },
+        "node_modules/@babel/helper-compilation-targets/node_modules/semver": {
+            "version": "6.3.0",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+            "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+            "dev": true,
+            "bin": {
+                "semver": "bin/semver.js"
+            }
+        },
+        "node_modules/@babel/helper-create-class-features-plugin": {
+            "version": "7.20.12",
+            "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.20.12.tgz",
+            "integrity": "sha512-9OunRkbT0JQcednL0UFvbfXpAsUXiGjUk0a7sN8fUXX7Mue79cUSMjHGDRRi/Vz9vYlpIhLV5fMD5dKoMhhsNQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-annotate-as-pure": "^7.18.6",
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-function-name": "^7.19.0",
+                "@babel/helper-member-expression-to-functions": "^7.20.7",
+                "@babel/helper-optimise-call-expression": "^7.18.6",
+                "@babel/helper-replace-supers": "^7.20.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
+                "@babel/helper-split-export-declaration": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0"
+            }
+        },
+        "node_modules/@babel/helper-create-regexp-features-plugin": {
+            "version": "7.20.5",
+            "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.20.5.tgz",
+            "integrity": "sha512-m68B1lkg3XDGX5yCvGO0kPx3v9WIYLnzjKfPcQiwntEQa5ZeRkPmo2X/ISJc8qxWGfwUr+kvZAeEzAwLec2r2w==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-annotate-as-pure": "^7.18.6",
+                "regexpu-core": "^5.2.1"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0"
+            }
+        },
+        "node_modules/@babel/helper-define-polyfill-provider": {
+            "version": "0.3.3",
+            "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.3.3.tgz",
+            "integrity": "sha512-z5aQKU4IzbqCC1XH0nAqfsFLMVSo22SBKUc0BxGrLkolTdPTructy0ToNnlO2zA4j9Q/7pjMZf0DSY+DSTYzww==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-compilation-targets": "^7.17.7",
+                "@babel/helper-plugin-utils": "^7.16.7",
+                "debug": "^4.1.1",
+                "lodash.debounce": "^4.0.8",
+                "resolve": "^1.14.2",
+                "semver": "^6.1.2"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.4.0-0"
+            }
+        },
+        "node_modules/@babel/helper-define-polyfill-provider/node_modules/debug": {
+            "version": "4.3.4",
+            "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
+            "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+            "dev": true,
+            "dependencies": {
+                "ms": "2.1.2"
+            },
+            "engines": {
+                "node": ">=6.0"
+            },
+            "peerDependenciesMeta": {
+                "supports-color": {
+                    "optional": true
+                }
+            }
+        },
+        "node_modules/@babel/helper-define-polyfill-provider/node_modules/ms": {
+            "version": "2.1.2",
+            "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+            "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+            "dev": true
+        },
+        "node_modules/@babel/helper-define-polyfill-provider/node_modules/semver": {
+            "version": "6.3.0",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+            "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+            "dev": true,
+            "bin": {
+                "semver": "bin/semver.js"
+            }
+        },
+        "node_modules/@babel/helper-environment-visitor": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.18.9.tgz",
+            "integrity": "sha512-3r/aACDJ3fhQ/EVgFy0hpj8oHyHpQc+LPtJoY9SzTThAsStm4Ptegq92vqKoE3vD706ZVFWITnMnxucw+S9Ipg==",
+            "dev": true,
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-explode-assignable-expression": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-explode-assignable-expression/-/helper-explode-assignable-expression-7.18.6.tgz",
+            "integrity": "sha512-eyAYAsQmB80jNfg4baAtLeWAQHfHFiR483rzFK+BhETlGZaQC9bsfrugfXDCbRHLQbIA7U5NxhhOxN7p/dWIcg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/types": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-function-name": {
+            "version": "7.19.0",
+            "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.19.0.tgz",
+            "integrity": "sha512-WAwHBINyrpqywkUH0nTnNgI5ina5TFn85HKS0pbPDfxFfhyR/aNQEn4hGi1P1JyT//I0t4OgXUlofzWILRvS5w==",
+            "dev": true,
+            "dependencies": {
+                "@babel/template": "^7.18.10",
+                "@babel/types": "^7.19.0"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-hoist-variables": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.18.6.tgz",
+            "integrity": "sha512-UlJQPkFqFULIcyW5sbzgbkxn2FKRgwWiRexcuaR8RNJRy8+LLveqPjwZV/bwrLZCN0eUHD/x8D0heK1ozuoo6Q==",
+            "dev": true,
+            "dependencies": {
+                "@babel/types": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-member-expression-to-functions": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.20.7.tgz",
+            "integrity": "sha512-9J0CxJLq315fEdi4s7xK5TQaNYjZw+nDVpVqr1axNGKzdrdwYBD5b4uKv3n75aABG0rCCTK8Im8Ww7eYfMrZgw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/types": "^7.20.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-module-imports": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.18.6.tgz",
+            "integrity": "sha512-0NFvs3VkuSYbFi1x2Vd6tKrywq+z/cLeYC/RJNFrIX/30Bf5aiGYbtvGXolEktzJH8o5E5KJ3tT+nkxuuZFVlA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/types": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-module-transforms": {
+            "version": "7.20.11",
+            "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.20.11.tgz",
+            "integrity": "sha512-uRy78kN4psmji1s2QtbtcCSaj/LILFDp0f/ymhpQH5QY3nljUZCaNWz9X1dEj/8MBdBEFECs7yRhKn8i7NjZgg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-module-imports": "^7.18.6",
+                "@babel/helper-simple-access": "^7.20.2",
+                "@babel/helper-split-export-declaration": "^7.18.6",
+                "@babel/helper-validator-identifier": "^7.19.1",
+                "@babel/template": "^7.20.7",
+                "@babel/traverse": "^7.20.10",
+                "@babel/types": "^7.20.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-optimise-call-expression": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.18.6.tgz",
+            "integrity": "sha512-HP59oD9/fEHQkdcbgFCnbmgH5vIQTJbxh2yf+CdM89/glUNnuzr87Q8GIjGEnOktTROemO0Pe0iPAYbqZuOUiA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/types": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-plugin-utils": {
+            "version": "7.20.2",
+            "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.20.2.tgz",
+            "integrity": "sha512-8RvlJG2mj4huQ4pZ+rU9lqKi9ZKiRmuvGuM2HlWmkmgOhbs6zEAw6IEiJ5cQqGbDzGZOhwuOQNtZMi/ENLjZoQ==",
+            "dev": true,
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-remap-async-to-generator": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.18.9.tgz",
+            "integrity": "sha512-dI7q50YKd8BAv3VEfgg7PS7yD3Rtbi2J1XMXaalXO0W0164hYLnh8zpjRS0mte9MfVp/tltvr/cfdXPvJr1opA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-annotate-as-pure": "^7.18.6",
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-wrap-function": "^7.18.9",
+                "@babel/types": "^7.18.9"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0"
+            }
+        },
+        "node_modules/@babel/helper-replace-supers": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.20.7.tgz",
+            "integrity": "sha512-vujDMtB6LVfNW13jhlCrp48QNslK6JXi7lQG736HVbHz/mbf4Dc7tIRh1Xf5C0rF7BP8iiSxGMCmY6Ci1ven3A==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-member-expression-to-functions": "^7.20.7",
+                "@babel/helper-optimise-call-expression": "^7.18.6",
+                "@babel/template": "^7.20.7",
+                "@babel/traverse": "^7.20.7",
+                "@babel/types": "^7.20.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-simple-access": {
+            "version": "7.20.2",
+            "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.20.2.tgz",
+            "integrity": "sha512-+0woI/WPq59IrqDYbVGfshjT5Dmk/nnbdpcF8SnMhhXObpTq2KNBdLFRFrkVdbDOyUmHBCxzm5FHV1rACIkIbA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/types": "^7.20.2"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-skip-transparent-expression-wrappers": {
+            "version": "7.20.0",
+            "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.20.0.tgz",
+            "integrity": "sha512-5y1JYeNKfvnT8sZcK9DVRtpTbGiomYIHviSP3OQWmDPU3DeH4a1ZlT/N2lyQ5P8egjcRaT/Y9aNqUxK0WsnIIg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/types": "^7.20.0"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-split-export-declaration": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.18.6.tgz",
+            "integrity": "sha512-bde1etTx6ZyTmobl9LLMMQsaizFVZrquTEHOqKeQESMKo4PlObf+8+JA25ZsIpZhT/WEd39+vOdLXAFG/nELpA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/types": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-string-parser": {
+            "version": "7.19.4",
+            "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.19.4.tgz",
+            "integrity": "sha512-nHtDoQcuqFmwYNYPz3Rah5ph2p8PFeFCsZk9A/48dPc/rGocJ5J3hAAZ7pb76VWX3fZKu+uEr/FhH5jLx7umrw==",
+            "dev": true,
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-validator-identifier": {
+            "version": "7.19.1",
+            "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.19.1.tgz",
+            "integrity": "sha512-awrNfaMtnHUr653GgGEs++LlAvW6w+DcPrOliSMXWCKo597CwL5Acf/wWdNkf/tfEQE3mjkeD1YOVZOUV/od1w==",
+            "dev": true,
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-validator-option": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.18.6.tgz",
+            "integrity": "sha512-XO7gESt5ouv/LRJdrVjkShckw6STTaB7l9BrpBaAHDeF5YZT+01PCwmR0SJHnkW6i8OwW/EVWRShfi4j2x+KQw==",
+            "dev": true,
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helper-wrap-function": {
+            "version": "7.20.5",
+            "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.20.5.tgz",
+            "integrity": "sha512-bYMxIWK5mh+TgXGVqAtnu5Yn1un+v8DDZtqyzKRLUzrh70Eal2O3aZ7aPYiMADO4uKlkzOiRiZ6GX5q3qxvW9Q==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-function-name": "^7.19.0",
+                "@babel/template": "^7.18.10",
+                "@babel/traverse": "^7.20.5",
+                "@babel/types": "^7.20.5"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/helpers": {
+            "version": "7.20.13",
+            "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.20.13.tgz",
+            "integrity": "sha512-nzJ0DWCL3gB5RCXbUO3KIMMsBY2Eqbx8mBpKGE/02PgyRQFcPQLbkQ1vyy596mZLaP+dAfD+R4ckASzNVmW3jg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/template": "^7.20.7",
+                "@babel/traverse": "^7.20.13",
+                "@babel/types": "^7.20.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/highlight": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.18.6.tgz",
+            "integrity": "sha512-u7stbOuYjaPezCuLj29hNW1v64M2Md2qupEKP1fHc7WdOA3DgLh37suiSrZYY7haUB7iBeQZ9P1uiRF359do3g==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-validator-identifier": "^7.18.6",
+                "chalk": "^2.0.0",
+                "js-tokens": "^4.0.0"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/highlight/node_modules/ansi-styles": {
+            "version": "3.2.1",
+            "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
+            "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
+            "dev": true,
+            "dependencies": {
+                "color-convert": "^1.9.0"
+            },
+            "engines": {
+                "node": ">=4"
+            }
+        },
+        "node_modules/@babel/highlight/node_modules/chalk": {
+            "version": "2.4.2",
+            "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
+            "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
+            "dev": true,
+            "dependencies": {
+                "ansi-styles": "^3.2.1",
+                "escape-string-regexp": "^1.0.5",
+                "supports-color": "^5.3.0"
+            },
+            "engines": {
+                "node": ">=4"
+            }
+        },
+        "node_modules/@babel/highlight/node_modules/color-convert": {
+            "version": "1.9.3",
+            "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
+            "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
+            "dev": true,
+            "dependencies": {
+                "color-name": "1.1.3"
+            }
+        },
+        "node_modules/@babel/highlight/node_modules/color-name": {
+            "version": "1.1.3",
+            "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
+            "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
+            "dev": true
+        },
+        "node_modules/@babel/highlight/node_modules/has-flag": {
+            "version": "3.0.0",
+            "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
+            "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
+            "dev": true,
+            "engines": {
+                "node": ">=4"
+            }
+        },
+        "node_modules/@babel/highlight/node_modules/supports-color": {
+            "version": "5.5.0",
+            "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
+            "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
+            "dev": true,
+            "dependencies": {
+                "has-flag": "^3.0.0"
+            },
+            "engines": {
+                "node": ">=4"
+            }
+        },
+        "node_modules/@babel/parser": {
+            "version": "7.20.13",
+            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.20.13.tgz",
+            "integrity": "sha512-gFDLKMfpiXCsjt4za2JA9oTMn70CeseCehb11kRZgvd7+F67Hih3OHOK24cRrWECJ/ljfPGac6ygXAs/C8kIvw==",
+            "dev": true,
+            "bin": {
+                "parser": "bin/babel-parser.js"
+            },
+            "engines": {
+                "node": ">=6.0.0"
+            }
+        },
+        "node_modules/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.18.6.tgz",
+            "integrity": "sha512-Dgxsyg54Fx1d4Nge8UnvTrED63vrwOdPmyvPzlNN/boaliRP54pm3pGzZD1SJUwrBA+Cs/xdG8kXX6Mn/RfISQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0"
+            }
+        },
+        "node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.20.7.tgz",
+            "integrity": "sha512-sbr9+wNE5aXMBBFBICk01tt7sBf2Oc9ikRFEcem/ZORup9IMUdNhW7/wVLEbbtlWOsEubJet46mHAL2C8+2jKQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
+                "@babel/plugin-proposal-optional-chaining": "^7.20.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.13.0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-async-generator-functions": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.20.7.tgz",
+            "integrity": "sha512-xMbiLsn/8RK7Wq7VeVytytS2L6qE69bXPB10YCmMdDZbKF4okCqY74pI/jJQ/8U0b/F6NrT2+14b8/P9/3AMGA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-remap-async-to-generator": "^7.18.9",
+                "@babel/plugin-syntax-async-generators": "^7.8.4"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-class-properties": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.18.6.tgz",
+            "integrity": "sha512-cumfXOF0+nzZrrN8Rf0t7M+tF6sZc7vhQwYQck9q1/5w2OExlD+b4v4RpMJFaV1Z7WcDRgO6FqvxqxGlwo+RHQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-create-class-features-plugin": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-class-static-block": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-static-block/-/plugin-proposal-class-static-block-7.20.7.tgz",
+            "integrity": "sha512-AveGOoi9DAjUYYuUAG//Ig69GlazLnoyzMw68VCDux+c1tsnnH/OkYcpz/5xzMkEFC6UxjR5Gw1c+iY2wOGVeQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-create-class-features-plugin": "^7.20.7",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/plugin-syntax-class-static-block": "^7.14.5"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.12.0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-dynamic-import": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-dynamic-import/-/plugin-proposal-dynamic-import-7.18.6.tgz",
+            "integrity": "sha512-1auuwmK+Rz13SJj36R+jqFPMJWyKEDd7lLSdOj4oJK0UTgGueSAtkrCvz9ewmgyU/P941Rv2fQwZJN8s6QruXw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/plugin-syntax-dynamic-import": "^7.8.3"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-export-namespace-from": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-export-namespace-from/-/plugin-proposal-export-namespace-from-7.18.9.tgz",
+            "integrity": "sha512-k1NtHyOMvlDDFeb9G5PhUXuGj8m/wiwojgQVEhJ/fsVsMCpLyOP4h0uGEjYJKrRI+EVPlb5Jk+Gt9P97lOGwtA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.9",
+                "@babel/plugin-syntax-export-namespace-from": "^7.8.3"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-json-strings": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-json-strings/-/plugin-proposal-json-strings-7.18.6.tgz",
+            "integrity": "sha512-lr1peyn9kOdbYc0xr0OdHTZ5FMqS6Di+H0Fz2I/JwMzGmzJETNeOFq2pBySw6X/KFL5EWDjlJuMsUGRFb8fQgQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/plugin-syntax-json-strings": "^7.8.3"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-logical-assignment-operators": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-logical-assignment-operators/-/plugin-proposal-logical-assignment-operators-7.20.7.tgz",
+            "integrity": "sha512-y7C7cZgpMIjWlKE5T7eJwp+tnRYM89HmRvWM5EQuB5BoHEONjmQ8lSNmBUwOyy/GFRsohJED51YBF79hE1djug==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-nullish-coalescing-operator": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-nullish-coalescing-operator/-/plugin-proposal-nullish-coalescing-operator-7.18.6.tgz",
+            "integrity": "sha512-wQxQzxYeJqHcfppzBDnm1yAY0jSRkUXR2z8RePZYrKwMKgMlE8+Z6LUno+bd6LvbGh8Gltvy74+9pIYkr+XkKA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-numeric-separator": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-numeric-separator/-/plugin-proposal-numeric-separator-7.18.6.tgz",
+            "integrity": "sha512-ozlZFogPqoLm8WBr5Z8UckIoE4YQ5KESVcNudyXOR8uqIkliTEgJ3RoketfG6pmzLdeZF0H/wjE9/cCEitBl7Q==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/plugin-syntax-numeric-separator": "^7.10.4"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-object-rest-spread": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.20.7.tgz",
+            "integrity": "sha512-d2S98yCiLxDVmBmE8UjGcfPvNEUbA1U5q5WxaWFUGRzJSVAZqm5W6MbPct0jxnegUZ0niLeNX+IOzEs7wYg9Dg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/compat-data": "^7.20.5",
+                "@babel/helper-compilation-targets": "^7.20.7",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+                "@babel/plugin-transform-parameters": "^7.20.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-optional-catch-binding": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-catch-binding/-/plugin-proposal-optional-catch-binding-7.18.6.tgz",
+            "integrity": "sha512-Q40HEhs9DJQyaZfUjjn6vE8Cv4GmMHCYuMGIWUnlxH6400VGxOuwWsPt4FxXxJkC/5eOzgn0z21M9gMT4MOhbw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/plugin-syntax-optional-catch-binding": "^7.8.3"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-optional-chaining": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-chaining/-/plugin-proposal-optional-chaining-7.20.7.tgz",
+            "integrity": "sha512-T+A7b1kfjtRM51ssoOfS1+wbyCVqorfyZhT99TvxxLMirPShD8CzKMRepMlCBGM5RpHMbn8s+5MMHnPstJH6mQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
+                "@babel/plugin-syntax-optional-chaining": "^7.8.3"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-private-methods": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-methods/-/plugin-proposal-private-methods-7.18.6.tgz",
+            "integrity": "sha512-nutsvktDItsNn4rpGItSNV2sz1XwS+nfU0Rg8aCx3W3NOKVzdMjJRu0O5OkgDp3ZGICSTbgRpxZoWsxoKRvbeA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-create-class-features-plugin": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-private-property-in-object": {
+            "version": "7.20.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.20.5.tgz",
+            "integrity": "sha512-Vq7b9dUA12ByzB4EjQTPo25sFhY+08pQDBSZRtUAkj7lb7jahaHR5igera16QZ+3my1nYR4dKsNdYj5IjPHilQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-annotate-as-pure": "^7.18.6",
+                "@babel/helper-create-class-features-plugin": "^7.20.5",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/plugin-syntax-private-property-in-object": "^7.14.5"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-proposal-unicode-property-regex": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-unicode-property-regex/-/plugin-proposal-unicode-property-regex-7.18.6.tgz",
+            "integrity": "sha512-2BShG/d5yoZyXZfVePH91urL5wTG6ASZU9M4o03lKK8u8UW1y08OMttBSOADTcJrnPMpvDXRG3G8fyLh4ovs8w==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=4"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-async-generators": {
+            "version": "7.8.4",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
+            "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-class-properties": {
+            "version": "7.12.13",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
+            "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.12.13"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-class-static-block": {
+            "version": "7.14.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz",
+            "integrity": "sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.14.5"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-dynamic-import": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-dynamic-import/-/plugin-syntax-dynamic-import-7.8.3.tgz",
+            "integrity": "sha512-5gdGbFon+PszYzqs83S3E5mpi7/y/8M9eC90MRTZfduQOYW76ig6SOSPNe41IG5LoP3FGBn2N0RjVDSQiS94kQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-export-namespace-from": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-export-namespace-from/-/plugin-syntax-export-namespace-from-7.8.3.tgz",
+            "integrity": "sha512-MXf5laXo6c1IbEbegDmzGPwGNTsHZmEy6QGznu5Sh2UCWvueywb2ee+CCE4zQiZstxU9BMoQO9i6zUFSY0Kj0Q==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.8.3"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-import-assertions": {
+            "version": "7.20.0",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.20.0.tgz",
+            "integrity": "sha512-IUh1vakzNoWalR8ch/areW7qFopR2AEw03JlG7BbrDqmQ4X3q9uuipQwSGrUn7oGiemKjtSLDhNtQHzMHr1JdQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.19.0"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-json-strings": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
+            "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-logical-assignment-operators": {
+            "version": "7.10.4",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz",
+            "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.10.4"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-nullish-coalescing-operator": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
+            "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-numeric-separator": {
+            "version": "7.10.4",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz",
+            "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.10.4"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-object-rest-spread": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
+            "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-optional-catch-binding": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
+            "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-optional-chaining": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
+            "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-private-property-in-object": {
+            "version": "7.14.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz",
+            "integrity": "sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.14.5"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-top-level-await": {
+            "version": "7.14.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz",
+            "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.14.5"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-arrow-functions": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.20.7.tgz",
+            "integrity": "sha512-3poA5E7dzDomxj9WXWwuD6A5F3kc7VXwIJO+E+J8qtDtS+pXPAhrgEyh+9GBwBgPq1Z+bB+/JD60lp5jsN7JPQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.20.2"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-async-to-generator": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.20.7.tgz",
+            "integrity": "sha512-Uo5gwHPT9vgnSXQxqGtpdufUiWp96gk7yiP4Mp5bm1QMkEmLXBO7PAGYbKoJ6DhAwiNkcHFBol/x5zZZkL/t0Q==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-module-imports": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-remap-async-to-generator": "^7.18.9"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-block-scoped-functions": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.18.6.tgz",
+            "integrity": "sha512-ExUcOqpPWnliRcPqves5HJcJOvHvIIWfuS4sroBUenPuMdmW+SMHDakmtS7qOo13sVppmUijqeTv7qqGsvURpQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-block-scoping": {
+            "version": "7.20.11",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.20.11.tgz",
+            "integrity": "sha512-tA4N427a7fjf1P0/2I4ScsHGc5jcHPbb30xMbaTke2gxDuWpUfXDuX1FEymJwKk4tuGUvGcejAR6HdZVqmmPyw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.20.2"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-classes": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.20.7.tgz",
+            "integrity": "sha512-LWYbsiXTPKl+oBlXUGlwNlJZetXD5Am+CyBdqhPsDVjM9Jc8jwBJFrKhHf900Kfk2eZG1y9MAG3UNajol7A4VQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-annotate-as-pure": "^7.18.6",
+                "@babel/helper-compilation-targets": "^7.20.7",
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-function-name": "^7.19.0",
+                "@babel/helper-optimise-call-expression": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-replace-supers": "^7.20.7",
+                "@babel/helper-split-export-declaration": "^7.18.6",
+                "globals": "^11.1.0"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-computed-properties": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.20.7.tgz",
+            "integrity": "sha512-Lz7MvBK6DTjElHAmfu6bfANzKcxpyNPeYBGEafyA6E5HtRpjpZwU+u7Qrgz/2OR0z+5TvKYbPdphfSaAcZBrYQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/template": "^7.20.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-destructuring": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.20.7.tgz",
+            "integrity": "sha512-Xwg403sRrZb81IVB79ZPqNQME23yhugYVqgTxAhT99h485F4f+GMELFhhOsscDUB7HCswepKeCKLn/GZvUKoBA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.20.2"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-dotall-regex": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.18.6.tgz",
+            "integrity": "sha512-6S3jpun1eEbAxq7TdjLotAsl4WpQI9DxfkycRcKrjhQYzU87qpXdknpBg/e+TdcMehqGnLFi7tnFUBR02Vq6wg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-duplicate-keys": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.18.9.tgz",
+            "integrity": "sha512-d2bmXCtZXYc59/0SanQKbiWINadaJXqtvIQIzd4+hNwkWBgyCd5F/2t1kXoUdvPMrxzPvhK6EMQRROxsue+mfw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.9"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-exponentiation-operator": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.18.6.tgz",
+            "integrity": "sha512-wzEtc0+2c88FVR34aQmiz56dxEkxr2g8DQb/KfaFa1JYXOFVsbhvAonFN6PwVWj++fKmku8NP80plJ5Et4wqHw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-builder-binary-assignment-operator-visitor": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-for-of": {
+            "version": "7.18.8",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.18.8.tgz",
+            "integrity": "sha512-yEfTRnjuskWYo0k1mHUqrVWaZwrdq8AYbfrpqULOJOaucGSp4mNMVps+YtA8byoevxS/urwU75vyhQIxcCgiBQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-function-name": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.18.9.tgz",
+            "integrity": "sha512-WvIBoRPaJQ5yVHzcnJFor7oS5Ls0PYixlTYE63lCj2RtdQEl15M68FXQlxnG6wdraJIXRdR7KI+hQ7q/9QjrCQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-compilation-targets": "^7.18.9",
+                "@babel/helper-function-name": "^7.18.9",
+                "@babel/helper-plugin-utils": "^7.18.9"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-literals": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.18.9.tgz",
+            "integrity": "sha512-IFQDSRoTPnrAIrI5zoZv73IFeZu2dhu6irxQjY9rNjTT53VmKg9fenjvoiOWOkJ6mm4jKVPtdMzBY98Fp4Z4cg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.9"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-member-expression-literals": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.18.6.tgz",
+            "integrity": "sha512-qSF1ihLGO3q+/g48k85tUjD033C29TNTVB2paCwZPVmOsjn9pClvYYrM2VeJpBY2bcNkuny0YUyTNRyRxJ54KA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-modules-amd": {
+            "version": "7.20.11",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.20.11.tgz",
+            "integrity": "sha512-NuzCt5IIYOW0O30UvqktzHYR2ud5bOWbY0yaxWZ6G+aFzOMJvrs5YHNikrbdaT15+KNO31nPOy5Fim3ku6Zb5g==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-module-transforms": "^7.20.11",
+                "@babel/helper-plugin-utils": "^7.20.2"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-modules-commonjs": {
+            "version": "7.20.11",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.20.11.tgz",
+            "integrity": "sha512-S8e1f7WQ7cimJQ51JkAaDrEtohVEitXjgCGAS2N8S31Y42E+kWwfSz83LYz57QdBm7q9diARVqanIaH2oVgQnw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-module-transforms": "^7.20.11",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-simple-access": "^7.20.2"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-modules-systemjs": {
+            "version": "7.20.11",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.20.11.tgz",
+            "integrity": "sha512-vVu5g9BPQKSFEmvt2TA4Da5N+QVS66EX21d8uoOihC+OCpUoGvzVsXeqFdtAEfVa5BILAeFt+U7yVmLbQnAJmw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-hoist-variables": "^7.18.6",
+                "@babel/helper-module-transforms": "^7.20.11",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-validator-identifier": "^7.19.1"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-modules-umd": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.18.6.tgz",
+            "integrity": "sha512-dcegErExVeXcRqNtkRU/z8WlBLnvD4MRnHgNs3MytRO1Mn1sHRyhbcpYbVMGclAqOjdW+9cfkdZno9dFdfKLfQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-module-transforms": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-named-capturing-groups-regex": {
+            "version": "7.20.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.20.5.tgz",
+            "integrity": "sha512-mOW4tTzi5iTLnw+78iEq3gr8Aoq4WNRGpmSlrogqaiCBoR1HFhpU4JkpQFOHfeYx3ReVIFWOQJS4aZBRvuZ6mA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-create-regexp-features-plugin": "^7.20.5",
+                "@babel/helper-plugin-utils": "^7.20.2"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-new-target": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.18.6.tgz",
+            "integrity": "sha512-DjwFA/9Iu3Z+vrAn+8pBUGcjhxKguSMlsFqeCKbhb9BAV756v0krzVK04CRDi/4aqmk8BsHb4a/gFcaA5joXRw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-object-super": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.18.6.tgz",
+            "integrity": "sha512-uvGz6zk+pZoS1aTZrOvrbj6Pp/kK2mp45t2B+bTDre2UgsZZ8EZLSJtUg7m/no0zOJUWgFONpB7Zv9W2tSaFlA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/helper-replace-supers": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-parameters": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.20.7.tgz",
+            "integrity": "sha512-WiWBIkeHKVOSYPO0pWkxGPfKeWrCJyD3NJ53+Lrp/QMSZbsVPovrVl2aWZ19D/LTVnaDv5Ap7GJ/B2CTOZdrfA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.20.2"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-property-literals": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.18.6.tgz",
+            "integrity": "sha512-cYcs6qlgafTud3PAzrrRNbQtfpQ8+y/+M5tKmksS9+M1ckbH6kzY8MrexEM9mcA6JDsukE19iIRvAyYl463sMg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-regenerator": {
+            "version": "7.20.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.20.5.tgz",
+            "integrity": "sha512-kW/oO7HPBtntbsahzQ0qSE3tFvkFwnbozz3NWFhLGqH75vLEg+sCGngLlhVkePlCs3Jv0dBBHDzCHxNiFAQKCQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "regenerator-transform": "^0.15.1"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-reserved-words": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.18.6.tgz",
+            "integrity": "sha512-oX/4MyMoypzHjFrT1CdivfKZ+XvIPMFXwwxHp/r0Ddy2Vuomt4HDFGmft1TAY2yiTKiNSsh3kjBAzcM8kSdsjA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-shorthand-properties": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.18.6.tgz",
+            "integrity": "sha512-eCLXXJqv8okzg86ywZJbRn19YJHU4XUa55oz2wbHhaQVn/MM+XhukiT7SYqp/7o00dg52Rj51Ny+Ecw4oyoygw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-spread": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.20.7.tgz",
+            "integrity": "sha512-ewBbHQ+1U/VnH1fxltbJqDeWBU1oNLG8Dj11uIv3xVf7nrQu0bPGe5Rf716r7K5Qz+SqtAOVswoVunoiBtGhxw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-sticky-regex": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.18.6.tgz",
+            "integrity": "sha512-kfiDrDQ+PBsQDO85yj1icueWMfGfJFKN1KCkndygtu/C9+XUfydLC8Iv5UYJqRwy4zk8EcplRxEOeLyjq1gm6Q==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-template-literals": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.18.9.tgz",
+            "integrity": "sha512-S8cOWfT82gTezpYOiVaGHrCbhlHgKhQt8XH5ES46P2XWmX92yisoZywf5km75wv5sYcXDUCLMmMxOLCtthDgMA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.9"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-typeof-symbol": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.18.9.tgz",
+            "integrity": "sha512-SRfwTtF11G2aemAZWivL7PD+C9z52v9EvMqH9BuYbabyPuKUvSWks3oCg6041pT925L4zVFqaVBeECwsmlguEw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.9"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-unicode-escapes": {
+            "version": "7.18.10",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.18.10.tgz",
+            "integrity": "sha512-kKAdAI+YzPgGY/ftStBFXTI1LZFju38rYThnfMykS+IXy8BVx+res7s2fxf1l8I35DV2T97ezo6+SGrXz6B3iQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.18.9"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-unicode-regex": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.18.6.tgz",
+            "integrity": "sha512-gE7A6Lt7YLnNOL3Pb9BNeZvi+d8l7tcRrG4+pwJjK9hD2xX4mEvjlQW60G9EEmfXVYRPv9VRQcyegIVHCql/AA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/preset-env": {
+            "version": "7.20.2",
+            "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.20.2.tgz",
+            "integrity": "sha512-1G0efQEWR1EHkKvKHqbG+IN/QdgwfByUpM5V5QroDzGV2t3S/WXNQd693cHiHTlCFMpr9B6FkPFXDA2lQcKoDg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/compat-data": "^7.20.1",
+                "@babel/helper-compilation-targets": "^7.20.0",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-validator-option": "^7.18.6",
+                "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.18.6",
+                "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.18.9",
+                "@babel/plugin-proposal-async-generator-functions": "^7.20.1",
+                "@babel/plugin-proposal-class-properties": "^7.18.6",
+                "@babel/plugin-proposal-class-static-block": "^7.18.6",
+                "@babel/plugin-proposal-dynamic-import": "^7.18.6",
+                "@babel/plugin-proposal-export-namespace-from": "^7.18.9",
+                "@babel/plugin-proposal-json-strings": "^7.18.6",
+                "@babel/plugin-proposal-logical-assignment-operators": "^7.18.9",
+                "@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6",
+                "@babel/plugin-proposal-numeric-separator": "^7.18.6",
+                "@babel/plugin-proposal-object-rest-spread": "^7.20.2",
+                "@babel/plugin-proposal-optional-catch-binding": "^7.18.6",
+                "@babel/plugin-proposal-optional-chaining": "^7.18.9",
+                "@babel/plugin-proposal-private-methods": "^7.18.6",
+                "@babel/plugin-proposal-private-property-in-object": "^7.18.6",
+                "@babel/plugin-proposal-unicode-property-regex": "^7.18.6",
+                "@babel/plugin-syntax-async-generators": "^7.8.4",
+                "@babel/plugin-syntax-class-properties": "^7.12.13",
+                "@babel/plugin-syntax-class-static-block": "^7.14.5",
+                "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+                "@babel/plugin-syntax-export-namespace-from": "^7.8.3",
+                "@babel/plugin-syntax-import-assertions": "^7.20.0",
+                "@babel/plugin-syntax-json-strings": "^7.8.3",
+                "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4",
+                "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
+                "@babel/plugin-syntax-numeric-separator": "^7.10.4",
+                "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+                "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
+                "@babel/plugin-syntax-optional-chaining": "^7.8.3",
+                "@babel/plugin-syntax-private-property-in-object": "^7.14.5",
+                "@babel/plugin-syntax-top-level-await": "^7.14.5",
+                "@babel/plugin-transform-arrow-functions": "^7.18.6",
+                "@babel/plugin-transform-async-to-generator": "^7.18.6",
+                "@babel/plugin-transform-block-scoped-functions": "^7.18.6",
+                "@babel/plugin-transform-block-scoping": "^7.20.2",
+                "@babel/plugin-transform-classes": "^7.20.2",
+                "@babel/plugin-transform-computed-properties": "^7.18.9",
+                "@babel/plugin-transform-destructuring": "^7.20.2",
+                "@babel/plugin-transform-dotall-regex": "^7.18.6",
+                "@babel/plugin-transform-duplicate-keys": "^7.18.9",
+                "@babel/plugin-transform-exponentiation-operator": "^7.18.6",
+                "@babel/plugin-transform-for-of": "^7.18.8",
+                "@babel/plugin-transform-function-name": "^7.18.9",
+                "@babel/plugin-transform-literals": "^7.18.9",
+                "@babel/plugin-transform-member-expression-literals": "^7.18.6",
+                "@babel/plugin-transform-modules-amd": "^7.19.6",
+                "@babel/plugin-transform-modules-commonjs": "^7.19.6",
+                "@babel/plugin-transform-modules-systemjs": "^7.19.6",
+                "@babel/plugin-transform-modules-umd": "^7.18.6",
+                "@babel/plugin-transform-named-capturing-groups-regex": "^7.19.1",
+                "@babel/plugin-transform-new-target": "^7.18.6",
+                "@babel/plugin-transform-object-super": "^7.18.6",
+                "@babel/plugin-transform-parameters": "^7.20.1",
+                "@babel/plugin-transform-property-literals": "^7.18.6",
+                "@babel/plugin-transform-regenerator": "^7.18.6",
+                "@babel/plugin-transform-reserved-words": "^7.18.6",
+                "@babel/plugin-transform-shorthand-properties": "^7.18.6",
+                "@babel/plugin-transform-spread": "^7.19.0",
+                "@babel/plugin-transform-sticky-regex": "^7.18.6",
+                "@babel/plugin-transform-template-literals": "^7.18.9",
+                "@babel/plugin-transform-typeof-symbol": "^7.18.9",
+                "@babel/plugin-transform-unicode-escapes": "^7.18.10",
+                "@babel/plugin-transform-unicode-regex": "^7.18.6",
+                "@babel/preset-modules": "^0.1.5",
+                "@babel/types": "^7.20.2",
+                "babel-plugin-polyfill-corejs2": "^0.3.3",
+                "babel-plugin-polyfill-corejs3": "^0.6.0",
+                "babel-plugin-polyfill-regenerator": "^0.4.1",
+                "core-js-compat": "^3.25.1",
+                "semver": "^6.3.0"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/preset-env/node_modules/semver": {
+            "version": "6.3.0",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+            "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+            "dev": true,
+            "bin": {
+                "semver": "bin/semver.js"
+            }
+        },
+        "node_modules/@babel/preset-modules": {
+            "version": "0.1.5",
+            "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.5.tgz",
+            "integrity": "sha512-A57th6YRG7oR3cq/yt/Y84MvGgE0eJG2F1JLhKuyG+jFxEgrd/HAMJatiFtmOiZurz+0DkrvbheCLaV5f2JfjA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.0.0",
+                "@babel/plugin-proposal-unicode-property-regex": "^7.4.4",
+                "@babel/plugin-transform-dotall-regex": "^7.4.4",
+                "@babel/types": "^7.4.4",
+                "esutils": "^2.0.2"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/runtime": {
+            "version": "7.20.13",
+            "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.20.13.tgz",
+            "integrity": "sha512-gt3PKXs0DBoL9xCvOIIZ2NEqAGZqHjAnmVbfQtB620V0uReIQutpel14KcneZuer7UioY8ALKZ7iocavvzTNFA==",
+            "dev": true,
+            "dependencies": {
+                "regenerator-runtime": "^0.13.11"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/template": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.20.7.tgz",
+            "integrity": "sha512-8SegXApWe6VoNw0r9JHpSteLKTpTiLZ4rMlGIm9JQ18KiCtyQiAMEazujAHrUS5flrcqYZa75ukev3P6QmUwUw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/code-frame": "^7.18.6",
+                "@babel/parser": "^7.20.7",
+                "@babel/types": "^7.20.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/traverse": {
+            "version": "7.20.13",
+            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.20.13.tgz",
+            "integrity": "sha512-kMJXfF0T6DIS9E8cgdLCSAL+cuCK+YEZHWiLK0SXpTo8YRj5lpJu3CDNKiIBCne4m9hhTIqUg6SYTAI39tAiVQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/code-frame": "^7.18.6",
+                "@babel/generator": "^7.20.7",
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-function-name": "^7.19.0",
+                "@babel/helper-hoist-variables": "^7.18.6",
+                "@babel/helper-split-export-declaration": "^7.18.6",
+                "@babel/parser": "^7.20.13",
+                "@babel/types": "^7.20.7",
+                "debug": "^4.1.0",
+                "globals": "^11.1.0"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
+        "node_modules/@babel/traverse/node_modules/debug": {
+            "version": "4.3.4",
+            "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
+            "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+            "dev": true,
+            "dependencies": {
+                "ms": "2.1.2"
+            },
+            "engines": {
+                "node": ">=6.0"
+            },
+            "peerDependenciesMeta": {
+                "supports-color": {
+                    "optional": true
+                }
+            }
+        },
+        "node_modules/@babel/traverse/node_modules/ms": {
+            "version": "2.1.2",
+            "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+            "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+            "dev": true
+        },
+        "node_modules/@babel/types": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.20.7.tgz",
+            "integrity": "sha512-69OnhBxSSgK0OzTJai4kyPDiKTIe3j+ctaHdIGVbRahTLAT7L3R9oeXHC2aVSuGYt3cVnoAMDmOCgJ2yaiLMvg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-string-parser": "^7.19.4",
+                "@babel/helper-validator-identifier": "^7.19.1",
+                "to-fast-properties": "^2.0.0"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
         "node_modules/@discoveryjs/json-ext": {
             "version": "0.5.7",
             "resolved": "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-0.5.7.tgz",
@@ -49,6 +1845,53 @@
             "integrity": "sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==",
             "dev": true
         },
+        "node_modules/@jridgewell/gen-mapping": {
+            "version": "0.1.1",
+            "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.1.1.tgz",
+            "integrity": "sha512-sQXCasFk+U8lWYEe66WxRDOE9PjVz4vSM51fTu3Hw+ClTpUSQb718772vH3pyS5pShp6lvQM7SxgIDXXXmOX7w==",
+            "dev": true,
+            "dependencies": {
+                "@jridgewell/set-array": "^1.0.0",
+                "@jridgewell/sourcemap-codec": "^1.4.10"
+            },
+            "engines": {
+                "node": ">=6.0.0"
+            }
+        },
+        "node_modules/@jridgewell/resolve-uri": {
+            "version": "3.1.0",
+            "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.0.tgz",
+            "integrity": "sha512-F2msla3tad+Mfht5cJq7LSXcdudKTWCVYUgw6pLFOOHSTtZlj6SWNYAp+AhuqLmWdBO2X5hPrLcu8cVP8fy28w==",
+            "dev": true,
+            "engines": {
+                "node": ">=6.0.0"
+            }
+        },
+        "node_modules/@jridgewell/set-array": {
+            "version": "1.1.2",
+            "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
+            "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
+            "dev": true,
+            "engines": {
+                "node": ">=6.0.0"
+            }
+        },
+        "node_modules/@jridgewell/sourcemap-codec": {
+            "version": "1.4.14",
+            "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.14.tgz",
+            "integrity": "sha512-XPSJHWmi394fuUuzDnGz1wiKqWfo1yXecHQMRf2l6hztTO+nPru658AyDngaBe7isIxEkRsPR3FZh+s7iVa4Uw==",
+            "dev": true
+        },
+        "node_modules/@jridgewell/trace-mapping": {
+            "version": "0.3.17",
+            "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.17.tgz",
+            "integrity": "sha512-MCNzAp77qzKca9+W/+I0+sEpaUnZoeasnghNeVc41VZCEKaCH73Vq3BZZ/SzWIgrqE4H4ceI+p+b6C0mHf9T4g==",
+            "dev": true,
+            "dependencies": {
+                "@jridgewell/resolve-uri": "3.1.0",
+                "@jridgewell/sourcemap-codec": "1.4.14"
+            }
+        },
         "node_modules/@npmcli/fs": {
             "version": "1.1.1",
             "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-1.1.1.tgz",
@@ -766,6 +2609,216 @@
                 "url": "https://github.com/sponsors/ljharb"
             }
         },
+        "node_modules/babel-loader": {
+            "version": "8.3.0",
+            "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-8.3.0.tgz",
+            "integrity": "sha512-H8SvsMF+m9t15HNLMipppzkC+Y2Yq+v3SonZyU70RBL/h1gxPkH08Ot8pEE9Z4Kd+czyWJClmFS8qzIP9OZ04Q==",
+            "dev": true,
+            "dependencies": {
+                "find-cache-dir": "^3.3.1",
+                "loader-utils": "^2.0.0",
+                "make-dir": "^3.1.0",
+                "schema-utils": "^2.6.5"
+            },
+            "engines": {
+                "node": ">= 8.9"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0",
+                "webpack": ">=2"
+            }
+        },
+        "node_modules/babel-loader/node_modules/find-cache-dir": {
+            "version": "3.3.2",
+            "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-3.3.2.tgz",
+            "integrity": "sha512-wXZV5emFEjrridIgED11OoUKLxiYjAcqot/NJdAkOhlJ+vGzwhOAfcG5OX1jP+S0PcjEn8bdMJv+g2jwQ3Onig==",
+            "dev": true,
+            "dependencies": {
+                "commondir": "^1.0.1",
+                "make-dir": "^3.0.2",
+                "pkg-dir": "^4.1.0"
+            },
+            "engines": {
+                "node": ">=8"
+            },
+            "funding": {
+                "url": "https://github.com/avajs/find-cache-dir?sponsor=1"
+            }
+        },
+        "node_modules/babel-loader/node_modules/find-up": {
+            "version": "4.1.0",
+            "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
+            "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
+            "dev": true,
+            "dependencies": {
+                "locate-path": "^5.0.0",
+                "path-exists": "^4.0.0"
+            },
+            "engines": {
+                "node": ">=8"
+            }
+        },
+        "node_modules/babel-loader/node_modules/json5": {
+            "version": "2.2.3",
+            "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+            "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+            "dev": true,
+            "bin": {
+                "json5": "lib/cli.js"
+            },
+            "engines": {
+                "node": ">=6"
+            }
+        },
+        "node_modules/babel-loader/node_modules/loader-utils": {
+            "version": "2.0.4",
+            "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
+            "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
+            "dev": true,
+            "dependencies": {
+                "big.js": "^5.2.2",
+                "emojis-list": "^3.0.0",
+                "json5": "^2.1.2"
+            },
+            "engines": {
+                "node": ">=8.9.0"
+            }
+        },
+        "node_modules/babel-loader/node_modules/locate-path": {
+            "version": "5.0.0",
+            "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
+            "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
+            "dev": true,
+            "dependencies": {
+                "p-locate": "^4.1.0"
+            },
+            "engines": {
+                "node": ">=8"
+            }
+        },
+        "node_modules/babel-loader/node_modules/make-dir": {
+            "version": "3.1.0",
+            "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz",
+            "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
+            "dev": true,
+            "dependencies": {
+                "semver": "^6.0.0"
+            },
+            "engines": {
+                "node": ">=8"
+            },
+            "funding": {
+                "url": "https://github.com/sponsors/sindresorhus"
+            }
+        },
+        "node_modules/babel-loader/node_modules/p-locate": {
+            "version": "4.1.0",
+            "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
+            "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
+            "dev": true,
+            "dependencies": {
+                "p-limit": "^2.2.0"
+            },
+            "engines": {
+                "node": ">=8"
+            }
+        },
+        "node_modules/babel-loader/node_modules/path-exists": {
+            "version": "4.0.0",
+            "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+            "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+            "dev": true,
+            "engines": {
+                "node": ">=8"
+            }
+        },
+        "node_modules/babel-loader/node_modules/pkg-dir": {
+            "version": "4.2.0",
+            "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz",
+            "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
+            "dev": true,
+            "dependencies": {
+                "find-up": "^4.0.0"
+            },
+            "engines": {
+                "node": ">=8"
+            }
+        },
+        "node_modules/babel-loader/node_modules/schema-utils": {
+            "version": "2.7.1",
+            "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-2.7.1.tgz",
+            "integrity": "sha512-SHiNtMOUGWBQJwzISiVYKu82GiV4QYGePp3odlY1tuKO7gPtphAT5R/py0fA6xtbgLL/RvtJZnU9b8s0F1q0Xg==",
+            "dev": true,
+            "dependencies": {
+                "@types/json-schema": "^7.0.5",
+                "ajv": "^6.12.4",
+                "ajv-keywords": "^3.5.2"
+            },
+            "engines": {
+                "node": ">= 8.9.0"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/webpack"
+            }
+        },
+        "node_modules/babel-loader/node_modules/semver": {
+            "version": "6.3.0",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+            "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+            "dev": true,
+            "bin": {
+                "semver": "bin/semver.js"
+            }
+        },
+        "node_modules/babel-plugin-polyfill-corejs2": {
+            "version": "0.3.3",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.3.3.tgz",
+            "integrity": "sha512-8hOdmFYFSZhqg2C/JgLUQ+t52o5nirNwaWM2B9LWteozwIvM14VSwdsCAUET10qT+kmySAlseadmfeeSWFCy+Q==",
+            "dev": true,
+            "dependencies": {
+                "@babel/compat-data": "^7.17.7",
+                "@babel/helper-define-polyfill-provider": "^0.3.3",
+                "semver": "^6.1.1"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/babel-plugin-polyfill-corejs2/node_modules/semver": {
+            "version": "6.3.0",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+            "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+            "dev": true,
+            "bin": {
+                "semver": "bin/semver.js"
+            }
+        },
+        "node_modules/babel-plugin-polyfill-corejs3": {
+            "version": "0.6.0",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.6.0.tgz",
+            "integrity": "sha512-+eHqR6OPcBhJOGgsIar7xoAB1GcSwVUA3XjAd7HJNzOXT4wv6/H7KIdA/Nc60cvUlDbKApmqNvD1B1bzOt4nyA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-define-polyfill-provider": "^0.3.3",
+                "core-js-compat": "^3.25.1"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/babel-plugin-polyfill-regenerator": {
+            "version": "0.4.1",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.4.1.tgz",
+            "integrity": "sha512-NtQGmyQDXjQqQ+IzRkBVwEOz9lQ4zxAQZgoAYEtU9dJjnl1Oc98qnN7jcp+bE7O7aYzVpavXE3/VKXNzUbh7aw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-define-polyfill-provider": "^0.3.3"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
         "node_modules/balanced-match": {
             "version": "1.0.2",
             "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -1703,6 +3756,12 @@
             "resolved": "https://registry.npmjs.org/constants-browserify/-/constants-browserify-1.0.0.tgz",
             "integrity": "sha512-xFxOwqIzR/e1k1gLiWEophSCMqXcwVHIH7akf7b/vxcUeGunlj3hvZaaqxwHsTgn+IndtkQJgSztIDWeumWJDQ=="
         },
+        "node_modules/convert-source-map": {
+            "version": "1.9.0",
+            "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
+            "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
+            "dev": true
+        },
         "node_modules/copy-concurrently": {
             "version": "1.0.5",
             "resolved": "https://registry.npmjs.org/copy-concurrently/-/copy-concurrently-1.0.5.tgz",
@@ -1786,6 +3845,19 @@
                 "url": "https://opencollective.com/core-js"
             }
         },
+        "node_modules/core-js-compat": {
+            "version": "3.27.2",
+            "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.27.2.tgz",
+            "integrity": "sha512-welaYuF7ZtbYKGrIy7y3eb40d37rG1FvzEOfe7hSLd2iD6duMDqUhRfSvCGyC46HhR6Y8JXXdZ2lnRUMkPBpvg==",
+            "dev": true,
+            "dependencies": {
+                "browserslist": "^4.21.4"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/core-js"
+            }
+        },
         "node_modules/core-util-is": {
             "version": "1.0.3",
             "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
@@ -2544,6 +4616,35 @@
             "integrity": "sha512-dn6wd0uw5GsdswPFfsgMp5NSB0/aDe6fK94YJV/AJDYXL6HVLWBsxeq7js7Ad+mU2K9LAlwpk6kN2D5mwCPVow==",
             "dev": true
         },
+        "node_modules/csv": {
+            "version": "6.2.5",
+            "resolved": "https://registry.npmjs.org/csv/-/csv-6.2.5.tgz",
+            "integrity": "sha512-T+K0H7MIrlrnP6KxYKo3lK+uLl6OC2Gmwdd81TG/VdkhKvpatl35sR7tyRSpDLGl22y2T+q9KvNHnVtn4OAscQ==",
+            "dependencies": {
+                "csv-generate": "^4.2.1",
+                "csv-parse": "^5.3.3",
+                "csv-stringify": "^6.2.3",
+                "stream-transform": "^3.2.1"
+            },
+            "engines": {
+                "node": ">= 0.1.90"
+            }
+        },
+        "node_modules/csv-generate": {
+            "version": "4.2.1",
+            "resolved": "https://registry.npmjs.org/csv-generate/-/csv-generate-4.2.1.tgz",
+            "integrity": "sha512-w6GFHjvApv6bcJ2xdi9JGsH6ZvUBfC+vUdfefnEzurXG6hMRwzkBLnhztU2H7v7+zfCk1I/knnQ+tGbgpxWrBw=="
+        },
+        "node_modules/csv-parse": {
+            "version": "5.3.3",
+            "resolved": "https://registry.npmjs.org/csv-parse/-/csv-parse-5.3.3.tgz",
+            "integrity": "sha512-kEWkAPleNEdhFNkHQpFHu9RYPogsFj3dx6bCxL847fsiLgidzWg0z/O0B1kVWMJUc5ky64zGp18LX2T3DQrOfw=="
+        },
+        "node_modules/csv-stringify": {
+            "version": "6.2.3",
+            "resolved": "https://registry.npmjs.org/csv-stringify/-/csv-stringify-6.2.3.tgz",
+            "integrity": "sha512-4qGjUMwnlaRc00gc2jrIYh2w/h1fo25B0mTuY9K8fBiIgtmCX3LcgUbrEGViL98Ci4Se/F5LFEtu8k+dItJVZQ=="
+        },
         "node_modules/cyclist": {
             "version": "1.0.1",
             "resolved": "https://registry.npmjs.org/cyclist/-/cyclist-1.0.1.tgz",
@@ -3045,6 +5146,15 @@
                 "node": ">=4.0"
             }
         },
+        "node_modules/esutils": {
+            "version": "2.0.3",
+            "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+            "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+            "dev": true,
+            "engines": {
+                "node": ">=0.10.0"
+            }
+        },
         "node_modules/events": {
             "version": "3.3.0",
             "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
@@ -3522,6 +5632,15 @@
                 "url": "https://github.com/sponsors/ljharb"
             }
         },
+        "node_modules/gensync": {
+            "version": "1.0.0-beta.2",
+            "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+            "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+            "dev": true,
+            "engines": {
+                "node": ">=6.9.0"
+            }
+        },
         "node_modules/get-intrinsic": {
             "version": "1.2.0",
             "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.0.tgz",
@@ -3590,6 +5709,15 @@
                 "node": ">= 6"
             }
         },
+        "node_modules/globals": {
+            "version": "11.12.0",
+            "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
+            "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
+            "dev": true,
+            "engines": {
+                "node": ">=4"
+            }
+        },
         "node_modules/globalthis": {
             "version": "1.0.3",
             "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.3.tgz",
@@ -4646,6 +6774,12 @@
             "resolved": "https://registry.npmjs.org/jquery/-/jquery-3.6.4.tgz",
             "integrity": "sha512-v28EW9DWDFpzcD9O5iyJXg3R3+q+mET5JhnjJzQUZMHOv67bpSIHq81GEYpPNZHG+XXHsfSme3nxp/hndKEcsQ=="
         },
+        "node_modules/js-tokens": {
+            "version": "4.0.0",
+            "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+            "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+            "dev": true
+        },
         "node_modules/js-yaml": {
             "version": "3.14.1",
             "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
@@ -4750,6 +6884,12 @@
             "resolved": "https://registry.npmjs.org/lodash._reinterpolate/-/lodash._reinterpolate-3.0.0.tgz",
             "integrity": "sha512-xYHt68QRoYGjeeM/XOE1uJtvXQAgvszfBhjV4yvsQH0u2i9I6cI6c6/eG4Hh3UAOVn0y/xAXwmTzEay49Q//HA=="
         },
+        "node_modules/lodash.debounce": {
+            "version": "4.0.8",
+            "resolved": "https://registry.npmjs.org/lodash.debounce/-/lodash.debounce-4.0.8.tgz",
+            "integrity": "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==",
+            "dev": true
+        },
         "node_modules/lodash.memoize": {
             "version": "4.1.2",
             "resolved": "https://registry.npmjs.org/lodash.memoize/-/lodash.memoize-4.1.2.tgz",
@@ -7202,6 +9342,39 @@
                 "node": ">= 0.10"
             }
         },
+        "node_modules/regenerate": {
+            "version": "1.4.2",
+            "resolved": "https://registry.npmjs.org/regenerate/-/regenerate-1.4.2.tgz",
+            "integrity": "sha512-zrceR/XhGYU/d/opr2EKO7aRHUeiBI8qjtfHqADTwZd6Szfy16la6kqD0MIUs5z5hx6AaKa+PixpPrR289+I0A==",
+            "dev": true
+        },
+        "node_modules/regenerate-unicode-properties": {
+            "version": "10.1.0",
+            "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-10.1.0.tgz",
+            "integrity": "sha512-d1VudCLoIGitcU/hEg2QqvyGZQmdC0Lf8BqdOMXGFSvJP4bNV1+XqbPQeHHLD51Jh4QJJ225dlIFvY4Ly6MXmQ==",
+            "dev": true,
+            "dependencies": {
+                "regenerate": "^1.4.2"
+            },
+            "engines": {
+                "node": ">=4"
+            }
+        },
+        "node_modules/regenerator-runtime": {
+            "version": "0.13.11",
+            "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
+            "integrity": "sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==",
+            "dev": true
+        },
+        "node_modules/regenerator-transform": {
+            "version": "0.15.1",
+            "resolved": "https://registry.npmjs.org/regenerator-transform/-/regenerator-transform-0.15.1.tgz",
+            "integrity": "sha512-knzmNAcuyxV+gQCufkYcvOqX/qIIfHLv0u5x79kRxuGojfYVky1f15TzZEu2Avte8QGepvUNTnLskf8E6X6Vyg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/runtime": "^7.8.4"
+            }
+        },
         "node_modules/regex-not": {
             "version": "1.0.2",
             "resolved": "https://registry.npmjs.org/regex-not/-/regex-not-1.0.2.tgz",
@@ -7231,6 +9404,50 @@
                 "url": "https://github.com/sponsors/ljharb"
             }
         },
+        "node_modules/regexpu-core": {
+            "version": "5.2.2",
+            "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-5.2.2.tgz",
+            "integrity": "sha512-T0+1Zp2wjF/juXMrMxHxidqGYn8U4R+zleSJhX9tQ1PUsS8a9UtYfbsF9LdiVgNX3kiX8RNaKM42nfSgvFJjmw==",
+            "dev": true,
+            "dependencies": {
+                "regenerate": "^1.4.2",
+                "regenerate-unicode-properties": "^10.1.0",
+                "regjsgen": "^0.7.1",
+                "regjsparser": "^0.9.1",
+                "unicode-match-property-ecmascript": "^2.0.0",
+                "unicode-match-property-value-ecmascript": "^2.1.0"
+            },
+            "engines": {
+                "node": ">=4"
+            }
+        },
+        "node_modules/regjsgen": {
+            "version": "0.7.1",
+            "resolved": "https://registry.npmjs.org/regjsgen/-/regjsgen-0.7.1.tgz",
+            "integrity": "sha512-RAt+8H2ZEzHeYWxZ3H2z6tF18zyyOnlcdaafLrm21Bguj7uZy6ULibiAFdXEtKQY4Sy7wDTwDiOazasMLc4KPA==",
+            "dev": true
+        },
+        "node_modules/regjsparser": {
+            "version": "0.9.1",
+            "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.9.1.tgz",
+            "integrity": "sha512-dQUtn90WanSNl+7mQKcXAgZxvUe7Z0SqXlgzv0za4LwiUhyzBC58yQO3liFoUgu8GiJVInAhJjkj1N0EtQ5nkQ==",
+            "dev": true,
+            "dependencies": {
+                "jsesc": "~0.5.0"
+            },
+            "bin": {
+                "regjsparser": "bin/parser"
+            }
+        },
+        "node_modules/regjsparser/node_modules/jsesc": {
+            "version": "0.5.0",
+            "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-0.5.0.tgz",
+            "integrity": "sha512-uZz5UnB7u4T9LvwmFqXii7pZSouaRPorGs5who1Ip7VO0wxanFvBL7GkM6dTHlgX+jhBApRetaWpnDabOeTcnA==",
+            "dev": true,
+            "bin": {
+                "jsesc": "bin/jsesc"
+            }
+        },
         "node_modules/relateurl": {
             "version": "0.2.7",
             "resolved": "https://registry.npmjs.org/relateurl/-/relateurl-0.2.7.tgz",
@@ -7975,6 +10192,11 @@
             "resolved": "https://registry.npmjs.org/stream-shift/-/stream-shift-1.0.1.tgz",
             "integrity": "sha512-AiisoFqQ0vbGcZgQPY1cdP2I76glaVA/RauYR4G4thNFgkTqr90yXTo4LYX60Jl+sIlPNHHdGSwo01AvbKUSVQ=="
         },
+        "node_modules/stream-transform": {
+            "version": "3.2.1",
+            "resolved": "https://registry.npmjs.org/stream-transform/-/stream-transform-3.2.1.tgz",
+            "integrity": "sha512-ApK+WTJ5bCOf0A2tlec1qhvr8bGEBM/sgXXB7mysdCYgZJO5DZeaV3h3G+g0HnAQ372P5IhiGqnW29zoLOfTzQ=="
+        },
         "node_modules/string_decoder": {
             "version": "1.1.1",
             "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
@@ -8399,6 +10621,15 @@
             "resolved": "https://registry.npmjs.org/to-arraybuffer/-/to-arraybuffer-1.0.1.tgz",
             "integrity": "sha512-okFlQcoGTi4LQBG/PgSYblw9VOyptsz2KJZqc6qtgGdes8VktzUQkj4BI2blit072iS8VODNcMA+tvnS9dnuMA=="
         },
+        "node_modules/to-fast-properties": {
+            "version": "2.0.0",
+            "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
+            "integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==",
+            "dev": true,
+            "engines": {
+                "node": ">=4"
+            }
+        },
         "node_modules/to-object-path": {
             "version": "0.3.0",
             "resolved": "https://registry.npmjs.org/to-object-path/-/to-object-path-0.3.0.tgz",
@@ -8492,6 +10723,46 @@
                 "url": "https://github.com/sponsors/ljharb"
             }
         },
+        "node_modules/unicode-canonical-property-names-ecmascript": {
+            "version": "2.0.0",
+            "resolved": "https://registry.npmjs.org/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.0.tgz",
+            "integrity": "sha512-yY5PpDlfVIU5+y/BSCxAJRBIS1Zc2dDG3Ujq+sR0U+JjUevW2JhocOF+soROYDSaAezOzOKuyyixhD6mBknSmQ==",
+            "dev": true,
+            "engines": {
+                "node": ">=4"
+            }
+        },
+        "node_modules/unicode-match-property-ecmascript": {
+            "version": "2.0.0",
+            "resolved": "https://registry.npmjs.org/unicode-match-property-ecmascript/-/unicode-match-property-ecmascript-2.0.0.tgz",
+            "integrity": "sha512-5kaZCrbp5mmbz5ulBkDkbY0SsPOjKqVS35VpL9ulMPfSl0J0Xsm+9Evphv9CoIZFwre7aJoa94AY6seMKGVN5Q==",
+            "dev": true,
+            "dependencies": {
+                "unicode-canonical-property-names-ecmascript": "^2.0.0",
+                "unicode-property-aliases-ecmascript": "^2.0.0"
+            },
+            "engines": {
+                "node": ">=4"
+            }
+        },
+        "node_modules/unicode-match-property-value-ecmascript": {
+            "version": "2.1.0",
+            "resolved": "https://registry.npmjs.org/unicode-match-property-value-ecmascript/-/unicode-match-property-value-ecmascript-2.1.0.tgz",
+            "integrity": "sha512-qxkjQt6qjg/mYscYMC0XKRn3Rh0wFPlfxB0xkt9CfyTvpX1Ra0+rAmdX2QyAobptSEvuy4RtpPRui6XkV+8wjA==",
+            "dev": true,
+            "engines": {
+                "node": ">=4"
+            }
+        },
+        "node_modules/unicode-property-aliases-ecmascript": {
+            "version": "2.1.0",
+            "resolved": "https://registry.npmjs.org/unicode-property-aliases-ecmascript/-/unicode-property-aliases-ecmascript-2.1.0.tgz",
+            "integrity": "sha512-6t3foTQI9qne+OZoVQB/8x8rk2k1eVy1gRXhV3oFQ5T6R1dqQ1xtin3XqSlx3+ATBkliTaR/hHyJBm+LVPNM8w==",
+            "dev": true,
+            "engines": {
+                "node": ">=4"
+            }
+        },
         "node_modules/union-value": {
             "version": "1.0.1",
             "resolved": "https://registry.npmjs.org/union-value/-/union-value-1.0.1.tgz",
@@ -9147,6 +11418,14 @@
             "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
             "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
         },
+        "node_modules/yaml": {
+            "version": "2.2.1",
+            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.1.tgz",
+            "integrity": "sha512-e0WHiYql7+9wr4cWMx3TVQrNwejKaEe7/rHNmQmqRjazfOP5W8PB6Jpebb5o6fIapbz9o9+2ipcaTM2ZwDI6lw==",
+            "engines": {
+                "node": ">= 14"
+            }
+        },
         "node_modules/yocto-queue": {
             "version": "0.1.0",
             "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
@@ -9161,6 +11440,1261 @@
         }
     },
     "dependencies": {
+        "@ampproject/remapping": {
+            "version": "2.2.0",
+            "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.2.0.tgz",
+            "integrity": "sha512-qRmjj8nj9qmLTQXXmaR1cck3UXSRMPrbsLJAasZpF+t3riI71BXed5ebIOYwQntykeZuhjsdweEc9BxH5Jc26w==",
+            "dev": true,
+            "requires": {
+                "@jridgewell/gen-mapping": "^0.1.0",
+                "@jridgewell/trace-mapping": "^0.3.9"
+            }
+        },
+        "@babel/code-frame": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.18.6.tgz",
+            "integrity": "sha512-TDCmlK5eOvH+eH7cdAFlNXeVJqWIQ7gW9tY1GJIpUtFb6CmjVyq2VM3u71bOyR8CRihcCgMUYoDNyLXao3+70Q==",
+            "dev": true,
+            "requires": {
+                "@babel/highlight": "^7.18.6"
+            }
+        },
+        "@babel/compat-data": {
+            "version": "7.20.10",
+            "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.20.10.tgz",
+            "integrity": "sha512-sEnuDPpOJR/fcafHMjpcpGN5M2jbUGUHwmuWKM/YdPzeEDJg8bgmbcWQFUfE32MQjti1koACvoPVsDe8Uq+idg==",
+            "dev": true
+        },
+        "@babel/core": {
+            "version": "7.20.12",
+            "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.20.12.tgz",
+            "integrity": "sha512-XsMfHovsUYHFMdrIHkZphTN/2Hzzi78R08NuHfDBehym2VsPDL6Zn/JAD/JQdnRvbSsbQc4mVaU1m6JgtTEElg==",
+            "dev": true,
+            "requires": {
+                "@ampproject/remapping": "^2.1.0",
+                "@babel/code-frame": "^7.18.6",
+                "@babel/generator": "^7.20.7",
+                "@babel/helper-compilation-targets": "^7.20.7",
+                "@babel/helper-module-transforms": "^7.20.11",
+                "@babel/helpers": "^7.20.7",
+                "@babel/parser": "^7.20.7",
+                "@babel/template": "^7.20.7",
+                "@babel/traverse": "^7.20.12",
+                "@babel/types": "^7.20.7",
+                "convert-source-map": "^1.7.0",
+                "debug": "^4.1.0",
+                "gensync": "^1.0.0-beta.2",
+                "json5": "^2.2.2",
+                "semver": "^6.3.0"
+            },
+            "dependencies": {
+                "debug": {
+                    "version": "4.3.4",
+                    "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
+                    "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+                    "dev": true,
+                    "requires": {
+                        "ms": "2.1.2"
+                    }
+                },
+                "json5": {
+                    "version": "2.2.3",
+                    "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+                    "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+                    "dev": true
+                },
+                "ms": {
+                    "version": "2.1.2",
+                    "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+                    "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+                    "dev": true
+                },
+                "semver": {
+                    "version": "6.3.0",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+                    "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+                    "dev": true
+                }
+            }
+        },
+        "@babel/generator": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.20.7.tgz",
+            "integrity": "sha512-7wqMOJq8doJMZmP4ApXTzLxSr7+oO2jroJURrVEp6XShrQUObV8Tq/D0NCcoYg2uHqUrjzO0zwBjoYzelxK+sw==",
+            "dev": true,
+            "requires": {
+                "@babel/types": "^7.20.7",
+                "@jridgewell/gen-mapping": "^0.3.2",
+                "jsesc": "^2.5.1"
+            },
+            "dependencies": {
+                "@jridgewell/gen-mapping": {
+                    "version": "0.3.2",
+                    "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
+                    "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+                    "dev": true,
+                    "requires": {
+                        "@jridgewell/set-array": "^1.0.1",
+                        "@jridgewell/sourcemap-codec": "^1.4.10",
+                        "@jridgewell/trace-mapping": "^0.3.9"
+                    }
+                },
+                "jsesc": {
+                    "version": "2.5.2",
+                    "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
+                    "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
+                    "dev": true
+                }
+            }
+        },
+        "@babel/helper-annotate-as-pure": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.18.6.tgz",
+            "integrity": "sha512-duORpUiYrEpzKIop6iNbjnwKLAKnJ47csTyRACyEmWj0QdUrm5aqNJGHSSEQSUAvNW0ojX0dOmK9dZduvkfeXA==",
+            "dev": true,
+            "requires": {
+                "@babel/types": "^7.18.6"
+            }
+        },
+        "@babel/helper-builder-binary-assignment-operator-visitor": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.18.9.tgz",
+            "integrity": "sha512-yFQ0YCHoIqarl8BCRwBL8ulYUaZpz3bNsA7oFepAzee+8/+ImtADXNOmO5vJvsPff3qi+hvpkY/NYBTrBQgdNw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-explode-assignable-expression": "^7.18.6",
+                "@babel/types": "^7.18.9"
+            }
+        },
+        "@babel/helper-compilation-targets": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.20.7.tgz",
+            "integrity": "sha512-4tGORmfQcrc+bvrjb5y3dG9Mx1IOZjsHqQVUz7XCNHO+iTmqxWnVg3KRygjGmpRLJGdQSKuvFinbIb0CnZwHAQ==",
+            "dev": true,
+            "requires": {
+                "@babel/compat-data": "^7.20.5",
+                "@babel/helper-validator-option": "^7.18.6",
+                "browserslist": "^4.21.3",
+                "lru-cache": "^5.1.1",
+                "semver": "^6.3.0"
+            },
+            "dependencies": {
+                "semver": {
+                    "version": "6.3.0",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+                    "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+                    "dev": true
+                }
+            }
+        },
+        "@babel/helper-create-class-features-plugin": {
+            "version": "7.20.12",
+            "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.20.12.tgz",
+            "integrity": "sha512-9OunRkbT0JQcednL0UFvbfXpAsUXiGjUk0a7sN8fUXX7Mue79cUSMjHGDRRi/Vz9vYlpIhLV5fMD5dKoMhhsNQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-annotate-as-pure": "^7.18.6",
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-function-name": "^7.19.0",
+                "@babel/helper-member-expression-to-functions": "^7.20.7",
+                "@babel/helper-optimise-call-expression": "^7.18.6",
+                "@babel/helper-replace-supers": "^7.20.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
+                "@babel/helper-split-export-declaration": "^7.18.6"
+            }
+        },
+        "@babel/helper-create-regexp-features-plugin": {
+            "version": "7.20.5",
+            "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.20.5.tgz",
+            "integrity": "sha512-m68B1lkg3XDGX5yCvGO0kPx3v9WIYLnzjKfPcQiwntEQa5ZeRkPmo2X/ISJc8qxWGfwUr+kvZAeEzAwLec2r2w==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-annotate-as-pure": "^7.18.6",
+                "regexpu-core": "^5.2.1"
+            }
+        },
+        "@babel/helper-define-polyfill-provider": {
+            "version": "0.3.3",
+            "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.3.3.tgz",
+            "integrity": "sha512-z5aQKU4IzbqCC1XH0nAqfsFLMVSo22SBKUc0BxGrLkolTdPTructy0ToNnlO2zA4j9Q/7pjMZf0DSY+DSTYzww==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-compilation-targets": "^7.17.7",
+                "@babel/helper-plugin-utils": "^7.16.7",
+                "debug": "^4.1.1",
+                "lodash.debounce": "^4.0.8",
+                "resolve": "^1.14.2",
+                "semver": "^6.1.2"
+            },
+            "dependencies": {
+                "debug": {
+                    "version": "4.3.4",
+                    "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
+                    "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+                    "dev": true,
+                    "requires": {
+                        "ms": "2.1.2"
+                    }
+                },
+                "ms": {
+                    "version": "2.1.2",
+                    "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+                    "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+                    "dev": true
+                },
+                "semver": {
+                    "version": "6.3.0",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+                    "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+                    "dev": true
+                }
+            }
+        },
+        "@babel/helper-environment-visitor": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.18.9.tgz",
+            "integrity": "sha512-3r/aACDJ3fhQ/EVgFy0hpj8oHyHpQc+LPtJoY9SzTThAsStm4Ptegq92vqKoE3vD706ZVFWITnMnxucw+S9Ipg==",
+            "dev": true
+        },
+        "@babel/helper-explode-assignable-expression": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-explode-assignable-expression/-/helper-explode-assignable-expression-7.18.6.tgz",
+            "integrity": "sha512-eyAYAsQmB80jNfg4baAtLeWAQHfHFiR483rzFK+BhETlGZaQC9bsfrugfXDCbRHLQbIA7U5NxhhOxN7p/dWIcg==",
+            "dev": true,
+            "requires": {
+                "@babel/types": "^7.18.6"
+            }
+        },
+        "@babel/helper-function-name": {
+            "version": "7.19.0",
+            "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.19.0.tgz",
+            "integrity": "sha512-WAwHBINyrpqywkUH0nTnNgI5ina5TFn85HKS0pbPDfxFfhyR/aNQEn4hGi1P1JyT//I0t4OgXUlofzWILRvS5w==",
+            "dev": true,
+            "requires": {
+                "@babel/template": "^7.18.10",
+                "@babel/types": "^7.19.0"
+            }
+        },
+        "@babel/helper-hoist-variables": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.18.6.tgz",
+            "integrity": "sha512-UlJQPkFqFULIcyW5sbzgbkxn2FKRgwWiRexcuaR8RNJRy8+LLveqPjwZV/bwrLZCN0eUHD/x8D0heK1ozuoo6Q==",
+            "dev": true,
+            "requires": {
+                "@babel/types": "^7.18.6"
+            }
+        },
+        "@babel/helper-member-expression-to-functions": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.20.7.tgz",
+            "integrity": "sha512-9J0CxJLq315fEdi4s7xK5TQaNYjZw+nDVpVqr1axNGKzdrdwYBD5b4uKv3n75aABG0rCCTK8Im8Ww7eYfMrZgw==",
+            "dev": true,
+            "requires": {
+                "@babel/types": "^7.20.7"
+            }
+        },
+        "@babel/helper-module-imports": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.18.6.tgz",
+            "integrity": "sha512-0NFvs3VkuSYbFi1x2Vd6tKrywq+z/cLeYC/RJNFrIX/30Bf5aiGYbtvGXolEktzJH8o5E5KJ3tT+nkxuuZFVlA==",
+            "dev": true,
+            "requires": {
+                "@babel/types": "^7.18.6"
+            }
+        },
+        "@babel/helper-module-transforms": {
+            "version": "7.20.11",
+            "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.20.11.tgz",
+            "integrity": "sha512-uRy78kN4psmji1s2QtbtcCSaj/LILFDp0f/ymhpQH5QY3nljUZCaNWz9X1dEj/8MBdBEFECs7yRhKn8i7NjZgg==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-module-imports": "^7.18.6",
+                "@babel/helper-simple-access": "^7.20.2",
+                "@babel/helper-split-export-declaration": "^7.18.6",
+                "@babel/helper-validator-identifier": "^7.19.1",
+                "@babel/template": "^7.20.7",
+                "@babel/traverse": "^7.20.10",
+                "@babel/types": "^7.20.7"
+            }
+        },
+        "@babel/helper-optimise-call-expression": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.18.6.tgz",
+            "integrity": "sha512-HP59oD9/fEHQkdcbgFCnbmgH5vIQTJbxh2yf+CdM89/glUNnuzr87Q8GIjGEnOktTROemO0Pe0iPAYbqZuOUiA==",
+            "dev": true,
+            "requires": {
+                "@babel/types": "^7.18.6"
+            }
+        },
+        "@babel/helper-plugin-utils": {
+            "version": "7.20.2",
+            "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.20.2.tgz",
+            "integrity": "sha512-8RvlJG2mj4huQ4pZ+rU9lqKi9ZKiRmuvGuM2HlWmkmgOhbs6zEAw6IEiJ5cQqGbDzGZOhwuOQNtZMi/ENLjZoQ==",
+            "dev": true
+        },
+        "@babel/helper-remap-async-to-generator": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.18.9.tgz",
+            "integrity": "sha512-dI7q50YKd8BAv3VEfgg7PS7yD3Rtbi2J1XMXaalXO0W0164hYLnh8zpjRS0mte9MfVp/tltvr/cfdXPvJr1opA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-annotate-as-pure": "^7.18.6",
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-wrap-function": "^7.18.9",
+                "@babel/types": "^7.18.9"
+            }
+        },
+        "@babel/helper-replace-supers": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.20.7.tgz",
+            "integrity": "sha512-vujDMtB6LVfNW13jhlCrp48QNslK6JXi7lQG736HVbHz/mbf4Dc7tIRh1Xf5C0rF7BP8iiSxGMCmY6Ci1ven3A==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-member-expression-to-functions": "^7.20.7",
+                "@babel/helper-optimise-call-expression": "^7.18.6",
+                "@babel/template": "^7.20.7",
+                "@babel/traverse": "^7.20.7",
+                "@babel/types": "^7.20.7"
+            }
+        },
+        "@babel/helper-simple-access": {
+            "version": "7.20.2",
+            "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.20.2.tgz",
+            "integrity": "sha512-+0woI/WPq59IrqDYbVGfshjT5Dmk/nnbdpcF8SnMhhXObpTq2KNBdLFRFrkVdbDOyUmHBCxzm5FHV1rACIkIbA==",
+            "dev": true,
+            "requires": {
+                "@babel/types": "^7.20.2"
+            }
+        },
+        "@babel/helper-skip-transparent-expression-wrappers": {
+            "version": "7.20.0",
+            "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.20.0.tgz",
+            "integrity": "sha512-5y1JYeNKfvnT8sZcK9DVRtpTbGiomYIHviSP3OQWmDPU3DeH4a1ZlT/N2lyQ5P8egjcRaT/Y9aNqUxK0WsnIIg==",
+            "dev": true,
+            "requires": {
+                "@babel/types": "^7.20.0"
+            }
+        },
+        "@babel/helper-split-export-declaration": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.18.6.tgz",
+            "integrity": "sha512-bde1etTx6ZyTmobl9LLMMQsaizFVZrquTEHOqKeQESMKo4PlObf+8+JA25ZsIpZhT/WEd39+vOdLXAFG/nELpA==",
+            "dev": true,
+            "requires": {
+                "@babel/types": "^7.18.6"
+            }
+        },
+        "@babel/helper-string-parser": {
+            "version": "7.19.4",
+            "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.19.4.tgz",
+            "integrity": "sha512-nHtDoQcuqFmwYNYPz3Rah5ph2p8PFeFCsZk9A/48dPc/rGocJ5J3hAAZ7pb76VWX3fZKu+uEr/FhH5jLx7umrw==",
+            "dev": true
+        },
+        "@babel/helper-validator-identifier": {
+            "version": "7.19.1",
+            "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.19.1.tgz",
+            "integrity": "sha512-awrNfaMtnHUr653GgGEs++LlAvW6w+DcPrOliSMXWCKo597CwL5Acf/wWdNkf/tfEQE3mjkeD1YOVZOUV/od1w==",
+            "dev": true
+        },
+        "@babel/helper-validator-option": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.18.6.tgz",
+            "integrity": "sha512-XO7gESt5ouv/LRJdrVjkShckw6STTaB7l9BrpBaAHDeF5YZT+01PCwmR0SJHnkW6i8OwW/EVWRShfi4j2x+KQw==",
+            "dev": true
+        },
+        "@babel/helper-wrap-function": {
+            "version": "7.20.5",
+            "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.20.5.tgz",
+            "integrity": "sha512-bYMxIWK5mh+TgXGVqAtnu5Yn1un+v8DDZtqyzKRLUzrh70Eal2O3aZ7aPYiMADO4uKlkzOiRiZ6GX5q3qxvW9Q==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-function-name": "^7.19.0",
+                "@babel/template": "^7.18.10",
+                "@babel/traverse": "^7.20.5",
+                "@babel/types": "^7.20.5"
+            }
+        },
+        "@babel/helpers": {
+            "version": "7.20.13",
+            "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.20.13.tgz",
+            "integrity": "sha512-nzJ0DWCL3gB5RCXbUO3KIMMsBY2Eqbx8mBpKGE/02PgyRQFcPQLbkQ1vyy596mZLaP+dAfD+R4ckASzNVmW3jg==",
+            "dev": true,
+            "requires": {
+                "@babel/template": "^7.20.7",
+                "@babel/traverse": "^7.20.13",
+                "@babel/types": "^7.20.7"
+            }
+        },
+        "@babel/highlight": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.18.6.tgz",
+            "integrity": "sha512-u7stbOuYjaPezCuLj29hNW1v64M2Md2qupEKP1fHc7WdOA3DgLh37suiSrZYY7haUB7iBeQZ9P1uiRF359do3g==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-validator-identifier": "^7.18.6",
+                "chalk": "^2.0.0",
+                "js-tokens": "^4.0.0"
+            },
+            "dependencies": {
+                "ansi-styles": {
+                    "version": "3.2.1",
+                    "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
+                    "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
+                    "dev": true,
+                    "requires": {
+                        "color-convert": "^1.9.0"
+                    }
+                },
+                "chalk": {
+                    "version": "2.4.2",
+                    "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
+                    "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
+                    "dev": true,
+                    "requires": {
+                        "ansi-styles": "^3.2.1",
+                        "escape-string-regexp": "^1.0.5",
+                        "supports-color": "^5.3.0"
+                    }
+                },
+                "color-convert": {
+                    "version": "1.9.3",
+                    "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
+                    "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
+                    "dev": true,
+                    "requires": {
+                        "color-name": "1.1.3"
+                    }
+                },
+                "color-name": {
+                    "version": "1.1.3",
+                    "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
+                    "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
+                    "dev": true
+                },
+                "has-flag": {
+                    "version": "3.0.0",
+                    "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
+                    "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
+                    "dev": true
+                },
+                "supports-color": {
+                    "version": "5.5.0",
+                    "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
+                    "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
+                    "dev": true,
+                    "requires": {
+                        "has-flag": "^3.0.0"
+                    }
+                }
+            }
+        },
+        "@babel/parser": {
+            "version": "7.20.13",
+            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.20.13.tgz",
+            "integrity": "sha512-gFDLKMfpiXCsjt4za2JA9oTMn70CeseCehb11kRZgvd7+F67Hih3OHOK24cRrWECJ/ljfPGac6ygXAs/C8kIvw==",
+            "dev": true
+        },
+        "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.18.6.tgz",
+            "integrity": "sha512-Dgxsyg54Fx1d4Nge8UnvTrED63vrwOdPmyvPzlNN/boaliRP54pm3pGzZD1SJUwrBA+Cs/xdG8kXX6Mn/RfISQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.20.7.tgz",
+            "integrity": "sha512-sbr9+wNE5aXMBBFBICk01tt7sBf2Oc9ikRFEcem/ZORup9IMUdNhW7/wVLEbbtlWOsEubJet46mHAL2C8+2jKQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
+                "@babel/plugin-proposal-optional-chaining": "^7.20.7"
+            }
+        },
+        "@babel/plugin-proposal-async-generator-functions": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.20.7.tgz",
+            "integrity": "sha512-xMbiLsn/8RK7Wq7VeVytytS2L6qE69bXPB10YCmMdDZbKF4okCqY74pI/jJQ/8U0b/F6NrT2+14b8/P9/3AMGA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-remap-async-to-generator": "^7.18.9",
+                "@babel/plugin-syntax-async-generators": "^7.8.4"
+            }
+        },
+        "@babel/plugin-proposal-class-properties": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.18.6.tgz",
+            "integrity": "sha512-cumfXOF0+nzZrrN8Rf0t7M+tF6sZc7vhQwYQck9q1/5w2OExlD+b4v4RpMJFaV1Z7WcDRgO6FqvxqxGlwo+RHQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-class-features-plugin": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-proposal-class-static-block": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-static-block/-/plugin-proposal-class-static-block-7.20.7.tgz",
+            "integrity": "sha512-AveGOoi9DAjUYYuUAG//Ig69GlazLnoyzMw68VCDux+c1tsnnH/OkYcpz/5xzMkEFC6UxjR5Gw1c+iY2wOGVeQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-class-features-plugin": "^7.20.7",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/plugin-syntax-class-static-block": "^7.14.5"
+            }
+        },
+        "@babel/plugin-proposal-dynamic-import": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-dynamic-import/-/plugin-proposal-dynamic-import-7.18.6.tgz",
+            "integrity": "sha512-1auuwmK+Rz13SJj36R+jqFPMJWyKEDd7lLSdOj4oJK0UTgGueSAtkrCvz9ewmgyU/P941Rv2fQwZJN8s6QruXw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/plugin-syntax-dynamic-import": "^7.8.3"
+            }
+        },
+        "@babel/plugin-proposal-export-namespace-from": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-export-namespace-from/-/plugin-proposal-export-namespace-from-7.18.9.tgz",
+            "integrity": "sha512-k1NtHyOMvlDDFeb9G5PhUXuGj8m/wiwojgQVEhJ/fsVsMCpLyOP4h0uGEjYJKrRI+EVPlb5Jk+Gt9P97lOGwtA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.9",
+                "@babel/plugin-syntax-export-namespace-from": "^7.8.3"
+            }
+        },
+        "@babel/plugin-proposal-json-strings": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-json-strings/-/plugin-proposal-json-strings-7.18.6.tgz",
+            "integrity": "sha512-lr1peyn9kOdbYc0xr0OdHTZ5FMqS6Di+H0Fz2I/JwMzGmzJETNeOFq2pBySw6X/KFL5EWDjlJuMsUGRFb8fQgQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/plugin-syntax-json-strings": "^7.8.3"
+            }
+        },
+        "@babel/plugin-proposal-logical-assignment-operators": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-logical-assignment-operators/-/plugin-proposal-logical-assignment-operators-7.20.7.tgz",
+            "integrity": "sha512-y7C7cZgpMIjWlKE5T7eJwp+tnRYM89HmRvWM5EQuB5BoHEONjmQ8lSNmBUwOyy/GFRsohJED51YBF79hE1djug==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4"
+            }
+        },
+        "@babel/plugin-proposal-nullish-coalescing-operator": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-nullish-coalescing-operator/-/plugin-proposal-nullish-coalescing-operator-7.18.6.tgz",
+            "integrity": "sha512-wQxQzxYeJqHcfppzBDnm1yAY0jSRkUXR2z8RePZYrKwMKgMlE8+Z6LUno+bd6LvbGh8Gltvy74+9pIYkr+XkKA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3"
+            }
+        },
+        "@babel/plugin-proposal-numeric-separator": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-numeric-separator/-/plugin-proposal-numeric-separator-7.18.6.tgz",
+            "integrity": "sha512-ozlZFogPqoLm8WBr5Z8UckIoE4YQ5KESVcNudyXOR8uqIkliTEgJ3RoketfG6pmzLdeZF0H/wjE9/cCEitBl7Q==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/plugin-syntax-numeric-separator": "^7.10.4"
+            }
+        },
+        "@babel/plugin-proposal-object-rest-spread": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.20.7.tgz",
+            "integrity": "sha512-d2S98yCiLxDVmBmE8UjGcfPvNEUbA1U5q5WxaWFUGRzJSVAZqm5W6MbPct0jxnegUZ0niLeNX+IOzEs7wYg9Dg==",
+            "dev": true,
+            "requires": {
+                "@babel/compat-data": "^7.20.5",
+                "@babel/helper-compilation-targets": "^7.20.7",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+                "@babel/plugin-transform-parameters": "^7.20.7"
+            }
+        },
+        "@babel/plugin-proposal-optional-catch-binding": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-catch-binding/-/plugin-proposal-optional-catch-binding-7.18.6.tgz",
+            "integrity": "sha512-Q40HEhs9DJQyaZfUjjn6vE8Cv4GmMHCYuMGIWUnlxH6400VGxOuwWsPt4FxXxJkC/5eOzgn0z21M9gMT4MOhbw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/plugin-syntax-optional-catch-binding": "^7.8.3"
+            }
+        },
+        "@babel/plugin-proposal-optional-chaining": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-chaining/-/plugin-proposal-optional-chaining-7.20.7.tgz",
+            "integrity": "sha512-T+A7b1kfjtRM51ssoOfS1+wbyCVqorfyZhT99TvxxLMirPShD8CzKMRepMlCBGM5RpHMbn8s+5MMHnPstJH6mQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
+                "@babel/plugin-syntax-optional-chaining": "^7.8.3"
+            }
+        },
+        "@babel/plugin-proposal-private-methods": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-methods/-/plugin-proposal-private-methods-7.18.6.tgz",
+            "integrity": "sha512-nutsvktDItsNn4rpGItSNV2sz1XwS+nfU0Rg8aCx3W3NOKVzdMjJRu0O5OkgDp3ZGICSTbgRpxZoWsxoKRvbeA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-class-features-plugin": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-proposal-private-property-in-object": {
+            "version": "7.20.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.20.5.tgz",
+            "integrity": "sha512-Vq7b9dUA12ByzB4EjQTPo25sFhY+08pQDBSZRtUAkj7lb7jahaHR5igera16QZ+3my1nYR4dKsNdYj5IjPHilQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-annotate-as-pure": "^7.18.6",
+                "@babel/helper-create-class-features-plugin": "^7.20.5",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/plugin-syntax-private-property-in-object": "^7.14.5"
+            }
+        },
+        "@babel/plugin-proposal-unicode-property-regex": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-unicode-property-regex/-/plugin-proposal-unicode-property-regex-7.18.6.tgz",
+            "integrity": "sha512-2BShG/d5yoZyXZfVePH91urL5wTG6ASZU9M4o03lKK8u8UW1y08OMttBSOADTcJrnPMpvDXRG3G8fyLh4ovs8w==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-syntax-async-generators": {
+            "version": "7.8.4",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
+            "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            }
+        },
+        "@babel/plugin-syntax-class-properties": {
+            "version": "7.12.13",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
+            "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.12.13"
+            }
+        },
+        "@babel/plugin-syntax-class-static-block": {
+            "version": "7.14.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz",
+            "integrity": "sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.14.5"
+            }
+        },
+        "@babel/plugin-syntax-dynamic-import": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-dynamic-import/-/plugin-syntax-dynamic-import-7.8.3.tgz",
+            "integrity": "sha512-5gdGbFon+PszYzqs83S3E5mpi7/y/8M9eC90MRTZfduQOYW76ig6SOSPNe41IG5LoP3FGBn2N0RjVDSQiS94kQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            }
+        },
+        "@babel/plugin-syntax-export-namespace-from": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-export-namespace-from/-/plugin-syntax-export-namespace-from-7.8.3.tgz",
+            "integrity": "sha512-MXf5laXo6c1IbEbegDmzGPwGNTsHZmEy6QGznu5Sh2UCWvueywb2ee+CCE4zQiZstxU9BMoQO9i6zUFSY0Kj0Q==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.8.3"
+            }
+        },
+        "@babel/plugin-syntax-import-assertions": {
+            "version": "7.20.0",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.20.0.tgz",
+            "integrity": "sha512-IUh1vakzNoWalR8ch/areW7qFopR2AEw03JlG7BbrDqmQ4X3q9uuipQwSGrUn7oGiemKjtSLDhNtQHzMHr1JdQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.19.0"
+            }
+        },
+        "@babel/plugin-syntax-json-strings": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
+            "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            }
+        },
+        "@babel/plugin-syntax-logical-assignment-operators": {
+            "version": "7.10.4",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz",
+            "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.10.4"
+            }
+        },
+        "@babel/plugin-syntax-nullish-coalescing-operator": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
+            "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            }
+        },
+        "@babel/plugin-syntax-numeric-separator": {
+            "version": "7.10.4",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz",
+            "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.10.4"
+            }
+        },
+        "@babel/plugin-syntax-object-rest-spread": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
+            "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            }
+        },
+        "@babel/plugin-syntax-optional-catch-binding": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
+            "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            }
+        },
+        "@babel/plugin-syntax-optional-chaining": {
+            "version": "7.8.3",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
+            "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.8.0"
+            }
+        },
+        "@babel/plugin-syntax-private-property-in-object": {
+            "version": "7.14.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz",
+            "integrity": "sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.14.5"
+            }
+        },
+        "@babel/plugin-syntax-top-level-await": {
+            "version": "7.14.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz",
+            "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.14.5"
+            }
+        },
+        "@babel/plugin-transform-arrow-functions": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.20.7.tgz",
+            "integrity": "sha512-3poA5E7dzDomxj9WXWwuD6A5F3kc7VXwIJO+E+J8qtDtS+pXPAhrgEyh+9GBwBgPq1Z+bB+/JD60lp5jsN7JPQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.20.2"
+            }
+        },
+        "@babel/plugin-transform-async-to-generator": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.20.7.tgz",
+            "integrity": "sha512-Uo5gwHPT9vgnSXQxqGtpdufUiWp96gk7yiP4Mp5bm1QMkEmLXBO7PAGYbKoJ6DhAwiNkcHFBol/x5zZZkL/t0Q==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-module-imports": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-remap-async-to-generator": "^7.18.9"
+            }
+        },
+        "@babel/plugin-transform-block-scoped-functions": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.18.6.tgz",
+            "integrity": "sha512-ExUcOqpPWnliRcPqves5HJcJOvHvIIWfuS4sroBUenPuMdmW+SMHDakmtS7qOo13sVppmUijqeTv7qqGsvURpQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-block-scoping": {
+            "version": "7.20.11",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.20.11.tgz",
+            "integrity": "sha512-tA4N427a7fjf1P0/2I4ScsHGc5jcHPbb30xMbaTke2gxDuWpUfXDuX1FEymJwKk4tuGUvGcejAR6HdZVqmmPyw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.20.2"
+            }
+        },
+        "@babel/plugin-transform-classes": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.20.7.tgz",
+            "integrity": "sha512-LWYbsiXTPKl+oBlXUGlwNlJZetXD5Am+CyBdqhPsDVjM9Jc8jwBJFrKhHf900Kfk2eZG1y9MAG3UNajol7A4VQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-annotate-as-pure": "^7.18.6",
+                "@babel/helper-compilation-targets": "^7.20.7",
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-function-name": "^7.19.0",
+                "@babel/helper-optimise-call-expression": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-replace-supers": "^7.20.7",
+                "@babel/helper-split-export-declaration": "^7.18.6",
+                "globals": "^11.1.0"
+            }
+        },
+        "@babel/plugin-transform-computed-properties": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.20.7.tgz",
+            "integrity": "sha512-Lz7MvBK6DTjElHAmfu6bfANzKcxpyNPeYBGEafyA6E5HtRpjpZwU+u7Qrgz/2OR0z+5TvKYbPdphfSaAcZBrYQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/template": "^7.20.7"
+            }
+        },
+        "@babel/plugin-transform-destructuring": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.20.7.tgz",
+            "integrity": "sha512-Xwg403sRrZb81IVB79ZPqNQME23yhugYVqgTxAhT99h485F4f+GMELFhhOsscDUB7HCswepKeCKLn/GZvUKoBA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.20.2"
+            }
+        },
+        "@babel/plugin-transform-dotall-regex": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.18.6.tgz",
+            "integrity": "sha512-6S3jpun1eEbAxq7TdjLotAsl4WpQI9DxfkycRcKrjhQYzU87qpXdknpBg/e+TdcMehqGnLFi7tnFUBR02Vq6wg==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-duplicate-keys": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.18.9.tgz",
+            "integrity": "sha512-d2bmXCtZXYc59/0SanQKbiWINadaJXqtvIQIzd4+hNwkWBgyCd5F/2t1kXoUdvPMrxzPvhK6EMQRROxsue+mfw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.9"
+            }
+        },
+        "@babel/plugin-transform-exponentiation-operator": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.18.6.tgz",
+            "integrity": "sha512-wzEtc0+2c88FVR34aQmiz56dxEkxr2g8DQb/KfaFa1JYXOFVsbhvAonFN6PwVWj++fKmku8NP80plJ5Et4wqHw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-builder-binary-assignment-operator-visitor": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-for-of": {
+            "version": "7.18.8",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.18.8.tgz",
+            "integrity": "sha512-yEfTRnjuskWYo0k1mHUqrVWaZwrdq8AYbfrpqULOJOaucGSp4mNMVps+YtA8byoevxS/urwU75vyhQIxcCgiBQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-function-name": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.18.9.tgz",
+            "integrity": "sha512-WvIBoRPaJQ5yVHzcnJFor7oS5Ls0PYixlTYE63lCj2RtdQEl15M68FXQlxnG6wdraJIXRdR7KI+hQ7q/9QjrCQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-compilation-targets": "^7.18.9",
+                "@babel/helper-function-name": "^7.18.9",
+                "@babel/helper-plugin-utils": "^7.18.9"
+            }
+        },
+        "@babel/plugin-transform-literals": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.18.9.tgz",
+            "integrity": "sha512-IFQDSRoTPnrAIrI5zoZv73IFeZu2dhu6irxQjY9rNjTT53VmKg9fenjvoiOWOkJ6mm4jKVPtdMzBY98Fp4Z4cg==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.9"
+            }
+        },
+        "@babel/plugin-transform-member-expression-literals": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.18.6.tgz",
+            "integrity": "sha512-qSF1ihLGO3q+/g48k85tUjD033C29TNTVB2paCwZPVmOsjn9pClvYYrM2VeJpBY2bcNkuny0YUyTNRyRxJ54KA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-modules-amd": {
+            "version": "7.20.11",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.20.11.tgz",
+            "integrity": "sha512-NuzCt5IIYOW0O30UvqktzHYR2ud5bOWbY0yaxWZ6G+aFzOMJvrs5YHNikrbdaT15+KNO31nPOy5Fim3ku6Zb5g==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-module-transforms": "^7.20.11",
+                "@babel/helper-plugin-utils": "^7.20.2"
+            }
+        },
+        "@babel/plugin-transform-modules-commonjs": {
+            "version": "7.20.11",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.20.11.tgz",
+            "integrity": "sha512-S8e1f7WQ7cimJQ51JkAaDrEtohVEitXjgCGAS2N8S31Y42E+kWwfSz83LYz57QdBm7q9diARVqanIaH2oVgQnw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-module-transforms": "^7.20.11",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-simple-access": "^7.20.2"
+            }
+        },
+        "@babel/plugin-transform-modules-systemjs": {
+            "version": "7.20.11",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.20.11.tgz",
+            "integrity": "sha512-vVu5g9BPQKSFEmvt2TA4Da5N+QVS66EX21d8uoOihC+OCpUoGvzVsXeqFdtAEfVa5BILAeFt+U7yVmLbQnAJmw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-hoist-variables": "^7.18.6",
+                "@babel/helper-module-transforms": "^7.20.11",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-validator-identifier": "^7.19.1"
+            }
+        },
+        "@babel/plugin-transform-modules-umd": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.18.6.tgz",
+            "integrity": "sha512-dcegErExVeXcRqNtkRU/z8WlBLnvD4MRnHgNs3MytRO1Mn1sHRyhbcpYbVMGclAqOjdW+9cfkdZno9dFdfKLfQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-module-transforms": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-named-capturing-groups-regex": {
+            "version": "7.20.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.20.5.tgz",
+            "integrity": "sha512-mOW4tTzi5iTLnw+78iEq3gr8Aoq4WNRGpmSlrogqaiCBoR1HFhpU4JkpQFOHfeYx3ReVIFWOQJS4aZBRvuZ6mA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-regexp-features-plugin": "^7.20.5",
+                "@babel/helper-plugin-utils": "^7.20.2"
+            }
+        },
+        "@babel/plugin-transform-new-target": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.18.6.tgz",
+            "integrity": "sha512-DjwFA/9Iu3Z+vrAn+8pBUGcjhxKguSMlsFqeCKbhb9BAV756v0krzVK04CRDi/4aqmk8BsHb4a/gFcaA5joXRw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-object-super": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.18.6.tgz",
+            "integrity": "sha512-uvGz6zk+pZoS1aTZrOvrbj6Pp/kK2mp45t2B+bTDre2UgsZZ8EZLSJtUg7m/no0zOJUWgFONpB7Zv9W2tSaFlA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6",
+                "@babel/helper-replace-supers": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-parameters": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.20.7.tgz",
+            "integrity": "sha512-WiWBIkeHKVOSYPO0pWkxGPfKeWrCJyD3NJ53+Lrp/QMSZbsVPovrVl2aWZ19D/LTVnaDv5Ap7GJ/B2CTOZdrfA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.20.2"
+            }
+        },
+        "@babel/plugin-transform-property-literals": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.18.6.tgz",
+            "integrity": "sha512-cYcs6qlgafTud3PAzrrRNbQtfpQ8+y/+M5tKmksS9+M1ckbH6kzY8MrexEM9mcA6JDsukE19iIRvAyYl463sMg==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-regenerator": {
+            "version": "7.20.5",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.20.5.tgz",
+            "integrity": "sha512-kW/oO7HPBtntbsahzQ0qSE3tFvkFwnbozz3NWFhLGqH75vLEg+sCGngLlhVkePlCs3Jv0dBBHDzCHxNiFAQKCQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "regenerator-transform": "^0.15.1"
+            }
+        },
+        "@babel/plugin-transform-reserved-words": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.18.6.tgz",
+            "integrity": "sha512-oX/4MyMoypzHjFrT1CdivfKZ+XvIPMFXwwxHp/r0Ddy2Vuomt4HDFGmft1TAY2yiTKiNSsh3kjBAzcM8kSdsjA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-shorthand-properties": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.18.6.tgz",
+            "integrity": "sha512-eCLXXJqv8okzg86ywZJbRn19YJHU4XUa55oz2wbHhaQVn/MM+XhukiT7SYqp/7o00dg52Rj51Ny+Ecw4oyoygw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-spread": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.20.7.tgz",
+            "integrity": "sha512-ewBbHQ+1U/VnH1fxltbJqDeWBU1oNLG8Dj11uIv3xVf7nrQu0bPGe5Rf716r7K5Qz+SqtAOVswoVunoiBtGhxw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0"
+            }
+        },
+        "@babel/plugin-transform-sticky-regex": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.18.6.tgz",
+            "integrity": "sha512-kfiDrDQ+PBsQDO85yj1icueWMfGfJFKN1KCkndygtu/C9+XUfydLC8Iv5UYJqRwy4zk8EcplRxEOeLyjq1gm6Q==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/plugin-transform-template-literals": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.18.9.tgz",
+            "integrity": "sha512-S8cOWfT82gTezpYOiVaGHrCbhlHgKhQt8XH5ES46P2XWmX92yisoZywf5km75wv5sYcXDUCLMmMxOLCtthDgMA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.9"
+            }
+        },
+        "@babel/plugin-transform-typeof-symbol": {
+            "version": "7.18.9",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.18.9.tgz",
+            "integrity": "sha512-SRfwTtF11G2aemAZWivL7PD+C9z52v9EvMqH9BuYbabyPuKUvSWks3oCg6041pT925L4zVFqaVBeECwsmlguEw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.9"
+            }
+        },
+        "@babel/plugin-transform-unicode-escapes": {
+            "version": "7.18.10",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.18.10.tgz",
+            "integrity": "sha512-kKAdAI+YzPgGY/ftStBFXTI1LZFju38rYThnfMykS+IXy8BVx+res7s2fxf1l8I35DV2T97ezo6+SGrXz6B3iQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.18.9"
+            }
+        },
+        "@babel/plugin-transform-unicode-regex": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.18.6.tgz",
+            "integrity": "sha512-gE7A6Lt7YLnNOL3Pb9BNeZvi+d8l7tcRrG4+pwJjK9hD2xX4mEvjlQW60G9EEmfXVYRPv9VRQcyegIVHCql/AA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            }
+        },
+        "@babel/preset-env": {
+            "version": "7.20.2",
+            "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.20.2.tgz",
+            "integrity": "sha512-1G0efQEWR1EHkKvKHqbG+IN/QdgwfByUpM5V5QroDzGV2t3S/WXNQd693cHiHTlCFMpr9B6FkPFXDA2lQcKoDg==",
+            "dev": true,
+            "requires": {
+                "@babel/compat-data": "^7.20.1",
+                "@babel/helper-compilation-targets": "^7.20.0",
+                "@babel/helper-plugin-utils": "^7.20.2",
+                "@babel/helper-validator-option": "^7.18.6",
+                "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.18.6",
+                "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.18.9",
+                "@babel/plugin-proposal-async-generator-functions": "^7.20.1",
+                "@babel/plugin-proposal-class-properties": "^7.18.6",
+                "@babel/plugin-proposal-class-static-block": "^7.18.6",
+                "@babel/plugin-proposal-dynamic-import": "^7.18.6",
+                "@babel/plugin-proposal-export-namespace-from": "^7.18.9",
+                "@babel/plugin-proposal-json-strings": "^7.18.6",
+                "@babel/plugin-proposal-logical-assignment-operators": "^7.18.9",
+                "@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6",
+                "@babel/plugin-proposal-numeric-separator": "^7.18.6",
+                "@babel/plugin-proposal-object-rest-spread": "^7.20.2",
+                "@babel/plugin-proposal-optional-catch-binding": "^7.18.6",
+                "@babel/plugin-proposal-optional-chaining": "^7.18.9",
+                "@babel/plugin-proposal-private-methods": "^7.18.6",
+                "@babel/plugin-proposal-private-property-in-object": "^7.18.6",
+                "@babel/plugin-proposal-unicode-property-regex": "^7.18.6",
+                "@babel/plugin-syntax-async-generators": "^7.8.4",
+                "@babel/plugin-syntax-class-properties": "^7.12.13",
+                "@babel/plugin-syntax-class-static-block": "^7.14.5",
+                "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+                "@babel/plugin-syntax-export-namespace-from": "^7.8.3",
+                "@babel/plugin-syntax-import-assertions": "^7.20.0",
+                "@babel/plugin-syntax-json-strings": "^7.8.3",
+                "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4",
+                "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
+                "@babel/plugin-syntax-numeric-separator": "^7.10.4",
+                "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+                "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
+                "@babel/plugin-syntax-optional-chaining": "^7.8.3",
+                "@babel/plugin-syntax-private-property-in-object": "^7.14.5",
+                "@babel/plugin-syntax-top-level-await": "^7.14.5",
+                "@babel/plugin-transform-arrow-functions": "^7.18.6",
+                "@babel/plugin-transform-async-to-generator": "^7.18.6",
+                "@babel/plugin-transform-block-scoped-functions": "^7.18.6",
+                "@babel/plugin-transform-block-scoping": "^7.20.2",
+                "@babel/plugin-transform-classes": "^7.20.2",
+                "@babel/plugin-transform-computed-properties": "^7.18.9",
+                "@babel/plugin-transform-destructuring": "^7.20.2",
+                "@babel/plugin-transform-dotall-regex": "^7.18.6",
+                "@babel/plugin-transform-duplicate-keys": "^7.18.9",
+                "@babel/plugin-transform-exponentiation-operator": "^7.18.6",
+                "@babel/plugin-transform-for-of": "^7.18.8",
+                "@babel/plugin-transform-function-name": "^7.18.9",
+                "@babel/plugin-transform-literals": "^7.18.9",
+                "@babel/plugin-transform-member-expression-literals": "^7.18.6",
+                "@babel/plugin-transform-modules-amd": "^7.19.6",
+                "@babel/plugin-transform-modules-commonjs": "^7.19.6",
+                "@babel/plugin-transform-modules-systemjs": "^7.19.6",
+                "@babel/plugin-transform-modules-umd": "^7.18.6",
+                "@babel/plugin-transform-named-capturing-groups-regex": "^7.19.1",
+                "@babel/plugin-transform-new-target": "^7.18.6",
+                "@babel/plugin-transform-object-super": "^7.18.6",
+                "@babel/plugin-transform-parameters": "^7.20.1",
+                "@babel/plugin-transform-property-literals": "^7.18.6",
+                "@babel/plugin-transform-regenerator": "^7.18.6",
+                "@babel/plugin-transform-reserved-words": "^7.18.6",
+                "@babel/plugin-transform-shorthand-properties": "^7.18.6",
+                "@babel/plugin-transform-spread": "^7.19.0",
+                "@babel/plugin-transform-sticky-regex": "^7.18.6",
+                "@babel/plugin-transform-template-literals": "^7.18.9",
+                "@babel/plugin-transform-typeof-symbol": "^7.18.9",
+                "@babel/plugin-transform-unicode-escapes": "^7.18.10",
+                "@babel/plugin-transform-unicode-regex": "^7.18.6",
+                "@babel/preset-modules": "^0.1.5",
+                "@babel/types": "^7.20.2",
+                "babel-plugin-polyfill-corejs2": "^0.3.3",
+                "babel-plugin-polyfill-corejs3": "^0.6.0",
+                "babel-plugin-polyfill-regenerator": "^0.4.1",
+                "core-js-compat": "^3.25.1",
+                "semver": "^6.3.0"
+            },
+            "dependencies": {
+                "semver": {
+                    "version": "6.3.0",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+                    "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+                    "dev": true
+                }
+            }
+        },
+        "@babel/preset-modules": {
+            "version": "0.1.5",
+            "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.5.tgz",
+            "integrity": "sha512-A57th6YRG7oR3cq/yt/Y84MvGgE0eJG2F1JLhKuyG+jFxEgrd/HAMJatiFtmOiZurz+0DkrvbheCLaV5f2JfjA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.0.0",
+                "@babel/plugin-proposal-unicode-property-regex": "^7.4.4",
+                "@babel/plugin-transform-dotall-regex": "^7.4.4",
+                "@babel/types": "^7.4.4",
+                "esutils": "^2.0.2"
+            }
+        },
+        "@babel/runtime": {
+            "version": "7.20.13",
+            "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.20.13.tgz",
+            "integrity": "sha512-gt3PKXs0DBoL9xCvOIIZ2NEqAGZqHjAnmVbfQtB620V0uReIQutpel14KcneZuer7UioY8ALKZ7iocavvzTNFA==",
+            "dev": true,
+            "requires": {
+                "regenerator-runtime": "^0.13.11"
+            }
+        },
+        "@babel/template": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.20.7.tgz",
+            "integrity": "sha512-8SegXApWe6VoNw0r9JHpSteLKTpTiLZ4rMlGIm9JQ18KiCtyQiAMEazujAHrUS5flrcqYZa75ukev3P6QmUwUw==",
+            "dev": true,
+            "requires": {
+                "@babel/code-frame": "^7.18.6",
+                "@babel/parser": "^7.20.7",
+                "@babel/types": "^7.20.7"
+            }
+        },
+        "@babel/traverse": {
+            "version": "7.20.13",
+            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.20.13.tgz",
+            "integrity": "sha512-kMJXfF0T6DIS9E8cgdLCSAL+cuCK+YEZHWiLK0SXpTo8YRj5lpJu3CDNKiIBCne4m9hhTIqUg6SYTAI39tAiVQ==",
+            "dev": true,
+            "requires": {
+                "@babel/code-frame": "^7.18.6",
+                "@babel/generator": "^7.20.7",
+                "@babel/helper-environment-visitor": "^7.18.9",
+                "@babel/helper-function-name": "^7.19.0",
+                "@babel/helper-hoist-variables": "^7.18.6",
+                "@babel/helper-split-export-declaration": "^7.18.6",
+                "@babel/parser": "^7.20.13",
+                "@babel/types": "^7.20.7",
+                "debug": "^4.1.0",
+                "globals": "^11.1.0"
+            },
+            "dependencies": {
+                "debug": {
+                    "version": "4.3.4",
+                    "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
+                    "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+                    "dev": true,
+                    "requires": {
+                        "ms": "2.1.2"
+                    }
+                },
+                "ms": {
+                    "version": "2.1.2",
+                    "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+                    "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+                    "dev": true
+                }
+            }
+        },
+        "@babel/types": {
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.20.7.tgz",
+            "integrity": "sha512-69OnhBxSSgK0OzTJai4kyPDiKTIe3j+ctaHdIGVbRahTLAT7L3R9oeXHC2aVSuGYt3cVnoAMDmOCgJ2yaiLMvg==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-string-parser": "^7.19.4",
+                "@babel/helper-validator-identifier": "^7.19.1",
+                "to-fast-properties": "^2.0.0"
+            }
+        },
         "@discoveryjs/json-ext": {
             "version": "0.5.7",
             "resolved": "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-0.5.7.tgz",
@@ -9173,6 +12707,44 @@
             "integrity": "sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==",
             "dev": true
         },
+        "@jridgewell/gen-mapping": {
+            "version": "0.1.1",
+            "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.1.1.tgz",
+            "integrity": "sha512-sQXCasFk+U8lWYEe66WxRDOE9PjVz4vSM51fTu3Hw+ClTpUSQb718772vH3pyS5pShp6lvQM7SxgIDXXXmOX7w==",
+            "dev": true,
+            "requires": {
+                "@jridgewell/set-array": "^1.0.0",
+                "@jridgewell/sourcemap-codec": "^1.4.10"
+            }
+        },
+        "@jridgewell/resolve-uri": {
+            "version": "3.1.0",
+            "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.0.tgz",
+            "integrity": "sha512-F2msla3tad+Mfht5cJq7LSXcdudKTWCVYUgw6pLFOOHSTtZlj6SWNYAp+AhuqLmWdBO2X5hPrLcu8cVP8fy28w==",
+            "dev": true
+        },
+        "@jridgewell/set-array": {
+            "version": "1.1.2",
+            "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
+            "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
+            "dev": true
+        },
+        "@jridgewell/sourcemap-codec": {
+            "version": "1.4.14",
+            "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.14.tgz",
+            "integrity": "sha512-XPSJHWmi394fuUuzDnGz1wiKqWfo1yXecHQMRf2l6hztTO+nPru658AyDngaBe7isIxEkRsPR3FZh+s7iVa4Uw==",
+            "dev": true
+        },
+        "@jridgewell/trace-mapping": {
+            "version": "0.3.17",
+            "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.17.tgz",
+            "integrity": "sha512-MCNzAp77qzKca9+W/+I0+sEpaUnZoeasnghNeVc41VZCEKaCH73Vq3BZZ/SzWIgrqE4H4ceI+p+b6C0mHf9T4g==",
+            "dev": true,
+            "requires": {
+                "@jridgewell/resolve-uri": "3.1.0",
+                "@jridgewell/sourcemap-codec": "1.4.14"
+            }
+        },
         "@npmcli/fs": {
             "version": "1.1.1",
             "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-1.1.1.tgz",
@@ -9775,6 +13347,155 @@
             "integrity": "sha512-DMD0KiN46eipeziST1LPP/STfDU0sufISXmjSgvVsoU2tqxctQeASejWcfNtxYKqETM1UxQ8sp2OrSBWpHY6sw==",
             "dev": true
         },
+        "babel-loader": {
+            "version": "8.3.0",
+            "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-8.3.0.tgz",
+            "integrity": "sha512-H8SvsMF+m9t15HNLMipppzkC+Y2Yq+v3SonZyU70RBL/h1gxPkH08Ot8pEE9Z4Kd+czyWJClmFS8qzIP9OZ04Q==",
+            "dev": true,
+            "requires": {
+                "find-cache-dir": "^3.3.1",
+                "loader-utils": "^2.0.0",
+                "make-dir": "^3.1.0",
+                "schema-utils": "^2.6.5"
+            },
+            "dependencies": {
+                "find-cache-dir": {
+                    "version": "3.3.2",
+                    "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-3.3.2.tgz",
+                    "integrity": "sha512-wXZV5emFEjrridIgED11OoUKLxiYjAcqot/NJdAkOhlJ+vGzwhOAfcG5OX1jP+S0PcjEn8bdMJv+g2jwQ3Onig==",
+                    "dev": true,
+                    "requires": {
+                        "commondir": "^1.0.1",
+                        "make-dir": "^3.0.2",
+                        "pkg-dir": "^4.1.0"
+                    }
+                },
+                "find-up": {
+                    "version": "4.1.0",
+                    "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
+                    "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
+                    "dev": true,
+                    "requires": {
+                        "locate-path": "^5.0.0",
+                        "path-exists": "^4.0.0"
+                    }
+                },
+                "json5": {
+                    "version": "2.2.3",
+                    "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+                    "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+                    "dev": true
+                },
+                "loader-utils": {
+                    "version": "2.0.4",
+                    "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
+                    "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
+                    "dev": true,
+                    "requires": {
+                        "big.js": "^5.2.2",
+                        "emojis-list": "^3.0.0",
+                        "json5": "^2.1.2"
+                    }
+                },
+                "locate-path": {
+                    "version": "5.0.0",
+                    "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
+                    "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
+                    "dev": true,
+                    "requires": {
+                        "p-locate": "^4.1.0"
+                    }
+                },
+                "make-dir": {
+                    "version": "3.1.0",
+                    "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz",
+                    "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
+                    "dev": true,
+                    "requires": {
+                        "semver": "^6.0.0"
+                    }
+                },
+                "p-locate": {
+                    "version": "4.1.0",
+                    "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
+                    "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
+                    "dev": true,
+                    "requires": {
+                        "p-limit": "^2.2.0"
+                    }
+                },
+                "path-exists": {
+                    "version": "4.0.0",
+                    "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+                    "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+                    "dev": true
+                },
+                "pkg-dir": {
+                    "version": "4.2.0",
+                    "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz",
+                    "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
+                    "dev": true,
+                    "requires": {
+                        "find-up": "^4.0.0"
+                    }
+                },
+                "schema-utils": {
+                    "version": "2.7.1",
+                    "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-2.7.1.tgz",
+                    "integrity": "sha512-SHiNtMOUGWBQJwzISiVYKu82GiV4QYGePp3odlY1tuKO7gPtphAT5R/py0fA6xtbgLL/RvtJZnU9b8s0F1q0Xg==",
+                    "dev": true,
+                    "requires": {
+                        "@types/json-schema": "^7.0.5",
+                        "ajv": "^6.12.4",
+                        "ajv-keywords": "^3.5.2"
+                    }
+                },
+                "semver": {
+                    "version": "6.3.0",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+                    "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+                    "dev": true
+                }
+            }
+        },
+        "babel-plugin-polyfill-corejs2": {
+            "version": "0.3.3",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.3.3.tgz",
+            "integrity": "sha512-8hOdmFYFSZhqg2C/JgLUQ+t52o5nirNwaWM2B9LWteozwIvM14VSwdsCAUET10qT+kmySAlseadmfeeSWFCy+Q==",
+            "dev": true,
+            "requires": {
+                "@babel/compat-data": "^7.17.7",
+                "@babel/helper-define-polyfill-provider": "^0.3.3",
+                "semver": "^6.1.1"
+            },
+            "dependencies": {
+                "semver": {
+                    "version": "6.3.0",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+                    "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+                    "dev": true
+                }
+            }
+        },
+        "babel-plugin-polyfill-corejs3": {
+            "version": "0.6.0",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.6.0.tgz",
+            "integrity": "sha512-+eHqR6OPcBhJOGgsIar7xoAB1GcSwVUA3XjAd7HJNzOXT4wv6/H7KIdA/Nc60cvUlDbKApmqNvD1B1bzOt4nyA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-define-polyfill-provider": "^0.3.3",
+                "core-js-compat": "^3.25.1"
+            }
+        },
+        "babel-plugin-polyfill-regenerator": {
+            "version": "0.4.1",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.4.1.tgz",
+            "integrity": "sha512-NtQGmyQDXjQqQ+IzRkBVwEOz9lQ4zxAQZgoAYEtU9dJjnl1Oc98qnN7jcp+bE7O7aYzVpavXE3/VKXNzUbh7aw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-define-polyfill-provider": "^0.3.3"
+            }
+        },
         "balanced-match": {
             "version": "1.0.2",
             "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -10518,6 +14239,12 @@
             "resolved": "https://registry.npmjs.org/constants-browserify/-/constants-browserify-1.0.0.tgz",
             "integrity": "sha512-xFxOwqIzR/e1k1gLiWEophSCMqXcwVHIH7akf7b/vxcUeGunlj3hvZaaqxwHsTgn+IndtkQJgSztIDWeumWJDQ=="
         },
+        "convert-source-map": {
+            "version": "1.9.0",
+            "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
+            "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
+            "dev": true
+        },
         "copy-concurrently": {
             "version": "1.0.5",
             "resolved": "https://registry.npmjs.org/copy-concurrently/-/copy-concurrently-1.0.5.tgz",
@@ -10584,6 +14311,15 @@
             "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.30.0.tgz",
             "integrity": "sha512-hQotSSARoNh1mYPi9O2YaWeiq/cEB95kOrFb4NCrO4RIFt1qqNpKsaE+vy/L3oiqvND5cThqXzUU3r9F7Efztg=="
         },
+        "core-js-compat": {
+            "version": "3.27.2",
+            "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.27.2.tgz",
+            "integrity": "sha512-welaYuF7ZtbYKGrIy7y3eb40d37rG1FvzEOfe7hSLd2iD6duMDqUhRfSvCGyC46HhR6Y8JXXdZ2lnRUMkPBpvg==",
+            "dev": true,
+            "requires": {
+                "browserslist": "^4.21.4"
+            }
+        },
         "core-util-is": {
             "version": "1.0.3",
             "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
@@ -11160,6 +14896,32 @@
                 }
             }
         },
+        "csv": {
+            "version": "6.2.5",
+            "resolved": "https://registry.npmjs.org/csv/-/csv-6.2.5.tgz",
+            "integrity": "sha512-T+K0H7MIrlrnP6KxYKo3lK+uLl6OC2Gmwdd81TG/VdkhKvpatl35sR7tyRSpDLGl22y2T+q9KvNHnVtn4OAscQ==",
+            "requires": {
+                "csv-generate": "^4.2.1",
+                "csv-parse": "^5.3.3",
+                "csv-stringify": "^6.2.3",
+                "stream-transform": "^3.2.1"
+            }
+        },
+        "csv-generate": {
+            "version": "4.2.1",
+            "resolved": "https://registry.npmjs.org/csv-generate/-/csv-generate-4.2.1.tgz",
+            "integrity": "sha512-w6GFHjvApv6bcJ2xdi9JGsH6ZvUBfC+vUdfefnEzurXG6hMRwzkBLnhztU2H7v7+zfCk1I/knnQ+tGbgpxWrBw=="
+        },
+        "csv-parse": {
+            "version": "5.3.3",
+            "resolved": "https://registry.npmjs.org/csv-parse/-/csv-parse-5.3.3.tgz",
+            "integrity": "sha512-kEWkAPleNEdhFNkHQpFHu9RYPogsFj3dx6bCxL847fsiLgidzWg0z/O0B1kVWMJUc5ky64zGp18LX2T3DQrOfw=="
+        },
+        "csv-stringify": {
+            "version": "6.2.3",
+            "resolved": "https://registry.npmjs.org/csv-stringify/-/csv-stringify-6.2.3.tgz",
+            "integrity": "sha512-4qGjUMwnlaRc00gc2jrIYh2w/h1fo25B0mTuY9K8fBiIgtmCX3LcgUbrEGViL98Ci4Se/F5LFEtu8k+dItJVZQ=="
+        },
         "cyclist": {
             "version": "1.0.1",
             "resolved": "https://registry.npmjs.org/cyclist/-/cyclist-1.0.1.tgz",
@@ -11563,6 +15325,12 @@
             "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
             "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw=="
         },
+        "esutils": {
+            "version": "2.0.3",
+            "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+            "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+            "dev": true
+        },
         "events": {
             "version": "3.3.0",
             "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
@@ -11935,6 +15703,12 @@
             "integrity": "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==",
             "dev": true
         },
+        "gensync": {
+            "version": "1.0.0-beta.2",
+            "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+            "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+            "dev": true
+        },
         "get-intrinsic": {
             "version": "1.2.0",
             "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.0.tgz",
@@ -11982,6 +15756,12 @@
                 "is-glob": "^4.0.1"
             }
         },
+        "globals": {
+            "version": "11.12.0",
+            "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
+            "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
+            "dev": true
+        },
         "globalthis": {
             "version": "1.0.3",
             "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.3.tgz",
@@ -12735,6 +16515,12 @@
             "resolved": "https://registry.npmjs.org/jquery/-/jquery-3.6.4.tgz",
             "integrity": "sha512-v28EW9DWDFpzcD9O5iyJXg3R3+q+mET5JhnjJzQUZMHOv67bpSIHq81GEYpPNZHG+XXHsfSme3nxp/hndKEcsQ=="
         },
+        "js-tokens": {
+            "version": "4.0.0",
+            "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+            "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+            "dev": true
+        },
         "js-yaml": {
             "version": "3.14.1",
             "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
@@ -12812,6 +16598,12 @@
             "resolved": "https://registry.npmjs.org/lodash._reinterpolate/-/lodash._reinterpolate-3.0.0.tgz",
             "integrity": "sha512-xYHt68QRoYGjeeM/XOE1uJtvXQAgvszfBhjV4yvsQH0u2i9I6cI6c6/eG4Hh3UAOVn0y/xAXwmTzEay49Q//HA=="
         },
+        "lodash.debounce": {
+            "version": "4.0.8",
+            "resolved": "https://registry.npmjs.org/lodash.debounce/-/lodash.debounce-4.0.8.tgz",
+            "integrity": "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==",
+            "dev": true
+        },
         "lodash.memoize": {
             "version": "4.1.2",
             "resolved": "https://registry.npmjs.org/lodash.memoize/-/lodash.memoize-4.1.2.tgz",
@@ -14783,6 +18575,36 @@
                 "resolve": "^1.9.0"
             }
         },
+        "regenerate": {
+            "version": "1.4.2",
+            "resolved": "https://registry.npmjs.org/regenerate/-/regenerate-1.4.2.tgz",
+            "integrity": "sha512-zrceR/XhGYU/d/opr2EKO7aRHUeiBI8qjtfHqADTwZd6Szfy16la6kqD0MIUs5z5hx6AaKa+PixpPrR289+I0A==",
+            "dev": true
+        },
+        "regenerate-unicode-properties": {
+            "version": "10.1.0",
+            "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-10.1.0.tgz",
+            "integrity": "sha512-d1VudCLoIGitcU/hEg2QqvyGZQmdC0Lf8BqdOMXGFSvJP4bNV1+XqbPQeHHLD51Jh4QJJ225dlIFvY4Ly6MXmQ==",
+            "dev": true,
+            "requires": {
+                "regenerate": "^1.4.2"
+            }
+        },
+        "regenerator-runtime": {
+            "version": "0.13.11",
+            "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
+            "integrity": "sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==",
+            "dev": true
+        },
+        "regenerator-transform": {
+            "version": "0.15.1",
+            "resolved": "https://registry.npmjs.org/regenerator-transform/-/regenerator-transform-0.15.1.tgz",
+            "integrity": "sha512-knzmNAcuyxV+gQCufkYcvOqX/qIIfHLv0u5x79kRxuGojfYVky1f15TzZEu2Avte8QGepvUNTnLskf8E6X6Vyg==",
+            "dev": true,
+            "requires": {
+                "@babel/runtime": "^7.8.4"
+            }
+        },
         "regex-not": {
             "version": "1.0.2",
             "resolved": "https://registry.npmjs.org/regex-not/-/regex-not-1.0.2.tgz",
@@ -14803,6 +18625,43 @@
                 "functions-have-names": "^1.2.2"
             }
         },
+        "regexpu-core": {
+            "version": "5.2.2",
+            "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-5.2.2.tgz",
+            "integrity": "sha512-T0+1Zp2wjF/juXMrMxHxidqGYn8U4R+zleSJhX9tQ1PUsS8a9UtYfbsF9LdiVgNX3kiX8RNaKM42nfSgvFJjmw==",
+            "dev": true,
+            "requires": {
+                "regenerate": "^1.4.2",
+                "regenerate-unicode-properties": "^10.1.0",
+                "regjsgen": "^0.7.1",
+                "regjsparser": "^0.9.1",
+                "unicode-match-property-ecmascript": "^2.0.0",
+                "unicode-match-property-value-ecmascript": "^2.1.0"
+            }
+        },
+        "regjsgen": {
+            "version": "0.7.1",
+            "resolved": "https://registry.npmjs.org/regjsgen/-/regjsgen-0.7.1.tgz",
+            "integrity": "sha512-RAt+8H2ZEzHeYWxZ3H2z6tF18zyyOnlcdaafLrm21Bguj7uZy6ULibiAFdXEtKQY4Sy7wDTwDiOazasMLc4KPA==",
+            "dev": true
+        },
+        "regjsparser": {
+            "version": "0.9.1",
+            "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.9.1.tgz",
+            "integrity": "sha512-dQUtn90WanSNl+7mQKcXAgZxvUe7Z0SqXlgzv0za4LwiUhyzBC58yQO3liFoUgu8GiJVInAhJjkj1N0EtQ5nkQ==",
+            "dev": true,
+            "requires": {
+                "jsesc": "~0.5.0"
+            },
+            "dependencies": {
+                "jsesc": {
+                    "version": "0.5.0",
+                    "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-0.5.0.tgz",
+                    "integrity": "sha512-uZz5UnB7u4T9LvwmFqXii7pZSouaRPorGs5who1Ip7VO0wxanFvBL7GkM6dTHlgX+jhBApRetaWpnDabOeTcnA==",
+                    "dev": true
+                }
+            }
+        },
         "relateurl": {
             "version": "0.2.7",
             "resolved": "https://registry.npmjs.org/relateurl/-/relateurl-0.2.7.tgz",
@@ -15414,6 +19273,11 @@
             "resolved": "https://registry.npmjs.org/stream-shift/-/stream-shift-1.0.1.tgz",
             "integrity": "sha512-AiisoFqQ0vbGcZgQPY1cdP2I76glaVA/RauYR4G4thNFgkTqr90yXTo4LYX60Jl+sIlPNHHdGSwo01AvbKUSVQ=="
         },
+        "stream-transform": {
+            "version": "3.2.1",
+            "resolved": "https://registry.npmjs.org/stream-transform/-/stream-transform-3.2.1.tgz",
+            "integrity": "sha512-ApK+WTJ5bCOf0A2tlec1qhvr8bGEBM/sgXXB7mysdCYgZJO5DZeaV3h3G+g0HnAQ372P5IhiGqnW29zoLOfTzQ=="
+        },
         "string_decoder": {
             "version": "1.1.1",
             "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
@@ -15753,6 +19617,12 @@
             "resolved": "https://registry.npmjs.org/to-arraybuffer/-/to-arraybuffer-1.0.1.tgz",
             "integrity": "sha512-okFlQcoGTi4LQBG/PgSYblw9VOyptsz2KJZqc6qtgGdes8VktzUQkj4BI2blit072iS8VODNcMA+tvnS9dnuMA=="
         },
+        "to-fast-properties": {
+            "version": "2.0.0",
+            "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
+            "integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==",
+            "dev": true
+        },
         "to-object-path": {
             "version": "0.3.0",
             "resolved": "https://registry.npmjs.org/to-object-path/-/to-object-path-0.3.0.tgz",
@@ -15830,6 +19700,34 @@
                 "which-boxed-primitive": "^1.0.2"
             }
         },
+        "unicode-canonical-property-names-ecmascript": {
+            "version": "2.0.0",
+            "resolved": "https://registry.npmjs.org/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.0.tgz",
+            "integrity": "sha512-yY5PpDlfVIU5+y/BSCxAJRBIS1Zc2dDG3Ujq+sR0U+JjUevW2JhocOF+soROYDSaAezOzOKuyyixhD6mBknSmQ==",
+            "dev": true
+        },
+        "unicode-match-property-ecmascript": {
+            "version": "2.0.0",
+            "resolved": "https://registry.npmjs.org/unicode-match-property-ecmascript/-/unicode-match-property-ecmascript-2.0.0.tgz",
+            "integrity": "sha512-5kaZCrbp5mmbz5ulBkDkbY0SsPOjKqVS35VpL9ulMPfSl0J0Xsm+9Evphv9CoIZFwre7aJoa94AY6seMKGVN5Q==",
+            "dev": true,
+            "requires": {
+                "unicode-canonical-property-names-ecmascript": "^2.0.0",
+                "unicode-property-aliases-ecmascript": "^2.0.0"
+            }
+        },
+        "unicode-match-property-value-ecmascript": {
+            "version": "2.1.0",
+            "resolved": "https://registry.npmjs.org/unicode-match-property-value-ecmascript/-/unicode-match-property-value-ecmascript-2.1.0.tgz",
+            "integrity": "sha512-qxkjQt6qjg/mYscYMC0XKRn3Rh0wFPlfxB0xkt9CfyTvpX1Ra0+rAmdX2QyAobptSEvuy4RtpPRui6XkV+8wjA==",
+            "dev": true
+        },
+        "unicode-property-aliases-ecmascript": {
+            "version": "2.1.0",
+            "resolved": "https://registry.npmjs.org/unicode-property-aliases-ecmascript/-/unicode-property-aliases-ecmascript-2.1.0.tgz",
+            "integrity": "sha512-6t3foTQI9qne+OZoVQB/8x8rk2k1eVy1gRXhV3oFQ5T6R1dqQ1xtin3XqSlx3+ATBkliTaR/hHyJBm+LVPNM8w==",
+            "dev": true
+        },
         "union-value": {
             "version": "1.0.1",
             "resolved": "https://registry.npmjs.org/union-value/-/union-value-1.0.1.tgz",
@@ -16342,6 +20240,11 @@
             "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
             "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
         },
+        "yaml": {
+            "version": "2.2.1",
+            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.1.tgz",
+            "integrity": "sha512-e0WHiYql7+9wr4cWMx3TVQrNwejKaEe7/rHNmQmqRjazfOP5W8PB6Jpebb5o6fIapbz9o9+2ipcaTM2ZwDI6lw=="
+        },
         "yocto-queue": {
             "version": "0.1.0",
             "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
diff --git a/guacamole/src/main/frontend/package.json b/guacamole/src/main/frontend/package.json
index cb4982da0..617cf308b 100644
--- a/guacamole/src/main/frontend/package.json
+++ b/guacamole/src/main/frontend/package.json
@@ -12,13 +12,18 @@
         "angular-translate-interpolation-messageformat": "^2.19.0",
         "angular-translate-loader-static-files": "^2.19.0",
         "blob-polyfill": ">=7.0.20220408",
+        "csv": "^6.2.5",
         "datalist-polyfill": "^1.25.1",
         "file-saver": "^2.0.5",
         "jquery": "^3.6.4",
         "jstz": "^2.1.1",
-        "lodash": "^4.17.21"
+        "lodash": "^4.17.21",
+        "yaml": "^2.2.1"
     },
     "devDependencies": {
+        "@babel/core": "^7.20.12",
+        "@babel/preset-env": "^7.20.2",
+        "babel-loader": "^8.3.0",
         "clean-webpack-plugin": "^4.0.0",
         "closure-webpack-plugin": "^2.6.1",
         "copy-webpack-plugin": "^5.1.2",
diff --git a/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js b/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
index d1e78754c..51c423932 100644
--- a/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
+++ b/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
@@ -126,6 +126,15 @@ angular.module('index').config(['$routeProvider', '$locationProvider',
             resolve       : { routeToUserHomePage: routeToUserHomePage }
         })
 
+        // Connection import page
+        .when('/settings/:dataSource/import', {
+            title         : 'APP.NAME',
+            bodyClassName : 'settings',
+            templateUrl   : 'app/settings/templates/settingsImport.html',
+            controller    : 'importConnectionsController',
+            resolve       : { updateCurrentToken: updateCurrentToken }
+        })
+
         // Management screen
         .when('/settings/:dataSource?/:tab', {
             title         : 'APP.NAME',
diff --git a/guacamole/src/main/frontend/src/app/rest/services/connectionService.js b/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
index 3531177ea..a91c8d05d 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
@@ -154,6 +154,46 @@ angular.module('rest').factory('connectionService', ['$injector',
         }
 
     };
+
+    /**
+     * Makes a request to the REST API to create multiple connections, returning a
+     * a promise that can be used for processing the results of the call. This
+     * operation is atomic - if any errors are encountered during the connection
+     * creation process, the entire request will fail, and no connections will be
+     * created.
+     *
+     * @param {Connection[]} connections The connections to create.
+     *
+     * @returns {Promise}
+     *     A promise for the HTTP call which will succeed if and only if the
+     *     create operation is successful.
+     */
+    service.createConnections = function createConnections(dataSource, connections) {
+
+        // An object containing a PATCH operation to create each connection
+        const patchBody = connections.map(connection => ({
+            op: "add",
+            path: "/",
+            value: connection
+        }));
+
+        // Make a PATCH request to create the connections
+        return authenticationService.request({
+            method  : 'PATCH',
+            url     : 'api/session/data/' + encodeURIComponent(dataSource) + '/connections',
+            data    : patchBody
+        })
+
+        // Clear the cache
+        .then(function connectionUpdated(){
+            cacheService.connections.removeAll();
+
+            // Clear users cache to force reload of permissions for this
+            // newly updated connection
+            cacheService.users.removeAll();
+        });
+
+    }
     
     /**
      * Makes a request to the REST API to delete a connection,
diff --git a/guacamole/src/main/frontend/src/app/rest/types/RelatedObjectPatch.js b/guacamole/src/main/frontend/src/app/rest/types/RelatedObjectPatch.js
index bb82def73..c06493816 100644
--- a/guacamole/src/main/frontend/src/app/rest/types/RelatedObjectPatch.js
+++ b/guacamole/src/main/frontend/src/app/rest/types/RelatedObjectPatch.js
@@ -82,4 +82,4 @@ angular.module('rest').factory('RelatedObjectPatch', [function defineRelatedObje
 
     return RelatedObjectPatch;
 
-}]);
\ No newline at end of file
+}]);
diff --git a/guacamole/src/main/frontend/src/app/settings/controllers/connectionHistoryPlayerController.js b/guacamole/src/main/frontend/src/app/settings/controllers/connectionHistoryPlayerController.js
index b40f5f93a..12c368be3 100644
--- a/guacamole/src/main/frontend/src/app/settings/controllers/connectionHistoryPlayerController.js
+++ b/guacamole/src/main/frontend/src/app/settings/controllers/connectionHistoryPlayerController.js
@@ -20,7 +20,7 @@
 /**
  * The controller for the session recording player page.
  */
-angular.module('manage').controller('connectionHistoryPlayerController', ['$scope', '$injector', 
+angular.module('settings').controller('connectionHistoryPlayerController', ['$scope', '$injector',
         function connectionHistoryPlayerController($scope, $injector) {
 
     // Required services
diff --git a/guacamole/src/main/frontend/src/app/settings/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/settings/controllers/importConnectionsController.js
new file mode 100644
index 000000000..33b8914ad
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/settings/controllers/importConnectionsController.js
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * The controller for the connection import page.
+ */
+angular.module('settings').controller('importConnectionsController', ['$scope', '$injector',
+        function importConnectionsController($scope, $injector) {
+
+    // Required services
+    const connectionImportParseService = $injector.get('connectionImportParseService');
+    const connectionService = $injector.get('connectionService');
+
+    function processData(type, data) {
+
+        let requestBody;
+
+        // Parse the data based on the provided mimetype
+        switch(type) {
+
+            case "application/json":
+            case "text/json":
+                requestBody = connectionImportParseService.parseJSON(data);
+                break;
+
+            case "text/csv":
+                requestBody = connectionImportParseService.parseCSV(data);
+                break;
+
+            case "application/yaml":
+            case "application/x-yaml":
+            case "text/yaml":
+            case "text/x-yaml":
+                requestBody = connectionImportParseService.parseYAML(data);
+                break;
+
+        }
+
+        console.log(requestBody);
+    }
+
+    $scope.upload = function() {
+
+        const files = angular.element('#file')[0].files;
+
+        if (files.length <= 0) {
+            console.error("TODO: This should be a proper error tho");
+            return;
+        }
+
+        // The file that the user uploaded
+        const file = files[0];
+
+        // Call processData when the data is ready
+        const reader = new FileReader();
+        reader.onloadend = (e => processData(file.type, e.target.result));
+
+        // Read all the data into memory and call processData when done
+        reader.readAsBinaryString(file);
+    }
+
+}]);
diff --git a/guacamole/src/main/frontend/src/app/settings/controllers/settingsController.js b/guacamole/src/main/frontend/src/app/settings/controllers/settingsController.js
index a462d8715..9961d292f 100644
--- a/guacamole/src/main/frontend/src/app/settings/controllers/settingsController.js
+++ b/guacamole/src/main/frontend/src/app/settings/controllers/settingsController.js
@@ -20,7 +20,7 @@
 /**
  * The controller for the general settings page.
  */
-angular.module('manage').controller('settingsController', ['$scope', '$injector', 
+angular.module('settings').controller('settingsController', ['$scope', '$injector',
         function settingsController($scope, $injector) {
 
     // Required services
diff --git a/guacamole/src/main/frontend/src/app/settings/services/connectionImportParseService.js b/guacamole/src/main/frontend/src/app/settings/services/connectionImportParseService.js
new file mode 100644
index 000000000..f2735acd6
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/settings/services/connectionImportParseService.js
@@ -0,0 +1,355 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * 'License'); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/* global _ */
+
+import { parse as parseCSVData } from 'csv-parse/lib/sync'
+import { parse as parseYAMLData } from 'yaml'
+
+/**
+ * A service for parsing user-provided JSON, YAML, or JSON connection data into
+ * an appropriate format for bulk uploading using the PATCH REST endpoint.
+ */
+angular.module('settings').factory('connectionImportParseService',
+        ['$injector', function connectionImportParseService($injector) {
+
+    // Required types
+    const Connection          = $injector.get('Connection');
+    const ParseError          = $injector.get('ParseError');
+    const TranslatableMessage = $injector.get('TranslatableMessage');
+    
+    // Required services
+    const $q                     = $injector.get('$q');
+    const $routeParams           = $injector.get('$routeParams');
+    const schemaService          = $injector.get('schemaService');
+    const connectionGroupService = $injector.get('connectionGroupService');
+
+    const service = {};
+    
+    /**
+     * Perform basic checks, common to all file types - namely that the parsed
+     * data is an array, and contains at least one connection entry.
+     * 
+     * @throws {ParseError}
+     *     An error describing the parsing failure, if one of the basic checks
+     *     fails.
+     */
+    function performBasicChecks(parsedData) {
+        
+        // Make sure that the file data parses to an array (connection list)
+        if (!(parsedData instanceof Array))
+            throw new ParseError({
+                message: 'Import data must be a list of connections',
+                translatableMessage: new TranslatableMessage({
+                    key: 'SETTINGS_CONNECTION_IMPORT.ERROR_ARRAY_REQUIRED'
+                })
+            });
+
+        // Make sure that the connection list is not empty - contains at least
+        // one connection
+        if (!parsedData.length)
+            throw new ParseError({
+                message: 'The provided CSV file is empty',
+                translatableMessage: new TranslatableMessage({
+                    key: 'SETTINGS_CONNECTION_IMPORT.ERROR_EMPTY_FILE'
+                })
+            });
+    }
+
+    /**
+     * Convert a provided YAML representation of a connection list into a JSON
+     * string to be submitted to the PATCH REST endpoint. The returned JSON
+     * string will contain a PATCH operation to create each connection in the
+     * provided list.
+     *
+     * @param {String} yamlData
+     *     The YAML-encoded connection list to convert to a PATCH request body.
+     *
+     * @return {Promise.<Connection[]>}
+     *     A promise resolving to an array of Connection objects, one for each 
+     *     connection in the provided CSV.
+     */
+    service.parseYAML = function parseYAML(yamlData) {
+
+        // Parse from YAML into a javascript array
+        const parsedData = parseYAMLData(yamlData);
+        
+        // Check that the data is the correct format, and not empty
+        performBasicChecks(parsedData);
+        
+        // Convert to an array of Connection objects and return
+        const deferredConnections = $q.defer();
+        deferredConnections.resolve(
+                parsedData.map(connection => new Connection(connection)));
+        return deferredConnections.promise;
+
+    };
+    
+    /**
+     * Returns a promise that resolves to an object detailing the connection
+     * attributes for the current data source, as well as the connection
+     * paremeters for every protocol, for the current data source.
+     * 
+     * The object that the promise will contain an "attributes" key that maps to
+     * a set of attribute names, and a "protocolParameters" key that maps to an
+     * object mapping protocol names to sets of parameter names for that protocol.
+     * 
+     * The intended use case for this object is to determine if there is a
+     * connection parameter or attribute with a given name, by e.g. checking the
+     * path `.protocolParameters[protocolName]` to see if a protocol exists,
+     * checking the path `.protocolParameters[protocolName][fieldName]` to see
+     * if a parameter exists for a given protocol, or checking the path
+     * `.attributes[fieldName]` to check if a connection attribute exists.
+     * 
+     * @returns {Promise.<Object>}
+     */
+    function getFieldLookups() {
+        
+        // The current data source - the one that the connections will be
+        // imported into
+        const dataSource = $routeParams.dataSource;
+        
+        // Fetch connection attributes and protocols for the current data source
+        return $q.all({
+            attributes : schemaService.getConnectionAttributes(dataSource),
+            protocols  : schemaService.getProtocols(dataSource)
+        })
+        .then(function connectionStructureRetrieved({attributes, protocols}) {
+            
+            return {
+                
+                // Translate the forms and fields into a flat map of attribute
+                // name to `true` boolean value
+                attributes: attributes.reduce(
+                    (attributeMap, form) => {
+                        form.fields.forEach(
+                            field => attributeMap[field.name] = true); 
+                        return attributeMap
+                    }, {}),
+                  
+                // Translate the protocol definitions into a map of protocol
+                // name to map of field name to `true` boolean value
+                protocolParameters: _.mapValues(
+                    protocols, protocol => protocol.connectionForms.reduce(
+                        (protocolFieldMap, form) => {
+                            form.fields.forEach(
+                                field => protocolFieldMap[field.name] = true); 
+                            return protocolFieldMap;
+                        }, {}))
+            };
+        });
+            
+    }
+    
+    
+    /**
+     * Returns a promise that resolves to an object mapping potential groups
+     * that might be encountered in an imported connection to group identifiers.
+     * 
+     * The idea is that a user-provided import file might directly specify a
+     * parentIdentifier, or it might specify a named group path like "ROOT",
+     * "ROOT/parent", or "ROOT/parent/child". This object resolved by the 
+     * promise returned from this function will map all of the above to the 
+     * identifier of the appropriate group, if defined.
+     * 
+     * @returns {Promise.<Object>}
+     */
+    function getGroupLookups() {
+        
+        // The current data source - defines all the groups that the connections
+        // might be imported into
+        const dataSource = $routeParams.dataSource;
+        
+        const deferredGroupLookups = $q.defer();
+        
+        connectionGroupService.getConnectionGroupTree(dataSource).then(
+                rootGroup => {
+            
+            const groupLookup = {};
+            
+            // Add the specified group to the lookup, appending all specified
+            // prefixes, and then recursively call saveLookups for all children
+            // of the group, appending to the prefix for each level
+            function saveLookups(prefix, group) {
+                
+                // To get the path for the current group, add the name
+                const currentPath = prefix + group.name;
+                
+                // Add the current path to the lookup
+                groupLookup[currentPath] = group.identifier;
+                
+                // Add each child group to the lookup
+                const nextPrefix = currentPath + "/";
+                _.forEach(group.childConnectionGroups,
+                        childGroup => saveLookups(nextPrefix, childGroup));
+            }
+            
+            // Start at the root group
+            saveLookups("", rootGroup);
+            
+            // Resolve with the now fully-populated lookups
+            deferredGroupLookups.resolve(groupLookup);
+            
+        });
+        
+        return deferredGroupLookups.promise;
+    }
+    
+/*
+// Example Connection JSON
+{
+   "attributes": {
+       "failover-only": "true",
+       "guacd-encryption": "none",
+       "guacd-hostname": "potato",
+       "guacd-port": "1234",
+       "ksm-user-config-enabled": "true",
+       "max-connections": "1",
+       "max-connections-per-user": "1",
+       "weight": "1"
+   },
+   "name": "Bloatato",
+   "parameters": {
+       "audio-servername": "heyoooooooo",
+       "clipboard-encoding": "",
+       "color-depth": "",
+       "create-recording-path": "",
+       "cursor": "remote",
+       "dest-host": "pooootato",
+       "dest-port": "4444",
+       "disable-copy": "",
+       "disable-paste": "true",
+       "enable-audio": "true",
+       "enable-sftp": "true",
+       "force-lossless": "true",
+       "hostname": "potato",
+       "password": "taste",
+       "port": "4321",
+       "read-only": "",
+       "recording-exclude-mouse": "",
+       "recording-exclude-output": "",
+       "recording-include-keys": "",
+       "recording-name": "heyoooooo",
+       "recording-path": "/path/to/goo",
+       "sftp-disable-download": "",
+       "sftp-disable-upload": "",
+       "sftp-hostname": "what what good sir",
+       "sftp-port": "",
+       "sftp-private-key": "lol i'll never tell",
+       "sftp-server-alive-interval": "",
+       "swap-red-blue": "true",
+       "username": "test",
+       "wol-send-packet": "",
+       "wol-udp-port": "",
+       "wol-wait-time": ""
+   },
+                
+   // or a numeric identifier - we will probably want to offer a way to allow
+   // them to specify a path like "ROOT/parent/child" or just "/parent/child" or
+   // something like that
+   // TODO: Call the 
+   "parentIdentifier": "ROOT",
+   "protocol": "vnc"
+                
+}
+*/
+
+    /**
+     * Convert a provided JSON representation of a connection list into a JSON
+     * string to be submitted to the PATCH REST endpoint. The returned JSON
+     * string will contain a PATCH operation to create each connection in the
+     * provided list.
+     *
+     * TODO: Describe disambiguation suffixes, e.g. hostname (parameter), and
+     * that we will accept without the suffix if it's unambigous. (or not? how about not?)
+     *
+     * @param {String} csvData
+     *     The JSON-encoded connection list to convert to a PATCH request body.
+     *
+     * @return {Promise.<Connection[]>}
+     *     A promise resolving to an array of Connection objects, one for each 
+     *     connection in the provided CSV.
+     */
+    service.parseCSV = function parseCSV(csvData) {
+        
+        const deferredConnections = $q.defer();
+        
+        return $q.all({
+            fieldLookups : getFieldLookups(),
+            groupLookups : getGroupLookups()
+        })
+        .then(function lookupsReady({fieldLookups, groupLookups}) {
+        
+            const {attributes, protocolParameters} = fieldLookups;
+    
+            console.log({attributes, protocolParameters}, groupLookups);
+            
+            // Convert to an array of arrays, one per CSV row (including the header)
+            const parsedData = parseCSVData(csvData);
+
+            // Slice off the header row to get the data rows
+            const connectionData = parsedData.slice(1);
+
+            // Check that the provided CSV is not empty (the parser always
+            // returns an array)
+            performBasicChecks(connectionData);
+
+            // The header row - an array of string header values
+            const header = parsedData[0];
+            
+            // TODO: Connectionify this
+            deferredConnections.resolve(connectionData);
+        });
+        
+        return deferredConnections.promise;
+
+    };
+
+    /**
+     * Convert a provided JSON representation of a connection list into a JSON
+     * string to be submitted to the PATCH REST endpoint. The returned JSON
+     * string will contain a PATCH operation to create each connection in the
+     * provided list.
+     *
+     * @param {String} jsonData
+     *     The JSON-encoded connection list to convert to a PATCH request body.
+     *
+     * @return {Promise.<Connection[]>}
+     *     A promise resolving to an array of Connection objects, one for each 
+     *     connection in the provided CSV.
+     */
+    service.parseJSON = function parseJSON(jsonData) {
+
+        // Parse from JSON into a javascript array
+        const parsedData = JSON.parse(yamlData);
+        
+        // Check that the data is the correct format, and not empty
+        performBasicChecks(parsedData);
+        
+        // Convert to an array of Connection objects and return
+        const deferredConnections = $q.defer();
+        deferredConnections.resolve(
+                parsedData.map(connection => new Connection(connection)));
+        return deferredConnections.promise;
+        
+    };
+
+    return service;
+
+}]);
diff --git a/guacamole/src/main/frontend/src/app/settings/styles/buttons.css b/guacamole/src/main/frontend/src/app/settings/styles/buttons.css
index f925c5121..167e46a06 100644
--- a/guacamole/src/main/frontend/src/app/settings/styles/buttons.css
+++ b/guacamole/src/main/frontend/src/app/settings/styles/buttons.css
@@ -20,7 +20,8 @@
 a.button.add-user,
 a.button.add-user-group,
 a.button.add-connection,
-a.button.add-connection-group {
+a.button.add-connection-group,
+a.button.import-connections {
     font-size: 0.8em;
     padding-left: 1.8em;
     position: relative;
@@ -29,7 +30,8 @@ a.button.add-connection-group {
 a.button.add-user::before,
 a.button.add-user-group::before,
 a.button.add-connection::before,
-a.button.add-connection-group::before {
+a.button.add-connection-group::before,
+a.button.import-connections::before {
 
     content: ' ';
     position: absolute;
@@ -59,3 +61,7 @@ a.button.add-connection::before {
 a.button.add-connection-group::before {
     background-image: url('images/action-icons/guac-group-add.svg');
 }
+
+a.button.import-connections::before {
+    background-image: url('images/action-icons/guac-monitor-add-many.svg');
+}
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
index ca7bc30df..76ebeebec 100644
--- a/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
@@ -9,6 +9,10 @@
         <!-- Form action buttons -->
         <div class="action-buttons">
 
+            <a class="import-connections button"
+                ng-show="canCreateConnections()"
+                href="#/settings/{{dataSource | escape}}/import/">{{'SETTINGS_CONNECTIONS.ACTION_IMPORT_CONNECTIONS' | translate}}</a>
+
             <a class="add-connection button"
                ng-show="canCreateConnections()"
                href="#/manage/{{dataSource | escape}}/connections/">{{'SETTINGS_CONNECTIONS.ACTION_NEW_CONNECTION' | translate}}</a>
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsImport.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsImport.html
new file mode 100644
index 000000000..c9c54e10e
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsImport.html
@@ -0,0 +1,11 @@
+<div class="settings-view import">
+
+    <div class="header">
+        <h2>{{'SETTINGS_CONNECTION_IMPORT.HEADER' | translate}}</h2>
+        <guac-user-menu></guac-user-menu>
+    </div>
+
+    <input type="file" id="file" name="file"/>
+    <button ng-click="upload()">Add</button>
+
+</div>
diff --git a/guacamole/src/main/frontend/src/app/settings/types/ParseError.js b/guacamole/src/main/frontend/src/app/settings/types/ParseError.js
new file mode 100644
index 000000000..b3d3da03a
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/settings/types/ParseError.js
@@ -0,0 +1,59 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Service which defines the ParseError class.
+ */
+angular.module('settings').factory('ParseError', [function defineParseError() {
+
+    /**
+     * An error representing a parsing failure when attempting to convert
+     * user-provided data into a list of Connection objects.
+     *
+     * @constructor
+     * @param {ParseError|Object} [template={}]
+     *     The object whose properties should be copied within the new
+     *     ParseError.
+     */
+    var ParseError = function ParseError(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * A human-readable message describing the error that occurred.
+         *
+         * @type String
+         */
+        this.message = template.message;
+
+        /**
+         * A message which can be translated using the translation service,
+         * consisting of a translation key and optional set of substitution
+         * variables.
+         *
+         * @type TranslatableMessage
+         */
+        this.translatableMessage = template.translatableMessage;
+
+    };
+
+    return ParseError;
+
+}]);
diff --git a/guacamole/src/main/frontend/src/images/action-icons/guac-monitor-add-many.svg b/guacamole/src/main/frontend/src/images/action-icons/guac-monitor-add-many.svg
new file mode 100644
index 000000000..95ab14b76
--- /dev/null
+++ b/guacamole/src/main/frontend/src/images/action-icons/guac-monitor-add-many.svg
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   width="64"
+   height="64"
+   viewBox="0 0 64 64"
+   version="1.1"
+   id="svg3828"
+   sodipodi:docname="guac-monitor-add-many.svg"
+   inkscape:version="1.1.2 (0a00cf5339, 2022-02-04)"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg">
+  <defs
+     id="defs3832" />
+  <sodipodi:namedview
+     id="namedview3830"
+     pagecolor="#5b5b5b"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageshadow="2"
+     inkscape:pageopacity="0"
+     inkscape:pagecheckerboard="true"
+     showgrid="false"
+     inkscape:zoom="6.546875"
+     inkscape:cx="33.603819"
+     inkscape:cy="22.377088"
+     inkscape:window-width="2048"
+     inkscape:window-height="1025"
+     inkscape:window-x="0"
+     inkscape:window-y="28"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="svg3828" />
+  <g
+     transform="translate(-19.073 1.734) scale(.10947)"
+     style="fill:#fff"
+     id="g3822">
+    <path
+       style="fill:#fff;fill-opacity:1;stroke:#000;stroke-width:.00956892;stroke-linecap:round;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0"
+       d="M4 .656c-2.215 0-4 1.927-4 4.313V48.03c0 2.386 1.785 4.282 4 4.282h56c2.215 0 4-1.896 4-4.282V4.97c0-2.386-1.785-4.313-4-4.313H4zm10.313 10.938h35.374c1.4 0 2.532 1.093 2.532 2.469v24.843c0 1.376-1.132 2.469-2.532 2.469H14.313c-1.4 0-2.532-1.093-2.532-2.469V14.063c0-1.376 1.132-2.47 2.531-2.47z"
+       transform="translate(174.22 231.813) scale(5.22525)"
+       id="path3818" />
+    <rect
+       ry="18"
+       rx="18"
+       y="524.187"
+       x="244.268"
+       height="38.636"
+       width="197.179"
+       style="fill:#fff;fill-opacity:1;stroke:#000;stroke-width:.05000001;stroke-linecap:round;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0"
+       id="rect3820" />
+  </g>
+  <path
+     style="fill:#ffffff;stroke:none"
+     d="m 48.309,0.865 h 7.518 V 23 h -7.518 z"
+     id="path3824" />
+  <path
+     style="fill:#ffffff;stroke:none"
+     d="m 63.135,8.173 v 7.518 H 41 V 8.173 Z"
+     id="path3826" />
+  <path
+     style="fill:#ffffff;stroke:none"
+     d="m 48.309,27 h 7.518 v 22.135 h -7.518 z"
+     id="path3824-2" />
+  <path
+     style="fill:#ffffff;stroke:none"
+     d="m 63.135,34.308 v 7.518 H 41 v -7.518 z"
+     id="path3826-8" />
+  <path
+     style="fill:#ffffff;stroke:none"
+     d="m 22.174,0.865 h 7.518 V 23 h -7.518 z"
+     id="path3824-4" />
+  <path
+     style="fill:#ffffff;stroke:none"
+     d="m 37,8.173 v 7.518 H 14.865 V 8.173 Z"
+     id="path3826-7" />
+</svg>
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 450a455bb..21812d376 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -5,7 +5,7 @@
     "APP" : {
 
         "NAME"    : "Apache Guacamole",
-        "VERSION" : "${project.version}",
+        "VERSION" : "1.5.0",
 
         "ACTION_ACKNOWLEDGE"        : "OK",
         "ACTION_CANCEL"             : "Cancel",
@@ -906,6 +906,7 @@
     "SETTINGS_CONNECTIONS" : {
 
         "ACTION_ACKNOWLEDGE"          : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_IMPORT_CONNECTIONS"   : "Import",
         "ACTION_NEW_CONNECTION"       : "New Connection",
         "ACTION_NEW_CONNECTION_GROUP" : "New Group",
         "ACTION_NEW_SHARING_PROFILE"  : "New Sharing Profile",
@@ -922,6 +923,13 @@
 
     },
 
+    "SETTINGS_CONNECTION_IMPORT": {
+
+        "HEADER": "Connection Import",
+
+        "ERROR_ARRAY_REQUIRED": "The provided file must contain a list of connections"
+    },
+
     "SETTINGS_PREFERENCES" : {
 
         "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
diff --git a/guacamole/src/main/frontend/webpack.config.js b/guacamole/src/main/frontend/webpack.config.js
index 29bb8ddd5..dc6ad08cf 100644
--- a/guacamole/src/main/frontend/webpack.config.js
+++ b/guacamole/src/main/frontend/webpack.config.js
@@ -47,6 +47,22 @@ module.exports = {
     module: {
         rules: [
 
+            // NOTE: This is required in order to parse ES2020 language features,
+            // like the optional chaining and nullish coalescing operators. It
+            // specifically needs to operate on the node-modules directory since
+            // Webpack 4 cannot handle such language features.
+            {
+                test: /\.js$/i,
+                use: {
+                    loader: 'babel-loader',
+                    options: {
+                      presets: [
+                        ['@babel/preset-env']
+                      ]
+                    }
+                }
+            },
+
             // Automatically extract imported CSS for later reference within separate CSS file
             {
                 test: /\.css$/i,

From fac76ef0cb1a3ff52bd5c03ba4aa632630175c02 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 1 Feb 2023 23:25:12 +0000
Subject: [PATCH 148/289] GUACAMOLE-926: Migrate import code to a dedicated
 module.

---
 .../importConnectionsController.js            |  10 +-
 .../frontend/src/app/import/importModule.js   |  24 ++++
 .../import/services/connectionCSVService.js   | 103 ++++++++++++++++++
 .../services/connectionParseService.js}       |  62 +++++------
 .../templates/connectionImport.html}          |   0
 .../{settings => import}/types/ParseError.js  |   2 +-
 .../src/app/index/config/indexRouteConfig.js  |   4 +-
 .../app/rest/services/connectionService.js    |  37 +++----
 .../src/app/rest/types/DirectoryPatch.js      |  95 ++++++++++++++++
 .../app/rest/types/DirectoryPatchOutcome.js   |  83 ++++++++++++++
 10 files changed, 361 insertions(+), 59 deletions(-)
 rename guacamole/src/main/frontend/src/app/{settings => import}/controllers/importConnectionsController.js (83%)
 create mode 100644 guacamole/src/main/frontend/src/app/import/importModule.js
 create mode 100644 guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
 rename guacamole/src/main/frontend/src/app/{settings/services/connectionImportParseService.js => import/services/connectionParseService.js} (98%)
 rename guacamole/src/main/frontend/src/app/{settings/templates/settingsImport.html => import/templates/connectionImport.html} (100%)
 rename guacamole/src/main/frontend/src/app/{settings => import}/types/ParseError.js (95%)
 create mode 100644 guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
 create mode 100644 guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js

diff --git a/guacamole/src/main/frontend/src/app/settings/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
similarity index 83%
rename from guacamole/src/main/frontend/src/app/settings/controllers/importConnectionsController.js
rename to guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 33b8914ad..178d6c69d 100644
--- a/guacamole/src/main/frontend/src/app/settings/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -20,11 +20,11 @@
 /**
  * The controller for the connection import page.
  */
-angular.module('settings').controller('importConnectionsController', ['$scope', '$injector',
+angular.module('import').controller('importConnectionsController', ['$scope', '$injector',
         function importConnectionsController($scope, $injector) {
 
     // Required services
-    const connectionImportParseService = $injector.get('connectionImportParseService');
+    const connectionParseService = $injector.get('connectionParseService');
     const connectionService = $injector.get('connectionService');
 
     function processData(type, data) {
@@ -36,18 +36,18 @@ angular.module('settings').controller('importConnectionsController', ['$scope',
 
             case "application/json":
             case "text/json":
-                requestBody = connectionImportParseService.parseJSON(data);
+                requestBody = connectionParseService.parseJSON(data);
                 break;
 
             case "text/csv":
-                requestBody = connectionImportParseService.parseCSV(data);
+                requestBody = connectionParseService.parseCSV(data);
                 break;
 
             case "application/yaml":
             case "application/x-yaml":
             case "text/yaml":
             case "text/x-yaml":
-                requestBody = connectionImportParseService.parseYAML(data);
+                requestBody = connectionParseService.parseYAML(data);
                 break;
 
         }
diff --git a/guacamole/src/main/frontend/src/app/import/importModule.js b/guacamole/src/main/frontend/src/app/import/importModule.js
new file mode 100644
index 000000000..6480d62fc
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/importModule.js
@@ -0,0 +1,24 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * The module for code supporting importing user-supplied files. Currently, only
+ * connection import is supported.
+ */
+angular.module('import', ['rest']);
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
new file mode 100644
index 000000000..361a15283
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
@@ -0,0 +1,103 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * 'License'); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/* global _ */
+
+/**
+ * A service for parsing user-provided CSV connection data for bulk import.
+ */
+angular.module('import').factory('connectionCSVService',
+        ['$injector', function connectionCSVService($injector) {
+    
+    // Required services
+    const $q                     = $injector.get('$q');
+    const $routeParams           = $injector.get('$routeParams');
+    const schemaService          = $injector.get('schemaService');
+    
+    const service = {};
+    
+    /**
+     * Returns a promise that resolves to an object detailing the connection
+     * attributes for the current data source, as well as the connection
+     * paremeters for every protocol, for the current data source.
+     * 
+     * The object that the promise will contain an "attributes" key that maps to
+     * a set of attribute names, and a "protocolParameters" key that maps to an
+     * object mapping protocol names to sets of parameter names for that protocol.
+     * 
+     * The intended use case for this object is to determine if there is a
+     * connection parameter or attribute with a given name, by e.g. checking the
+     * path `.protocolParameters[protocolName]` to see if a protocol exists,
+     * checking the path `.protocolParameters[protocolName][fieldName]` to see
+     * if a parameter exists for a given protocol, or checking the path
+     * `.attributes[fieldName]` to check if a connection attribute exists.
+     * 
+     * @returns {Promise.<Object>}
+     */
+    function getFieldLookups() {
+        
+        // The current data source - the one that the connections will be
+        // imported into
+        const dataSource = $routeParams.dataSource;
+        
+        // Fetch connection attributes and protocols for the current data source
+        return $q.all({
+            attributes : schemaService.getConnectionAttributes(dataSource),
+            protocols  : schemaService.getProtocols(dataSource)
+        })
+        .then(function connectionStructureRetrieved({attributes, protocols}) {
+            
+            return {
+                
+                // Translate the forms and fields into a flat map of attribute
+                // name to `true` boolean value
+                attributes: attributes.reduce(
+                    (attributeMap, form) => {
+                        form.fields.forEach(
+                            field => attributeMap[field.name] = true); 
+                        return attributeMap
+                    }, {}),
+                  
+                // Translate the protocol definitions into a map of protocol
+                // name to map of field name to `true` boolean value
+                protocolParameters: _.mapValues(
+                    protocols, protocol => protocol.connectionForms.reduce(
+                        (protocolFieldMap, form) => {
+                            form.fields.forEach(
+                                field => protocolFieldMap[field.name] = true); 
+                            return protocolFieldMap;
+                        }, {}))
+            };
+        }); 
+    }
+    
+    /**
+     * 
+     * 
+     * @returns {Promise.<Function.<String[], Object>>}
+     *     A promise that will resolve to a function that translates a CSV data
+     *     row (array of strings) to a connection object.
+     */
+    service.getCSVTransformer = function getCSVTransformer(headerRow) {
+        
+    };
+    
+    return service;
+    
+}]);
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/settings/services/connectionImportParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
similarity index 98%
rename from guacamole/src/main/frontend/src/app/settings/services/connectionImportParseService.js
rename to guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index f2735acd6..1051b800b 100644
--- a/guacamole/src/main/frontend/src/app/settings/services/connectionImportParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -26,8 +26,8 @@ import { parse as parseYAMLData } from 'yaml'
  * A service for parsing user-provided JSON, YAML, or JSON connection data into
  * an appropriate format for bulk uploading using the PATCH REST endpoint.
  */
-angular.module('settings').factory('connectionImportParseService',
-        ['$injector', function connectionImportParseService($injector) {
+angular.module('import').factory('connectionParseService',
+        ['$injector', function connectionParseService($injector) {
 
     // Required types
     const Connection          = $injector.get('Connection');
@@ -71,35 +71,6 @@ angular.module('settings').factory('connectionImportParseService',
                 })
             });
     }
-
-    /**
-     * Convert a provided YAML representation of a connection list into a JSON
-     * string to be submitted to the PATCH REST endpoint. The returned JSON
-     * string will contain a PATCH operation to create each connection in the
-     * provided list.
-     *
-     * @param {String} yamlData
-     *     The YAML-encoded connection list to convert to a PATCH request body.
-     *
-     * @return {Promise.<Connection[]>}
-     *     A promise resolving to an array of Connection objects, one for each 
-     *     connection in the provided CSV.
-     */
-    service.parseYAML = function parseYAML(yamlData) {
-
-        // Parse from YAML into a javascript array
-        const parsedData = parseYAMLData(yamlData);
-        
-        // Check that the data is the correct format, and not empty
-        performBasicChecks(parsedData);
-        
-        // Convert to an array of Connection objects and return
-        const deferredConnections = $q.defer();
-        deferredConnections.resolve(
-                parsedData.map(connection => new Connection(connection)));
-        return deferredConnections.promise;
-
-    };
     
     /**
      * Returns a promise that resolves to an object detailing the connection
@@ -321,6 +292,35 @@ angular.module('settings').factory('connectionImportParseService',
 
     };
 
+    /**
+     * Convert a provided YAML representation of a connection list into a JSON
+     * string to be submitted to the PATCH REST endpoint. The returned JSON
+     * string will contain a PATCH operation to create each connection in the
+     * provided list.
+     *
+     * @param {String} yamlData
+     *     The YAML-encoded connection list to convert to a PATCH request body.
+     *
+     * @return {Promise.<Connection[]>}
+     *     A promise resolving to an array of Connection objects, one for each 
+     *     connection in the provided CSV.
+     */
+    service.parseYAML = function parseYAML(yamlData) {
+
+        // Parse from YAML into a javascript array
+        const parsedData = parseYAMLData(yamlData);
+        
+        // Check that the data is the correct format, and not empty
+        performBasicChecks(parsedData);
+        
+        // Convert to an array of Connection objects and return
+        const deferredConnections = $q.defer();
+        deferredConnections.resolve(
+                parsedData.map(connection => new Connection(connection)));
+        return deferredConnections.promise;
+
+    };
+
     /**
      * Convert a provided JSON representation of a connection list into a JSON
      * string to be submitted to the PATCH REST endpoint. The returned JSON
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
similarity index 100%
rename from guacamole/src/main/frontend/src/app/settings/templates/settingsImport.html
rename to guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
diff --git a/guacamole/src/main/frontend/src/app/settings/types/ParseError.js b/guacamole/src/main/frontend/src/app/import/types/ParseError.js
similarity index 95%
rename from guacamole/src/main/frontend/src/app/settings/types/ParseError.js
rename to guacamole/src/main/frontend/src/app/import/types/ParseError.js
index b3d3da03a..21cd545d7 100644
--- a/guacamole/src/main/frontend/src/app/settings/types/ParseError.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ParseError.js
@@ -20,7 +20,7 @@
 /**
  * Service which defines the ParseError class.
  */
-angular.module('settings').factory('ParseError', [function defineParseError() {
+angular.module('import').factory('ParseError', [function defineParseError() {
 
     /**
      * An error representing a parsing failure when attempting to convert
diff --git a/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js b/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
index 51c423932..dd9cc0637 100644
--- a/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
+++ b/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
@@ -127,10 +127,10 @@ angular.module('index').config(['$routeProvider', '$locationProvider',
         })
 
         // Connection import page
-        .when('/settings/:dataSource/import', {
+        .when('/import/:dataSource/connection', {
             title         : 'APP.NAME',
             bodyClassName : 'settings',
-            templateUrl   : 'app/settings/templates/settingsImport.html',
+            templateUrl   : 'app/import/templates/connectionImport.html',
             controller    : 'importConnectionsController',
             resolve       : { updateCurrentToken: updateCurrentToken }
         })
diff --git a/guacamole/src/main/frontend/src/app/rest/services/connectionService.js b/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
index a91c8d05d..053559530 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
@@ -156,41 +156,38 @@ angular.module('rest').factory('connectionService', ['$injector',
     };
 
     /**
-     * Makes a request to the REST API to create multiple connections, returning a
-     * a promise that can be used for processing the results of the call. This
-     * operation is atomic - if any errors are encountered during the connection
-     * creation process, the entire request will fail, and no connections will be
-     * created.
+     * Makes a request to the REST API to apply a supplied list of connection
+     * patches, returning a promise that can be used for processing the results 
+     * of the  call. 
+     * 
+     * This operation is atomic - if any errors are encountered during the 
+     * connection patching process, the entire request will fail, and no 
+     * changes will be persisted.
      *
-     * @param {Connection[]} connections The connections to create.
+     * @param {DirectoryPatch.<Connection>[]} patches 
+     *     An array of patches to apply.
      *
      * @returns {Promise}
      *     A promise for the HTTP call which will succeed if and only if the
-     *     create operation is successful.
+     *     patch operation is successful.
      */
-    service.createConnections = function createConnections(dataSource, connections) {
+    service.patchConnections = function patchConnections(dataSource, patches) {
 
-        // An object containing a PATCH operation to create each connection
-        const patchBody = connections.map(connection => ({
-            op: "add",
-            path: "/",
-            value: connection
-        }));
-
-        // Make a PATCH request to create the connections
+        // Make the PATCH request
         return authenticationService.request({
             method  : 'PATCH',
             url     : 'api/session/data/' + encodeURIComponent(dataSource) + '/connections',
-            data    : patchBody
+            data    : patches
         })
 
         // Clear the cache
-        .then(function connectionUpdated(){
+        .then(function connectionsPatched(){
             cacheService.connections.removeAll();
 
-            // Clear users cache to force reload of permissions for this
-            // newly updated connection
+            // Clear users cache to force reload of permissions for any
+            // newly created or replaced connections
             cacheService.users.removeAll();
+            
         });
 
     }
diff --git a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
new file mode 100644
index 000000000..96a2cb093
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
@@ -0,0 +1,95 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Service which defines the DirectoryPatch class.
+ */
+angular.module('rest').factory('DirectoryPatch', [function defineDirectoryPatch() {
+            
+    /**
+     * The object consumed by REST API calls when representing changes to an
+     * arbitrary set of directory-based objects.
+     * @constructor
+     * 
+     * @template DirectoryObject
+     *     The directory-based object type that this DirectoryPatch will 
+     *     operate on.
+     * 
+     * @param {DirectoryObject|Object} [template={}]
+     *     The object whose properties should be copied within the new
+     *     DirectoryPatch.
+     */
+    var DirectoryPatch = function DirectoryPatch(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * The operation to apply to the objects indicated by the path. Valid
+         * operation values are defined within DirectoryPatch.Operation.
+         *
+         * @type {String}
+         */
+        this.op = template.op;
+
+        /**
+         * The path of the objects to modify. For creation of new objects, this
+         * should be "/". Otherwise, it should be "/{identifier}", specifying
+         * the identifier of the existing object being modified.
+         *
+         * @type {String}
+         * @default '/'
+         */
+        this.path = template.path || '/';
+
+        /**
+         * The object being added or replaced, or the identifier of the object
+         * being removed.
+         *
+         * @type {DirectoryObject|String}
+         */
+        this.value = template.value;
+
+    };
+
+    /**
+     * All valid patch operations for directory-based objects.
+     */
+    DirectoryPatch.Operation = {
+
+        /**
+         * Adds the specified object to the relation.
+         */
+        ADD : "add",
+
+        /**
+         * Removes the specified object from the relation.
+         */
+        REPLACE : "replace",
+
+        /**
+         * Removes the specified object from the relation.
+         */
+        REMOVE : "remove"
+
+    };
+
+    return DirectoryPatch;
+
+}]);
diff --git a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js
new file mode 100644
index 000000000..4534dae13
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js
@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Service which defines the DirectoryPatchOutcome class.
+ */
+angular.module('rest').factory('DirectoryPatchOutcome', [
+        function defineDirectoryPatchOutcome() {
+            
+    /**
+     * An object returned by a PATCH request to a directory REST API, 
+     * representing the outcome associated with a particular patch in the
+     * request. This object can indicate either a successful or unsuccessful 
+     * response. The error field is only meaningful for unsuccessful patches.
+     * @constructor
+     * 
+     * @template DirectoryObject
+     *     The directory-based object type that this DirectoryPatchOutcome
+     *     represents a patch outcome for.
+     * 
+     * @param {DirectoryObject|Object} [template={}]
+     *     The object whose properties should be copied within the new
+     *     DirectoryPatchOutcome.
+     */
+    var DirectoryPatchOutcome = function DirectoryPatchOutcome(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * The operation to apply to the objects indicated by the path. Valid
+         * operation values are defined within DirectoryPatch.Operation.
+         *
+         * @type {String}
+         */
+        this.op = template.op;
+
+        /**
+         * The path of the object operated on by the corresponding patch in the
+         * request.
+         *
+         * @type {String}
+         */
+        this.path = template.path;
+
+        /**
+         * The identifier of the object operated on by the corresponding patch
+         * in the request. If the object was newly created and the PATCH request
+         * did not fail, this will be the identifier of the newly created object.
+         *
+         * @type {String}
+         */
+        this.identifier = template.identifier;
+
+        /**
+         * The error message associated with the failure, if the patch failed to
+         * apply.
+         *
+         * @type {String}
+         */
+        this.error = template.error;
+
+    };
+
+    return DirectoryPatch;
+
+}]);

From a6af634d868b11bff7da7c82dccf4ff5cece35ef Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 2 Feb 2023 01:56:33 +0000
Subject: [PATCH 149/289] GUACAMOLE-926: Implement logic for translating CSV
 rows to connection objects.

---
 .../importConnectionsController.js            |  57 +++-
 .../import/services/connectionCSVService.js   | 258 +++++++++++++++++-
 .../import/services/connectionParseService.js | 211 ++++----------
 .../frontend/src/app/import/styles/import.css |  22 ++
 .../import/templates/connectionImport.html    |  14 +-
 .../src/app/import/types/ParseError.js        |  19 +-
 .../frontend/src/app/index/indexModule.js     |   1 +
 .../templates/settingsConnections.html        |   2 +-
 .../main/frontend/src/translations/en.json    |  32 ++-
 9 files changed, 431 insertions(+), 185 deletions(-)
 create mode 100644 guacamole/src/main/frontend/src/app/import/styles/import.css

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 178d6c69d..73164a08c 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -25,42 +25,81 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
     // Required services
     const connectionParseService = $injector.get('connectionParseService');
-    const connectionService = $injector.get('connectionService');
+    const connectionService      = $injector.get('connectionService');
+    
+    // Required types
+    const ParseError          = $injector.get('ParseError');
+    const TranslatableMessage = $injector.get('TranslatableMessage');
+    
+    function handleSuccess(data) {
+        console.log("OMG SUCCESS: ", data)
+    }
+    
+    // Set any caught error message to the scope for display
+    const handleError = error => {
+        console.error(error);
+        $scope.error = error;
+    }
+    
+    // Clear the current error
+    const clearError = () => delete $scope.error;
 
     function processData(type, data) {
-
-        let requestBody;
+        
+        // The function that will process all the raw data and return a list of
+        // patches to be submitted to the API
+        let processDataCallback;
 
         // Parse the data based on the provided mimetype
         switch(type) {
 
             case "application/json":
             case "text/json":
-                requestBody = connectionParseService.parseJSON(data);
+                processDataCallback = connectionParseService.parseJSON;
                 break;
 
             case "text/csv":
-                requestBody = connectionParseService.parseCSV(data);
+                processDataCallback = connectionParseService.parseCSV;
                 break;
 
             case "application/yaml":
             case "application/x-yaml":
             case "text/yaml":
             case "text/x-yaml":
-                requestBody = connectionParseService.parseYAML(data);
+                processDataCallback = connectionParseService.parseYAML;
                 break;
-
+                
+            default:
+                handleError(new ParseError({
+                    message: 'Invalid file type: ' + type,
+                    key: 'CONNECTION_IMPORT.INVALID_FILE_TYPE',
+                    variables: { TYPE: type } 
+                }));
+                return;
         }
+        
+        // Make the call to process the data into a series of patches
+        processDataCallback(data)
 
-        console.log(requestBody);
+            // Send the data off to be imported if parsing is successful
+            .then(handleSuccess)
+
+            // Display any error found while parsing the file
+            .catch(handleError);
     }
 
     $scope.upload = function() {
+        
+        // Clear any error message from the previous upload attempt
+        clearError();
 
         const files = angular.element('#file')[0].files;
 
         if (files.length <= 0) {
-            console.error("TODO: This should be a proper error tho");
+            handleError(new ParseError({
+                message: 'No file supplied',
+                key: 'CONNECTION_IMPORT.ERROR_NO_FILE_SUPPLIED'
+            }));
             return;
         }
 
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
index 361a15283..ee14f809b 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
@@ -19,16 +19,26 @@
 
 /* global _ */
 
+// A suffix that indicates that a particular header refers to a parameter
+const PARAMETER_SUFFIX = ' (parameter)';
+
+// A suffix that indicates that a particular header refers to an attribute
+const ATTRIBUTE_SUFFIX = ' (attribute)';
+
 /**
  * A service for parsing user-provided CSV connection data for bulk import.
  */
 angular.module('import').factory('connectionCSVService',
         ['$injector', function connectionCSVService($injector) {
+                
+    // Required types
+    const ParseError          = $injector.get('ParseError');
+    const TranslatableMessage = $injector.get('TranslatableMessage');
     
     // Required services
-    const $q                     = $injector.get('$q');
-    const $routeParams           = $injector.get('$routeParams');
-    const schemaService          = $injector.get('schemaService');
+    const $q            = $injector.get('$q');
+    const $routeParams  = $injector.get('$routeParams');
+    const schemaService = $injector.get('schemaService');
     
     const service = {};
     
@@ -88,14 +98,254 @@ angular.module('import').factory('connectionCSVService',
     }
     
     /**
+     * Given a CSV header row, create and return a promise that will resolve to
+     * a function that can take a CSV data row and return a connection object.
+     * If an error occurs while parsing a particular row, the resolved function
+     * will throw a ParseError describing the failure.
      * 
+     * The provided CSV must contain columns for name and protocol. Optionally,
+     * the parentIdentifier of the target parent connection group, or a connection
+     * name path e.g. "ROOT/parent/child" may be included. Additionallty, 
+     * connection parameters or attributes can be included.
+     * 
+     * The names of connection attributes and parameters are not guaranteed to
+     * be mutually exclusive, so the CSV import format supports a distinguishing
+     * suffix. A column may be explicitly declared to be a parameter using a
+     * " (parameter)" suffix, or an attribute using an " (attribute)" suffix.
+     * No suffix is required if the name is unique across connections and
+     * attributes.
+     *
+     * If a parameter or attribute name conflicts with the standard
+     * "name", "protocol", "group", or "parentIdentifier" fields, the suffix is
+     * required.
+     * 
+     * This returned object will be very similar to the Connection type, with
+     * the exception that a human-readable "group" field may be present.
+     * 
+     * If a failure occurs while attempting to create the transformer function,
+     * the promise will be rejected with a ParseError describing the failure.
      * 
      * @returns {Promise.<Function.<String[], Object>>}
      *     A promise that will resolve to a function that translates a CSV data
-     *     row (array of strings) to a connection object.
+     *     row (array of strings) to a connection object. 
      */
     service.getCSVTransformer = function getCSVTransformer(headerRow) {
         
+        // A promise that will be resolved with the transformer or rejected if
+        // an error occurs
+        const deferred = $q.defer();
+        
+        getFieldLookups().then(({attributes, protocolParameters}) => {
+            
+            // All configuration required to generate a function that can
+            // transform a row of CSV into a connection object.
+            // NOTE: This is a single object instead of a collection of variables
+            // to ensure that no stale references are used - e.g. when one getter
+            // invokes another getter
+            const transformConfig = {
+                
+                // Callbacks for required fields
+                nameGetter: undefined,
+                protocolGetter: undefined,
+                
+                // Callbacks for a parent group ID or group path
+                groupGetter: _.noop,
+                parentIdentifierGetter: _.noop,
+
+                // Callbacks that will generate either connection attributes or 
+                // parameters. These callbacks will return a {type, name, value}
+                // object containing the type ("parameter" or "attribute"),
+                // the name of the attribute or parameter, and the corresponding
+                // value.
+                parameterOrAttributeGetters: []
+                
+            };
+            
+            // A set of all headers that have been seen so far. If any of these
+            // are duplicated, the CSV is invalid.
+            const headerSet = {};
+            
+            // Iterate through the headers one by one
+            headerRow.forEach((rawHeader, index) => {
+                
+                // Trim to normalize all headers
+                const header = rawHeader.trim();
+                
+                // Check if the header is duplicated
+                if (headerSet[header]) {
+                    deferred.reject(new ParseError({
+                        message: 'Duplicate CSV Header: ' + header,
+                        translatableMessage: new TranslatableMessage({
+                            key: 'CONNECTION_IMPORT.ERROR_DUPLICATE_CSV_HEADER',
+                            variables: { HEADER: header }
+                        })
+                    }));
+                    return;
+                }
+                
+                // Mark that this particular header has already been seen
+                headerSet[header] = true;
+                
+                // A callback that returns the field at the current index
+                const fetchFieldAtIndex = row => row[index];
+                
+                // Set up the name callback
+                if (header == 'name')
+                    transformConfig.nameGetter = fetchFieldAtIndex;
+                
+                // Set up the protocol callback
+                else if (header == 'protocol') 
+                    transformConfig.protocolGetter = fetchFieldAtIndex;
+                
+                // Set up the group callback
+                else if (header == 'group')
+                    transformConfig.groupGetter = fetchFieldAtIndex;
+                
+                // Set up the group parent ID callback
+                else if (header == 'parentIdentifier')
+                    transformConfig.parentIdentifierGetter = fetchFieldAtIndex;
+
+                // At this point, any other header might refer to a connection 
+                // parameter or to an attribute
+
+                // A field may be explicitly specified as a parameter
+                else if (header.endsWith(PARAMETER_SUFFIX)) {
+
+                    // Push as an explicit parameter getter
+                    const parameterName = header.replace(PARAMETER_SUFFIX);
+                    transformConfig.parameterOrAttributeGetters.push(
+                        row => ({
+                            type: 'parameter',
+                            name: parameterName,
+                            value: fetchFieldAtIndex(row)
+                        })
+                    );
+                }
+
+                // A field may be explicitly specified as a parameter
+                else if (header.endsWith(ATTRIBUTE_SUFFIX)) {
+
+                    // Push as an explicit attribute getter
+                    const attributeName = header.replace(ATTRIBUTE_SUFFIX);
+                    transformConfig.parameterOrAttributeGetters.push(
+                        row => ({
+                            type: 'attribute',
+                            name: parameterName,
+                            value: fetchFieldAtIndex(row)
+                        })
+                    );
+                }
+                
+                // The field is ambiguous, either an attribute or parameter,
+                // so the getter will have to determine this for every row
+                else 
+                    transformConfig.parameterOrAttributeGetters.push(row => {
+                        
+                        // The name is just the value of the current header
+                        const name = header;
+                        
+                        // The value is at the index that matches the position
+                        // of the header
+                        const value = fetchFieldAtIndex(row);
+                           
+                        // The protocol may determine whether a field is
+                        // a parameter or an attribute (or both)
+                        const protocol = transformConfig.protocolGetter(row);
+                        
+                        // Determine if the field refers to an attribute or a
+                        // parameter (or both, which is an error)
+                        const isAttribute = !!attributes[name];
+                        const isParameter = !!_.get(
+                                protocolParameters, [protocol, name]);
+                        
+                        // If there is both an attribute and a protocol-specific
+                        // parameter with the provided name, it's impossible to
+                        // figure out which this should be
+                        if (isAttribute && isParameter)
+                            throw new ParseError({
+                                message: 'Ambiguous CSV Header: ' + header,
+                                key: 'CONNECTION_IMPORT.ERROR_AMBIGUOUS_CSV_HEADER',
+                                variables: { HEADER: header }
+                            });
+                        
+                        // It's neither an attribute or a parameter
+                        else if (!isAttribute && !isParameter)
+                            throw new ParseError({
+                                message: 'Invalid CSV Header: ' + header,
+                                key: 'CONNECTION_IMPORT.ERROR_INVALID_CSV_HEADER',
+                                variables: { HEADER: header }
+                            });
+                        
+                        // Choose the appropriate type
+                        const type = isAttribute ? 'attributes' : 'parameters';
+                      
+                        return { type, name, value };
+                    });
+            });
+            
+            // Fail if the name wasn't provided
+            if (!transformConfig.nameGetter) 
+                return deferred.reject(new ParseError({
+                    message: 'The connection name must be provided',
+                    key: 'CONNECTION_IMPORT.ERROR_REQUIRED_NAME'
+                }));
+            
+            // Fail if the protocol wasn't provided
+            if (!transformConfig.protocolGetter)
+                return deferred.reject(new ParseError({
+                    message: 'The connection protocol must be provided',
+                    key: 'CONNECTION_IMPORT.ERROR_REQUIRED_PROTOCOL'
+                }));
+            
+            // The function to transform a CSV row into a connection object
+            deferred.resolve(function transformCSVRow(row) {
+                    
+                const {
+                    nameGetter, protocolGetter, 
+                    parentIdentifierGetter, groupGetter,
+                    parameterOrAttributeGetters
+                } = transformConfig;
+                
+                // Set name and protocol
+                const name = nameGetter(row);
+                const protocol = protocolGetter(row);
+                
+                // Set the parent group ID and/or group path
+                const group = groupGetter && groupGetter(row);
+                const parentIdentifier = (
+                        parentIdentifierGetter && parentIdentifierGetter(row));
+               
+                return { 
+                    
+                    // Simple fields that are not protocol-specific
+                    ...{
+                        name,
+                        protocol,
+                        parentIdentifier,
+                        group
+                    },
+                    
+                    // Fields that might potentially be either attributes or
+                    // parameters, depending on the protocol
+                    ...parameterOrAttributeGetters.reduce((values, getter) => {
+                        
+                        // Determine the type, name, and value
+                        const { type, name, value } = getter(row);
+                        
+                        // Set the value and continue on to the next attribute
+                        // or parameter
+                        values[type][name] = value;
+                        return values;
+                        
+                    }, {parameters: {}, attributes: {}})
+                   
+                }
+                
+            });
+            
+        });
+        
+        return deferred.promise;
     };
     
     return service;
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index 1051b800b..82b7e0c6b 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -38,15 +38,17 @@ angular.module('import').factory('connectionParseService',
     const $q                     = $injector.get('$q');
     const $routeParams           = $injector.get('$routeParams');
     const schemaService          = $injector.get('schemaService');
+    const connectionCSVService   = $injector.get('connectionCSVService');
     const connectionGroupService = $injector.get('connectionGroupService');
 
     const service = {};
     
     /**
      * Perform basic checks, common to all file types - namely that the parsed
-     * data is an array, and contains at least one connection entry.
+     * data is an array, and contains at least one connection entry. Returns an 
+     * error if any of these basic checks fails.
      * 
-     * @throws {ParseError}
+     * returns {ParseError}
      *     An error describing the parsing failure, if one of the basic checks
      *     fails.
      */
@@ -54,80 +56,20 @@ angular.module('import').factory('connectionParseService',
         
         // Make sure that the file data parses to an array (connection list)
         if (!(parsedData instanceof Array))
-            throw new ParseError({
+            return new ParseError({
                 message: 'Import data must be a list of connections',
-                translatableMessage: new TranslatableMessage({
-                    key: 'SETTINGS_CONNECTION_IMPORT.ERROR_ARRAY_REQUIRED'
-                })
+                key: 'CONNECTION_IMPORT.ERROR_ARRAY_REQUIRED'
             });
 
         // Make sure that the connection list is not empty - contains at least
         // one connection
         if (!parsedData.length)
-            throw new ParseError({
-                message: 'The provided CSV file is empty',
-                translatableMessage: new TranslatableMessage({
-                    key: 'SETTINGS_CONNECTION_IMPORT.ERROR_EMPTY_FILE'
-                })
+            return new ParseError({
+                message: 'The provided file is empty',
+                key: 'CONNECTION_IMPORT.ERROR_EMPTY_FILE'
             });
     }
     
-    /**
-     * Returns a promise that resolves to an object detailing the connection
-     * attributes for the current data source, as well as the connection
-     * paremeters for every protocol, for the current data source.
-     * 
-     * The object that the promise will contain an "attributes" key that maps to
-     * a set of attribute names, and a "protocolParameters" key that maps to an
-     * object mapping protocol names to sets of parameter names for that protocol.
-     * 
-     * The intended use case for this object is to determine if there is a
-     * connection parameter or attribute with a given name, by e.g. checking the
-     * path `.protocolParameters[protocolName]` to see if a protocol exists,
-     * checking the path `.protocolParameters[protocolName][fieldName]` to see
-     * if a parameter exists for a given protocol, or checking the path
-     * `.attributes[fieldName]` to check if a connection attribute exists.
-     * 
-     * @returns {Promise.<Object>}
-     */
-    function getFieldLookups() {
-        
-        // The current data source - the one that the connections will be
-        // imported into
-        const dataSource = $routeParams.dataSource;
-        
-        // Fetch connection attributes and protocols for the current data source
-        return $q.all({
-            attributes : schemaService.getConnectionAttributes(dataSource),
-            protocols  : schemaService.getProtocols(dataSource)
-        })
-        .then(function connectionStructureRetrieved({attributes, protocols}) {
-            
-            return {
-                
-                // Translate the forms and fields into a flat map of attribute
-                // name to `true` boolean value
-                attributes: attributes.reduce(
-                    (attributeMap, form) => {
-                        form.fields.forEach(
-                            field => attributeMap[field.name] = true); 
-                        return attributeMap
-                    }, {}),
-                  
-                // Translate the protocol definitions into a map of protocol
-                // name to map of field name to `true` boolean value
-                protocolParameters: _.mapValues(
-                    protocols, protocol => protocol.connectionForms.reduce(
-                        (protocolFieldMap, form) => {
-                            form.fields.forEach(
-                                field => protocolFieldMap[field.name] = true); 
-                            return protocolFieldMap;
-                        }, {}))
-            };
-        });
-            
-    }
-    
     
     /**
      * Returns a promise that resolves to an object mapping potential groups
@@ -181,68 +123,9 @@ angular.module('import').factory('connectionParseService',
         
         return deferredGroupLookups.promise;
     }
-    
-/*
-// Example Connection JSON
-{
-   "attributes": {
-       "failover-only": "true",
-       "guacd-encryption": "none",
-       "guacd-hostname": "potato",
-       "guacd-port": "1234",
-       "ksm-user-config-enabled": "true",
-       "max-connections": "1",
-       "max-connections-per-user": "1",
-       "weight": "1"
-   },
-   "name": "Bloatato",
-   "parameters": {
-       "audio-servername": "heyoooooooo",
-       "clipboard-encoding": "",
-       "color-depth": "",
-       "create-recording-path": "",
-       "cursor": "remote",
-       "dest-host": "pooootato",
-       "dest-port": "4444",
-       "disable-copy": "",
-       "disable-paste": "true",
-       "enable-audio": "true",
-       "enable-sftp": "true",
-       "force-lossless": "true",
-       "hostname": "potato",
-       "password": "taste",
-       "port": "4321",
-       "read-only": "",
-       "recording-exclude-mouse": "",
-       "recording-exclude-output": "",
-       "recording-include-keys": "",
-       "recording-name": "heyoooooo",
-       "recording-path": "/path/to/goo",
-       "sftp-disable-download": "",
-       "sftp-disable-upload": "",
-       "sftp-hostname": "what what good sir",
-       "sftp-port": "",
-       "sftp-private-key": "lol i'll never tell",
-       "sftp-server-alive-interval": "",
-       "swap-red-blue": "true",
-       "username": "test",
-       "wol-send-packet": "",
-       "wol-udp-port": "",
-       "wol-wait-time": ""
-   },
-                
-   // or a numeric identifier - we will probably want to offer a way to allow
-   // them to specify a path like "ROOT/parent/child" or just "/parent/child" or
-   // something like that
-   // TODO: Call the 
-   "parentIdentifier": "ROOT",
-   "protocol": "vnc"
-                
-}
-*/
 
     /**
-     * Convert a provided JSON representation of a connection list into a JSON
+     * Convert a provided CSV representation of a connection list into a JSON
      * string to be submitted to the PATCH REST endpoint. The returned JSON
      * string will contain a PATCH operation to create each connection in the
      * provided list.
@@ -259,36 +142,44 @@ angular.module('import').factory('connectionParseService',
      */
     service.parseCSV = function parseCSV(csvData) {
         
-        const deferredConnections = $q.defer();
+        // Convert to an array of arrays, one per CSV row (including the header)
+        // NOTE: skip_empty_lines is required, or a trailing newline will error
+        let parsedData;
+        try {
+            parsedData = parseCSVData(csvData, {skip_empty_lines: true});
+        } 
         
-        return $q.all({
-            fieldLookups : getFieldLookups(),
-            groupLookups : getGroupLookups()
-        })
-        .then(function lookupsReady({fieldLookups, groupLookups}) {
+        // If the CSV parser throws an error, reject with that error. No
+        // translation key will be available here.
+        catch(error) {
+            console.error(error);
+            const deferred = $q.defer();
+            deferred.reject(error);
+            return deferred.promise;
+        }
+
+        // Slice off the header row to get the data rows
+        const connectionData = parsedData.slice(1);
+
+        // Check that the provided CSV is not empty (the parser always
+        // returns an array)
+        const checkError = performBasicChecks(connectionData);
+        if (checkError) {
+            const deferred = $q.defer();
+            deferred.reject(checkError);
+            return deferred.promise;
+        }
         
-            const {attributes, protocolParameters} = fieldLookups;
-    
-            console.log({attributes, protocolParameters}, groupLookups);
-            
-            // Convert to an array of arrays, one per CSV row (including the header)
-            const parsedData = parseCSVData(csvData);
-
-            // Slice off the header row to get the data rows
-            const connectionData = parsedData.slice(1);
-
-            // Check that the provided CSV is not empty (the parser always
-            // returns an array)
-            performBasicChecks(connectionData);
-
-            // The header row - an array of string header values
-            const header = parsedData[0];
-            
-            // TODO: Connectionify this
-            deferredConnections.resolve(connectionData);
-        });
+        // The header row - an array of string header values
+        const header = parsedData[0];
         
-        return deferredConnections.promise;
+        return connectionCSVService.getCSVTransformer(header).then(
+                
+            // If the transformer was successfully generated, apply it to the
+            // data rows
+            // TODO: Also apply the group -> parentIdentifier transform
+            csvTransformer => connectionData.map(csvTransformer)
+        );
 
     };
 
@@ -303,7 +194,7 @@ angular.module('import').factory('connectionParseService',
      *
      * @return {Promise.<Connection[]>}
      *     A promise resolving to an array of Connection objects, one for each 
-     *     connection in the provided CSV.
+     *     connection in the provided YAML.
      */
     service.parseYAML = function parseYAML(yamlData) {
 
@@ -311,7 +202,9 @@ angular.module('import').factory('connectionParseService',
         const parsedData = parseYAMLData(yamlData);
         
         // Check that the data is the correct format, and not empty
-        performBasicChecks(parsedData);
+        const checkError = performBasicChecks(connectionData);
+        if (checkError)
+            return $q.defer().reject(checkError);
         
         // Convert to an array of Connection objects and return
         const deferredConnections = $q.defer();
@@ -332,7 +225,7 @@ angular.module('import').factory('connectionParseService',
      *
      * @return {Promise.<Connection[]>}
      *     A promise resolving to an array of Connection objects, one for each 
-     *     connection in the provided CSV.
+     *     connection in the provided JSON.
      */
     service.parseJSON = function parseJSON(jsonData) {
 
@@ -340,7 +233,9 @@ angular.module('import').factory('connectionParseService',
         const parsedData = JSON.parse(yamlData);
         
         // Check that the data is the correct format, and not empty
-        performBasicChecks(parsedData);
+        const checkError = performBasicChecks(connectionData);
+        if (checkError)
+            return $q.defer().reject(checkError);
         
         // Convert to an array of Connection objects and return
         const deferredConnections = $q.defer();
diff --git a/guacamole/src/main/frontend/src/app/import/styles/import.css b/guacamole/src/main/frontend/src/app/import/styles/import.css
new file mode 100644
index 000000000..f5551bb42
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/styles/import.css
@@ -0,0 +1,22 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+.import .parseError {
+    color: red;
+}
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index c9c54e10e..39b12fece 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -1,11 +1,23 @@
 <div class="settings-view import">
 
     <div class="header">
-        <h2>{{'SETTINGS_CONNECTION_IMPORT.HEADER' | translate}}</h2>
+        <h2>{{'CONNECTION_IMPORT.HEADER' | translate}}</h2>
         <guac-user-menu></guac-user-menu>
     </div>
 
     <input type="file" id="file" name="file"/>
     <button ng-click="upload()">Add</button>
+    
+    <!-- The translatable error message, if one is set -->
+    <p 
+        class="parseError" ng-show="error.key" 
+        translate="{{error.key}}" translate-values="{{error.variables}}"
+    ></p>
+    
+    <!-- The base message, if no translatable message is available -->
+    <p class="parseError" ng-show="!error.key && error.message">
+        {{error.message}}
+    </p>
+
 
 </div>
diff --git a/guacamole/src/main/frontend/src/app/import/types/ParseError.js b/guacamole/src/main/frontend/src/app/import/types/ParseError.js
index 21cd545d7..1e4ce478e 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ParseError.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ParseError.js
@@ -44,13 +44,22 @@ angular.module('import').factory('ParseError', [function defineParseError() {
         this.message = template.message;
 
         /**
-         * A message which can be translated using the translation service,
-         * consisting of a translation key and optional set of substitution
-         * variables.
+         * The key associated with the translation string that used when
+         * displaying this message.
          *
-         * @type TranslatableMessage
+         * @type String
          */
-        this.translatableMessage = template.translatableMessage;
+        this.key = template.key;
+
+        /**
+         * The object which should be passed through to the translation service
+         * for the sake of variable substitution. Each property of the provided
+         * object will be substituted for the variable of the same name within
+         * the translation string.
+         *
+         * @type Object
+         */
+        this.variables = template.variables;
 
     };
 
diff --git a/guacamole/src/main/frontend/src/app/index/indexModule.js b/guacamole/src/main/frontend/src/app/index/indexModule.js
index e0281f439..2bcc94527 100644
--- a/guacamole/src/main/frontend/src/app/index/indexModule.js
+++ b/guacamole/src/main/frontend/src/app/index/indexModule.js
@@ -35,6 +35,7 @@ angular.module('index', [
     'client',
     'clipboard',
     'home',
+    'import',
     'login',
     'manage',
     'navigation',
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
index 76ebeebec..0718307a1 100644
--- a/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
@@ -11,7 +11,7 @@
 
             <a class="import-connections button"
                 ng-show="canCreateConnections()"
-                href="#/settings/{{dataSource | escape}}/import/">{{'SETTINGS_CONNECTIONS.ACTION_IMPORT_CONNECTIONS' | translate}}</a>
+                href="#/import/{{dataSource | escape}}/connection/">{{'SETTINGS_CONNECTIONS.ACTION_IMPORT_CONNECTIONS' | translate}}</a>
 
             <a class="add-connection button"
                ng-show="canCreateConnections()"
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 21812d376..89647a491 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -184,6 +184,31 @@
 
     },
 
+    "CONNECTION_IMPORT": {
+
+        "HEADER": "Connection Import",
+
+        "ERROR_AMBIGUOUS_CSV_HEADER": 
+            "Ambiguous CSV Header \"{HEADER}\" could be either a connection attribute or parameter",
+        "ERROR_ARRAY_REQUIRED": 
+            "The provided file must contain a list of connections",
+        "ERROR_DUPLICATE_CSV_HEADER": 
+            "Duplicate CSV Header: {HEADER}",
+        "ERROR_EMPTY_FILE": "The provided file is empty",
+        "ERROR_INVALID_CSV_HEADER": 
+            "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
+        "ERROR_INVALID_FILE_TYPE": 
+            "Invalid import file type \"{TYPE}\"",
+        "ERROR_NO_FILE_SUPPLIED": "Please select a file to import",
+        "ERROR_REQUIRED_GROUP": 
+            "Either group or parentIdentifier must be specified, but not both",
+        "ERROR_REQUIRED_PROTOCOL": 
+            "No connection protocol found in the provided file",
+        "ERROR_REQUIRED_NAME": 
+            "No connection name found in the provided file"
+        
+    },
+
     "DATA_SOURCE_DEFAULT" : {
         "NAME" : "Default (XML)"
     },
@@ -923,13 +948,6 @@
 
     },
 
-    "SETTINGS_CONNECTION_IMPORT": {
-
-        "HEADER": "Connection Import",
-
-        "ERROR_ARRAY_REQUIRED": "The provided file must contain a list of connections"
-    },
-
     "SETTINGS_PREFERENCES" : {
 
         "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",

From cbb44efb2bb8f7634feefa52e6f7e2b35819ef42 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Sat, 4 Feb 2023 02:05:17 +0000
Subject: [PATCH 150/289] GUACAMOLE-926: Translate to API patches in patch
 service.

---
 .../import/services/connectionParseService.js | 146 +++++++++++++++---
 .../main/frontend/src/translations/en.json    |   5 +-
 2 files changed, 124 insertions(+), 27 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index 82b7e0c6b..322e22c15 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -31,6 +31,7 @@ angular.module('import').factory('connectionParseService',
 
     // Required types
     const Connection          = $injector.get('Connection');
+    const DirectoryPatch      = $injector.get('DirectoryPatch');
     const ParseError          = $injector.get('ParseError');
     const TranslatableMessage = $injector.get('TranslatableMessage');
     
@@ -124,6 +125,62 @@ angular.module('import').factory('connectionParseService',
         return deferredGroupLookups.promise;
     }
 
+    /**
+     * Returns a promise that will resolve to a transformer function that will
+     * take an object that may a "group" field, replacing it if present with a
+     * "parentIdentifier". If both a "group" and "parentIdentifier" field are
+     * present on the provided object, or if no group exists at the specified
+     * path, the function will throw a ParseError describing the failure.
+     *
+     * @returns {Promise.<Function<Object, Object>>}
+     *     A promise that will resolve to a function that will transform a
+     *     "group" field into a "parentIdentifier" field if possible.
+     */
+    function getGroupTransformer() {
+        return getGroupLookups().then(lookups => connection => {
+
+            // If there's no group to translate, do nothing
+            if (!connection.group)
+                return;
+
+            // If both are specified, the parent group is ambigious
+            if (connection.parentIdentifier)
+                throw new ParseError({
+                    message: 'Only one of group or parentIdentifier can be set',
+                    key: 'CONNECTION_IMPORT.ERROR_AMBIGUOUS_PARENT_GROUP'
+                });
+
+            // Look up the parent identifier for the specified group path
+            const identifier = lookups[connection.group];
+
+            // If the group doesn't match anything in the tree
+            if (!identifier)
+                throw new ParseError({
+                    message: 'No group found named: ' + connection.group,
+                    key: 'CONNECTION_IMPORT.ERROR_INVALID_GROUP',
+                    variables: { GROUP: connection.group }
+                });
+
+            // Set the parent identifier now that it's known
+            return {
+                ...connection,
+                parentIdentifier: identifier
+            };
+
+        });
+    }
+
+    // Translate a given javascript object to a full-fledged Connection
+    const connectionTransformer = connection => new Connection(connection);
+
+    // Translate a Connection object to a patch requesting the creation of said
+    // Connection
+    const patchTransformer = connection => new DirectoryPatch({
+       op: 'add',
+       path: '/',
+       value: connection
+    });
+
     /**
      * Convert a provided CSV representation of a connection list into a JSON
      * string to be submitted to the PATCH REST endpoint. The returned JSON
@@ -172,14 +229,29 @@ angular.module('import').factory('connectionParseService',
         
         // The header row - an array of string header values
         const header = parsedData[0];
-        
-        return connectionCSVService.getCSVTransformer(header).then(
-                
-            // If the transformer was successfully generated, apply it to the
-            // data rows
-            // TODO: Also apply the group -> parentIdentifier transform
-            csvTransformer => connectionData.map(csvTransformer)
-        );
+
+        return $q.all({
+            csvTransformer   : connectionCSVService.getCSVTransformer(header),
+            groupTransformer : getGroupTransformer()
+        })
+
+        // Transform the rows from the CSV file to an array of API patches
+        .then(({csvTransformer, groupTransformer}) => connectionData.map(
+                dataRow => {
+
+            // Translate the raw CSV data to a javascript object
+            let connectionObject = csvTransformer(dataRow);
+
+            // Translate the group on the object to a parentIdentifier
+            connectionObject = groupTransformer(connectionObject);
+
+            // Translate to a full-fledged Connection
+            const connection = connectionTransformer(connectionObject);
+
+            // Finally, translate to a patch for creating the connection
+            return patchTransformer(connection);
+
+        }));
 
     };
 
@@ -203,14 +275,26 @@ angular.module('import').factory('connectionParseService',
         
         // Check that the data is the correct format, and not empty
         const checkError = performBasicChecks(connectionData);
-        if (checkError)
-            return $q.defer().reject(checkError);
-        
-        // Convert to an array of Connection objects and return
-        const deferredConnections = $q.defer();
-        deferredConnections.resolve(
-                parsedData.map(connection => new Connection(connection)));
-        return deferredConnections.promise;
+        if (checkError) {
+            const deferred = $q.defer();
+            deferred.reject(checkError);
+            return deferred.promise;
+        }
+
+        // Transform the data from the YAML file to an array of API patches
+        return getGroupTransformer().then(
+                groupTransformer => parsedData.map(connectionObject => {
+
+            // Translate the group on the object to a parentIdentifier
+            connectionObject = groupTransformer(connectionObject);
+
+            // Translate to a full-fledged Connection
+            const connection = connectionTransformer(connectionObject);
+
+            // Finally, translate to a patch for creating the connection
+            return patchTransformer(connection);
+
+        }));
 
     };
 
@@ -231,17 +315,29 @@ angular.module('import').factory('connectionParseService',
 
         // Parse from JSON into a javascript array
         const parsedData = JSON.parse(yamlData);
-        
+
         // Check that the data is the correct format, and not empty
         const checkError = performBasicChecks(connectionData);
-        if (checkError)
-            return $q.defer().reject(checkError);
-        
-        // Convert to an array of Connection objects and return
-        const deferredConnections = $q.defer();
-        deferredConnections.resolve(
-                parsedData.map(connection => new Connection(connection)));
-        return deferredConnections.promise;
+        if (checkError) {
+            const deferred = $q.defer();
+            deferred.reject(checkError);
+            return deferred.promise;
+        }
+
+        // Transform the data from the YAML file to an array of API patches
+        return getGroupTransformer().then(
+                groupTransformer => parsedData.map(connectionObject => {
+
+            // Translate the group on the object to a parentIdentifier
+            connectionObject = groupTransformer(connectionObject);
+
+            // Translate to a full-fledged Connection
+            const connection = connectionTransformer(connectionObject);
+
+            // Finally, translate to a patch for creating the connection
+            return patchTransformer(connection);
+
+        }));
         
     };
 
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 89647a491..98b983b9f 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -197,11 +197,12 @@
         "ERROR_EMPTY_FILE": "The provided file is empty",
         "ERROR_INVALID_CSV_HEADER": 
             "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
+        "ERROR_INVALID_GROUP": "No group matching \"{GROUP}\" found",
         "ERROR_INVALID_FILE_TYPE": 
             "Invalid import file type \"{TYPE}\"",
         "ERROR_NO_FILE_SUPPLIED": "Please select a file to import",
-        "ERROR_REQUIRED_GROUP": 
-            "Either group or parentIdentifier must be specified, but not both",
+        "ERROR_AMBIGUOUS_PARENT_GROUP":
+            "Both group and parentIdentifier may be not specified at the same time",
         "ERROR_REQUIRED_PROTOCOL": 
             "No connection protocol found in the provided file",
         "ERROR_REQUIRED_NAME": 

From 314adf6c235f59feaa117132424118fabe82e0f1 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 7 Feb 2023 00:31:06 +0000
Subject: [PATCH 151/289] GUACAMOLE-926: Remove patch update functionality.
 It's needed for batch import, and it's a can of worms.

---
 .../ActiveConnectionService.java              |  8 --
 .../jdbc/base/DirectoryObjectService.java     | 18 ----
 .../base/ModeledDirectoryObjectService.java   | 14 ---
 .../guacamole/auth/jdbc/base/ObjectModel.java | 29 +-----
 .../jdbc/connection/ConnectionDirectory.java  | 14 +--
 .../auth/jdbc/connection/ConnectionModel.java |  5 +
 .../jdbc/connection/ConnectionService.java    |  7 +-
 .../connectiongroup/ConnectionGroupModel.java |  6 ++
 .../ConnectionGroupService.java               |  7 +-
 .../sharingprofile/SharingProfileModel.java   |  6 ++
 .../sharingprofile/SharingProfileService.java |  7 +-
 .../guacamole/auth/jdbc/user/UserService.java |  4 -
 .../auth/jdbc/usergroup/UserGroupService.java |  4 -
 .../rest/directory/DirectoryResource.java     | 94 ++++---------------
 14 files changed, 39 insertions(+), 184 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionService.java
index 80c75dbbb..046cee1e2 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/activeconnection/ActiveConnectionService.java
@@ -166,14 +166,6 @@ public class ActiveConnectionService
 
     }
 
-    @Override
-    public void updateExternalObject(ModeledAuthenticatedUser user, ActiveConnection object) throws GuacamoleException {
-
-        // Updating active connections is not implemented
-        throw new GuacamoleSecurityException("Permission denied.");
-
-    }
-
     /**
      * Retrieve the permission set for the specified user that relates
      * to access to active connections.
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/DirectoryObjectService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/DirectoryObjectService.java
index 29d40cc49..590e01e9f 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/DirectoryObjectService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/DirectoryObjectService.java
@@ -116,24 +116,6 @@ public interface DirectoryObjectService<InternalType, ExternalType> {
     void deleteObject(ModeledAuthenticatedUser user, String identifier)
         throws GuacamoleException;
 
-    /**
-     * Updates the object corresponding to the given external representation,
-     * applying any changes that have been made. If no such object exists,
-     * this function has no effect.
-     *
-     * @param user
-     *     The user updating the object.
-     *
-     * @param object
-     *     The external object to apply updates from.
-     *
-     * @throws GuacamoleException
-     *     If the user lacks permission to update the object, or an error
-     *     occurs while updating the object.
-     */
-    void updateExternalObject(ModeledAuthenticatedUser user, ExternalType object)
-            throws GuacamoleException;
-
     /**
      * Updates the given object, applying any changes that have been made. If
      * no such object exists, this function has no effect.
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java
index 75c25926b..80bc7eb5c 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java
@@ -511,20 +511,6 @@ public abstract class ModeledDirectoryObjectService<InternalType extends Modeled
 
     }
 
-    @Override
-    @Transactional
-    public void updateExternalObject(ModeledAuthenticatedUser user, ExternalType object)
-        throws GuacamoleException {
-
-        // Convert to the internal type
-        InternalType internalObject = getObjectInstance(
-                user, getModelInstance(user, object));
-
-        // Delegate to the standard internal update functionality
-        updateObject(user, internalObject);
-
-    }
-
     @Override
     public Set<String> getIdentifiers(ModeledAuthenticatedUser user)
         throws GuacamoleException {
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ObjectModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ObjectModel.java
index 69eb1fd36..c3052b1b4 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ObjectModel.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ObjectModel.java
@@ -21,8 +21,6 @@ package org.apache.guacamole.auth.jdbc.base;
 
 import java.util.Collection;
 
-import org.apache.guacamole.GuacamoleException;
-
 /**
  * Object representation of a Guacamole object, such as a user or connection,
  * as represented in the database.
@@ -77,7 +75,7 @@ public abstract class ObjectModel {
      *
      * @return
      *     The ID of this object in the database, or null if this object was
-     *     not retrieved from or intended to update the database.
+     *     not retrieved from the database.
      */
     public Integer getObjectID() {
         return objectID;
@@ -93,31 +91,6 @@ public abstract class ObjectModel {
         this.objectID = objectID;
     }
 
-    /**
-     * Given a text identifier, attempt to convert to an integer database ID.
-     * If the identifier is valid, the database ID will be set to this value.
-     * Otherwise, a GuacamoleException will be thrown.
-     *
-     * @param identifier
-     *     The identifier to convert to an integer and set on the database
-     *     model, if valid.
-     *
-     * @throws GuacamoleException
-     *     If the provided identifier is not a valid integer.
-     */
-    public void setObjectID(String identifier) throws GuacamoleException {
-
-        // Try to convert the provided identifier to an integer ID
-        try {
-            setObjectID(Integer.parseInt(identifier));
-        }
-
-        catch (NumberFormatException e) {
-            throw new GuacamoleException(
-                    "Database identifiers must be integers.");
-        }
-    }
-
     /**
      * Returns a map of attribute name/value pairs for all attributes associated
      * with this model which do not have explicit mappings to actual model
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
index b2f3e2bea..3e364f509 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionDirectory.java
@@ -68,18 +68,8 @@ public class ConnectionDirectory extends JDBCDirectory<Connection> {
     @Override
     @Transactional
     public void update(Connection object) throws GuacamoleException {
-
-        // If the provided connection is already an internal type, update
-        // using the internal method
-        if (object instanceof ModeledConnection)
-            connectionService.updateObject(
-                getCurrentUser(), (ModeledConnection) object);
-
-        // If the type is not already the expected internal type, use the
-        // external update method
-        else
-            connectionService.updateExternalObject(getCurrentUser(), object);
-
+        ModeledConnection connection = (ModeledConnection) object;
+        connectionService.updateObject(getCurrentUser(), connection);
     }
 
     @Override
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java
index 03413650b..da454025d 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java
@@ -387,4 +387,9 @@ public class ConnectionModel extends ChildObjectModel {
 
     }
 
+    @Override
+    public void setIdentifier(String identifier) {
+        throw new UnsupportedOperationException("Connection identifiers are derived from IDs. They cannot be set.");
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionService.java
index cdf2afb76..b3ed89ce8 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionService.java
@@ -110,19 +110,14 @@ public class ConnectionService extends ModeledChildDirectoryObjectService<Modele
 
     @Override
     protected ConnectionModel getModelInstance(ModeledAuthenticatedUser currentUser,
-            final Connection object) throws GuacamoleException {
+            final Connection object) {
 
         // Create new ModeledConnection backed by blank model
         ConnectionModel model = new ConnectionModel();
         ModeledConnection connection = getObjectInstance(currentUser, model);
 
-        // If the provided connection has an identifier, set it on the model
-        if (object.getIdentifier() != null)
-            model.setObjectID(object.getIdentifier());
-
         // Set model contents through ModeledConnection, copying the provided connection
         connection.setParentIdentifier(object.getParentIdentifier());
-        connection.setIdentifier(object.getIdentifier());
         connection.setName(object.getName());
         connection.setConfiguration(object.getConfiguration());
         connection.setAttributes(object.getAttributes());
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java
index ebad3383f..d58cc9b2e 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupModel.java
@@ -266,4 +266,10 @@ public class ConnectionGroupModel extends ChildObjectModel {
         return id.toString();
 
     }
+
+    @Override
+    public void setIdentifier(String identifier) {
+        throw new UnsupportedOperationException("Connection group identifiers are derived from IDs. They cannot be set.");
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java
index 11771032a..dbf7793ec 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java
@@ -92,19 +92,14 @@ public class ConnectionGroupService extends ModeledChildDirectoryObjectService<M
 
     @Override
     protected ConnectionGroupModel getModelInstance(ModeledAuthenticatedUser currentUser,
-            final ConnectionGroup object) throws GuacamoleException {
+            final ConnectionGroup object) {
 
         // Create new ModeledConnectionGroup backed by blank model
         ConnectionGroupModel model = new ConnectionGroupModel();
         ModeledConnectionGroup connectionGroup = getObjectInstance(currentUser, model);
 
-        // If the provided connection has an identifier, set it on the model
-        if (object.getIdentifier() != null)
-            model.setObjectID(object.getIdentifier());
-
         // Set model contents through ModeledConnectionGroup, copying the provided connection group
         connectionGroup.setParentIdentifier(object.getParentIdentifier());
-        connectionGroup.setIdentifier(object.getIdentifier());
         connectionGroup.setName(object.getName());
         connectionGroup.setType(object.getType());
         connectionGroup.setAttributes(object.getAttributes());
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileModel.java
index bdffb2fdf..375282da8 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileModel.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileModel.java
@@ -71,4 +71,10 @@ public class SharingProfileModel extends ChildObjectModel {
 
     }
 
+    @Override
+    public void setIdentifier(String identifier) {
+        throw new UnsupportedOperationException("Sharing profile identifiers "
+                + "are derived from IDs. They cannot be set.");
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileService.java
index afab47c25..4ca492c84 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharingprofile/SharingProfileService.java
@@ -90,20 +90,15 @@ public class SharingProfileService
 
     @Override
     protected SharingProfileModel getModelInstance(ModeledAuthenticatedUser currentUser,
-            final SharingProfile object) throws GuacamoleException {
+            final SharingProfile object) {
 
         // Create new ModeledSharingProfile backed by blank model
         SharingProfileModel model = new SharingProfileModel();
         ModeledSharingProfile sharingProfile = getObjectInstance(currentUser, model);
 
-        // If the provided connection has an identifier, set it on the model
-        if (object.getIdentifier() != null)
-            model.setObjectID(object.getIdentifier());
-
         // Set model contents through ModeledSharingProfile, copying the
         // provided sharing profile
         sharingProfile.setPrimaryConnectionIdentifier(object.getPrimaryConnectionIdentifier());
-        sharingProfile.setIdentifier(object.getIdentifier());
         sharingProfile.setName(object.getName());
         sharingProfile.setParameters(object.getParameters());
         sharingProfile.setAttributes(object.getAttributes());
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
index 0cf206f04..161976ce4 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
@@ -202,10 +202,6 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
         UserModel model = new UserModel();
         ModeledUser user = getObjectInstance(currentUser, model);
 
-        // If the provided connection has an identifier, set it on the model
-        if (object.getIdentifier() != null)
-            model.setObjectID(object.getIdentifier());
-
         // Set model contents through ModeledUser, copying the provided user
         user.setIdentifier(object.getIdentifier());
         user.setPassword(object.getPassword());
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupService.java
index 81f6a3afa..3c42572ce 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/UserGroupService.java
@@ -107,10 +107,6 @@ public class UserGroupService extends ModeledDirectoryObjectService<ModeledUserG
         UserGroupModel model = new UserGroupModel();
         ModeledUserGroup group = getObjectInstance(currentUser, model);
 
-        // If the provided connection has an identifier, set it on the model
-        if (object.getIdentifier() != null)
-            model.setObjectID(object.getIdentifier());
-
         // Set model contents through ModeledUser, copying the provided group
         group.setIdentifier(object.getIdentifier());
         group.setAttributes(object.getAttributes());
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index e27fa1596..72ddf2ff5 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -417,12 +417,12 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
     /**
      * Applies the given object patches, updating the underlying directory
-     * accordingly. This operation supports addition, update, and removal of
-     * objects through the "add", "replace", and "remove" patch operation.
-     * The path of each patch operation is of the form "/ID" where ID is the
-     * identifier of the object being modified. In the case of object creation,
-     * the identifier is ignored, as the identifier will be automatically
-     * provided. This operation is atomic.
+     * accordingly. This operation supports addition and removal of objects
+     * through the "add" and "remove" patch operation. The path of each patch
+     * operation is of the form "/ID" where ID is the identifier of the object
+     * being modified. In the case of object creation, the identifier is
+     * ignored, as the identifier will be automatically provided. This operation
+     * is atomic.
      *
      * @param patches
      *     The patches to apply for this request.
@@ -461,9 +461,8 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                             "The patch cannot be executed.");
 
                 // Keep a list of all objects that have been successfully
-                // added, updated, or removed
+                // added or removed
                 Collection<InternalType> addedObjects = new ArrayList<>();
-                Collection<InternalType> updatedObjects = new ArrayList<>();
                 Collection<String> removedIdentifiers = new ArrayList<>();
 
                 // A list of all responses associated with the successful
@@ -527,64 +526,6 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                     }
 
-                    else if (patch.getOp() == APIPatch.Operation.replace) {
-
-                        // Filter/sanitize object contents
-                        InternalType internal = filterAndTranslate(patch.getValue());
-
-                        try {
-
-                            // Set the model to the supplied identifier from the PATH
-                            String identifier = path.substring(1);
-
-                            if (identifier == null)
-                                throw new GuacamoleClientException(
-                                        "An identifier is required when updating.");
-
-                            // If there's an identiifer provided in the value,
-                            // make sure it matches the one from the path
-                            String valueId = internal.getIdentifier();
-                            if (valueId != null && !valueId.equals(identifier))
-                                throw new GuacamoleClientException(
-                                        "Identifier mismatch between path and value.");
-
-                            internal.setIdentifier(identifier);
-
-                            // Attempt to update the object
-                            directory.update(internal);
-
-                            // Add the object to the list if the update was successful
-                            updatedObjects.add(internal);
-
-                            // Add a success outcome describing the object update
-                            APIPatchOutcome response = new APIPatchOutcome(
-                                    patch.getOp(), internal.getIdentifier(), path);
-                            patchOutcomes.add(response);
-                            creationSuccesses.add(response);
-                        }
-
-                        catch (GuacamoleException | RuntimeException | Error e) {
-                            failed = true;
-                            fireDirectoryFailureEvent(
-                                    DirectoryEvent.Operation.UPDATE,
-                                    internal.getIdentifier(), internal, e);
-
-                            /*
-                             * If the failure represents an understood issue,
-                             * create a failure outcome for this failed patch.
-                             */
-                            if (e instanceof GuacamoleException)
-                                patchOutcomes.add(new APIPatchError(
-                                        patch.getOp(), internal.getIdentifier(), path,
-                                        ((GuacamoleException) e).getMessage()));
-
-                            // If an unexpected failure occurs, fall through to the
-                            // standard API error handling
-                            else
-                                throw e;
-                        }
-                    }
-
                     // Append each identifier to the list, to be removed atomically
                     else if (patch.getOp() == APIPatch.Operation.remove) {
 
@@ -625,6 +566,14 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                                 throw e;
                         }
                     }
+                    
+                    else {
+                        throw new GuacamoleUnsupportedException(
+                                "Unsupported patch operation \""
+                                + patch.getOp() + "\". "
+                                + "Only add and remove are supported.");
+                    }
+
 
                 }
 
@@ -655,24 +604,13 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                 }
 
-                // Fire directory success events for each updated object
-                Iterator<InternalType> updatedIterator = updatedObjects.iterator();
-                while (updatedIterator.hasNext()) {
-
-                    InternalType internal = updatedIterator.next();
-                    fireDirectorySuccessEvent(
-                            DirectoryEvent.Operation.UPDATE,
-                            internal.getIdentifier(), internal);
-
-                }
-
                 // Fire directory success events for each removed object
                 Iterator<String> removedIterator = removedIdentifiers.iterator();
                 while (removedIterator.hasNext()) {
 
                     String identifier = removedIterator.next();
                     fireDirectorySuccessEvent(
-                            DirectoryEvent.Operation.UPDATE,
+                            DirectoryEvent.Operation.REMOVE,
                             identifier, null);
 
                 }

From 761438e02d4a86a4b12269f2494a431860cfa794 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 9 Feb 2023 01:51:14 +0000
Subject: [PATCH 152/289] GUACAMOLE-926: Also accept user and group identifiers
 to post in a seperate request.

---
 .../import/services/connectionCSVService.js   | 138 ++++++--
 .../import/services/connectionParseService.js | 322 +++++++++++-------
 .../src/app/import/types/ParseError.js        |   2 +-
 .../src/app/import/types/ParseResult.js       |  87 +++++
 .../src/app/import/types/ProtoConnection.js   | 111 ++++++
 .../main/frontend/src/translations/en.json    |   4 +
 6 files changed, 522 insertions(+), 142 deletions(-)
 create mode 100644 guacamole/src/main/frontend/src/app/import/types/ParseResult.js
 create mode 100644 guacamole/src/main/frontend/src/app/import/types/ProtoConnection.js

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
index ee14f809b..a104cdd46 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
@@ -33,6 +33,7 @@ angular.module('import').factory('connectionCSVService',
                 
     // Required types
     const ParseError          = $injector.get('ParseError');
+    const ProtoConnection     = $injector.get('ProtoConnection');
     const TranslatableMessage = $injector.get('TranslatableMessage');
     
     // Required services
@@ -43,7 +44,7 @@ angular.module('import').factory('connectionCSVService',
     const service = {};
     
     /**
-     * Returns a promise that resolves to an object detailing the connection
+     * Returns a promise that resolves to a object detailing the connection
      * attributes for the current data source, as well as the connection
      * paremeters for every protocol, for the current data source.
      * 
@@ -96,12 +97,66 @@ angular.module('import').factory('connectionCSVService',
             };
         }); 
     }
+
+    /**
+     * Split a raw user-provided, semicolon-seperated list of identifiers into
+     * an array of identifiers. If identifiers contain semicolons, they can be
+     * escaped with backslashes, and backslashes can also be escaped using other
+     * backslashes.
+     *
+     * @param {type} rawIdentifiers
+     *     The raw string value as fetched from the CSV.
+     *
+     * @returns {Array.<String>}
+     *     An array of identifier values.
+     */
+    function splitIdentifiers(rawIdentifiers) {
+
+        // Keep track of whether a backslash was seen
+        let escaped = false;
+
+        return _.reduce(rawIdentifiers, (identifiers, ch) => {
+
+            // The current identifier will be the last one in the final list
+            let identifier = identifiers[identifiers.length - 1];
+
+            // If a semicolon is seen, set the "escaped" flag and continue
+            // to the next character
+            if (!escaped && ch == '\\') {
+                escaped = true;
+                return identifiers;
+            }
+
+            // End the current identifier and start a new one if there's an
+            // unescaped semicolon
+            else if (!escaped && ch == ';') {
+                identifiers.push('');
+                return identifiers;
+            }
+
+            // In all other cases, just append to the identifier
+            else {
+                identifier += ch;
+                escaped = false;
+            }
+
+            // Save the updated identifier to the list
+            identifiers[identifiers.length - 1] = identifier;
+
+            return identifiers;
+
+        }, [''])
+
+        // Filter out any 0-length (empty) identifiers
+        .filter(identifier => identifier.length);
+
+    }
     
     /**
      * Given a CSV header row, create and return a promise that will resolve to
-     * a function that can take a CSV data row and return a connection object.
-     * If an error occurs while parsing a particular row, the resolved function
-     * will throw a ParseError describing the failure.
+     * a function that can take a CSV data row and return a ProtoConnection
+     * object. If an error occurs while parsing a particular row, the resolved 
+     * function will throw a ParseError describing the failure.
      * 
      * The provided CSV must contain columns for name and protocol. Optionally,
      * the parentIdentifier of the target parent connection group, or a connection
@@ -120,14 +175,17 @@ angular.module('import').factory('connectionCSVService',
      * required.
      * 
      * This returned object will be very similar to the Connection type, with
-     * the exception that a human-readable "group" field may be present.
+     * the exception that a human-readable "group" field may be present, in
+     * addition to "user" and "userGroup" fields containing arrays of user and
+     * user group identifiers for whom read access should be granted to this
+     * connection.
      * 
      * If a failure occurs while attempting to create the transformer function,
      * the promise will be rejected with a ParseError describing the failure.
      * 
      * @returns {Promise.<Function.<String[], Object>>}
      *     A promise that will resolve to a function that translates a CSV data
-     *     row (array of strings) to a connection object. 
+     *     row (array of strings) to a ProtoConnection object.
      */
     service.getCSVTransformer = function getCSVTransformer(headerRow) {
         
@@ -149,8 +207,12 @@ angular.module('import').factory('connectionCSVService',
                 protocolGetter: undefined,
                 
                 // Callbacks for a parent group ID or group path
-                groupGetter: _.noop,
-                parentIdentifierGetter: _.noop,
+                groupGetter: undefined,
+                parentIdentifierGetter: undefined,
+
+                // Callbacks for user and user group identifiers
+                usersGetter: () => [],
+                userGroupsGetter: () => [],
 
                 // Callbacks that will generate either connection attributes or 
                 // parameters. These callbacks will return a {type, name, value}
@@ -188,6 +250,11 @@ angular.module('import').factory('connectionCSVService',
                 
                 // A callback that returns the field at the current index
                 const fetchFieldAtIndex = row => row[index];
+
+                // A callback that splits identifier lists by semicolon
+                // characters into a javascript list of identifiers
+                const identifierListCallback = row => 
+                    splitIdentifiers(fetchFieldAtIndex(row));
                 
                 // Set up the name callback
                 if (header == 'name')
@@ -203,7 +270,18 @@ angular.module('import').factory('connectionCSVService',
                 
                 // Set up the group parent ID callback
                 else if (header == 'parentIdentifier')
-                    transformConfig.parentIdentifierGetter = fetchFieldAtIndex;
+                    transformConfig.parentIdentifierGetter = (
+                        identifierListCallback);
+
+                // Set the user identifiers callback
+                else if (header == 'users')
+                    transformConfig.usersGetter = (
+                        identifierListCallback);
+
+                // Set the user group identifiers callback
+                else if (header == 'groups')
+                    transformConfig.userGroupsGetter = (
+                        identifierListCallback);
 
                 // At this point, any other header might refer to a connection 
                 // parameter or to an attribute
@@ -282,47 +360,61 @@ angular.module('import').factory('connectionCSVService',
                         return { type, name, value };
                     });
             });
+
+            const {
+                nameGetter, protocolGetter,
+                parentIdentifierGetter, groupGetter,
+                usersGetter, userGroupsGetter,
+                parameterOrAttributeGetters
+            } = transformConfig;
             
             // Fail if the name wasn't provided
-            if (!transformConfig.nameGetter) 
+            if (!nameGetter) 
                 return deferred.reject(new ParseError({
                     message: 'The connection name must be provided',
                     key: 'CONNECTION_IMPORT.ERROR_REQUIRED_NAME'
                 }));
             
             // Fail if the protocol wasn't provided
-            if (!transformConfig.protocolGetter)
+            if (!protocolGetter)
                 return deferred.reject(new ParseError({
                     message: 'The connection protocol must be provided',
                     key: 'CONNECTION_IMPORT.ERROR_REQUIRED_PROTOCOL'
                 }));
+
+            // If both are specified, the parent group is ambigious
+            if (parentIdentifierGetter && groupGetter)
+                throw new ParseError({
+                    message: 'Only one of group or parentIdentifier can be set',
+                    key: 'CONNECTION_IMPORT.ERROR_AMBIGUOUS_PARENT_GROUP'
+                });
             
             // The function to transform a CSV row into a connection object
             deferred.resolve(function transformCSVRow(row) {
-                    
-                const {
-                    nameGetter, protocolGetter, 
-                    parentIdentifierGetter, groupGetter,
-                    parameterOrAttributeGetters
-                } = transformConfig;
                 
-                // Set name and protocol
+                // Get name and protocol
                 const name = nameGetter(row);
                 const protocol = protocolGetter(row);
+
+                // Get any users or user groups who should be granted access
+                const users = usersGetter(row);
+                const groups = userGroupsGetter(row);
                 
-                // Set the parent group ID and/or group path
+                // Get the parent group ID and/or group path
                 const group = groupGetter && groupGetter(row);
                 const parentIdentifier = (
                         parentIdentifierGetter && parentIdentifierGetter(row));
                
-                return { 
+                return new ProtoConnection({
                     
-                    // Simple fields that are not protocol-specific
+                    // Fields that are not protocol-specific
                     ...{
                         name,
                         protocol,
                         parentIdentifier,
-                        group
+                        group,
+                        users,
+                        groups
                     },
                     
                     // Fields that might potentially be either attributes or
@@ -339,7 +431,7 @@ angular.module('import').factory('connectionCSVService',
                         
                     }, {parameters: {}, attributes: {}})
                    
-                }
+                });
                 
             });
             
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index 322e22c15..f2f6c1daa 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -33,6 +33,7 @@ angular.module('import').factory('connectionParseService',
     const Connection          = $injector.get('Connection');
     const DirectoryPatch      = $injector.get('DirectoryPatch');
     const ParseError          = $injector.get('ParseError');
+    const ParseResult         = $injector.get('ParseResult');
     const TranslatableMessage = $injector.get('TranslatableMessage');
     
     // Required services
@@ -41,8 +42,81 @@ angular.module('import').factory('connectionParseService',
     const schemaService          = $injector.get('schemaService');
     const connectionCSVService   = $injector.get('connectionCSVService');
     const connectionGroupService = $injector.get('connectionGroupService');
+    const userService            = $injector.get('userService');
+    const userGroupService       = $injector.get('userGroupService');
 
     const service = {};
+
+    /**
+     * Resolves to an object whose keys are all valid identifiers in the current
+     * data source. The provided `requestFunction` should resolve to such an
+     * object when provided with the current data source.
+     *
+     * @param {Function.<String<Object.<String, *>>} requestFunction
+     *     A function that, given a data source, will return a promise resolving
+     *     to an object with keys that are unique identifiers for entities in
+     *     that data source.
+     *
+     * @returns {Promise.<Function[String[], String[]>>}
+     *     A promise that will resolve to an function that, given an array of
+     *     identifiers, will return all identifiers that do not exist as keys in
+     *     the object returned by `requestFunction`, i.e. all identifiers that
+     *     do not exist in the current data source.
+     */
+    function getIdentifierMap(requestFunction) {
+
+        // The current data source to which all the identifiers will belong
+        const dataSource = $routeParams.dataSource;
+
+        // Make the request and return the response, which should be an object
+        // whose keys are all valid identifiers for the current data source
+        return requestFunction(dataSource);
+    }
+
+    /**
+     * Return a promise that resolves to a function that takes an array of
+     * identifiers, returning a ParseError describing the invalid identifiers
+     * from the list. The provided `requestFunction` should resolve to such an
+     * object whose keys are all valid identifiers when provided with the
+     * current data source.
+     *
+     * @param {Function.<String<Object.<String, *>>} requestFunction
+     *     A function that, given a data source, will return a promise resolving
+     *     to an object with keys that are unique identifiers for entities in
+     *     that data source.
+     *
+     * @returns {Promise.<Function.<String[], ParseError?>>}
+     *     A promise that will resolve to a function to check the validity of
+     *     each identifier in a provided array, returning a ParseError 
+     *     describing the problem if any are not valid.
+     */
+    function getInvalidIdentifierErrorChecker(requestFunction) {
+
+        // Fetch all the valid user identifiers in the system, and
+        return getIdentifierMap(requestFunction).then(validIdentifiers =>
+
+            // The resolved function that takes a list of user group identifiers
+            allIdentifiers => {
+
+                // Filter to only include invalid identifiers
+                const invalidIdentifiers = _.filter(allIdentifiers,
+                    identifier => !validIdentifiers[identifier]);
+
+                if (invalidIdentifiers.length) {
+
+                    // Quote and comma-seperate for display
+                    const identifierList = invalidIdentifiers.map(
+                        identifier => '"' + identifier + '"').join(', ');
+
+                    return new ParseError({
+                        message: 'Invalid User Group Identifiers: ' + identifierList,
+                        key: 'CONNECTION_IMPORT.ERROR_INVALID_USER_GROUP_IDENTIFIERS',
+                        variables: { IDENTIFIER_LIST: identifierList }
+                    });
+                }
+
+            });
+    }
     
     /**
      * Perform basic checks, common to all file types - namely that the parsed
@@ -127,9 +201,9 @@ angular.module('import').factory('connectionParseService',
 
     /**
      * Returns a promise that will resolve to a transformer function that will
-     * take an object that may a "group" field, replacing it if present with a
-     * "parentIdentifier". If both a "group" and "parentIdentifier" field are
-     * present on the provided object, or if no group exists at the specified
+     * take an object that may contain a "group" field, replacing it if present 
+     * with a "parentIdentifier". If both a "group" and "parentIdentifier" field
+     * are present on the provided object, or if no group exists at the specified
      * path, the function will throw a ParseError describing the failure.
      *
      * @returns {Promise.<Function<Object, Object>>}
@@ -170,32 +244,109 @@ angular.module('import').factory('connectionParseService',
         });
     }
 
-    // Translate a given javascript object to a full-fledged Connection
-    const connectionTransformer = connection => new Connection(connection);
+    /**
+     * Convert a provided ProtoConnection array into a ParseResult. Any provided
+     * transform functions will be run on each entry in `connectionData` before
+     * any other processing is done.
+     *
+     * @param {*[]} connectionData
+     *     An arbitrary array of data. This must evaluate to a ProtoConnection
+     *     object after being run through all functions in `transformFunctions`.
+     *
+     * @param {Function[]} transformFunctions
+     *     An array of transformation functions to run on each entry in
+     *     `connection` data.
+     *
+     * @return {Promise.<Object>}
+     *     A promise resolving to ParseResult object representing the result of
+     *     parsing all provided connection data.
+     */
+    function parseConnectionData(connectionData, transformFunctions) {
+        
+        // Check that the provided connection data array is not empty
+        const checkError = performBasicChecks(connectionData);
+        if (checkError) {
+            const deferred = $q.defer();
+            deferred.reject(checkError);
+            return deferred.promise;
+        }
 
-    // Translate a Connection object to a patch requesting the creation of said
-    // Connection
-    const patchTransformer = connection => new DirectoryPatch({
-       op: 'add',
-       path: '/',
-       value: connection
-    });
+        return $q.all({
+            groupTransformer           : getGroupTransformer(),
+            invalidUserIdErrorDetector : getInvalidIdentifierErrorChecker(
+                    userService.getUsers),
+            invalidGroupIDErrorDetector : getInvalidIdentifierErrorChecker(
+                    userGroupService.getUserGroups),
+        })
+
+        // Transform the rows from the CSV file to an array of API patches
+        // and lists of user and group identifiers
+        .then(({groupTransformer,
+                invalidUserIdErrorDetector, invalidGroupIDErrorDetector}) =>
+                    connectionData.reduce((parseResult, data) => {
+
+            const { patches, identifiers, users, groups } = parseResult;
+
+            // Run the array data through each provided transform
+            let connectionObject = data;
+            _.forEach(transformFunctions, transform => {
+                connectionObject = transform(connectionObject);
+            });
+
+            // All errors found while parsing this connection
+            const connectionErrors = [];
+            parseResult.errors.push(connectionErrors);
+
+            // Translate the group on the object to a parentIdentifier
+            try {
+                connectionObject = groupTransformer(connectionObject);
+            }
+
+            // If there was a problem with the group or parentIdentifier
+            catch (error) {
+                connectionErrors.push(error);
+            }
+
+            // Push any errors for invalid user or user group identifiers
+            const pushError = error => error && connectionErrors.push(error);
+            pushError(invalidUserIdErrorDetector(connectionObject.users));
+            pushError(invalidGroupIDErrorDetector(connectionObject.userGroups));
+
+            // Add the user and group identifiers for this connection
+            users.push(connectionObject.users);
+            groups.push(connectionObject.groups);
+
+            // Translate to a full-fledged Connection
+            const connection = new Connection(connectionObject);
+
+            // Finally, add a patch for creating the connection
+            patches.push(new DirectoryPatch({
+                op: 'add',
+                path: '/',
+                value: connection
+            }));
+
+            // If there are any errors for this connection fail the whole batch 
+            if (connectionErrors.length)
+                parseResult.hasErrors = true;
+
+            return parseResult;
+
+        }, new ParseResult()));
+    }
 
     /**
      * Convert a provided CSV representation of a connection list into a JSON
-     * string to be submitted to the PATCH REST endpoint. The returned JSON
-     * string will contain a PATCH operation to create each connection in the
-     * provided list.
-     *
-     * TODO: Describe disambiguation suffixes, e.g. hostname (parameter), and
-     * that we will accept without the suffix if it's unambigous. (or not? how about not?)
+     * object to be submitted to the PATCH REST endpoint, as well as a list of
+     * objects containing lists of user and user group identifiers to be granted
+     * to each connection.
      *
      * @param {String} csvData
-     *     The JSON-encoded connection list to convert to a PATCH request body.
+     *     The CSV-encoded connection list to process.
      *
-     * @return {Promise.<Connection[]>}
-     *     A promise resolving to an array of Connection objects, one for each 
-     *     connection in the provided CSV.
+     * @return {Promise.<Object>}
+     *     A promise resolving to ParseResult object representing the result of
+     *     parsing all provided connection data.
      */
     service.parseCSV = function parseCSV(csvData) {
         
@@ -211,134 +362,69 @@ angular.module('import').factory('connectionParseService',
         catch(error) {
             console.error(error);
             const deferred = $q.defer();
-            deferred.reject(error);
+            deferred.reject(new ParseError({ message: error.message }));
             return deferred.promise;
         }
 
+        // The header row - an array of string header values
+        const header = parsedData.length ? parsedData[0] : [];
+
         // Slice off the header row to get the data rows
         const connectionData = parsedData.slice(1);
 
-        // Check that the provided CSV is not empty (the parser always
-        // returns an array)
-        const checkError = performBasicChecks(connectionData);
-        if (checkError) {
-            const deferred = $q.defer();
-            deferred.reject(checkError);
-            return deferred.promise;
-        }
-        
-        // The header row - an array of string header values
-        const header = parsedData[0];
+        // Generate the CSV transform function, and apply it to every row
+        // before applying all the rest of the standard transforms
+        return connectionCSVService.getCSVTransformer(header).then(
+            csvTransformer =>
 
-        return $q.all({
-            csvTransformer   : connectionCSVService.getCSVTransformer(header),
-            groupTransformer : getGroupTransformer()
-        })
-
-        // Transform the rows from the CSV file to an array of API patches
-        .then(({csvTransformer, groupTransformer}) => connectionData.map(
-                dataRow => {
-
-            // Translate the raw CSV data to a javascript object
-            let connectionObject = csvTransformer(dataRow);
-
-            // Translate the group on the object to a parentIdentifier
-            connectionObject = groupTransformer(connectionObject);
-
-            // Translate to a full-fledged Connection
-            const connection = connectionTransformer(connectionObject);
-
-            // Finally, translate to a patch for creating the connection
-            return patchTransformer(connection);
-
-        }));
+                // Apply the CSV transform to every row
+                parseConnectionData(connectionData, [csvTransformer]));
 
     };
 
     /**
      * Convert a provided YAML representation of a connection list into a JSON
-     * string to be submitted to the PATCH REST endpoint. The returned JSON
-     * string will contain a PATCH operation to create each connection in the
-     * provided list.
+     * object to be submitted to the PATCH REST endpoint, as well as a list of
+     * objects containing lists of user and user group identifiers to be granted
+     * to each connection.
      *
      * @param {String} yamlData
-     *     The YAML-encoded connection list to convert to a PATCH request body.
+     *     The YAML-encoded connection list to process.
      *
-     * @return {Promise.<Connection[]>}
-     *     A promise resolving to an array of Connection objects, one for each 
-     *     connection in the provided YAML.
+     * @return {Promise.<Object>}
+     *     A promise resolving to ParseResult object representing the result of
+     *     parsing all provided connection data.
      */
     service.parseYAML = function parseYAML(yamlData) {
 
         // Parse from YAML into a javascript array
-        const parsedData = parseYAMLData(yamlData);
+        const connectionData = parseYAMLData(yamlData);
         
-        // Check that the data is the correct format, and not empty
-        const checkError = performBasicChecks(connectionData);
-        if (checkError) {
-            const deferred = $q.defer();
-            deferred.reject(checkError);
-            return deferred.promise;
-        }
-
-        // Transform the data from the YAML file to an array of API patches
-        return getGroupTransformer().then(
-                groupTransformer => parsedData.map(connectionObject => {
-
-            // Translate the group on the object to a parentIdentifier
-            connectionObject = groupTransformer(connectionObject);
-
-            // Translate to a full-fledged Connection
-            const connection = connectionTransformer(connectionObject);
-
-            // Finally, translate to a patch for creating the connection
-            return patchTransformer(connection);
-
-        }));
-
+        // Produce a ParseResult
+        return parseConnectionData(connectionData);
     };
 
     /**
-     * Convert a provided JSON representation of a connection list into a JSON
-     * string to be submitted to the PATCH REST endpoint. The returned JSON
-     * string will contain a PATCH operation to create each connection in the
-     * provided list.
+     * Convert a provided JSON-encoded representation of a connection list into
+     * an array of patches to be submitted to the PATCH REST endpoint, as well
+     * as a list of objects containing lists of user and user group identifiers
+     * to be granted to each connection.
      *
      * @param {String} jsonData
-     *     The JSON-encoded connection list to convert to a PATCH request body.
+     *     The JSON-encoded connection list to process.
      *
-     * @return {Promise.<Connection[]>}
-     *     A promise resolving to an array of Connection objects, one for each 
-     *     connection in the provided JSON.
+     * @return {Promise.<Object>}
+     *     A promise resolving to ParseResult object representing the result of
+     *     parsing all provided connection data.
      */
     service.parseJSON = function parseJSON(jsonData) {
 
         // Parse from JSON into a javascript array
-        const parsedData = JSON.parse(yamlData);
+        const connectionData = JSON.parse(jsonData);
 
-        // Check that the data is the correct format, and not empty
-        const checkError = performBasicChecks(connectionData);
-        if (checkError) {
-            const deferred = $q.defer();
-            deferred.reject(checkError);
-            return deferred.promise;
-        }
+        // Produce a ParseResult
+        return parseConnectionData(connectionData);
 
-        // Transform the data from the YAML file to an array of API patches
-        return getGroupTransformer().then(
-                groupTransformer => parsedData.map(connectionObject => {
-
-            // Translate the group on the object to a parentIdentifier
-            connectionObject = groupTransformer(connectionObject);
-
-            // Translate to a full-fledged Connection
-            const connection = connectionTransformer(connectionObject);
-
-            // Finally, translate to a patch for creating the connection
-            return patchTransformer(connection);
-
-        }));
-        
     };
 
     return service;
diff --git a/guacamole/src/main/frontend/src/app/import/types/ParseError.js b/guacamole/src/main/frontend/src/app/import/types/ParseError.js
index 1e4ce478e..33fd07765 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ParseError.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ParseError.js
@@ -31,7 +31,7 @@ angular.module('import').factory('ParseError', [function defineParseError() {
      *     The object whose properties should be copied within the new
      *     ParseError.
      */
-    var ParseError = function ParseError(template) {
+    const ParseError = function ParseError(template) {
 
         // Use empty object by default
         template = template || {};
diff --git a/guacamole/src/main/frontend/src/app/import/types/ParseResult.js b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
new file mode 100644
index 000000000..e6aa59229
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Service which defines the ParseResult class.
+ */
+angular.module('import').factory('ParseResult', [function defineParseResult() {
+
+    /**
+     * The result of parsing a connection import file - containing a list of
+     * API patches ready to be submitted to the PATCH REST API for batch
+     * connection creation, a set of users and user groups to grant access to
+     * each connection, and any errors that may have occured while parsing
+     * each connection.
+     *
+     * @constructor
+     * @param {ParseResult|Object} [template={}]
+     *     The object whose properties should be copied within the new
+     *     ParseResult.
+     */
+    const ParseResult = function ParseResult(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * An array of patches, ready to be submitted to the PATCH REST API for
+         * batch connection creation.
+         *
+         * @type {DirectoryPatch[]}
+         */
+        this.patches = template.patches || [];
+
+        /**
+         * A list of user identifiers that should be granted read access to the
+         * the corresponding connection (at the same array index).
+         *
+         * @type {String[]}
+         */
+        this.users = template.users || [];
+
+        /**
+         * A list of user group identifiers that should be granted read access
+         * to the corresponding connection (at the same array index).
+         *
+         * @type {String[]}
+         */
+        this.groups = template.groups || [];
+
+        /**
+         * An array of errors encountered while parsing the corresponding
+         * connection (at the same array index). Each connection should have a
+         * an array of errors. If empty, no errors occured for this connection.
+         *
+         * @type {ParseError[][]}
+         */
+        this.errors = template.errors || [];
+
+        /**
+         * True if any errors were encountered while parsing the connections
+         * represented by this ParseResult. This should always be true if there
+         * are a non-zero number of elements in the errors list for any
+         * connection, or false otherwise.
+         */
+        this.hasErrors = template.hasErrors || false;
+
+    };
+
+    return ParseResult;
+    
+}]);
diff --git a/guacamole/src/main/frontend/src/app/import/types/ProtoConnection.js b/guacamole/src/main/frontend/src/app/import/types/ProtoConnection.js
new file mode 100644
index 000000000..c853934d0
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/types/ProtoConnection.js
@@ -0,0 +1,111 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Service which defines the Connection class.
+ */
+angular.module('import').factory('ProtoConnection', [
+        function defineProtoConnection() {
+
+    /**
+     * A representation of a connection to be imported, as parsed from an
+     * user-supplied import file.
+     *
+     * @constructor
+     * @param {Connection|Object} [template={}]
+     *     The object whose properties should be copied within the new
+     *     Connection.
+     */
+    var ProtoConnection = function ProtoConnection(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * The unique identifier of the connection group that contains this
+         * connection.
+         *
+         * @type String
+         */
+        this.parentIdentifier = template.parentIdentifier;
+
+        /**
+         * The path to the connection group that contains this connection,
+         * written as e.g. "ROOT/parent/child/group".
+         *
+         * @type String
+         */
+        this.group = template.group;
+
+        /**
+         * The human-readable name of this connection, which is not necessarily
+         * unique.
+         *
+         * @type String
+         */
+        this.name = template.name;
+
+        /**
+         * The name of the protocol associated with this connection, such as
+         * "vnc" or "rdp".
+         *
+         * @type String
+         */
+        this.protocol = template.protocol;
+
+        /**
+         * Connection configuration parameters, as dictated by the protocol in
+         * use, arranged as name/value pairs. This information may not be
+         * available until directly queried. If this information is
+         * unavailable, this property will be null or undefined.
+         *
+         * @type Object.<String, String>
+         */
+        this.parameters = template.parameters || {};
+
+        /**
+         * Arbitrary name/value pairs which further describe this connection.
+         * The semantics and validity of these attributes are dictated by the
+         * extension which defines them.
+         *
+         * @type Object.<String, String>
+         */
+        this.attributes = template.attributes || {};
+
+        /**
+         * The identifiers of all users who should be granted read access to
+         * this connection.
+         *
+         * @type String[]
+         */
+        this.users = template.users || [];
+
+        /**
+         * The identifiers of all user groups who should be granted read access
+         * to this connection.
+         *
+         * @type String[]
+         */
+        this.groups = template.groups || [];
+
+    };
+
+    return ProtoConnection;
+
+}]);
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 98b983b9f..978ffc0e2 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -200,6 +200,10 @@
         "ERROR_INVALID_GROUP": "No group matching \"{GROUP}\" found",
         "ERROR_INVALID_FILE_TYPE": 
             "Invalid import file type \"{TYPE}\"",
+        "ERROR_INVALID_USER_IDENTIFIERS":
+            "Users not found: {IDENTIFIER_LIST}",
+        "ERROR_INVALID_USER_GROUP_IDENTIFIERS":
+            "User Groups not found: {IDENTIFIER_LIST}",
         "ERROR_NO_FILE_SUPPLIED": "Please select a file to import",
         "ERROR_AMBIGUOUS_PARENT_GROUP":
             "Both group and parentIdentifier may be not specified at the same time",

From bfb7f3b78a7699183d8255b6bf3415d9fc32c2b1 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 13 Feb 2023 19:02:26 +0000
Subject: [PATCH 153/289] GUACAMOLE-926: Create users and groups; don't require
 them to exist beforehand.

---
 .../importConnectionsController.js            |  79 +++++++++-
 .../import/services/connectionCSVService.js   |   8 +-
 .../import/services/connectionParseService.js | 135 +++++-------------
 ...ProtoConnection.js => ImportConnection.js} |  12 +-
 .../src/app/import/types/ParseResult.js       |  17 +++
 .../app/rest/services/connectionService.js    |   6 +-
 .../src/app/rest/types/DirectoryPatch.js      |  10 +-
 .../app/rest/types/DirectoryPatchOutcome.js   |  10 +-
 .../app/rest/types/DirectoryPatchResponse.js  |  50 +++++++
 9 files changed, 195 insertions(+), 132 deletions(-)
 rename guacamole/src/main/frontend/src/app/import/types/{ProtoConnection.js => ImportConnection.js} (91%)
 create mode 100644 guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchResponse.js

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 73164a08c..2d7cdab22 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -24,19 +24,73 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         function importConnectionsController($scope, $injector) {
 
     // Required services
+    const $routeParams           = $injector.get('$routeParams');
     const connectionParseService = $injector.get('connectionParseService');
     const connectionService      = $injector.get('connectionService');
     
     // Required types
+    const DirectoryPatch      = $injector.get('DirectoryPatch');
     const ParseError          = $injector.get('ParseError');
     const TranslatableMessage = $injector.get('TranslatableMessage');
+
+    /**
+     * Given a successful response to an import PATCH request, make another
+     * request to delete every created connection in the provided request, i.e.
+     * clean up every connection that was created.
+     *
+     * @param {DirectoryPatchResponse} creationResponse
+     */
+    function cleanUpConnections(creationResponse) {
+
+        // The patches to delete - one delete per initial creation
+        const deletionPatches = creationResponse.patches.map(patch =>
+            new DirectoryPatch({
+                op: 'remove',
+                path: '/' + patch.identifier
+            }));
+
+        console.log("Deletion Patches", deletionPatches);
+
+        connectionService.patchConnections(
+            $routeParams.dataSource, deletionPatches)
     
-    function handleSuccess(data) {
-        console.log("OMG SUCCESS: ", data)
+            .then(deletionResponse =>
+                console.log("Deletion response", deletionResponse))
+            .catch(handleParseError);
+
+    }
+
+    /**
+     * Process a successfully parsed import file, creating any specified
+     * connections, creating and granting permissions to any specified users
+     * and user groups.
+     * 
+     * TODO:
+     * - Do batch import of connections
+     * - Create all users/groups not already present
+     * - Grant permissions to all users/groups as defined in the import file
+     * - On failure: Roll back everything (maybe ask the user first):
+     *   - Attempt to delete all created connections
+     *   - Attempt to delete any created users / groups
+     *
+     * @param {ParseResult} parseResult
+     *     The result of parsing the user-supplied import file.
+     *
+     */
+    function handleParseSuccess(parseResult) {
+        connectionService.patchConnections(
+                $routeParams.dataSource, parseResult.patches)
+        
+                .then(response => {
+            console.log("Creation Response", response);
+
+            // TODON'T: Delete connections so we can test over and over
+            cleanUpConnections(response);
+        });
     }
     
     // Set any caught error message to the scope for display
-    const handleError = error => {
+    const handleParseError = error => {
         console.error(error);
         $scope.error = error;
     }
@@ -44,14 +98,25 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     // Clear the current error
     const clearError = () => delete $scope.error;
 
-    function processData(type, data) {
+    /**
+     * Process the uploaded import file, importing the connections, granting
+     * connection permissions, or displaying errors to the user if there are 
+     * problems with the provided file.
+     *
+     * @param {String} mimeType
+     *     The MIME type of the uploaded data file.
+     * 
+     * @param {String} data
+     *     The raw string contents of the import file.
+     */
+    function processData(mimeType, data) {
         
         // The function that will process all the raw data and return a list of
         // patches to be submitted to the API
         let processDataCallback;
 
         // Parse the data based on the provided mimetype
-        switch(type) {
+        switch(mimeType) {
 
             case "application/json":
             case "text/json":
@@ -82,10 +147,10 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         processDataCallback(data)
 
             // Send the data off to be imported if parsing is successful
-            .then(handleSuccess)
+            .then(handleParseSuccess)
 
             // Display any error found while parsing the file
-            .catch(handleError);
+            .catch(handleParseError);
     }
 
     $scope.upload = function() {
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
index a104cdd46..492b9388b 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
@@ -33,7 +33,7 @@ angular.module('import').factory('connectionCSVService',
                 
     // Required types
     const ParseError          = $injector.get('ParseError');
-    const ProtoConnection     = $injector.get('ProtoConnection');
+    const ImportConnection     = $injector.get('ImportConnection');
     const TranslatableMessage = $injector.get('TranslatableMessage');
     
     // Required services
@@ -154,7 +154,7 @@ angular.module('import').factory('connectionCSVService',
     
     /**
      * Given a CSV header row, create and return a promise that will resolve to
-     * a function that can take a CSV data row and return a ProtoConnection
+     * a function that can take a CSV data row and return a ImportConnection
      * object. If an error occurs while parsing a particular row, the resolved 
      * function will throw a ParseError describing the failure.
      * 
@@ -185,7 +185,7 @@ angular.module('import').factory('connectionCSVService',
      * 
      * @returns {Promise.<Function.<String[], Object>>}
      *     A promise that will resolve to a function that translates a CSV data
-     *     row (array of strings) to a ProtoConnection object.
+     *     row (array of strings) to a ImportConnection object.
      */
     service.getCSVTransformer = function getCSVTransformer(headerRow) {
         
@@ -405,7 +405,7 @@ angular.module('import').factory('connectionCSVService',
                 const parentIdentifier = (
                         parentIdentifierGetter && parentIdentifierGetter(row));
                
-                return new ProtoConnection({
+                return new ImportConnection({
                     
                     // Fields that are not protocol-specific
                     ...{
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index f2f6c1daa..7c4f6c754 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -42,81 +42,8 @@ angular.module('import').factory('connectionParseService',
     const schemaService          = $injector.get('schemaService');
     const connectionCSVService   = $injector.get('connectionCSVService');
     const connectionGroupService = $injector.get('connectionGroupService');
-    const userService            = $injector.get('userService');
-    const userGroupService       = $injector.get('userGroupService');
 
     const service = {};
-
-    /**
-     * Resolves to an object whose keys are all valid identifiers in the current
-     * data source. The provided `requestFunction` should resolve to such an
-     * object when provided with the current data source.
-     *
-     * @param {Function.<String<Object.<String, *>>} requestFunction
-     *     A function that, given a data source, will return a promise resolving
-     *     to an object with keys that are unique identifiers for entities in
-     *     that data source.
-     *
-     * @returns {Promise.<Function[String[], String[]>>}
-     *     A promise that will resolve to an function that, given an array of
-     *     identifiers, will return all identifiers that do not exist as keys in
-     *     the object returned by `requestFunction`, i.e. all identifiers that
-     *     do not exist in the current data source.
-     */
-    function getIdentifierMap(requestFunction) {
-
-        // The current data source to which all the identifiers will belong
-        const dataSource = $routeParams.dataSource;
-
-        // Make the request and return the response, which should be an object
-        // whose keys are all valid identifiers for the current data source
-        return requestFunction(dataSource);
-    }
-
-    /**
-     * Return a promise that resolves to a function that takes an array of
-     * identifiers, returning a ParseError describing the invalid identifiers
-     * from the list. The provided `requestFunction` should resolve to such an
-     * object whose keys are all valid identifiers when provided with the
-     * current data source.
-     *
-     * @param {Function.<String<Object.<String, *>>} requestFunction
-     *     A function that, given a data source, will return a promise resolving
-     *     to an object with keys that are unique identifiers for entities in
-     *     that data source.
-     *
-     * @returns {Promise.<Function.<String[], ParseError?>>}
-     *     A promise that will resolve to a function to check the validity of
-     *     each identifier in a provided array, returning a ParseError 
-     *     describing the problem if any are not valid.
-     */
-    function getInvalidIdentifierErrorChecker(requestFunction) {
-
-        // Fetch all the valid user identifiers in the system, and
-        return getIdentifierMap(requestFunction).then(validIdentifiers =>
-
-            // The resolved function that takes a list of user group identifiers
-            allIdentifiers => {
-
-                // Filter to only include invalid identifiers
-                const invalidIdentifiers = _.filter(allIdentifiers,
-                    identifier => !validIdentifiers[identifier]);
-
-                if (invalidIdentifiers.length) {
-
-                    // Quote and comma-seperate for display
-                    const identifierList = invalidIdentifiers.map(
-                        identifier => '"' + identifier + '"').join(', ');
-
-                    return new ParseError({
-                        message: 'Invalid User Group Identifiers: ' + identifierList,
-                        key: 'CONNECTION_IMPORT.ERROR_INVALID_USER_GROUP_IDENTIFIERS',
-                        variables: { IDENTIFIER_LIST: identifierList }
-                    });
-                }
-
-            });
-    }
     
     /**
      * Perform basic checks, common to all file types - namely that the parsed
@@ -245,12 +172,12 @@ angular.module('import').factory('connectionParseService',
     }
 
     /**
-     * Convert a provided ProtoConnection array into a ParseResult. Any provided
+     * Convert a provided ImportConnection array into a ParseResult. Any provided
      * transform functions will be run on each entry in `connectionData` before
      * any other processing is done.
      *
      * @param {*[]} connectionData
-     *     An arbitrary array of data. This must evaluate to a ProtoConnection
+     *     An arbitrary array of data. This must evaluate to a ImportConnection
      *     object after being run through all functions in `transformFunctions`.
      *
      * @param {Function[]} transformFunctions
@@ -271,21 +198,10 @@ angular.module('import').factory('connectionParseService',
             return deferred.promise;
         }
 
-        return $q.all({
-            groupTransformer           : getGroupTransformer(),
-            invalidUserIdErrorDetector : getInvalidIdentifierErrorChecker(
-                    userService.getUsers),
-            invalidGroupIDErrorDetector : getInvalidIdentifierErrorChecker(
-                    userGroupService.getUserGroups),
-        })
+        return getGroupTransformer().then(groupTransformer =>
+                connectionData.reduce((parseResult, data) => {
 
-        // Transform the rows from the CSV file to an array of API patches
-        // and lists of user and group identifiers
-        .then(({groupTransformer,
-                invalidUserIdErrorDetector, invalidGroupIDErrorDetector}) =>
-                    connectionData.reduce((parseResult, data) => {
-
-            const { patches, identifiers, users, groups } = parseResult;
+            const { patches, users, groups, allUsers, allGroups } = parseResult;
 
             // Run the array data through each provided transform
             let connectionObject = data;
@@ -307,14 +223,15 @@ angular.module('import').factory('connectionParseService',
                 connectionErrors.push(error);
             }
 
-            // Push any errors for invalid user or user group identifiers
-            const pushError = error => error && connectionErrors.push(error);
-            pushError(invalidUserIdErrorDetector(connectionObject.users));
-            pushError(invalidGroupIDErrorDetector(connectionObject.userGroups));
-
             // Add the user and group identifiers for this connection
-            users.push(connectionObject.users);
-            groups.push(connectionObject.groups);
+            const connectionUsers = connectionObject.users || [];
+            const connectionGroups = connectionObject.groups || [];
+            users.push(connectionUsers);
+            groups.push(connectionGroups);
+
+            // Add all user and user group identifiers to the overall sets
+            connectionUsers.forEach(identifier => allUsers[identifier] = true);
+            connectionGroups.forEach(identifier => allGroups[identifier] = true);
 
             // Translate to a full-fledged Connection
             const connection = new Connection(connectionObject);
@@ -398,7 +315,18 @@ angular.module('import').factory('connectionParseService',
     service.parseYAML = function parseYAML(yamlData) {
 
         // Parse from YAML into a javascript array
-        const connectionData = parseYAMLData(yamlData);
+        try {
+            const connectionData = parseYAMLData(yamlData);
+        }
+
+        // If the YAML parser throws an error, reject with that error. No
+        // translation key will be available here.
+        catch(error) {
+            console.error(error);
+            const deferred = $q.defer();
+            deferred.reject(new ParseError({ message: error.message }));
+            return deferred.promise;
+        }
         
         // Produce a ParseResult
         return parseConnectionData(connectionData);
@@ -420,7 +348,18 @@ angular.module('import').factory('connectionParseService',
     service.parseJSON = function parseJSON(jsonData) {
 
         // Parse from JSON into a javascript array
-        const connectionData = JSON.parse(jsonData);
+        try {
+            const connectionData = JSON.parse(jsonData);
+        }
+
+        // If the JSON parse attempt throws an error, reject with that error.
+        // No translation key will be available here.
+        catch(error) {
+            console.error(error);
+            const deferred = $q.defer();
+            deferred.reject(new ParseError({ message: error.message }));
+            return deferred.promise;
+        }
 
         // Produce a ParseResult
         return parseConnectionData(connectionData);
diff --git a/guacamole/src/main/frontend/src/app/import/types/ProtoConnection.js b/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
similarity index 91%
rename from guacamole/src/main/frontend/src/app/import/types/ProtoConnection.js
rename to guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
index c853934d0..9f336ef77 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ProtoConnection.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
@@ -18,21 +18,21 @@
  */
 
 /**
- * Service which defines the Connection class.
+ * Service which defines the ImportConnection class.
  */
-angular.module('import').factory('ProtoConnection', [
-        function defineProtoConnection() {
+angular.module('import').factory('ImportConnection', [
+        function defineImportConnection() {
 
     /**
      * A representation of a connection to be imported, as parsed from an
      * user-supplied import file.
      *
      * @constructor
-     * @param {Connection|Object} [template={}]
+     * @param {ImportConnection|Object} [template={}]
      *     The object whose properties should be copied within the new
      *     Connection.
      */
-    var ProtoConnection = function ProtoConnection(template) {
+    var ImportConnection = function ImportConnection(template) {
 
         // Use empty object by default
         template = template || {};
@@ -106,6 +106,6 @@ angular.module('import').factory('ProtoConnection', [
 
     };
 
-    return ProtoConnection;
+    return ImportConnection;
 
 }]);
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/import/types/ParseResult.js b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
index e6aa59229..77c49eb31 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
@@ -63,6 +63,23 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
          */
         this.groups = template.groups || [];
 
+        /**
+         * An object whose keys are the user identifiers of every user specified
+         * in the batch import. i.e. a set of all user identifiers.
+         *
+         * @type {Object.<String, Boolean>}
+         */
+        this.allUsers = template.allUsers || {};
+
+        /**
+         * An object whose keys are the user group identifiers of every user
+         * group specified in the batch import. i.e. a set of all user group
+         * identifiers.
+         *
+         * @type {Object.<String, Boolean>}
+         */
+        this.allGroups = template.allGroups || {};
+
         /**
          * An array of errors encountered while parsing the corresponding
          * connection (at the same array index). Each connection should have a
diff --git a/guacamole/src/main/frontend/src/app/rest/services/connectionService.js b/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
index 053559530..5c1451ec2 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
@@ -158,7 +158,7 @@ angular.module('rest').factory('connectionService', ['$injector',
     /**
      * Makes a request to the REST API to apply a supplied list of connection
      * patches, returning a promise that can be used for processing the results 
-     * of the  call. 
+     * of the call. 
      * 
      * This operation is atomic - if any errors are encountered during the 
      * connection patching process, the entire request will fail, and no 
@@ -181,12 +181,14 @@ angular.module('rest').factory('connectionService', ['$injector',
         })
 
         // Clear the cache
-        .then(function connectionsPatched(){
+        .then(function connectionsPatched(patchResponse){
             cacheService.connections.removeAll();
 
             // Clear users cache to force reload of permissions for any
             // newly created or replaced connections
             cacheService.users.removeAll();
+
+            return patchResponse;
             
         });
 
diff --git a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
index 96a2cb093..05874d4fc 100644
--- a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
+++ b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
@@ -59,10 +59,9 @@ angular.module('rest').factory('DirectoryPatch', [function defineDirectoryPatch(
         this.path = template.path || '/';
 
         /**
-         * The object being added or replaced, or the identifier of the object
-         * being removed.
+         * The object being added, or undefined if deleting.
          *
-         * @type {DirectoryObject|String}
+         * @type {DirectoryObject}
          */
         this.value = template.value;
 
@@ -78,11 +77,6 @@ angular.module('rest').factory('DirectoryPatch', [function defineDirectoryPatch(
          */
         ADD : "add",
 
-        /**
-         * Removes the specified object from the relation.
-         */
-        REPLACE : "replace",
-
         /**
          * Removes the specified object from the relation.
          */
diff --git a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js
index 4534dae13..e6710c2ca 100644
--- a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js
+++ b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js
@@ -30,15 +30,11 @@ angular.module('rest').factory('DirectoryPatchOutcome', [
      * response. The error field is only meaningful for unsuccessful patches.
      * @constructor
      * 
-     * @template DirectoryObject
-     *     The directory-based object type that this DirectoryPatchOutcome
-     *     represents a patch outcome for.
-     * 
-     * @param {DirectoryObject|Object} [template={}]
+     * @param {DirectoryPatchOutcome|Object} [template={}]
      *     The object whose properties should be copied within the new
      *     DirectoryPatchOutcome.
      */
-    var DirectoryPatchOutcome = function DirectoryPatchOutcome(template) {
+    const DirectoryPatchOutcome = function DirectoryPatchOutcome(template) {
 
         // Use empty object by default
         template = template || {};
@@ -78,6 +74,6 @@ angular.module('rest').factory('DirectoryPatchOutcome', [
 
     };
 
-    return DirectoryPatch;
+    return DirectoryPatchOutcome;
 
 }]);
diff --git a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchResponse.js b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchResponse.js
new file mode 100644
index 000000000..9538c077e
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchResponse.js
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Service which defines the DirectoryPatchResponse class.
+ */
+angular.module('rest').factory('DirectoryPatchResponse', [
+        function defineDirectoryPatchResponse() {
+
+    /**
+     * An object returned by a PATCH request to a directory REST API,
+     * representing the successful response to a patch request.
+     *
+     * @param {DirectoryPatchResponse|Object} [template={}]
+     *     The object whose properties should be copied within the new
+     *     DirectoryPatchResponse.
+     */
+    const DirectoryPatchResponse = function DirectoryPatchResponse(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * An outcome for each patch in the corresponding patch request.
+         *
+         * @type {DirectoryPatchOutcome[]}
+         */
+        this.patches = template.patches;
+
+    };
+
+    return DirectoryPatchResponse;
+
+}]);

From 51e0fb8c661373afadb7e09e8965076db8057bf8 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 14 Feb 2023 02:12:20 +0000
Subject: [PATCH 154/289] GUACAMOLE-926: Grant permissions to all users /
 groups.

---
 .../importConnectionsController.js            | 165 ++++++++++++++++--
 .../import/services/connectionParseService.js |  34 +++-
 .../src/app/import/types/ParseResult.js       |  27 +--
 .../src/app/rest/services/userGroupService.js |  33 ++++
 .../src/app/rest/services/userService.js      |  33 ++++
 5 files changed, 253 insertions(+), 39 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 2d7cdab22..8cd235e6e 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -17,6 +17,8 @@
  * under the License.
  */
 
+/* global _ */
+
 /**
  * The controller for the connection import page.
  */
@@ -24,14 +26,21 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         function importConnectionsController($scope, $injector) {
 
     // Required services
+    const $q                     = $injector.get('$q');
     const $routeParams           = $injector.get('$routeParams');
     const connectionParseService = $injector.get('connectionParseService');
     const connectionService      = $injector.get('connectionService');
+    const permissionService      = $injector.get('permissionService');
+    const userService            = $injector.get('userService');
+    const userGroupService       = $injector.get('userGroupService');
     
     // Required types
     const DirectoryPatch      = $injector.get('DirectoryPatch');
     const ParseError          = $injector.get('ParseError');
+    const PermissionSet       = $injector.get('PermissionSet');
     const TranslatableMessage = $injector.get('TranslatableMessage');
+    const User                = $injector.get('User');
+    const UserGroup           = $injector.get('UserGroup');
 
     /**
      * Given a successful response to an import PATCH request, make another
@@ -56,10 +65,133 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     
             .then(deletionResponse =>
                 console.log("Deletion response", deletionResponse))
-            .catch(handleParseError);
+            .catch(handleError);
 
     }
 
+    /**
+     * Create all users and user groups mentioned in the import file that don't
+     * already exist in the current data source.
+     *
+     * @param {ParseResult} parseResult
+     *     The result of parsing the user-supplied import file.
+     *
+     * @return {Object}
+     *     An object containing the results of the calls to create the users
+     *     and groups.
+     */
+    function createUsersAndGroups(parseResult) {
+
+        const dataSource = $routeParams.dataSource;
+
+        return $q.all({
+            existingUsers : userService.getUsers(dataSource),
+            existingGroups : userGroupService.getUserGroups(dataSource)
+        }).then(({existingUsers, existingGroups}) => {
+
+            const userPatches = Object.keys(parseResult.users)
+
+                // Filter out any existing users
+                .filter(identifier => !existingUsers[identifier])
+
+                // A patch to create each new user
+                .map(username => new DirectoryPatch({
+                    op: 'add',
+                    path: '/',
+                    value: new User({ username })
+                }));
+
+            const groupPatches = Object.keys(parseResult.groups)
+
+                // Filter out any existing groups
+                .filter(identifier => !existingGroups[identifier])
+
+                // A patch to create each new user group
+                .map(identifier => new DirectoryPatch({
+                    op: 'add',
+                    path: '/',
+                    value: new UserGroup({ identifier })
+                }));
+
+            return $q.all({
+                createdUsers: userService.patchUsers(dataSource, userPatches),
+                createdGroups: userGroupService.patchUserGroups(dataSource, groupPatches)
+            });
+            
+        });
+        
+    }
+
+    /**
+     * Grant read permissions for each user and group in the supplied parse
+     * result to each connection in their connection list. Note that there will
+     * be a seperate request for each user and group.
+     *
+     * @param {ParseResult} parseResult
+     *     The result of successfully parsing a user-supplied import file.
+     *
+     * @param {Object} response
+     *     The response from the PATCH API request.
+     *
+     * @returns {Promise.<Object>}
+     *     A promise that will resolve with the result of every permission
+     *     granting request.
+     */
+    function grantConnectionPermissions(parseResult, response) {
+
+        const dataSource = $routeParams.dataSource;
+
+        // All connection grant requests, one per user/group
+        const userRequests = {};
+        const groupRequests = {};
+
+        // Create a PermissionSet granting access to all connections at
+        // the provided indices within the provided parse result
+        const createPermissionSet = indices =>
+            new PermissionSet({ connectionPermissions: indices.reduce(
+                    (permissions, index) => {
+                const connectionId = response.patches[index].identifier;
+                permissions[connectionId] = [
+                        PermissionSet.ObjectPermissionType.READ];
+                return permissions;
+            }, {}) });
+        
+        // Now that we've created all the users, grant access to each
+        _.forEach(parseResult.users, (connectionIndices, identifier) => 
+
+            // Grant the permissions - note the group flag is `false`
+            userRequests[identifier] = permissionService.patchPermissions(
+                dataSource, identifier,
+
+                // Create the permissions to these connections for this user
+                createPermissionSet(connectionIndices),
+
+                // Do not remove any permissions
+                new PermissionSet(),
+
+                // This call is not for a group
+                false));
+
+        // Now that we've created all the groups, grant access to each
+        _.forEach(parseResult.groups, (connectionIndices, identifier) => 
+
+            // Grant the permissions - note the group flag is `true`
+            groupRequests[identifier] = permissionService.patchPermissions(
+                dataSource, identifier,
+
+                // Create the permissions to these connections for this user
+                createPermissionSet(connectionIndices),
+
+                // Do not remove any permissions
+                new PermissionSet(),
+
+                // This call is for a group
+                true));
+
+        // Return the result from all the permission granting calls
+        return $q.all({ ...userRequests, ...groupRequests });
+    }
+
     /**
      * Process a successfully parsed import file, creating any specified
      * connections, creating and granting permissions to any specified users
@@ -78,19 +210,32 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      *
      */
     function handleParseSuccess(parseResult) {
-        connectionService.patchConnections(
-                $routeParams.dataSource, parseResult.patches)
-        
-                .then(response => {
-            console.log("Creation Response", response);
 
-            // TODON'T: Delete connections so we can test over and over
-            cleanUpConnections(response);
+        const dataSource = $routeParams.dataSource;
+
+        console.log("parseResult", parseResult);
+
+        // First, attempt to create the connections
+        connectionService.patchConnections(dataSource, parseResult.patches)
+                .then(response => {
+
+            // If connection creation is successful, create users and groups
+            createUsersAndGroups(parseResult).then(() => {
+
+                grantConnectionPermissions(parseResult, response).then(results => {
+                    console.log("permission requests", results);
+                   
+                    // TODON'T: Delete connections so we can test over and over
+                    cleanUpConnections(response);
+                })
+
+
+            });
         });
     }
     
     // Set any caught error message to the scope for display
-    const handleParseError = error => {
+    const handleError = error => {
         console.error(error);
         $scope.error = error;
     }
@@ -150,7 +295,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
             .then(handleParseSuccess)
 
             // Display any error found while parsing the file
-            .catch(handleParseError);
+            .catch(handleError);
     }
 
     $scope.upload = function() {
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index 7c4f6c754..4b9f50c2d 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -199,9 +199,9 @@ angular.module('import').factory('connectionParseService',
         }
 
         return getGroupTransformer().then(groupTransformer =>
-                connectionData.reduce((parseResult, data) => {
+                connectionData.reduce((parseResult, data, index) => {
 
-            const { patches, users, groups, allUsers, allGroups } = parseResult;
+            const { patches, users, groups } = parseResult;
 
             // Run the array data through each provided transform
             let connectionObject = data;
@@ -223,15 +223,33 @@ angular.module('import').factory('connectionParseService',
                 connectionErrors.push(error);
             }
 
-            // Add the user and group identifiers for this connection
+            // The users and user groups that should be granted access
             const connectionUsers = connectionObject.users || [];
             const connectionGroups = connectionObject.groups || [];
-            users.push(connectionUsers);
-            groups.push(connectionGroups);
 
-            // Add all user and user group identifiers to the overall sets
-            connectionUsers.forEach(identifier => allUsers[identifier] = true);
-            connectionGroups.forEach(identifier => allGroups[identifier] = true);
+            // Add this connection index to the list for each user
+            connectionUsers.forEach(identifier => {
+
+                // If there's an existing list, add the index to that
+                if (users[identifier])
+                    users[identifier].push(index);
+
+                // Otherwise, create a new list with just this index
+                else
+                    users[identifier] = [index];
+            });
+
+            // Add this connection index to the list for each group
+            connectionGroups.forEach(identifier => {
+
+                // If there's an existing list, add the index to that
+                if (groups[identifier])
+                    groups[identifier].push(index);
+
+                // Otherwise, create a new list with just this index
+                else
+                    groups[identifier] = [index];
+            });
 
             // Translate to a full-fledged Connection
             const connection = new Connection(connectionObject);
diff --git a/guacamole/src/main/frontend/src/app/import/types/ParseResult.js b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
index 77c49eb31..1a5abd14d 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
@@ -48,28 +48,13 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
         this.patches = template.patches || [];
 
         /**
-         * A list of user identifiers that should be granted read access to the
-         * the corresponding connection (at the same array index).
+         * An object whose keys are the user identifiers of users specified
+         * in the batch import. and the keys are an array of indices of
+         * connections to which those users should be granted access.
          *
-         * @type {String[]}
+         * @type {Object.<String, Integer[]>}
          */
-        this.users = template.users || [];
-
-        /**
-         * A list of user group identifiers that should be granted read access
-         * to the corresponding connection (at the same array index).
-         *
-         * @type {String[]}
-         */
-        this.groups = template.groups || [];
-
-        /**
-         * An object whose keys are the user identifiers of every user specified
-         * in the batch import. i.e. a set of all user identifiers.
-         *
-         * @type {Object.<String, Boolean>}
-         */
-        this.allUsers = template.allUsers || {};
+        this.users = template.users || {};
 
         /**
          * An object whose keys are the user group identifiers of every user
@@ -78,7 +63,7 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
          *
          * @type {Object.<String, Boolean>}
          */
-        this.allGroups = template.allGroups || {};
+        this.groups = template.users || {};
 
         /**
          * An array of errors encountered while parsing the corresponding
diff --git a/guacamole/src/main/frontend/src/app/rest/services/userGroupService.js b/guacamole/src/main/frontend/src/app/rest/services/userGroupService.js
index 090efa944..987f8383a 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/userGroupService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/userGroupService.js
@@ -190,6 +190,39 @@ angular.module('rest').factory('userGroupService', ['$injector',
 
     };
 
+    /**
+     * Makes a request to the REST API to apply a supplied list of user group
+     * patches, returning a promise that can be used for processing the results
+     * of the call.
+     *
+     * This operation is atomic - if any errors are encountered during the
+     * connection patching process, the entire request will fail, and no
+     * changes will be persisted.
+     *
+     * @param {DirectoryPatch.<UserGroup>[]} patches
+     *     An array of patches to apply.
+     *
+     * @returns {Promise}
+     *     A promise for the HTTP call which will succeed if and only if the
+     *     patch operation is successful.
+     */
+    service.patchUserGroups = function patchUserGroups(dataSource, patches) {
+
+        // Make the PATCH request
+        return authenticationService.request({
+            method  : 'PATCH',
+            url     : 'api/session/data/' + encodeURIComponent(dataSource) + '/userGroups',
+            data    : patches
+        })
+
+        // Clear the cache
+        .then(function userGroupsPatched(patchResponse){
+            cacheService.users.removeAll();
+            return patchResponse;
+        });
+
+    }
+
     return service;
 
 }]);
diff --git a/guacamole/src/main/frontend/src/app/rest/services/userService.js b/guacamole/src/main/frontend/src/app/rest/services/userService.js
index faa26b40a..252aead3a 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/userService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/userService.js
@@ -235,6 +235,39 @@ angular.module('rest').factory('userService', ['$injector',
         });
 
     };
+
+    /**
+     * Makes a request to the REST API to apply a supplied list of user patches,
+     * returning a promise that can be used for processing the results of the
+     * call.
+     *
+     * This operation is atomic - if any errors are encountered during the
+     * connection patching process, the entire request will fail, and no
+     * changes will be persisted.
+     *
+     * @param {DirectoryPatch.<User>[]} patches
+     *     An array of patches to apply.
+     *
+     * @returns {Promise}
+     *     A promise for the HTTP call which will succeed if and only if the
+     *     patch operation is successful.
+     */
+    service.patchUsers = function patchUsers(dataSource, patches) {
+
+        // Make the PATCH request
+        return authenticationService.request({
+            method  : 'PATCH',
+            url     : 'api/session/data/' + encodeURIComponent(dataSource) + '/users',
+            data    : patches
+        })
+
+        // Clear the cache
+        .then(function usersPatched(patchResponse){
+            cacheService.users.removeAll();
+            return patchResponse;
+        });
+
+    }
     
     return service;
 

From a1c1a5888612a0b05b7741dc27c7ec8d8b30dd2d Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 16 Feb 2023 01:30:55 +0000
Subject: [PATCH 155/289] GUACAMOLE-926: Create new file upload UI.

---
 .../importConnectionsController.js            | 240 ++++++++++++++---
 .../directives/connectionImportFileUpload.js  | 253 ++++++++++++++++++
 .../src/app/import/styles/file-upload.css     | 119 ++++++++
 .../frontend/src/app/import/styles/import.css |   9 +
 .../import/templates/connectionImport.html    |  16 +-
 .../templates/connectionImportFileUpload.html |  30 +++
 .../main/frontend/src/translations/en.json    |  14 +-
 guacamole/src/main/frontend/webpack.config.js |  16 +-
 8 files changed, 641 insertions(+), 56 deletions(-)
 create mode 100644 guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
 create mode 100644 guacamole/src/main/frontend/src/app/import/styles/file-upload.css
 create mode 100644 guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 8cd235e6e..31a49adf8 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -42,6 +42,70 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     const User                = $injector.get('User');
     const UserGroup           = $injector.get('UserGroup');
 
+    /**
+     * Any error that may have occured during import file parsing.
+     *
+     * @type {ParseError}
+     */
+    $scope.error = null;
+
+    /**
+     * True if the file is fully uploaded and ready to be processed, or false
+     * otherwise.
+     *
+     * @type {Boolean}
+     */
+    $scope.dataReady = false;
+
+    /**
+     * True if the file upload has been aborted mid-upload, or false otherwise.
+     */
+    $scope.aborted = false;
+
+    /**
+     * True if fully-uploaded data is being processed, or false otherwise.
+     */
+    $scope.processing = false;
+
+    /**
+     * The MIME type of the uploaded file, if any.
+     *
+     * @type {String}
+     */
+    $scope.mimeType = null;
+
+    /**
+     * The raw string contents of the uploaded file, if any.
+     *
+     * @type {String}
+     */
+    $scope.fileData = null;
+
+    /**
+     * The file reader currently being used to upload the file, if any. If
+     * null, no file upload is currently in progress.
+     *
+     * @type {FileReader}
+     */
+    $scope.fileReader = null;
+
+    /**
+     * Clear all file upload state.
+     */
+    function resetUploadState() {
+
+        $scope.aborted = false;
+        $scope.dataReady = false;
+        $scope.processing = false;
+        $scope.fileData = null;
+        $scope.mimeType = null;
+        $scope.fileReader = null;
+
+        // Broadcast an event to clear the file upload UI
+        $scope.$broadcast('clearFile');
+        
+    }
+
     /**
      * Given a successful response to an import PATCH request, make another
      * request to delete every created connection in the provided request, i.e.
@@ -227,20 +291,35 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                    
                     // TODON'T: Delete connections so we can test over and over
                     cleanUpConnections(response);
-                })
 
+                    resetUploadState();
+                })
 
             });
         });
     }
     
-    // Set any caught error message to the scope for display
+    /**
+     * Set any caught error message to the scope for display.
+     *
+     * @argument {ParseError} error
+     *     The error to display.
+     */
     const handleError = error => {
+
+        // Any error indicates that processing of the file has failed, so clear
+        // all upload state to allow for a fresh retry
+        resetUploadState();
+
+        // Set the error for display
         console.error(error);
         $scope.error = error;
+        
     }
     
-    // Clear the current error
+    /**
+     * Clear the current displayed error.
+     */
     const clearError = () => delete $scope.error;
 
     /**
@@ -255,39 +334,35 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      *     The raw string contents of the import file.
      */
     function processData(mimeType, data) {
+
+        // Data processing has begun
+        $scope.processing = true;
         
         // The function that will process all the raw data and return a list of
         // patches to be submitted to the API
         let processDataCallback;
 
-        // Parse the data based on the provided mimetype
-        switch(mimeType) {
+        // Choose the appropriate parse function based on the mimetype
+        if (mimeType.endsWith("json"))
+            processDataCallback = connectionParseService.parseJSON;
 
-            case "application/json":
-            case "text/json":
-                processDataCallback = connectionParseService.parseJSON;
-                break;
+        else if (mimeType.endsWith("csv"))
+            processDataCallback = connectionParseService.parseCSV;
 
-            case "text/csv":
-                processDataCallback = connectionParseService.parseCSV;
-                break;
+        else if (mimeType.endsWith("yaml"))
+            processDataCallback = connectionParseService.parseYAML;
 
-            case "application/yaml":
-            case "application/x-yaml":
-            case "text/yaml":
-            case "text/x-yaml":
-                processDataCallback = connectionParseService.parseYAML;
-                break;
-                
-            default:
-                handleError(new ParseError({
-                    message: 'Invalid file type: ' + type,
-                    key: 'CONNECTION_IMPORT.INVALID_FILE_TYPE',
-                    variables: { TYPE: type } 
-                }));
-                return;
+        // We don't expect this to happen - the file upload directive should
+        // have already have filtered out any invalid file types
+        else {
+            handleError(new ParseError({
+                message: 'Invalid file type: ' + type,
+                key: 'CONNECTION_IMPORT.INVALID_FILE_TYPE',
+                variables: { TYPE: type }
+            }));
+            return;
         }
-        
+
         // Make the call to process the data into a series of patches
         processDataCallback(data)
 
@@ -298,30 +373,109 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
             .catch(handleError);
     }
 
-    $scope.upload = function() {
+    /**
+     * Process the uploaded import data. Only usuable if the upload is fully
+     * complete.
+     */
+    $scope.import = () => processData($scope.mimeType, $scope.fileData);
+
+    /**
+     * @return {Boolean}
+     *     True if import should be disabled, or false if cancellation
+     *     should be allowed.
+     */
+    $scope.importDisabled = () =>
+        
+        // Disable import if no data is ready
+        !$scope.dataReady ||
+
+        // Disable import if the file is currently being processed
+        $scope.processing;
+
+    /**
+     * Cancel any in-progress upload, or clear any uploaded-but
+     */
+    $scope.cancel = function() {
+
+        // Clear any error message
+        clearError();
+
+        // If the upload is in progress, stop it now; the FileReader will
+        // reset the upload state when it stops
+        if ($scope.fileReader) {
+            $scope.aborted = true;
+            $scope.fileReader.abort();
+        }
+
+        // Clear any upload state - there's no FileReader handler to do it
+        else 
+            resetUploadState();
+
+    };
+
+    /**
+     * @return {Boolean}
+     *     True if cancellation should be disabled, or false if cancellation
+     *     should be allowed.
+     */
+    $scope.cancelDisabled = () =>
+
+        // Disable cancellation if the import has already been cancelled
+        $scope.aborted ||
+
+        // Disable cancellation if the file is currently being processed
+        $scope.processing ||
+
+        // Disable cancellation if no data is ready or being uploaded
+        !($scope.fileReader || $scope.dataReady);
+
+    /**
+     * Handle a provided File upload, reading all data onto the scope for
+     * import processing, should the user request an import.
+     *
+     * @argument {File} file
+     *     The file to upload onto the scope for further processing.
+     */
+    $scope.handleFile = function(file) {
         
         // Clear any error message from the previous upload attempt
         clearError();
 
-        const files = angular.element('#file')[0].files;
+        // Initialize upload state
+        $scope.aborted = false;
+        $scope.dataReady = false;
+        $scope.processing = false;
+        $scope.uploadStarted = true;
 
-        if (files.length <= 0) {
-            handleError(new ParseError({
-                message: 'No file supplied',
-                key: 'CONNECTION_IMPORT.ERROR_NO_FILE_SUPPLIED'
-            }));
-            return;
-        }
+        // Save the MIME type to the scope
+        $scope.mimeType = file.type;
 
-        // The file that the user uploaded
-        const file = files[0];
+        // Save the file to the scope when ready
+        $scope.fileReader = new FileReader();
+        $scope.fileReader.onloadend = (e => {
 
-        // Call processData when the data is ready
-        const reader = new FileReader();
-        reader.onloadend = (e => processData(file.type, e.target.result));
+            // If the upload was explicitly aborted, clear any upload state and
+            // do not process the data
+            if ($scope.aborted) 
+                resetUploadState();
 
-        // Read all the data into memory and call processData when done
-        reader.readAsBinaryString(file);
+            else {
+                
+                // Save the uploaded data
+                $scope.fileData = e.target.result;
+
+                // Mark the data as ready
+                $scope.dataReady = true;
+                
+                // Clear the file reader from the scope now that this file is
+                // fully uploaded
+                $scope.fileReader = null;
+
+            }
+        });
+
+        // Read all the data into memory 
+        $scope.fileReader.readAsBinaryString(file);
     }
 
 }]);
diff --git a/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js b/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
new file mode 100644
index 000000000..d988e7c7d
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
@@ -0,0 +1,253 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/* global _ */
+
+/**
+ * A directive that allows for file upload, either through drag-and-drop or
+ * a file browser.
+ */
+
+/**
+ * All legal import file types. Any file not belonging to one of these types
+ * must be rejected.
+ */
+const LEGAL_FILE_TYPES = ["csv", "json", "yaml"];
+
+angular.module('import').directive('connectionImportFileUpload', [
+        function connectionImportFileUpload() {
+
+    const directive = {
+        restrict: 'E',
+        replace: true,
+        templateUrl: 'app/import/templates/connectionImportFileUpload.html',
+        scope: {
+
+            /**
+             * The function to invoke when a file is provided to the file upload
+             * UI, either by dragging and dropping, or by navigating using the
+             * file browser. The function will be called with 2 arguments - the
+             * mime type, and the raw string contents of the file.
+             *
+             * @type function
+             */
+            onFile : '&',
+        }
+    };
+
+    directive.controller = ['$scope', '$injector', '$element',
+            function fileUploadController($scope, $injector, $element) {
+
+        // Required services
+        const $timeout = $injector.get('$timeout');
+
+        /**
+         * Whether a drag/drop operation is currently in progress (the user has
+         * dragged a file over the Guacamole connection but has not yet
+         * dropped it).
+         *
+         * @type boolean
+         */
+        $scope.dropPending = false;
+
+        /**
+         * The error associated with the file upload, if any. An object of the
+         * form { key, variables }, or null if no error has occured.
+         */
+        $scope.error = null;
+
+        /**
+         * The name of the file that's currently being uploaded, or has yet to
+         * be imported, if any.
+         */
+        $scope.fileName = null;
+
+        // Clear the file if instructed to do so by the parent
+        $scope.$on('clearFile', () => delete $scope.fileName);
+
+        /**
+         * Clear any displayed error message.
+         */
+        const clearError = () => $scope.error = null;
+
+        /**
+         * Set an error for display using the provided translation key and
+         * translation variables.
+         *
+         * @param {String} key
+         *     The translation key.
+         *
+         * @param {Object.<String, String>} variables
+         *     The variables to subsitute into the message, if any.
+         */
+        const setError = (key, variables) => $scope.error = { key, variables };
+
+        /**
+         * The location where files can be dragged-and-dropped to.
+         *
+         * @type Element
+         */
+        const dropTarget = $element.find('.drop-target')[0];
+
+        /**
+         * Displays a visual indication that dropping the file currently
+         * being dragged is possible. Further propagation and default behavior
+         * of the given event is automatically prevented.
+         *
+         * @param {Event} e
+         *     The event related to the in-progress drag/drop operation.
+         */
+        const notifyDragStart = function notifyDragStart(e) {
+
+            e.preventDefault();
+            e.stopPropagation();
+
+            $scope.$apply(() => {
+                $scope.dropPending = true;
+            });
+
+        };
+
+        /**
+         * Removes the visual indication that dropping the file currently
+         * being dragged is possible. Further propagation and default behavior
+         * of the given event is automatically prevented.
+         *
+         * @param {Event} e
+         *     The event related to the end of the former drag/drop operation.
+         */
+        const notifyDragEnd = function notifyDragEnd(e) {
+
+            e.preventDefault();
+            e.stopPropagation();
+
+            $scope.$apply(() => {
+                $scope.dropPending = false;
+            });
+
+        };
+
+        // Add listeners to the drop target to ensure that the visual state
+        // stays up to date
+        dropTarget.addEventListener('dragenter', notifyDragStart, false);
+        dropTarget.addEventListener('dragover',  notifyDragStart, false);
+        dropTarget.addEventListener('dragleave', notifyDragEnd,   false);
+
+        /**
+         * Given a user-supplied file, validate that the file type is correct,
+         * and invoke the onFile callback provided to this directive if so.
+         * 
+         * @param {File} file
+         *     The user-supplied file.
+         */
+        function handleFile(file) {
+
+            // Clear any error from a previous attempted file upload
+            clearError();
+
+            // The MIME type of the provided file
+            const mimeType = file.type;
+
+            // Check if the mimetype ends with one of the supported types,
+            // e.g. "application/json" or "text/csv"
+            if (_.every(LEGAL_FILE_TYPES.map(
+                    type => !mimeType.endsWith(type)))) {
+
+                // If the provided file is not one of the supported types,
+                // display an error and abort processing
+                setError('CONNECTION_IMPORT.ERROR_INVALID_FILE_TYPE',
+                        { TYPE: mimeType });
+                return;
+            }
+
+            $scope.fileName = file.name;
+
+            // Invoke the provided file callback using the file
+            $scope.onFile({ file });
+        }
+
+        /**
+         * Drop target event listener that will be invoked if the user drops
+         * anything onto the drop target. If a valid file is provided, the
+         * onFile callback provided to this directive will be called; otherwise
+         * an error will be displayed, if appropriate.
+         *
+         * @param {Event} e
+         *     The drop event that triggered this handler.
+         */
+        dropTarget.addEventListener('drop', function(e) {
+
+            notifyDragEnd(e);
+            
+            const files = e.dataTransfer.files;
+
+            // Ignore any non-files that are dragged into the drop area
+            if (files.length < 1)
+                return;
+
+            if (files.length > 2) {
+
+                // If more than one file was provided, print an error explaining
+                // that only a single file is allowed and abort processing
+                setError('CONNECTION_IMPORT.ERROR_FILE_SINGLE_ONLY');
+                return;
+            }
+
+            handleFile(files[0]);
+            
+        }, false);
+
+        /**
+         * The hidden file input used to create a file browser.
+         *
+         * @type Element
+         */
+        const fileUploadInput = $element.find('.file-upload-input')[0];
+
+        /**
+         * A function that will click on the hidden file input to open a file
+         * browser to allow the user to select a file for upload.
+         */
+        $scope.openFileBrowser = () =>
+                $timeout(() => fileUploadInput.click(), 0, false);
+
+        /**
+         * A handler that will be invoked when a user selectes a file in the
+         * file browser. After some error checking, the file will be passed to
+         * the onFile callback provided to this directive.
+         *
+         * @param {Event} e
+         *     The event that was triggered when the user selected a file in
+         *     their file browser.
+         */
+        fileUploadInput.onchange = e => {
+
+            // Process the uploaded file
+            handleFile(e.target.files[0]);
+
+            // Clear the value to ensure that the change event will be fired
+            // if the user selects the same file again
+            fileUploadInput.value = null;
+            
+        };
+        
+    }];
+    return directive;
+    
+}]);
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/import/styles/file-upload.css b/guacamole/src/main/frontend/src/app/import/styles/file-upload.css
new file mode 100644
index 000000000..afe0fcf97
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/styles/file-upload.css
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+.file-upload-container {
+
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    padding: 24px 24px 24px;
+
+    width: fit-content;
+    
+    border: 1px solid rgba(0,0,0,.25);
+    box-shadow: 1px 1px 2px rgb(0 0 0 / 25%);
+    
+    margin-left: auto;
+    margin-right: auto;
+    
+}
+
+.file-upload-container .upload-header {
+
+    display: flex;
+    flex-direction: row;
+    width: 500px;
+    margin-bottom: 5px;
+    justify-content: space-between;
+    
+}
+
+.file-upload-container .file-error {
+    
+    color: red;
+
+}
+
+.file-upload-container .file-options {
+
+    font-weight: bold;
+
+}
+
+.file-upload-container .file-upload-input {
+
+    display: none;
+
+}
+
+.file-upload-container .drop-target {
+
+    display: flex;
+    flex-direction: column;
+
+    align-items: center;
+    justify-content: space-evenly;
+
+    width: 500px;
+    height: 200px;
+
+    background: rgba(0,0,0,.04);
+    border: 1px solid black;
+
+}
+
+.file-upload-container .drop-target.file-present {
+
+    background: rgba(0,0,0,.15);
+    
+}
+
+
+.file-upload-container .drop-target .file-name {
+
+    font-weight: bold;
+    font-size: 1.5em;
+
+}
+
+.file-upload-container .drop-target.drop-pending {
+
+    background: #3161a9;
+
+}
+
+.file-upload-container .drop-target.drop-pending > * {
+    
+    opacity: 0.5;
+
+}
+
+.file-upload-container .drop-target .title {
+    
+    font-weight: bold;
+    font-size: 1.25em;
+    
+}
+
+.file-upload-container .drop-target .browse-link {
+
+    text-decoration: underline;
+    cursor: pointer;
+
+}
diff --git a/guacamole/src/main/frontend/src/app/import/styles/import.css b/guacamole/src/main/frontend/src/app/import/styles/import.css
index f5551bb42..5addb1933 100644
--- a/guacamole/src/main/frontend/src/app/import/styles/import.css
+++ b/guacamole/src/main/frontend/src/app/import/styles/import.css
@@ -19,4 +19,13 @@
 
 .import .parseError {
     color: red;
+}
+
+.import .import-buttons {
+
+    margin-top: 10px;
+    display: flex;
+    gap: 10px;
+    justify-content: center;
+    
 }
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index 39b12fece..881cb2429 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -5,9 +5,19 @@
         <guac-user-menu></guac-user-menu>
     </div>
 
-    <input type="file" id="file" name="file"/>
-    <button ng-click="upload()">Add</button>
-    
+    <connection-import-file-upload on-file="handleFile(file)"></connection-import-file-upload>
+
+    <div class="import-buttons">
+        <button 
+            ng-click="import()" ng-disabled="importDisabled()" class="import">
+                {{'CONNECTION_IMPORT.BUTTON_IMPORT' | translate}}
+        </button>
+        <button
+            ng-click="cancel()" ng-disabled="cancelDisabled()" class="cancel">
+                {{'CONNECTION_IMPORT.BUTTON_CANCEL' | translate}}
+        </button>
+    </div>
+
     <!-- The translatable error message, if one is set -->
     <p 
         class="parseError" ng-show="error.key" 
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html
new file mode 100644
index 000000000..0e9741ede
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html
@@ -0,0 +1,30 @@
+<div class="file-upload-container">
+
+    <div class="upload-header">
+        <span class="file-options">{{'CONNECTION_IMPORT.UPLOAD_FILE_TYPES' | translate}}</span>
+        <a
+            href="#/import/upload-help"
+            class="file-help-link">{{'CONNECTION_IMPORT.UPLOAD_HELP_LINK' | translate}}
+        </a>
+    </div>
+
+    <div class="drop-target" ng-class="{ 'drop-pending': dropPending, 'file-present': fileName}">
+
+        <div ng-show="!fileName" class="title">{{'CONNECTION_IMPORT.UPLOAD_DROP_TITLE' | translate}}</div>
+
+        <input type="file" class="file-upload-input"/>
+        <a ng-show="!fileName" ng-click="openFileBrowser()" class="browse-link">
+            {{'CONNECTION_IMPORT.UPLOAD_BROWSE_LINK' | translate}}
+        </a>
+
+        <div ng-show="fileName" class="file-name"> {{fileName}} </div>
+
+    </div>
+
+    <!-- The translatable error message regarding the provided file(s), if any -->
+    <p
+        class="file-error" ng-show="error.key"
+        translate="{{error.key}}" translate-values="{{error.variables}}"
+    ></p>
+
+</div>
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 978ffc0e2..73afddb3c 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -186,6 +186,9 @@
 
     "CONNECTION_IMPORT": {
 
+        "BUTTON_CANCEL": "Cancel",
+        "BUTTON_IMPORT": "Import Connections",
+
         "HEADER": "Connection Import",
 
         "ERROR_AMBIGUOUS_CSV_HEADER": 
@@ -199,7 +202,7 @@
             "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
         "ERROR_INVALID_GROUP": "No group matching \"{GROUP}\" found",
         "ERROR_INVALID_FILE_TYPE": 
-            "Invalid import file type \"{TYPE}\"",
+            "Unsupported file type: \"{TYPE}\"",
         "ERROR_INVALID_USER_IDENTIFIERS":
             "Users not found: {IDENTIFIER_LIST}",
         "ERROR_INVALID_USER_GROUP_IDENTIFIERS":
@@ -210,7 +213,14 @@
         "ERROR_REQUIRED_PROTOCOL": 
             "No connection protocol found in the provided file",
         "ERROR_REQUIRED_NAME": 
-            "No connection name found in the provided file"
+            "No connection name found in the provided file",
+
+        "UPLOAD_FILE_TYPES": "CSV, JSON, or YAML",
+        "UPLOAD_HELP_LINK": "View Format Tips",
+        "UPLOAD_DROP_TITLE": "Drop a File Here",
+        "UPLOAD_BROWSE_LINK": "Browse for File",
+
+        "ERROR_FILE_SINGLE_ONLY": "Please upload only a single file at a time"
         
     },
 
diff --git a/guacamole/src/main/frontend/webpack.config.js b/guacamole/src/main/frontend/webpack.config.js
index dc6ad08cf..7f8f9da81 100644
--- a/guacamole/src/main/frontend/webpack.config.js
+++ b/guacamole/src/main/frontend/webpack.config.js
@@ -95,14 +95,14 @@ module.exports = {
     optimization: {
         minimizer: [
 
-            // Minify using Google Closure Compiler
-            new ClosureWebpackPlugin({ mode: 'STANDARD' }, {
-                languageIn: 'ECMASCRIPT_2020',
-                languageOut: 'ECMASCRIPT5',
-                compilationLevel: 'SIMPLE'
-            }),
-
-            new CssMinimizerPlugin()
+//            // Minify using Google Closure Compiler
+//            new ClosureWebpackPlugin({ mode: 'STANDARD' }, {
+//                languageIn: 'ECMASCRIPT_2020',
+//                languageOut: 'ECMASCRIPT5',
+//                compilationLevel: 'SIMPLE'
+//            }),
+//
+//            new CssMinimizerPlugin()
 
         ],
         splitChunks: {

From 690a8a34cabfb899d35e52201d6573657ab832c7 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 21 Feb 2023 22:14:02 +0000
Subject: [PATCH 156/289] GUACAMOLE-926: Add file format help page.

---
 .../frontend/src/app/import/styles/help.css   | 60 ++++++++++++
 .../templates/connectionImportFileHelp.html   | 93 +++++++++++++++++++
 .../templates/connectionImportFileUpload.html |  2 +-
 .../src/app/index/config/indexRouteConfig.js  |  8 ++
 .../main/frontend/src/translations/en.json    | 18 ++++
 5 files changed, 180 insertions(+), 1 deletion(-)
 create mode 100644 guacamole/src/main/frontend/src/app/import/styles/help.css
 create mode 100644 guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html

diff --git a/guacamole/src/main/frontend/src/app/import/styles/help.css b/guacamole/src/main/frontend/src/app/import/styles/help.css
new file mode 100644
index 000000000..e78acea4a
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/styles/help.css
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+.import.help {
+
+    text-transform: none;
+
+}
+
+.import.help p {
+
+    max-width: 70em;
+
+}
+
+.import.help h2 {
+
+    padding-top: 0px;
+    padding-bottom: 0px;
+
+}
+
+.import.help p, .import.help pre {
+
+    margin-left: 1em;
+
+}
+
+.import.help pre {
+
+    background-color: rgba(0,0,0,0.15);
+    padding: 10px;
+    width: fit-content;
+
+}
+
+.import.help .footnotes {
+
+    border-top: 1px solid gray;
+    padding-top: 1em;
+    width: fit-content;
+    margin-left: 1em;
+    
+}
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html
new file mode 100644
index 000000000..bd7f21845
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html
@@ -0,0 +1,93 @@
+<div class="import help">
+
+    <div class="header">
+        <h2>{{'CONNECTION_IMPORT.HELP_HEADER' | translate}}</h2>
+        <guac-user-menu></guac-user-menu>
+    </div>
+
+    <h2>{{'CONNECTION_IMPORT.HELP_FILE_TYPE_HEADER' | translate}}</h2>
+    <p>{{'CONNECTION_IMPORT.HELP_FILE_TYPE_DESCRIPTION' | translate}}</p>
+
+    <h2>{{'CONNECTION_IMPORT.HELP_CSV_HEADER' | translate}}</h2>
+    <p>{{'CONNECTION_IMPORT.HELP_CSV_DESCRIPTION' | translate}}</p>
+    <p>{{'CONNECTION_IMPORT.HELP_CSV_MORE_DETAILS' | translate}}</p>
+    <pre>name,protocol,hostname,group,users,groups,guacd-encryption (attribute)
+conn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none
+conn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl
+conn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,
+conn4,kubernetes,,,,,</pre>
+
+    <h2>{{'CONNECTION_IMPORT.HELP_JSON_HEADER' | translate}}</h2>
+    <p>{{'CONNECTION_IMPORT.HELP_JSON_DESCRIPTION' | translate}}</p>
+    <p>{{'CONNECTION_IMPORT.HELP_JSON_MORE_DETAILS' | translate}}</p>
+    <pre>[
+  {
+    "name": "conn1",
+    "protocol": "vnc",
+    "parameters": { "hostname": "conn1.web.com" },
+    "parentIdentifier": "ROOT",
+    "users": [ "guac user 1", "guac user 2" ],
+    "groups": [ "Connection 1 Users" ],
+    "attributes": { "guacd-encryption": "none" }
+  },
+  {
+    "name": "conn2",
+    "protocol": "rdp",
+    "parameters": { "hostname": "conn2.web.com" },
+    "group": "ROOT/Parent Group",
+    "users": [ "guac user 1" ],
+    "attributes": { "guacd-encryption": "none" }
+  },
+  {
+    "name": "conn3",
+    "protocol": "ssh",
+    "parameters": { "hostname": "conn3.web.com" },
+    "group": "ROOT/Parent Group/Child Group",
+    "users": [ "guac user 2", "guac user 3" ],
+  },
+  {
+    "name": "conn4",
+    "protocol": "kubernetes",
+  }
+]</pre>
+
+    <h2>{{'CONNECTION_IMPORT.HELP_YAML_HEADER' | translate}}</h2>
+    <p>{{'CONNECTION_IMPORT.HELP_YAML_DESCRIPTION' | translate}}</p>
+    <pre>---
+  - name: conn1
+    protocol: vnc
+    parameters:
+      hostname: conn1.web.com
+    group: ROOT
+    users:
+    - guac user 1
+    - guac user 2
+    groups:
+    - AWS EC2 Administrators
+    attributes:
+      guacd-encryption: none
+  - name: conn2
+    protocol: rdp
+    parameters:
+      hostname: conn2.web.com
+    group: ROOT/Parent Group
+    users:
+    - guac user 1
+    attributes:
+      guacd-encryption: none
+  - name: conn3
+    protocol: ssh
+    parameters:
+      hostname: conn3.web.com
+    group: ROOT/Parent Group/Child Group
+    users:
+    - guac user 2
+    - guac user 3
+  - name: conn4
+    protocol: kubernetes</pre>
+
+    <ol class="footnotes">
+        <li>{{'CONNECTION_IMPORT.HELP_SEMICOLON_FOOTNOTE' | translate}}</li>
+    </ol>
+
+</div>
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html
index 0e9741ede..08dbaf511 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html
@@ -3,7 +3,7 @@
     <div class="upload-header">
         <span class="file-options">{{'CONNECTION_IMPORT.UPLOAD_FILE_TYPES' | translate}}</span>
         <a
-            href="#/import/upload-help"
+            href="#/import/connection/file-format-help" target="_blank"
             class="file-help-link">{{'CONNECTION_IMPORT.UPLOAD_HELP_LINK' | translate}}
         </a>
     </div>
diff --git a/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js b/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
index dd9cc0637..7caeee526 100644
--- a/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
+++ b/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
@@ -135,6 +135,14 @@ angular.module('index').config(['$routeProvider', '$locationProvider',
             resolve       : { updateCurrentToken: updateCurrentToken }
         })
 
+        // Connection import page
+        .when('/import/connection/file-format-help', {
+            title         : 'APP.NAME',
+            bodyClassName : 'settings',
+            templateUrl   : 'app/import/templates/connectionImportFileHelp.html',
+            resolve       : { updateCurrentToken: updateCurrentToken }
+        })
+
         // Management screen
         .when('/settings/:dataSource?/:tab', {
             title         : 'APP.NAME',
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 73afddb3c..06e3a4d9d 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -191,6 +191,24 @@
 
         "HEADER": "Connection Import",
 
+        "HELP_HEADER": "Connection Import File Format",
+
+        "HELP_FILE_TYPE_HEADER": "File Types",
+        "HELP_FILE_TYPE_DESCRIPTION" : "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified.",
+
+        "HELP_CSV_HEADER": "CSV Format",
+        "HELP_CSV_DESCRIPTION": "A connection import CSV file has one connection record per row. Each column will specify a connection field. At minimum the connection name and protocol must be specified.",
+        "HELP_CSV_MORE_DETAILS": "The CSV header for each row specifies the connection field. The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. In most cases, there should be no conflict between fields, but if needed, an \" (attribute)\" or \" (parameter)\" suffix may be added to disambiguate. Lists of user or user group identifiers must be semicolon-seperated.¹",
+
+        "HELP_JSON_HEADER": "JSON Format",
+        "HELP_JSON_DESCRIPTION": "A connection import JSON file is a list of connection objects. At minimum the connection name and protocol must be specified in each connection object.",
+        "HELP_JSON_MORE_DETAILS": "The connection group ID that the connection should be imported into may be directly specified with a \"parentIdentifier\" field, or the path to the parent group may be specified using a \"group\" field as shown below. An array of user and user group identifiers to grant access to may be specified per connection.",
+
+        "HELP_YAML_HEADER": "YAML Format",
+        "HELP_YAML_DESCRIPTION": "A connection import YAML file is a list of connection objects with exactly the same structure as the JSON format.",
+        
+        "HELP_SEMICOLON_FOOTNOTE": "If needed, semicolons can be escaped with a backslash, e.g. \"first\\\\;last\"",
+
         "ERROR_AMBIGUOUS_CSV_HEADER": 
             "Ambiguous CSV Header \"{HEADER}\" could be either a connection attribute or parameter",
         "ERROR_ARRAY_REQUIRED": 

From 5a2a4a79a7d45a4cc10c96e09bdd419d3938efa4 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 21 Feb 2023 23:58:15 +0000
Subject: [PATCH 157/289] GUACAMOLE-926: Roll back created users and user
 groups as well.

---
 .../importConnectionsController.js            | 184 +++++++++++++-----
 .../directives/connectionImportFileUpload.js  |   9 +-
 .../import/services/connectionParseService.js |   8 +-
 .../frontend/src/app/import/styles/help.css   |   1 -
 .../templates/connectionImportFileHelp.html   |   6 +-
 .../main/frontend/src/translations/en.json    |   5 +-
 6 files changed, 146 insertions(+), 67 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 31a49adf8..73acb1cc3 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -106,33 +106,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         
     }
 
-    /**
-     * Given a successful response to an import PATCH request, make another
-     * request to delete every created connection in the provided request, i.e.
-     * clean up every connection that was created.
-     *
-     * @param {DirectoryPatchResponse} creationResponse
-     */
-    function cleanUpConnections(creationResponse) {
-
-        // The patches to delete - one delete per initial creation
-        const deletionPatches = creationResponse.patches.map(patch =>
-            new DirectoryPatch({
-                op: 'remove',
-                path: '/' + patch.identifier
-            }));
-
-        console.log("Deletion Patches", deletionPatches);
-
-        connectionService.patchConnections(
-            $routeParams.dataSource, deletionPatches)
-    
-            .then(deletionResponse =>
-                console.log("Deletion response", deletionResponse))
-            .catch(handleError);
-
-    }
-
     /**
      * Create all users and user groups mentioned in the import file that don't
      * already exist in the current data source.
@@ -178,8 +151,8 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                 }));
 
             return $q.all({
-                createdUsers: userService.patchUsers(dataSource, userPatches),
-                createdGroups: userGroupService.patchUserGroups(dataSource, groupPatches)
+                userResponse: userService.patchUsers(dataSource, userPatches),
+                groupResponse: userGroupService.patchUserGroups(dataSource, groupPatches)
             });
             
         });
@@ -256,22 +229,126 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         return $q.all({ ...userRequests, ...groupRequests });
     }
 
+    // Given a PATCH API response, create an array of patches to delete every
+    // entity created in the original request that generated this response
+    const createDeletionPatches = creationResponse =>
+        creationResponse.patches.map(patch =>
+
+            // Add one deletion patch per original creation patch
+            new DirectoryPatch({
+                op: 'remove',
+                path: '/' + patch.identifier
+            }));
+
+    /**
+     * Given a successful response to a connection PATCH request, make another
+     * request to delete every created connection in the provided request, i.e.
+     * clean up every connection that was created.
+     *
+     * @param {DirectoryPatchResponse} creationResponse
+     *     The response to the connection PATCH request.
+     *
+     * @returns {DirectoryPatchResponse}
+     *     The response to the PATCH deletion request.
+     */
+    function cleanUpConnections(creationResponse) {
+
+        return connectionService.patchConnections(
+            $routeParams.dataSource, createDeletionPatches(creationResponse))
+
+            // TODO: Better error handling? Make additional cleanup requests?
+            .catch(handleError);
+
+    }
+
+    /**
+     * Given a successful response to a user PATCH request, make another
+     * request to delete every created user in the provided request.
+     *
+     * @param {DirectoryPatchResponse} creationResponse
+     *     The response to the user PATCH request.
+     *
+     * @returns {DirectoryPatchResponse}
+     *     The response to the PATCH deletion request.
+     */
+    function cleanUpUsers(creationResponse) {
+
+        return userService.patchUsers(
+            $routeParams.dataSource, createDeletionPatches(creationResponse))
+
+            // TODO: Better error handling? Make additional cleanup requests?
+            .catch(handleError);
+
+    }
+
+    /**
+     * Given a successful response to a user group PATCH request, make another
+     * request to delete every created user group in the provided request.
+     *
+     * @param {DirectoryPatchResponse} creationResponse
+     *     The response to the user group PATCH creation request.
+     *
+     * @returns {DirectoryPatchResponse}
+     *     The response to the PATCH deletion request.
+     */
+    function cleanUpUserGroups(creationResponse) {
+
+        return userGroupService.patchUserGroups(
+            $routeParams.dataSource, createDeletionPatches(creationResponse))
+
+            // TODO: Better error handling? Make additional cleanup requests?
+            .catch(handleError);
+
+    }
+
+    /**
+     * Make requests to delete all connections, users, and/or groups from any
+     * provided PATCH API responses. If any responses are not provided, no
+     * cleanup will be attempted.
+     *
+     * @param {DirectoryPatchResponse} connectionResponse
+     *     The response to the connection PATCH creation request.
+     *
+     * @param {DirectoryPatchResponse} userResponse
+     *     The response to the user PATCH creation request.
+     *
+     * @param {DirectoryPatchResponse} userGroupResponse
+     *     The response to the user group PATCH creation request.
+     * 
+     * @returns {Object}
+     *     An object containing PATCH deletion responses corresponding to any
+     *     provided connection, user, and/or user group creation responses.
+     */
+    function cleanUpAll(connectionResponse, userResponse, userGroupResponse) {
+
+        // All cleanup requests that need to be made
+        const requests = {};
+
+        // If the connection response was provided, clean up connections
+        if (connectionResponse)
+            requests.connectionCleanup = cleanUpConnections(connectionResponse);
+
+        // If the user response was provided, clean up users
+        if (userResponse)
+            requests.userCleanup = cleanUpUsers(userResponse);
+
+        // If the user group response was provided, clean up user groups
+        if (connectionResponse)
+            requests.userGroupCleanup = cleanUpUserGroups(userGroupResponse);
+
+        // Return when all cleanup is complete
+        return $q.all(requests);
+    }
+
     /**
      * Process a successfully parsed import file, creating any specified
      * connections, creating and granting permissions to any specified users
-     * and user groups.
-     * 
-     * TODO:
-     * - Do batch import of connections
-     * - Create all users/groups not already present
-     * - Grant permissions to all users/groups as defined in the import file
-     * - On failure: Roll back everything (maybe ask the user first):
-     *   - Attempt to delete all created connections
-     *   - Attempt to delete any created users / groups
+     * and user groups. If successful, the user will be shown a success message.
+     * If not, any errors will be displayed, and the user will be given ???an
+     * option??? to roll back any already-created entities.
      *
      * @param {ParseResult} parseResult
      *     The result of parsing the user-supplied import file.
-     *
      */
     function handleParseSuccess(parseResult) {
 
@@ -281,21 +358,20 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
         // First, attempt to create the connections
         connectionService.patchConnections(dataSource, parseResult.patches)
-                .then(response => {
+                .then(connectionResponse => {
 
             // If connection creation is successful, create users and groups
-            createUsersAndGroups(parseResult).then(() => {
+            createUsersAndGroups(parseResult).then(
+                    ({userResponse, groupResponse}) => 
 
-                grantConnectionPermissions(parseResult, response).then(results => {
-                    console.log("permission requests", results);
+                grantConnectionPermissions(parseResult, connectionResponse)
+                        .then(() =>
                    
-                    // TODON'T: Delete connections so we can test over and over
-                    cleanUpConnections(response);
+                    // TODON'T: Delete the stuff so we can test over and over
+                    cleanUpAll(connectionResponse, userResponse, groupResponse)
+                        .then(resetUploadState)
 
-                    resetUploadState();
-                })
-
-            });
+                ));
         });
     }
     
@@ -315,7 +391,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         console.error(error);
         $scope.error = error;
         
-    }
+    };
     
     /**
      * Clear the current displayed error.
@@ -356,14 +432,16 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         // have already have filtered out any invalid file types
         else {
             handleError(new ParseError({
-                message: 'Invalid file type: ' + type,
+                message: 'Invalid file type: ' + mimeType,
                 key: 'CONNECTION_IMPORT.INVALID_FILE_TYPE',
-                variables: { TYPE: type }
+                variables: { TYPE: mimeType }
             }));
             return;
         }
 
         // Make the call to process the data into a series of patches
+        // TODO: Check if there's errors, and if so, display those rather than
+        // just YOLOing a create call
         processDataCallback(data)
 
             // Send the data off to be imported if parsing is successful
@@ -476,6 +554,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
         // Read all the data into memory 
         $scope.fileReader.readAsBinaryString(file);
-    }
+    };
 
 }]);
diff --git a/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js b/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
index d988e7c7d..4e2c76b24 100644
--- a/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
+++ b/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
@@ -19,17 +19,16 @@
 
 /* global _ */
 
-/**
- * A directive that allows for file upload, either through drag-and-drop or
- * a file browser.
- */
-
 /**
  * All legal import file types. Any file not belonging to one of these types
  * must be rejected.
  */
 const LEGAL_FILE_TYPES = ["csv", "json", "yaml"];
 
+/**
+ * A directive that allows for file upload, either through drag-and-drop or
+ * a file browser.
+ */
 angular.module('import').directive('connectionImportFileUpload', [
         function connectionImportFileUpload() {
 
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index 4b9f50c2d..cf15a374e 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -142,7 +142,7 @@ angular.module('import').factory('connectionParseService',
 
             // If there's no group to translate, do nothing
             if (!connection.group)
-                return;
+                return connection;
 
             // If both are specified, the parent group is ambigious
             if (connection.parentIdentifier)
@@ -333,8 +333,9 @@ angular.module('import').factory('connectionParseService',
     service.parseYAML = function parseYAML(yamlData) {
 
         // Parse from YAML into a javascript array
+        let connectionData;
         try {
-            const connectionData = parseYAMLData(yamlData);
+            connectionData = parseYAMLData(yamlData);
         }
 
         // If the YAML parser throws an error, reject with that error. No
@@ -366,8 +367,9 @@ angular.module('import').factory('connectionParseService',
     service.parseJSON = function parseJSON(jsonData) {
 
         // Parse from JSON into a javascript array
+        let connectionData;
         try {
-            const connectionData = JSON.parse(jsonData);
+            connectionData = JSON.parse(jsonData);
         }
 
         // If the JSON parse attempt throws an error, reject with that error.
diff --git a/guacamole/src/main/frontend/src/app/import/styles/help.css b/guacamole/src/main/frontend/src/app/import/styles/help.css
index e78acea4a..a73b43afa 100644
--- a/guacamole/src/main/frontend/src/app/import/styles/help.css
+++ b/guacamole/src/main/frontend/src/app/import/styles/help.css
@@ -31,7 +31,6 @@
 
 .import.help h2 {
 
-    padding-top: 0px;
     padding-bottom: 0px;
 
 }
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html
index bd7f21845..e6063e89f 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html
@@ -43,11 +43,11 @@ conn4,kubernetes,,,,,</pre>
     "protocol": "ssh",
     "parameters": { "hostname": "conn3.web.com" },
     "group": "ROOT/Parent Group/Child Group",
-    "users": [ "guac user 2", "guac user 3" ],
+    "users": [ "guac user 2", "guac user 3" ]
   },
   {
     "name": "conn4",
-    "protocol": "kubernetes",
+    "protocol": "kubernetes"
   }
 ]</pre>
 
@@ -63,7 +63,7 @@ conn4,kubernetes,,,,,</pre>
     - guac user 1
     - guac user 2
     groups:
-    - AWS EC2 Administrators
+    - Connection 1 Users
     attributes:
       guacd-encryption: none
   - name: conn2
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 06e3a4d9d..0233f8bb6 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -194,7 +194,8 @@
         "HELP_HEADER": "Connection Import File Format",
 
         "HELP_FILE_TYPE_HEADER": "File Types",
-        "HELP_FILE_TYPE_DESCRIPTION" : "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified.",
+        "HELP_FILE_TYPE_DESCRIPTION" : "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created.",
+
 
         "HELP_CSV_HEADER": "CSV Format",
         "HELP_CSV_DESCRIPTION": "A connection import CSV file has one connection record per row. Each column will specify a connection field. At minimum the connection name and protocol must be specified.",
@@ -207,7 +208,7 @@
         "HELP_YAML_HEADER": "YAML Format",
         "HELP_YAML_DESCRIPTION": "A connection import YAML file is a list of connection objects with exactly the same structure as the JSON format.",
         
-        "HELP_SEMICOLON_FOOTNOTE": "If needed, semicolons can be escaped with a backslash, e.g. \"first\\\\;last\"",
+        "HELP_SEMICOLON_FOOTNOTE": "If present, semicolons can be escaped with a backslash, e.g. \"first\\\\;last\"",
 
         "ERROR_AMBIGUOUS_CSV_HEADER": 
             "Ambiguous CSV Header \"{HEADER}\" could be either a connection attribute or parameter",

From 322adbc294c2189019e84a278017fdf85d309658 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 23 Feb 2023 19:44:46 +0000
Subject: [PATCH 158/289] GUACAMOLE-926: Display connection-specific errors to
 the user.

---
 .../importConnectionsController.js            |  57 ++--
 .../directives/connectionImportErrors.js      | 248 ++++++++++++++++++
 .../directives/connectionImportFileUpload.js  |   4 +-
 .../frontend/src/app/import/importModule.js   |   2 +-
 .../import/services/connectionCSVService.js   |  12 +-
 .../import/services/connectionParseService.js |   8 +-
 .../frontend/src/app/import/styles/import.css |  17 +-
 .../import/templates/connectionErrors.html    |  45 ++++
 .../import/templates/connectionImport.html    |   9 +-
 .../templates/connectionImportFileHelp.html   |  24 +-
 .../templates/connectionImportFileUpload.html |   8 +-
 .../src/app/import/types/DisplayErrorList.js  |  83 ++++++
 .../src/app/import/types/ImportConnection.js  |   2 +-
 .../app/import/types/ImportConnectionError.js | 108 ++++++++
 .../app/rest/services/connectionService.js    |   4 +-
 .../main/frontend/src/app/rest/types/Error.js |   9 +
 .../main/frontend/src/translations/en.json    |  16 +-
 17 files changed, 598 insertions(+), 58 deletions(-)
 create mode 100644 guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
 create mode 100644 guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
 create mode 100644 guacamole/src/main/frontend/src/app/import/types/DisplayErrorList.js
 create mode 100644 guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 73acb1cc3..ec1227e95 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -49,6 +49,21 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      */
     $scope.error = null;
 
+    /**
+     * The result of parsing the current upload, if successful.
+     *
+     * @type {ParseResult}
+     */
+    $scope.parseResult = null;
+
+    /**
+     * The failure associated with the current attempt to create connections
+     * through the API, if any.
+     *
+     * @type {Error}
+     */
+    $scope.patchFailure = null;;
+
     /**
      * True if the file is fully uploaded and ready to be processed, or false
      * otherwise.
@@ -100,6 +115,8 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         $scope.fileData = null;
         $scope.mimeType = null;
         $scope.fileReader = null;
+        $scope.parseResult = null;
+        $scope.patchFailure = null;
 
         // Broadcast an event to clear the file upload UI
         $scope.$broadcast('clearFile');
@@ -254,10 +271,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     function cleanUpConnections(creationResponse) {
 
         return connectionService.patchConnections(
-            $routeParams.dataSource, createDeletionPatches(creationResponse))
-
-            // TODO: Better error handling? Make additional cleanup requests?
-            .catch(handleError);
+            $routeParams.dataSource, createDeletionPatches(creationResponse));
 
     }
 
@@ -274,10 +288,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     function cleanUpUsers(creationResponse) {
 
         return userService.patchUsers(
-            $routeParams.dataSource, createDeletionPatches(creationResponse))
-
-            // TODO: Better error handling? Make additional cleanup requests?
-            .catch(handleError);
+            $routeParams.dataSource, createDeletionPatches(creationResponse));
 
     }
 
@@ -294,10 +305,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     function cleanUpUserGroups(creationResponse) {
 
         return userGroupService.patchUserGroups(
-            $routeParams.dataSource, createDeletionPatches(creationResponse))
-
-            // TODO: Better error handling? Make additional cleanup requests?
-            .catch(handleError);
+            $routeParams.dataSource, createDeletionPatches(creationResponse));
 
     }
 
@@ -352,6 +360,15 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      */
     function handleParseSuccess(parseResult) {
 
+        $scope.processing = false;
+        $scope.parseResult = parseResult;
+
+        // If errors were encounted during file parsing, abort further
+        // processing - the user will have a chance to fix the errors and try
+        // again
+        if (parseResult.hasErrors) 
+            return;
+
         const dataSource = $routeParams.dataSource;
 
         console.log("parseResult", parseResult);
@@ -372,7 +389,12 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                         .then(resetUploadState)
 
                 ));
-        });
+        })
+
+        // If an error occured when the call to create the connections was made,
+        // skip any further processing - the user will have a chance to fix the
+        // problems and try again
+        .catch(patchFailure => { $scope.patchFailure = patchFailure; });
     }
     
     /**
@@ -433,7 +455,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         else {
             handleError(new ParseError({
                 message: 'Invalid file type: ' + mimeType,
-                key: 'CONNECTION_IMPORT.INVALID_FILE_TYPE',
+                key: 'IMPORT.INVALID_FILE_TYPE',
                 variables: { TYPE: mimeType }
             }));
             return;
@@ -459,8 +481,8 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
     /**
      * @return {Boolean}
-     *     True if import should be disabled, or false if cancellation
-     *     should be allowed.
+     *     True if import should be disabled, or false if import should be
+     *     allowed.
      */
     $scope.importDisabled = () =>
         
@@ -471,7 +493,8 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         $scope.processing;
 
     /**
-     * Cancel any in-progress upload, or clear any uploaded-but
+     * Cancel any in-progress upload, or clear any uploaded-but-errored-out
+     * batch.
      */
     $scope.cancel = function() {
 
diff --git a/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js b/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
new file mode 100644
index 000000000..dcf42695a
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
@@ -0,0 +1,248 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/* global _ */
+
+/**
+ * A directive that displays errors that occured during parsing of a connection
+ * import file, or errors that were returned from the API during the connection
+ * batch creation attempt.
+ */
+angular.module('import').directive('connectionImportErrors', [
+        function connectionImportErrors() {
+
+    const directive = {
+        restrict: 'E',
+        replace: true,
+        templateUrl: 'app/import/templates/connectionErrors.html',
+        scope: {
+
+            /**
+             * The result of parsing the import file. Any errors in this file
+             * will be displayed to the user.
+             *
+             * @type ParseResult
+             */
+            parseResult : '=',
+
+            /**
+             * The error associated with an attempt to batch create the
+             * connections represented by the ParseResult, if the ParseResult
+             * had no errors. If the provided ParseResult has errors, no request
+             * should have been made, and any provided patch error will be
+             * ignored.
+             *
+             * @type Error
+             */
+            patchFailure : '=',
+
+        }
+    };
+
+    directive.controller = ['$scope', '$injector',
+            function connectionImportErrorsController($scope, $injector) {
+
+        // Required types
+        const DisplayErrorList      = $injector.get('DisplayErrorList');
+        const ImportConnectionError = $injector.get('ImportConnectionError');
+        const ParseError            = $injector.get('ParseError');
+        const SortOrder             = $injector.get('SortOrder');
+
+        // Required services
+        const $q                    = $injector.get('$q');
+        const $translate            = $injector.get('$translate');
+
+        // There are errors to display if the parse result generated errors, or
+        // if the patch request failed
+        $scope.hasErrors = () =>
+            !!_.get($scope, 'parseResult.hasErrors') || !!$scope.patchFailure;
+
+        /**
+         * All connections with their associated errors for display. These may
+         * be either parsing failures, or errors returned from the API. Both
+         * error types will be adapted to a common display format, though the
+         * error types will never be mixed, because no REST request should ever
+         * be made if there are client-side parse errors.
+         *
+         * @type {ImportConnectionError[]}
+         */
+        $scope.connectionErrors = [];
+
+        /**
+         * SortOrder instance which maintains the sort order of the visible
+         * connection errors.
+         *
+         * @type SortOrder
+         */
+        $scope.errorOrder = new SortOrder([
+            'rowNumber',
+            'name',
+            'protocol',
+            'errors',
+        ]);
+
+        /**
+         * Array of all connection error properties that are filterable.
+         *
+         * @type String[]
+         */
+        $scope.filteredErrorProperties = [
+            'rowNumber',
+            'name',
+            'protocol',
+            'errors',
+        ];
+
+        /**
+         * Generate a ImportConnectionError representing any errors associated
+         * with the row at the given index within the given parse result.
+         *
+         * @param {ParseResult} parseResult
+         *     The result of parsing the connection import file.
+         *
+         * @param {Integer} index
+         *     The current row within the import file, 0-indexed.
+         *
+         * @returns {ImportConnectionError}
+         *     The connection error object associated with the given row in the
+         *     given parse result.
+         */
+        const generateConnectionError = (parseResult, index) => {
+            
+            // Get the patch associated with the current row
+            const patch = parseResult.patches[index];
+
+            // The value of a patch is just the Connection object
+            const connection = patch.value;
+
+            return new ImportConnectionError({
+
+                // Add 1 to the index to get the position in the file
+                rowNumber: index + 1,
+
+                // Basic connection information - name and protocol.
+                name: connection.name,
+                protocol: connection.protocol,
+
+                // The group and parent identifiers, if any are set. Include
+                // both since these could be a potential source of conflict.
+                // TODO: Should we _really_ have both of these here?
+                group: connection.group,
+                parentIdentifier: connection.parentIdentifier,
+
+                // Get the list of user and group identifiers from the parse
+                // result. There should one entry in each of these lists for
+                // each patch.
+                users: parseResult.users[index],
+                groups: parseResult.groups[index],
+
+                // The human-readable error messages
+                errors: new DisplayErrorList(
+                        [ ...(parseResult.errors[index] || []) ])
+            });
+        };
+
+        // If a new connection patch failure is seen, update the display list
+        $scope.$watch('patchFailure', async function patchFailureChanged(patchFailure) {
+
+            const { parseResult } = $scope;
+
+            // Do not attempt to process anything before the data has loaded
+            if (!patchFailure || !parseResult)
+                return;
+
+            // Set up the list of connection errors based on the existing parse
+            // result, with error messages fetched from the patch failure
+            $scope.connectionErrors = parseResult.patches.map(
+                    (patch, index) => {
+
+                // Generate a connection error for display
+                const connectionError = generateConnectionError(parseResult, index);
+
+                // Set the error from the PATCH request, if there is one
+                // TODO: These generally aren't translated from the backend -
+                // should we even bother trying to translate them?
+                const error = _.get(patchFailure, ['patches', index, 'error']);
+                if (error)
+                    connectionError.errors = new DisplayErrorList([error]);
+
+                return connectionError;
+            });
+        });
+
+        // If a new parse result with errors is seen, update the display list
+        $scope.$watch('parseResult', async function parseResultChanged(parseResult) {
+
+            // Do not process if there are no errors in the provided result
+            if (!parseResult || !parseResult.hasErrors)
+                return;
+
+            // All promises from all translation requests. The scope will not be
+            // updated until all translations are ready.
+            const translationPromises = [];
+
+            // The parse result should only be updated on a fresh file import;
+            // therefore it should be safe to skip checking the patch errors
+            // entirely - if set, they will be from the previous file and no
+            // longer relevant.
+
+            // Set up the list of connection errors based on the updated parse
+            // result
+            const connectionErrors = parseResult.patches.map(
+                    (patch, index) => {
+
+                // Generate a connection error for display
+                const connectionError = generateConnectionError(parseResult, index);
+
+                // Go through the errors and check if any are translateable
+                connectionError.errors.getArray().forEach(
+                        (error, errorIndex) => {
+
+                    // If this error is a ParseError, it can be translated.
+                    // NOTE: Generally one would translate error messages in the
+                    // template, but in this case, the connection errors need to
+                    // be raw strings in order to enable sorting and filtering.
+                    if (error instanceof ParseError)
+
+                        // Fetch the translation and update it when it's ready
+                        translationPromises.push($translate(
+                            error.key, error.variables)
+                            .then(translatedError => {
+                                connectionError.errors.getArray()[errorIndex] = translatedError;
+                            }));
+                    
+                });
+                
+                return connectionError;
+                
+            });
+
+            // Once all the translations have been completed, update the
+            // connectionErrors all in one go, to ensure no excessive reloading
+            $q.all(translationPromises).then(() => {
+                $scope.connectionErrors = connectionErrors;
+            });
+
+        });
+
+    }];
+
+    return directive;
+
+}]);
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js b/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
index 4e2c76b24..196e8f48f 100644
--- a/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
+++ b/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
@@ -170,7 +170,7 @@ angular.module('import').directive('connectionImportFileUpload', [
 
                 // If the provided file is not one of the supported types,
                 // display an error and abort processing
-                setError('CONNECTION_IMPORT.ERROR_INVALID_FILE_TYPE',
+                setError('IMPORT.ERROR_INVALID_FILE_TYPE',
                         { TYPE: mimeType });
                 return;
             }
@@ -204,7 +204,7 @@ angular.module('import').directive('connectionImportFileUpload', [
 
                 // If more than one file was provided, print an error explaining
                 // that only a single file is allowed and abort processing
-                setError('CONNECTION_IMPORT.ERROR_FILE_SINGLE_ONLY');
+                setError('IMPORT.ERROR_FILE_SINGLE_ONLY');
                 return;
             }
 
diff --git a/guacamole/src/main/frontend/src/app/import/importModule.js b/guacamole/src/main/frontend/src/app/import/importModule.js
index 6480d62fc..46e5fa157 100644
--- a/guacamole/src/main/frontend/src/app/import/importModule.js
+++ b/guacamole/src/main/frontend/src/app/import/importModule.js
@@ -21,4 +21,4 @@
  * The module for code supporting importing user-supplied files. Currently, only
  * connection import is supported.
  */
-angular.module('import', ['rest']);
+angular.module('import', ['rest', 'list']);
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
index 492b9388b..389749555 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
@@ -238,7 +238,7 @@ angular.module('import').factory('connectionCSVService',
                     deferred.reject(new ParseError({
                         message: 'Duplicate CSV Header: ' + header,
                         translatableMessage: new TranslatableMessage({
-                            key: 'CONNECTION_IMPORT.ERROR_DUPLICATE_CSV_HEADER',
+                            key: 'IMPORT.ERROR_DUPLICATE_CSV_HEADER',
                             variables: { HEADER: header }
                         })
                     }));
@@ -342,7 +342,7 @@ angular.module('import').factory('connectionCSVService',
                         if (isAttribute && isParameter)
                             throw new ParseError({
                                 message: 'Ambiguous CSV Header: ' + header,
-                                key: 'CONNECTION_IMPORT.ERROR_AMBIGUOUS_CSV_HEADER',
+                                key: 'IMPORT.ERROR_AMBIGUOUS_CSV_HEADER',
                                 variables: { HEADER: header }
                             });
                         
@@ -350,7 +350,7 @@ angular.module('import').factory('connectionCSVService',
                         else if (!isAttribute && !isParameter)
                             throw new ParseError({
                                 message: 'Invalid CSV Header: ' + header,
-                                key: 'CONNECTION_IMPORT.ERROR_INVALID_CSV_HEADER',
+                                key: 'IMPORT.ERROR_INVALID_CSV_HEADER',
                                 variables: { HEADER: header }
                             });
                         
@@ -372,21 +372,21 @@ angular.module('import').factory('connectionCSVService',
             if (!nameGetter) 
                 return deferred.reject(new ParseError({
                     message: 'The connection name must be provided',
-                    key: 'CONNECTION_IMPORT.ERROR_REQUIRED_NAME'
+                    key: 'IMPORT.ERROR_REQUIRED_NAME'
                 }));
             
             // Fail if the protocol wasn't provided
             if (!protocolGetter)
                 return deferred.reject(new ParseError({
                     message: 'The connection protocol must be provided',
-                    key: 'CONNECTION_IMPORT.ERROR_REQUIRED_PROTOCOL'
+                    key: 'IMPORT.ERROR_REQUIRED_PROTOCOL'
                 }));
 
             // If both are specified, the parent group is ambigious
             if (parentIdentifierGetter && groupGetter)
                 throw new ParseError({
                     message: 'Only one of group or parentIdentifier can be set',
-                    key: 'CONNECTION_IMPORT.ERROR_AMBIGUOUS_PARENT_GROUP'
+                    key: 'IMPORT.ERROR_AMBIGUOUS_PARENT_GROUP'
                 });
             
             // The function to transform a CSV row into a connection object
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index cf15a374e..dd9f49593 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -60,7 +60,7 @@ angular.module('import').factory('connectionParseService',
         if (!(parsedData instanceof Array))
             return new ParseError({
                 message: 'Import data must be a list of connections',
-                key: 'CONNECTION_IMPORT.ERROR_ARRAY_REQUIRED'
+                key: 'IMPORT.ERROR_ARRAY_REQUIRED'
             });
 
         // Make sure that the connection list is not empty - contains at least
@@ -68,7 +68,7 @@ angular.module('import').factory('connectionParseService',
         if (!parsedData.length)
             return new ParseError({
                 message: 'The provided file is empty',
-                key: 'CONNECTION_IMPORT.ERROR_EMPTY_FILE'
+                key: 'IMPORT.ERROR_EMPTY_FILE'
             });
     }
     
@@ -148,7 +148,7 @@ angular.module('import').factory('connectionParseService',
             if (connection.parentIdentifier)
                 throw new ParseError({
                     message: 'Only one of group or parentIdentifier can be set',
-                    key: 'CONNECTION_IMPORT.ERROR_AMBIGUOUS_PARENT_GROUP'
+                    key: 'IMPORT.ERROR_AMBIGUOUS_PARENT_GROUP'
                 });
 
             // Look up the parent identifier for the specified group path
@@ -158,7 +158,7 @@ angular.module('import').factory('connectionParseService',
             if (!identifier)
                 throw new ParseError({
                     message: 'No group found named: ' + connection.group,
-                    key: 'CONNECTION_IMPORT.ERROR_INVALID_GROUP',
+                    key: 'IMPORT.ERROR_INVALID_GROUP',
                     variables: { GROUP: connection.group }
                 });
 
diff --git a/guacamole/src/main/frontend/src/app/import/styles/import.css b/guacamole/src/main/frontend/src/app/import/styles/import.css
index 5addb1933..8f038e4d1 100644
--- a/guacamole/src/main/frontend/src/app/import/styles/import.css
+++ b/guacamole/src/main/frontend/src/app/import/styles/import.css
@@ -27,5 +27,18 @@
     display: flex;
     gap: 10px;
     justify-content: center;
-    
-}
\ No newline at end of file
+
+}
+
+
+.import .errors table {
+    width: 100%;
+}
+
+.import .errors .error-message {
+    color: red;
+}
+
+.import .errors .error-message ul {
+    margin: 0px;
+}
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html b/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
new file mode 100644
index 000000000..eee23c260
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
@@ -0,0 +1,45 @@
+<div ng-show="hasErrors()" class="errors">
+
+    <!-- Connection / Error filter -->
+    <guac-filter filtered-items="filteredErrors" items="connectionErrors"
+                 placeholder="'IMPORT.FIELD_PLACEHOLDER_FILTER' | translate"
+                 properties="filteredErrorProperties"></guac-filter>
+
+    <!-- List of current u -->
+    <table class="sorted">
+        <thead>
+            <tr>
+                <th guac-sort-order="errorOrder" guac-sort-property="'rowNumber'">
+                    {{'IMPORT.TABLE_HEADER_ROW_NUMBER' | translate}}
+                </th>
+                <th guac-sort-order="errorOrder" guac-sort-property="'name'">
+                    {{'IMPORT.TABLE_HEADER_NAME' | translate}}
+                </th>
+                <th guac-sort-order="errorOrder" guac-sort-property="'protocol'">
+                    {{'IMPORT.TABLE_HEADER_PROTOCOL' | translate}}
+                </th>
+                <th guac-sort-order="errorOrder" guac-sort-property="'errors'">
+                    {{'IMPORT.TABLE_HEADER_ERRORS' | translate}}
+                </th>
+            </tr>
+        </thead>
+        <tbody>
+            <tr ng-repeat="error in errorPage">
+                <td>{{error.rowNumber}}</td>
+                <td>{{error.name}}</td>
+                <td>{{error.protocol}}</td>
+                <td class="error-message">
+                    <ul>
+                        <li ng-repeat="message in error.errors.getArray()">
+                            {{ message }}
+                        </li>
+                    </ul>
+                </td>
+            </tr>
+        </tbody>
+    </table>
+
+    <!-- Pager for connection error list -->
+    <guac-pager page="errorPage" page-size="25"
+                items="filteredErrors | orderBy : errorOrder.predicate"></guac-pager>
+</div>
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index 881cb2429..d0f9fd537 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -1,7 +1,7 @@
 <div class="settings-view import">
 
     <div class="header">
-        <h2>{{'CONNECTION_IMPORT.HEADER' | translate}}</h2>
+        <h2>{{'IMPORT.HEADER' | translate}}</h2>
         <guac-user-menu></guac-user-menu>
     </div>
 
@@ -10,11 +10,11 @@
     <div class="import-buttons">
         <button 
             ng-click="import()" ng-disabled="importDisabled()" class="import">
-                {{'CONNECTION_IMPORT.BUTTON_IMPORT' | translate}}
+                {{'IMPORT.BUTTON_IMPORT' | translate}}
         </button>
         <button
             ng-click="cancel()" ng-disabled="cancelDisabled()" class="cancel">
-                {{'CONNECTION_IMPORT.BUTTON_CANCEL' | translate}}
+                {{'IMPORT.BUTTON_CANCEL' | translate}}
         </button>
     </div>
 
@@ -29,5 +29,8 @@
         {{error.message}}
     </p>
 
+    <!-- Connection specific errors, if there are any -->
+    <connection-import-errors parse-result="parseResult" patch-failure="patchFailure" />
+
 
 </div>
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html
index e6063e89f..8e88d235a 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html
@@ -1,25 +1,25 @@
 <div class="import help">
 
     <div class="header">
-        <h2>{{'CONNECTION_IMPORT.HELP_HEADER' | translate}}</h2>
+        <h2>{{'IMPORT.HELP_HEADER' | translate}}</h2>
         <guac-user-menu></guac-user-menu>
     </div>
 
-    <h2>{{'CONNECTION_IMPORT.HELP_FILE_TYPE_HEADER' | translate}}</h2>
-    <p>{{'CONNECTION_IMPORT.HELP_FILE_TYPE_DESCRIPTION' | translate}}</p>
+    <h2>{{'IMPORT.HELP_FILE_TYPE_HEADER' | translate}}</h2>
+    <p>{{'IMPORT.HELP_FILE_TYPE_DESCRIPTION' | translate}}</p>
 
-    <h2>{{'CONNECTION_IMPORT.HELP_CSV_HEADER' | translate}}</h2>
-    <p>{{'CONNECTION_IMPORT.HELP_CSV_DESCRIPTION' | translate}}</p>
-    <p>{{'CONNECTION_IMPORT.HELP_CSV_MORE_DETAILS' | translate}}</p>
+    <h2>{{'IMPORT.HELP_CSV_HEADER' | translate}}</h2>
+    <p>{{'IMPORT.HELP_CSV_DESCRIPTION' | translate}}</p>
+    <p>{{'IMPORT.HELP_CSV_MORE_DETAILS' | translate}}</p>
     <pre>name,protocol,hostname,group,users,groups,guacd-encryption (attribute)
 conn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none
 conn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl
 conn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,
 conn4,kubernetes,,,,,</pre>
 
-    <h2>{{'CONNECTION_IMPORT.HELP_JSON_HEADER' | translate}}</h2>
-    <p>{{'CONNECTION_IMPORT.HELP_JSON_DESCRIPTION' | translate}}</p>
-    <p>{{'CONNECTION_IMPORT.HELP_JSON_MORE_DETAILS' | translate}}</p>
+    <h2>{{'IMPORT.HELP_JSON_HEADER' | translate}}</h2>
+    <p>{{'IMPORT.HELP_JSON_DESCRIPTION' | translate}}</p>
+    <p>{{'IMPORT.HELP_JSON_MORE_DETAILS' | translate}}</p>
     <pre>[
   {
     "name": "conn1",
@@ -51,8 +51,8 @@ conn4,kubernetes,,,,,</pre>
   }
 ]</pre>
 
-    <h2>{{'CONNECTION_IMPORT.HELP_YAML_HEADER' | translate}}</h2>
-    <p>{{'CONNECTION_IMPORT.HELP_YAML_DESCRIPTION' | translate}}</p>
+    <h2>{{'IMPORT.HELP_YAML_HEADER' | translate}}</h2>
+    <p>{{'IMPORT.HELP_YAML_DESCRIPTION' | translate}}</p>
     <pre>---
   - name: conn1
     protocol: vnc
@@ -87,7 +87,7 @@ conn4,kubernetes,,,,,</pre>
     protocol: kubernetes</pre>
 
     <ol class="footnotes">
-        <li>{{'CONNECTION_IMPORT.HELP_SEMICOLON_FOOTNOTE' | translate}}</li>
+        <li>{{'IMPORT.HELP_SEMICOLON_FOOTNOTE' | translate}}</li>
     </ol>
 
 </div>
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html
index 08dbaf511..188567c00 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html
@@ -1,20 +1,20 @@
 <div class="file-upload-container">
 
     <div class="upload-header">
-        <span class="file-options">{{'CONNECTION_IMPORT.UPLOAD_FILE_TYPES' | translate}}</span>
+        <span class="file-options">{{'IMPORT.UPLOAD_FILE_TYPES' | translate}}</span>
         <a
             href="#/import/connection/file-format-help" target="_blank"
-            class="file-help-link">{{'CONNECTION_IMPORT.UPLOAD_HELP_LINK' | translate}}
+            class="file-help-link">{{'IMPORT.UPLOAD_HELP_LINK' | translate}}
         </a>
     </div>
 
     <div class="drop-target" ng-class="{ 'drop-pending': dropPending, 'file-present': fileName}">
 
-        <div ng-show="!fileName" class="title">{{'CONNECTION_IMPORT.UPLOAD_DROP_TITLE' | translate}}</div>
+        <div ng-show="!fileName" class="title">{{'IMPORT.UPLOAD_DROP_TITLE' | translate}}</div>
 
         <input type="file" class="file-upload-input"/>
         <a ng-show="!fileName" ng-click="openFileBrowser()" class="browse-link">
-            {{'CONNECTION_IMPORT.UPLOAD_BROWSE_LINK' | translate}}
+            {{'IMPORT.UPLOAD_BROWSE_LINK' | translate}}
         </a>
 
         <div ng-show="fileName" class="file-name"> {{fileName}} </div>
diff --git a/guacamole/src/main/frontend/src/app/import/types/DisplayErrorList.js b/guacamole/src/main/frontend/src/app/import/types/DisplayErrorList.js
new file mode 100644
index 000000000..d775c5734
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/types/DisplayErrorList.js
@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Service which defines the DisplayErrorList class.
+ */
+angular.module('import').factory('DisplayErrorList', [
+        function defineDisplayErrorList() {
+
+    /**
+     * A list of human-readable error messages, intended to be usable in a
+     * sortable / filterable table.
+     *
+     * @constructor
+     * @param {String[]} messages
+     *     The error messages that should be prepared for display.
+     */
+    const DisplayErrorList = function DisplayErrorList(messages) {
+
+        // Use empty message list by default
+        this.messages = messages || [];
+
+        // The single String message composed of all messages concatenated
+        // together. This will be used for filtering / sorting, and should only
+        // be calculated once.
+        this.cachedMessage = null;
+
+    };
+
+    /**
+     * Return a sortable / filterable representation of all the error messages
+     * wrapped by this DisplayErrorList. 
+     * 
+     * NOTE: Once this method is called, any changes to the underlying array
+     * will have no effect. This is to ensure that repeated calls to toString()
+     * by sorting / filtering UI code will not regenerate the concatenated
+     * message every time.
+     * 
+     * @returns {String}
+     *     A sortable / filterable representation of the error messages wrapped
+     *     by this DisplayErrorList
+     */
+    DisplayErrorList.prototype.toString = function messageListToString() {
+
+        // Generate the concatenated message if not already generated
+        if (!this.concatenatedMessage)
+            this.concatenatedMessage = this.messages.join(' ');
+
+        return this.concatenatedMessage;
+
+    }
+
+    /**
+     * Return the underlying array containing the raw error messages, wrapped
+     * by this DisplayErrorList.
+     *
+     * @returns {String[]}
+     *     The underlying array containing the raw error messages, wrapped by
+     *     this DisplayErrorList
+     */
+    DisplayErrorList.prototype.getArray = function getUnderlyingArray() {
+        return this.messages;
+    }
+
+    return DisplayErrorList;
+
+}]);
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js b/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
index 9f336ef77..5639ba1c6 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
@@ -32,7 +32,7 @@ angular.module('import').factory('ImportConnection', [
      *     The object whose properties should be copied within the new
      *     Connection.
      */
-    var ImportConnection = function ImportConnection(template) {
+    const ImportConnection = function ImportConnection(template) {
 
         // Use empty object by default
         template = template || {};
diff --git a/guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js b/guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js
new file mode 100644
index 000000000..4d4fd3661
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js
@@ -0,0 +1,108 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Service which defines the ImportConnectionError class.
+ */
+angular.module('import').factory('ImportConnectionError', ['$injector',
+        function defineImportConnectionError($injector) {
+
+    // Required types
+    const DisplayErrorList = $injector.get('DisplayErrorList');
+
+    /**
+     * A representation of a connection to be imported, as parsed from an
+     * user-supplied import file.
+     *
+     * @constructor
+     * @param {ImportConnection|Object} [template={}]
+     *     The object whose properties should be copied within the new
+     *     Connection.
+     */
+    const ImportConnectionError = function ImportConnectionError(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * The row number within the original connection import file for this
+         * connection. This should be 1-indexed.
+         */
+        this.rowNumber = template.rowNumber;
+
+        /**
+         * The unique identifier of the connection group that contains this
+         * connection.
+         *
+         * @type String
+         */
+        this.parentIdentifier = template.parentIdentifier;
+
+        /**
+         * The path to the connection group that contains this connection,
+         * written as e.g. "ROOT/parent/child/group".
+         *
+         * @type String
+         */
+        this.group = template.group;
+
+        /**
+         * The human-readable name of this connection, which is not necessarily
+         * unique.
+         *
+         * @type String
+         */
+        this.name = template.name;
+
+        /**
+         * The name of the protocol associated with this connection, such as
+         * "vnc" or "rdp".
+         *
+         * @type String
+         */
+        this.protocol = template.protocol;
+
+        /**
+         * The identifiers of all users who should be granted read access to
+         * this connection.
+         *
+         * @type String[]
+         */
+        this.users = template.users || [];
+
+        /**
+         * The identifiers of all user groups who should be granted read access
+         * to this connection.
+         *
+         * @type String[]
+         */
+        this.groups = template.groups || [];
+
+        /**
+         * The error messages associated with this particular connection, if any.
+         *
+         * @type ImportConnectionError
+         */
+        this.errors = template.errors || new DisplayErrorList();
+
+    };
+
+    return ImportConnectionError;
+
+}]);
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/rest/services/connectionService.js b/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
index 5c1451ec2..c46874ea4 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
@@ -24,9 +24,11 @@ angular.module('rest').factory('connectionService', ['$injector',
         function connectionService($injector) {
 
     // Required services
-    var requestService        = $injector.get('requestService');
     var authenticationService = $injector.get('authenticationService');
     var cacheService          = $injector.get('cacheService');
+
+    // Required types
+    const Error = $injector.get('Error');
     
     var service = {};
     
diff --git a/guacamole/src/main/frontend/src/app/rest/types/Error.js b/guacamole/src/main/frontend/src/app/rest/types/Error.js
index 47f9cf770..74b28ebae 100644
--- a/guacamole/src/main/frontend/src/app/rest/types/Error.js
+++ b/guacamole/src/main/frontend/src/app/rest/types/Error.js
@@ -78,6 +78,15 @@ angular.module('rest').factory('Error', [function defineError() {
          */
         this.expected = template.expected;
 
+        /**
+         * The outcome for each patch that was submitted as part of the request
+         * that generated this error, if the request was a directory PATCH
+         * request. In all other cases, this will be null.
+         *
+         * @type DirectoryPatchOutcome[]
+         */
+        this.patches = template.patches || null;
+
     };
 
     /**
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 0233f8bb6..c5292b80f 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -184,11 +184,13 @@
 
     },
 
-    "CONNECTION_IMPORT": {
+    "IMPORT": {
 
         "BUTTON_CANCEL": "Cancel",
         "BUTTON_IMPORT": "Import Connections",
 
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
         "HEADER": "Connection Import",
 
         "HELP_HEADER": "Connection Import File Format",
@@ -196,7 +198,6 @@
         "HELP_FILE_TYPE_HEADER": "File Types",
         "HELP_FILE_TYPE_DESCRIPTION" : "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created.",
 
-
         "HELP_CSV_HEADER": "CSV Format",
         "HELP_CSV_DESCRIPTION": "A connection import CSV file has one connection record per row. Each column will specify a connection field. At minimum the connection name and protocol must be specified.",
         "HELP_CSV_MORE_DETAILS": "The CSV header for each row specifies the connection field. The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. In most cases, there should be no conflict between fields, but if needed, an \" (attribute)\" or \" (parameter)\" suffix may be added to disambiguate. Lists of user or user group identifiers must be semicolon-seperated.¹",
@@ -234,12 +235,17 @@
         "ERROR_REQUIRED_NAME": 
             "No connection name found in the provided file",
 
+        "ERROR_FILE_SINGLE_ONLY": "Please upload only a single file at a time",
+
+        "TABLE_HEADER_NAME" : "Name",
+        "TABLE_HEADER_PROTOCOL" : "Protocol",
+        "TABLE_HEADER_ERRORS" : "Errors",
+        "TABLE_HEADER_ROW_NUMBER": "Row Number",
+
         "UPLOAD_FILE_TYPES": "CSV, JSON, or YAML",
         "UPLOAD_HELP_LINK": "View Format Tips",
         "UPLOAD_DROP_TITLE": "Drop a File Here",
-        "UPLOAD_BROWSE_LINK": "Browse for File",
-
-        "ERROR_FILE_SINGLE_ONLY": "Please upload only a single file at a time"
+        "UPLOAD_BROWSE_LINK": "Browse for File"
         
     },
 

From 2ce7876f26845502a2d5b73f616ab7b8b546f867 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 3 Mar 2023 02:38:47 +0000
Subject: [PATCH 159/289] GUACAMOLE-926: Migrate upload directive into import
 page controller since they're so tangled up together to make it not worth
 seperating them.

---
 .../importConnectionsController.js            | 178 ++++++++++++-
 .../directives/connectionImportFileUpload.js  | 252 ------------------
 .../src/app/import/styles/file-upload.css     | 119 ---------
 .../frontend/src/app/import/styles/import.css | 101 +++++++
 .../import/templates/connectionImport.html    |  26 +-
 .../templates/connectionImportFileUpload.html |  30 ---
 6 files changed, 300 insertions(+), 406 deletions(-)
 delete mode 100644 guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
 delete mode 100644 guacamole/src/main/frontend/src/app/import/styles/file-upload.css
 delete mode 100644 guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index ec1227e95..14da850f9 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -25,9 +25,14 @@
 angular.module('import').controller('importConnectionsController', ['$scope', '$injector',
         function importConnectionsController($scope, $injector) {
 
+    // The file types supported for connection import
+    const LEGAL_FILE_TYPES = ['csv', 'json', 'yaml'];
+
     // Required services
+    const $document              = $injector.get('$document');
     const $q                     = $injector.get('$q');
     const $routeParams           = $injector.get('$routeParams');
+    const $timeout               = $injector.get('$timeout');
     const connectionParseService = $injector.get('connectionParseService');
     const connectionService      = $injector.get('connectionService');
     const permissionService      = $injector.get('permissionService');
@@ -112,11 +117,13 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         $scope.aborted = false;
         $scope.dataReady = false;
         $scope.processing = false;
+        $scope.error = null;
         $scope.fileData = null;
         $scope.mimeType = null;
         $scope.fileReader = null;
         $scope.parseResult = null;
         $scope.patchFailure = null;
+        $scope.fileName = null;
 
         // Broadcast an event to clear the file upload UI
         $scope.$broadcast('clearFile');
@@ -410,7 +417,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         resetUploadState();
 
         // Set the error for display
-        console.error(error);
         $scope.error = error;
         
     };
@@ -462,8 +468,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         }
 
         // Make the call to process the data into a series of patches
-        // TODO: Check if there's errors, and if so, display those rather than
-        // just YOLOing a create call
         processDataCallback(data)
 
             // Send the data off to be imported if parsing is successful
@@ -537,7 +541,30 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      * @argument {File} file
      *     The file to upload onto the scope for further processing.
      */
-    $scope.handleFile = function(file) {
+    const handleFile = file => {
+
+        // Clear any error from a previous attempted file upload
+        clearError();
+
+        // The MIME type of the provided file
+        const mimeType = file.type;
+
+        // Check if the mimetype ends with one of the supported types,
+        // e.g. "application/json" or "text/csv"
+        if (_.every(LEGAL_FILE_TYPES.map(
+                type => !mimeType.endsWith(type)))) {
+
+            // If the provided file is not one of the supported types,
+            // display an error and abort processing
+            handleError(new ParseError({
+                message: "Invalid file type: " + type,
+                key: 'IMPORT.ERROR_INVALID_FILE_TYPE',
+                variables: { TYPE: mimeType }
+            }));
+            return;
+        }
+
+        $scope.fileName = file.name;
         
         // Clear any error message from the previous upload attempt
         clearError();
@@ -578,5 +605,148 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         // Read all the data into memory 
         $scope.fileReader.readAsBinaryString(file);
     };
+   
+    /**
+     * Whether a drag/drop operation is currently in progress (the user has
+     * dragged a file over the Guacamole connection but has not yet
+     * dropped it).
+     *
+     * @type boolean
+     */
+    $scope.dropPending = false;
+
+    /**
+     * The name of the file that's currently being uploaded, or has yet to
+     * be imported, if any.
+     */
+    $scope.fileName = null;
+
+    /**
+     * The container for the file upload UI.
+     *
+     * @type Element
+     *
+     */
+    const uploadContainer = angular.element(
+            $document.find('.file-upload-container'));
+
+    /**
+     * The location where files can be dragged-and-dropped to.
+     *
+     * @type Element
+     */
+    const dropTarget = uploadContainer.find('.drop-target');
+
+    /**
+     * Displays a visual indication that dropping the file currently
+     * being dragged is possible. Further propagation and default behavior
+     * of the given event is automatically prevented.
+     *
+     * @param {Event} e
+     *     The event related to the in-progress drag/drop operation.
+     */
+    const notifyDragStart = function notifyDragStart(e) {
+
+        e.preventDefault();
+        e.stopPropagation();
+
+        $scope.$apply(() => {
+            $scope.dropPending = true;
+        });
+
+    };
+
+    /**
+     * Removes the visual indication that dropping the file currently
+     * being dragged is possible. Further propagation and default behavior
+     * of the given event is automatically prevented.
+     *
+     * @param {Event} e
+     *     The event related to the end of the former drag/drop operation.
+     */
+    const notifyDragEnd = function notifyDragEnd(e) {
+
+        e.preventDefault();
+        e.stopPropagation();
+
+        $scope.$apply(() => {
+            $scope.dropPending = false;
+        });
+
+    };
+
+    // Add listeners to the drop target to ensure that the visual state
+    // stays up to date
+    dropTarget.on('dragenter', notifyDragStart);
+    dropTarget.on('dragover',  notifyDragStart);
+    dropTarget.on('dragleave', notifyDragEnd);
+
+    /**
+     * Drop target event listener that will be invoked if the user drops
+     * anything onto the drop target. If a valid file is provided, the
+     * onFile callback provided to this directive will be called; otherwise
+     * an error will be displayed, if appropriate.
+     *
+     * @param {Event} e
+     *     The drop event that triggered this handler.
+     */
+    dropTarget.on('drop', e => {
+
+        notifyDragEnd(e);
+
+        const files = e.originalEvent.dataTransfer.files;
+
+        // Ignore any non-files that are dragged into the drop area
+        if (files.length < 1)
+            return;
+
+        if (files.length >= 2) {
+
+            // If more than one file was provided, print an error explaining
+            // that only a single file is allowed and abort processing
+            handleError(new ParseError({
+                message: 'Only a single file may be imported at once',
+                key: 'IMPORT.ERROR_FILE_SINGLE_ONLY'
+            }));
+            return;
+        }
+
+        handleFile(files[0]);
+
+    });
+
+    /**
+     * The hidden file input used to create a file browser.
+     *
+     * @type Element
+     */
+    const fileUploadInput = uploadContainer.find('.file-upload-input');
+
+    /**
+     * A function that will click on the hidden file input to open a file
+     * browser to allow the user to select a file for upload.
+     */
+    $scope.openFileBrowser = () =>
+            $timeout(() => fileUploadInput.click(), 0, false);
+
+    /**
+     * A handler that will be invoked when a user selectes a file in the
+     * file browser. After some error checking, the file will be passed to
+     * the onFile callback provided to this directive.
+     *
+     * @param {Event} e
+     *     The event that was triggered when the user selected a file in
+     *     their file browser.
+     */
+    fileUploadInput.on('change', e => {
+
+        // Process the uploaded file
+        handleFile(e.target.files[0]);
+
+        // Clear the value to ensure that the change event will be fired
+        // if the user selects the same file again
+        fileUploadInput.value = null;
+
+    });
 
 }]);
diff --git a/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js b/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
deleted file mode 100644
index 196e8f48f..000000000
--- a/guacamole/src/main/frontend/src/app/import/directives/connectionImportFileUpload.js
+++ /dev/null
@@ -1,252 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/* global _ */
-
-/**
- * All legal import file types. Any file not belonging to one of these types
- * must be rejected.
- */
-const LEGAL_FILE_TYPES = ["csv", "json", "yaml"];
-
-/**
- * A directive that allows for file upload, either through drag-and-drop or
- * a file browser.
- */
-angular.module('import').directive('connectionImportFileUpload', [
-        function connectionImportFileUpload() {
-
-    const directive = {
-        restrict: 'E',
-        replace: true,
-        templateUrl: 'app/import/templates/connectionImportFileUpload.html',
-        scope: {
-
-            /**
-             * The function to invoke when a file is provided to the file upload
-             * UI, either by dragging and dropping, or by navigating using the
-             * file browser. The function will be called with 2 arguments - the
-             * mime type, and the raw string contents of the file.
-             *
-             * @type function
-             */
-            onFile : '&',
-        }
-    };
-
-    directive.controller = ['$scope', '$injector', '$element',
-            function fileUploadController($scope, $injector, $element) {
-
-        // Required services
-        const $timeout = $injector.get('$timeout');
-
-        /**
-         * Whether a drag/drop operation is currently in progress (the user has
-         * dragged a file over the Guacamole connection but has not yet
-         * dropped it).
-         *
-         * @type boolean
-         */
-        $scope.dropPending = false;
-
-        /**
-         * The error associated with the file upload, if any. An object of the
-         * form { key, variables }, or null if no error has occured.
-         */
-        $scope.error = null;
-
-        /**
-         * The name of the file that's currently being uploaded, or has yet to
-         * be imported, if any.
-         */
-        $scope.fileName = null;
-
-        // Clear the file if instructed to do so by the parent
-        $scope.$on('clearFile', () => delete $scope.fileName);
-
-        /**
-         * Clear any displayed error message.
-         */
-        const clearError = () => $scope.error = null;
-
-        /**
-         * Set an error for display using the provided translation key and
-         * translation variables.
-         *
-         * @param {String} key
-         *     The translation key.
-         *
-         * @param {Object.<String, String>} variables
-         *     The variables to subsitute into the message, if any.
-         */
-        const setError = (key, variables) => $scope.error = { key, variables };
-
-        /**
-         * The location where files can be dragged-and-dropped to.
-         *
-         * @type Element
-         */
-        const dropTarget = $element.find('.drop-target')[0];
-
-        /**
-         * Displays a visual indication that dropping the file currently
-         * being dragged is possible. Further propagation and default behavior
-         * of the given event is automatically prevented.
-         *
-         * @param {Event} e
-         *     The event related to the in-progress drag/drop operation.
-         */
-        const notifyDragStart = function notifyDragStart(e) {
-
-            e.preventDefault();
-            e.stopPropagation();
-
-            $scope.$apply(() => {
-                $scope.dropPending = true;
-            });
-
-        };
-
-        /**
-         * Removes the visual indication that dropping the file currently
-         * being dragged is possible. Further propagation and default behavior
-         * of the given event is automatically prevented.
-         *
-         * @param {Event} e
-         *     The event related to the end of the former drag/drop operation.
-         */
-        const notifyDragEnd = function notifyDragEnd(e) {
-
-            e.preventDefault();
-            e.stopPropagation();
-
-            $scope.$apply(() => {
-                $scope.dropPending = false;
-            });
-
-        };
-
-        // Add listeners to the drop target to ensure that the visual state
-        // stays up to date
-        dropTarget.addEventListener('dragenter', notifyDragStart, false);
-        dropTarget.addEventListener('dragover',  notifyDragStart, false);
-        dropTarget.addEventListener('dragleave', notifyDragEnd,   false);
-
-        /**
-         * Given a user-supplied file, validate that the file type is correct,
-         * and invoke the onFile callback provided to this directive if so.
-         * 
-         * @param {File} file
-         *     The user-supplied file.
-         */
-        function handleFile(file) {
-
-            // Clear any error from a previous attempted file upload
-            clearError();
-
-            // The MIME type of the provided file
-            const mimeType = file.type;
-
-            // Check if the mimetype ends with one of the supported types,
-            // e.g. "application/json" or "text/csv"
-            if (_.every(LEGAL_FILE_TYPES.map(
-                    type => !mimeType.endsWith(type)))) {
-
-                // If the provided file is not one of the supported types,
-                // display an error and abort processing
-                setError('IMPORT.ERROR_INVALID_FILE_TYPE',
-                        { TYPE: mimeType });
-                return;
-            }
-
-            $scope.fileName = file.name;
-
-            // Invoke the provided file callback using the file
-            $scope.onFile({ file });
-        }
-
-        /**
-         * Drop target event listener that will be invoked if the user drops
-         * anything onto the drop target. If a valid file is provided, the
-         * onFile callback provided to this directive will be called; otherwise
-         * an error will be displayed, if appropriate.
-         *
-         * @param {Event} e
-         *     The drop event that triggered this handler.
-         */
-        dropTarget.addEventListener('drop', function(e) {
-
-            notifyDragEnd(e);
-            
-            const files = e.dataTransfer.files;
-
-            // Ignore any non-files that are dragged into the drop area
-            if (files.length < 1)
-                return;
-
-            if (files.length > 2) {
-
-                // If more than one file was provided, print an error explaining
-                // that only a single file is allowed and abort processing
-                setError('IMPORT.ERROR_FILE_SINGLE_ONLY');
-                return;
-            }
-
-            handleFile(files[0]);
-            
-        }, false);
-
-        /**
-         * The hidden file input used to create a file browser.
-         *
-         * @type Element
-         */
-        const fileUploadInput = $element.find('.file-upload-input')[0];
-
-        /**
-         * A function that will click on the hidden file input to open a file
-         * browser to allow the user to select a file for upload.
-         */
-        $scope.openFileBrowser = () =>
-                $timeout(() => fileUploadInput.click(), 0, false);
-
-        /**
-         * A handler that will be invoked when a user selectes a file in the
-         * file browser. After some error checking, the file will be passed to
-         * the onFile callback provided to this directive.
-         *
-         * @param {Event} e
-         *     The event that was triggered when the user selected a file in
-         *     their file browser.
-         */
-        fileUploadInput.onchange = e => {
-
-            // Process the uploaded file
-            handleFile(e.target.files[0]);
-
-            // Clear the value to ensure that the change event will be fired
-            // if the user selects the same file again
-            fileUploadInput.value = null;
-            
-        };
-        
-    }];
-    return directive;
-    
-}]);
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/import/styles/file-upload.css b/guacamole/src/main/frontend/src/app/import/styles/file-upload.css
deleted file mode 100644
index afe0fcf97..000000000
--- a/guacamole/src/main/frontend/src/app/import/styles/file-upload.css
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-.file-upload-container {
-
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    padding: 24px 24px 24px;
-
-    width: fit-content;
-    
-    border: 1px solid rgba(0,0,0,.25);
-    box-shadow: 1px 1px 2px rgb(0 0 0 / 25%);
-    
-    margin-left: auto;
-    margin-right: auto;
-    
-}
-
-.file-upload-container .upload-header {
-
-    display: flex;
-    flex-direction: row;
-    width: 500px;
-    margin-bottom: 5px;
-    justify-content: space-between;
-    
-}
-
-.file-upload-container .file-error {
-    
-    color: red;
-
-}
-
-.file-upload-container .file-options {
-
-    font-weight: bold;
-
-}
-
-.file-upload-container .file-upload-input {
-
-    display: none;
-
-}
-
-.file-upload-container .drop-target {
-
-    display: flex;
-    flex-direction: column;
-
-    align-items: center;
-    justify-content: space-evenly;
-
-    width: 500px;
-    height: 200px;
-
-    background: rgba(0,0,0,.04);
-    border: 1px solid black;
-
-}
-
-.file-upload-container .drop-target.file-present {
-
-    background: rgba(0,0,0,.15);
-    
-}
-
-
-.file-upload-container .drop-target .file-name {
-
-    font-weight: bold;
-    font-size: 1.5em;
-
-}
-
-.file-upload-container .drop-target.drop-pending {
-
-    background: #3161a9;
-
-}
-
-.file-upload-container .drop-target.drop-pending > * {
-    
-    opacity: 0.5;
-
-}
-
-.file-upload-container .drop-target .title {
-    
-    font-weight: bold;
-    font-size: 1.25em;
-    
-}
-
-.file-upload-container .drop-target .browse-link {
-
-    text-decoration: underline;
-    cursor: pointer;
-
-}
diff --git a/guacamole/src/main/frontend/src/app/import/styles/import.css b/guacamole/src/main/frontend/src/app/import/styles/import.css
index 8f038e4d1..3fbdbe077 100644
--- a/guacamole/src/main/frontend/src/app/import/styles/import.css
+++ b/guacamole/src/main/frontend/src/app/import/styles/import.css
@@ -42,3 +42,104 @@
 .import .errors .error-message ul {
     margin: 0px;
 }
+
+.file-upload-container {
+
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    padding: 24px 24px 24px;
+
+    width: fit-content;
+
+    border: 1px solid rgba(0,0,0,.25);
+    box-shadow: 1px 1px 2px rgb(0 0 0 / 25%);
+
+    margin-left: auto;
+    margin-right: auto;
+
+}
+
+.file-upload-container .upload-header {
+
+    display: flex;
+    flex-direction: row;
+    width: 500px;
+    margin-bottom: 5px;
+    justify-content: space-between;
+
+}
+
+.file-upload-container .file-error {
+
+    color: red;
+
+}
+
+.file-upload-container .file-options {
+
+    font-weight: bold;
+
+}
+
+.file-upload-container .file-upload-input {
+
+    display: none;
+
+}
+
+.file-upload-container .drop-target {
+
+    display: flex;
+    flex-direction: column;
+
+    align-items: center;
+    justify-content: space-evenly;
+
+    width: 500px;
+    height: 200px;
+
+    background: rgba(0,0,0,.04);
+    border: 1px solid black;
+
+}
+
+.file-upload-container .drop-target.file-present {
+
+    background: rgba(0,0,0,.15);
+
+}
+
+
+.file-upload-container .drop-target .file-name {
+
+    font-weight: bold;
+    font-size: 1.5em;
+
+}
+
+.file-upload-container .drop-target.drop-pending {
+
+    background: #3161a9;
+
+}
+
+.file-upload-container .drop-target.drop-pending > * {
+
+    opacity: 0.5;
+
+}
+
+.file-upload-container .drop-target .title {
+
+    font-weight: bold;
+    font-size: 1.25em;
+
+}
+
+.file-upload-container .drop-target .browse-link {
+
+    text-decoration: underline;
+    cursor: pointer;
+
+}
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index d0f9fd537..c9e37be46 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -4,8 +4,32 @@
         <h2>{{'IMPORT.HEADER' | translate}}</h2>
         <guac-user-menu></guac-user-menu>
     </div>
+    
+    <div class="file-upload-container">
+
+        <div class="upload-header">
+            <span class="file-options">{{'IMPORT.UPLOAD_FILE_TYPES' | translate}}</span>
+            <a
+                href="#/import/connection/file-format-help" target="_blank"
+                class="file-help-link">{{'IMPORT.UPLOAD_HELP_LINK' | translate}}
+            </a>
+        </div>
+
+        <div class="drop-target" ng-class="{ 'drop-pending': dropPending, 'file-present': fileName}">
+
+            <div ng-show="!fileName" class="title">{{'IMPORT.UPLOAD_DROP_TITLE' | translate}}</div>
+
+            <input type="file" class="file-upload-input"/>
+            <a ng-show="!fileName" ng-click="openFileBrowser()" class="browse-link">
+                {{'IMPORT.UPLOAD_BROWSE_LINK' | translate}}
+            </a>
+
+            <div ng-show="fileName" class="file-name"> {{fileName}} </div>
+
+        </div>
+
+    </div>
 
-    <connection-import-file-upload on-file="handleFile(file)"></connection-import-file-upload>
 
     <div class="import-buttons">
         <button 
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html
deleted file mode 100644
index 188567c00..000000000
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileUpload.html
+++ /dev/null
@@ -1,30 +0,0 @@
-<div class="file-upload-container">
-
-    <div class="upload-header">
-        <span class="file-options">{{'IMPORT.UPLOAD_FILE_TYPES' | translate}}</span>
-        <a
-            href="#/import/connection/file-format-help" target="_blank"
-            class="file-help-link">{{'IMPORT.UPLOAD_HELP_LINK' | translate}}
-        </a>
-    </div>
-
-    <div class="drop-target" ng-class="{ 'drop-pending': dropPending, 'file-present': fileName}">
-
-        <div ng-show="!fileName" class="title">{{'IMPORT.UPLOAD_DROP_TITLE' | translate}}</div>
-
-        <input type="file" class="file-upload-input"/>
-        <a ng-show="!fileName" ng-click="openFileBrowser()" class="browse-link">
-            {{'IMPORT.UPLOAD_BROWSE_LINK' | translate}}
-        </a>
-
-        <div ng-show="fileName" class="file-name"> {{fileName}} </div>
-
-    </div>
-
-    <!-- The translatable error message regarding the provided file(s), if any -->
-    <p
-        class="file-error" ng-show="error.key"
-        translate="{{error.key}}" translate-values="{{error.variables}}"
-    ></p>
-
-</div>

From eadc1779a0d2b008afd70fa7d9855fec39efe722 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 3 Mar 2023 19:38:46 +0000
Subject: [PATCH 160/289] GUACAMOLE-926: Import/upload UI improvements.

---
 .../importConnectionsController.js            |  9 ++--
 .../frontend/src/app/import/importModule.js   |  2 +-
 .../frontend/src/app/import/styles/import.css | 26 ++++++++++-
 .../import/templates/connectionImport.html    | 44 ++++++++++++-------
 .../main/frontend/src/translations/en.json    |  6 ++-
 5 files changed, 63 insertions(+), 24 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 14da850f9..124b69555 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -43,7 +43,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     const DirectoryPatch      = $injector.get('DirectoryPatch');
     const ParseError          = $injector.get('ParseError');
     const PermissionSet       = $injector.get('PermissionSet');
-    const TranslatableMessage = $injector.get('TranslatableMessage');
     const User                = $injector.get('User');
     const UserGroup           = $injector.get('UserGroup');
 
@@ -424,7 +423,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     /**
      * Clear the current displayed error.
      */
-    const clearError = () => delete $scope.error;
+    $scope.clearError = () => delete $scope.error;
 
     /**
      * Process the uploaded import file, importing the connections, granting
@@ -503,7 +502,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     $scope.cancel = function() {
 
         // Clear any error message
-        clearError();
+        $scope.clearError();
 
         // If the upload is in progress, stop it now; the FileReader will
         // reset the upload state when it stops
@@ -544,7 +543,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     const handleFile = file => {
 
         // Clear any error from a previous attempted file upload
-        clearError();
+        $scope.clearError();
 
         // The MIME type of the provided file
         const mimeType = file.type;
@@ -567,7 +566,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         $scope.fileName = file.name;
         
         // Clear any error message from the previous upload attempt
-        clearError();
+        $scope.clearError();
 
         // Initialize upload state
         $scope.aborted = false;
diff --git a/guacamole/src/main/frontend/src/app/import/importModule.js b/guacamole/src/main/frontend/src/app/import/importModule.js
index 46e5fa157..164ec2b16 100644
--- a/guacamole/src/main/frontend/src/app/import/importModule.js
+++ b/guacamole/src/main/frontend/src/app/import/importModule.js
@@ -21,4 +21,4 @@
  * The module for code supporting importing user-supplied files. Currently, only
  * connection import is supported.
  */
-angular.module('import', ['rest', 'list']);
+angular.module('import', ['rest', 'list', 'notification']);
diff --git a/guacamole/src/main/frontend/src/app/import/styles/import.css b/guacamole/src/main/frontend/src/app/import/styles/import.css
index 3fbdbe077..0b813083d 100644
--- a/guacamole/src/main/frontend/src/app/import/styles/import.css
+++ b/guacamole/src/main/frontend/src/app/import/styles/import.css
@@ -60,6 +60,17 @@
 
 }
 
+.file-upload-container.file-selected {
+    display: flex;
+    flex-direction: row;
+    gap: 100px;
+}
+
+.file-upload-container .clear {
+    margin: 0;
+    padding:
+}
+
 .file-upload-container .upload-header {
 
     display: flex;
@@ -142,4 +153,17 @@
     text-decoration: underline;
     cursor: pointer;
 
-}
\ No newline at end of file
+}
+
+.import .parseError {
+    display: flex;
+    justify-content: center;
+    padding: 0.75em;
+    margin-bottom: 10px;
+    gap: 3em;
+}
+
+.import .parseError .clear {
+    cursor: pointer;
+}
+
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index c9e37be46..488b38160 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -4,8 +4,32 @@
         <h2>{{'IMPORT.HEADER' | translate}}</h2>
         <guac-user-menu></guac-user-menu>
     </div>
+
+    <div ng-show="error" class="parseError notification error">
+
+        <!-- The translatable error message, if one is set -->
+        <span
+            class="message" ng-show="error.key"
+            translate="{{error.key}}" translate-values="{{error.variables}}"
+        ></span>
+
+        <!-- The base message, if no translatable message is available -->
+        <span class="message" ng-show="!error.key && error.message">
+            {{error.message}}
+        </span>
+
+        <span class="clear" ng-click="clearError()"> {{'IMPORT.BUTTON_CLEAR_ERROR' | translate}} </span>
+
+    </div>
+
+    <div ng-show="fileName" class="file-upload-container file-selected">
+        <div class="file-name"> {{fileName}} </div>
+        <button class="danger clear" ng-click="cancel()">
+            {{'IMPORT.BUTTON_CLEAR' | translate}}
+        </button>
+    </div>
     
-    <div class="file-upload-container">
+    <div ng-show="!fileName" class="file-upload-container">
 
         <div class="upload-header">
             <span class="file-options">{{'IMPORT.UPLOAD_FILE_TYPES' | translate}}</span>
@@ -17,20 +41,19 @@
 
         <div class="drop-target" ng-class="{ 'drop-pending': dropPending, 'file-present': fileName}">
 
-            <div ng-show="!fileName" class="title">{{'IMPORT.UPLOAD_DROP_TITLE' | translate}}</div>
+            <div class="title">{{'IMPORT.UPLOAD_DROP_TITLE' | translate}}</div>
 
             <input type="file" class="file-upload-input"/>
-            <a ng-show="!fileName" ng-click="openFileBrowser()" class="browse-link">
+            <a ng-click="openFileBrowser()" class="browse-link">
                 {{'IMPORT.UPLOAD_BROWSE_LINK' | translate}}
             </a>
 
-            <div ng-show="fileName" class="file-name"> {{fileName}} </div>
+            <div class="file-name"> {{fileName}} </div>
 
         </div>
 
     </div>
 
-
     <div class="import-buttons">
         <button 
             ng-click="import()" ng-disabled="importDisabled()" class="import">
@@ -42,17 +65,6 @@
         </button>
     </div>
 
-    <!-- The translatable error message, if one is set -->
-    <p 
-        class="parseError" ng-show="error.key" 
-        translate="{{error.key}}" translate-values="{{error.variables}}"
-    ></p>
-    
-    <!-- The base message, if no translatable message is available -->
-    <p class="parseError" ng-show="!error.key && error.message">
-        {{error.message}}
-    </p>
-
     <!-- Connection specific errors, if there are any -->
     <connection-import-errors parse-result="parseResult" patch-failure="patchFailure" />
 
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index c5292b80f..f80e91a5a 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -187,8 +187,12 @@
     "IMPORT": {
 
         "BUTTON_CANCEL": "Cancel",
+        "BUTTON_CLEAR" : "Clear",
+        "BUTTON_CLEAR_ERROR": "✖",
         "BUTTON_IMPORT": "Import Connections",
 
+        "ERROR_HEADER": "Error",
+
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
         "HEADER": "Connection Import",
@@ -240,7 +244,7 @@
         "TABLE_HEADER_NAME" : "Name",
         "TABLE_HEADER_PROTOCOL" : "Protocol",
         "TABLE_HEADER_ERRORS" : "Errors",
-        "TABLE_HEADER_ROW_NUMBER": "Row Number",
+        "TABLE_HEADER_ROW_NUMBER": "Row #",
 
         "UPLOAD_FILE_TYPES": "CSV, JSON, or YAML",
         "UPLOAD_HELP_LINK": "View Format Tips",

From 7bf192fd73018bb8b61a9626d34d786b648255f0 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 9 Mar 2023 19:14:13 +0000
Subject: [PATCH 161/289] GUACAMOLE-926: Switch to standard notification style.

---
 .../importConnectionsController.js            | 67 ++++++++-----------
 .../frontend/src/app/import/styles/import.css | 19 ------
 .../import/templates/connectionImport.html    | 17 -----
 .../main/frontend/src/translations/en.json    |  3 +-
 4 files changed, 30 insertions(+), 76 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 124b69555..ea06979e7 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -35,6 +35,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     const $timeout               = $injector.get('$timeout');
     const connectionParseService = $injector.get('connectionParseService');
     const connectionService      = $injector.get('connectionService');
+    const guacNotification       = $injector.get('guacNotification');
     const permissionService      = $injector.get('permissionService');
     const userService            = $injector.get('userService');
     const userGroupService       = $injector.get('userGroupService');
@@ -45,14 +46,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     const PermissionSet       = $injector.get('PermissionSet');
     const User                = $injector.get('User');
     const UserGroup           = $injector.get('UserGroup');
-
-    /**
-     * Any error that may have occured during import file parsing.
-     *
-     * @type {ParseError}
-     */
-    $scope.error = null;
-
+    
     /**
      * The result of parsing the current upload, if successful.
      *
@@ -116,7 +110,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         $scope.aborted = false;
         $scope.dataReady = false;
         $scope.processing = false;
-        $scope.error = null;
         $scope.fileData = null;
         $scope.mimeType = null;
         $scope.fileReader = null;
@@ -404,7 +397,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     }
     
     /**
-     * Set any caught error message to the scope for display.
+     * Display the provided error to the user in a dismissable dialog.
      *
      * @argument {ParseError} error
      *     The error to display.
@@ -415,15 +408,24 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         // all upload state to allow for a fresh retry
         resetUploadState();
 
-        // Set the error for display
-        $scope.error = error;
-        
+        guacNotification.showStatus({
+            className  : 'error',
+            title      : 'IMPORT.DIALOG_HEADER_ERROR',
+
+            // Use the translation key if available
+            text       : {
+                key: error.key || error.message,
+                variables: error.variables
+            },
+
+            // Add a button to hide the error
+            actions    : [{
+                name      : 'IMPORT.BUTTON_CLEAR',
+                callback  : () => guacNotification.showStatus(false)
+            }]
+        })
+
     };
-    
-    /**
-     * Clear the current displayed error.
-     */
-    $scope.clearError = () => delete $scope.error;
 
     /**
      * Process the uploaded import file, importing the connections, granting
@@ -455,16 +457,14 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         else if (mimeType.endsWith("yaml"))
             processDataCallback = connectionParseService.parseYAML;
 
-        // We don't expect this to happen - the file upload directive should
-        // have already have filtered out any invalid file types
-        else {
-            handleError(new ParseError({
-                message: 'Invalid file type: ' + mimeType,
-                key: 'IMPORT.INVALID_FILE_TYPE',
-                variables: { TYPE: mimeType }
-            }));
-            return;
-        }
+        // The file type was validated before being uploaded - this should
+        // never happen
+        else
+            processDataCallback = () => {
+                throw new ParseError({
+                    message: "Unexpected invalid file type: " + mimeType
+                });
+            };
 
         // Make the call to process the data into a series of patches
         processDataCallback(data)
@@ -501,9 +501,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      */
     $scope.cancel = function() {
 
-        // Clear any error message
-        $scope.clearError();
-
         // If the upload is in progress, stop it now; the FileReader will
         // reset the upload state when it stops
         if ($scope.fileReader) {
@@ -542,9 +539,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      */
     const handleFile = file => {
 
-        // Clear any error from a previous attempted file upload
-        $scope.clearError();
-
         // The MIME type of the provided file
         const mimeType = file.type;
 
@@ -556,7 +550,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
             // If the provided file is not one of the supported types,
             // display an error and abort processing
             handleError(new ParseError({
-                message: "Invalid file type: " + type,
+                message: "Invalid file type: " + mimeType,
                 key: 'IMPORT.ERROR_INVALID_FILE_TYPE',
                 variables: { TYPE: mimeType }
             }));
@@ -564,9 +558,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         }
 
         $scope.fileName = file.name;
-        
-        // Clear any error message from the previous upload attempt
-        $scope.clearError();
 
         // Initialize upload state
         $scope.aborted = false;
diff --git a/guacamole/src/main/frontend/src/app/import/styles/import.css b/guacamole/src/main/frontend/src/app/import/styles/import.css
index 0b813083d..656571c63 100644
--- a/guacamole/src/main/frontend/src/app/import/styles/import.css
+++ b/guacamole/src/main/frontend/src/app/import/styles/import.css
@@ -17,10 +17,6 @@
  * under the License.
  */
 
-.import .parseError {
-    color: red;
-}
-
 .import .import-buttons {
 
     margin-top: 10px;
@@ -30,7 +26,6 @@
 
 }
 
-
 .import .errors table {
     width: 100%;
 }
@@ -68,7 +63,6 @@
 
 .file-upload-container .clear {
     margin: 0;
-    padding:
 }
 
 .file-upload-container .upload-header {
@@ -154,16 +148,3 @@
     cursor: pointer;
 
 }
-
-.import .parseError {
-    display: flex;
-    justify-content: center;
-    padding: 0.75em;
-    margin-bottom: 10px;
-    gap: 3em;
-}
-
-.import .parseError .clear {
-    cursor: pointer;
-}
-
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index 488b38160..e33959e66 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -5,23 +5,6 @@
         <guac-user-menu></guac-user-menu>
     </div>
 
-    <div ng-show="error" class="parseError notification error">
-
-        <!-- The translatable error message, if one is set -->
-        <span
-            class="message" ng-show="error.key"
-            translate="{{error.key}}" translate-values="{{error.variables}}"
-        ></span>
-
-        <!-- The base message, if no translatable message is available -->
-        <span class="message" ng-show="!error.key && error.message">
-            {{error.message}}
-        </span>
-
-        <span class="clear" ng-click="clearError()"> {{'IMPORT.BUTTON_CLEAR_ERROR' | translate}} </span>
-
-    </div>
-
     <div ng-show="fileName" class="file-upload-container file-selected">
         <div class="file-name"> {{fileName}} </div>
         <button class="danger clear" ng-click="cancel()">
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index f80e91a5a..f52da91b5 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -188,10 +188,9 @@
 
         "BUTTON_CANCEL": "Cancel",
         "BUTTON_CLEAR" : "Clear",
-        "BUTTON_CLEAR_ERROR": "✖",
         "BUTTON_IMPORT": "Import Connections",
 
-        "ERROR_HEADER": "Error",
+        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 

From 9c31dba3cdc0f3b85014087c6dc14a9143e944e0 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 10 Mar 2023 18:43:17 +0000
Subject: [PATCH 162/289] GUACAMOLE-926: Add a success message once the import
 has succeeded.

---
 .../importConnectionsController.js            | 53 +++++++++++++++----
 .../import/templates/connectionImport.html    |  2 +
 .../main/frontend/src/translations/en.json    |  5 ++
 3 files changed, 49 insertions(+), 11 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index ea06979e7..e35726f4e 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -30,6 +30,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
     // Required services
     const $document              = $injector.get('$document');
+    const $location              = $injector.get('$location');
     const $q                     = $injector.get('$q');
     const $routeParams           = $injector.get('$routeParams');
     const $timeout               = $injector.get('$timeout');
@@ -122,6 +123,12 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         
     }
 
+    // Indicate that data is currently being loaded / processed if the the file
+    // has been provided but not yet fully uploaded, or if the the file is
+    // fully loaded and is currently being processed.
+    $scope.isLoading = () => (
+            ($scope.fileName && !$scope.dataReady) || $scope.processing);
+
     /**
      * Create all users and user groups mentioned in the import file that don't
      * already exist in the current data source.
@@ -322,9 +329,10 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      * @param {DirectoryPatchResponse} userGroupResponse
      *     The response to the user group PATCH creation request.
      * 
-     * @returns {Object}
-     *     An object containing PATCH deletion responses corresponding to any
-     *     provided connection, user, and/or user group creation responses.
+     * @returns {Promise.<Object>}
+     *     A promise resolving to an object containing PATCH deletion responses
+     *     corresponding to any provided connection, user, and/or user group
+     *     creation responses.
      */
     function cleanUpAll(connectionResponse, userResponse, userGroupResponse) {
 
@@ -351,15 +359,14 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      * Process a successfully parsed import file, creating any specified
      * connections, creating and granting permissions to any specified users
      * and user groups. If successful, the user will be shown a success message.
-     * If not, any errors will be displayed, and the user will be given ???an
-     * option??? to roll back any already-created entities.
+     * If not, any errors will be displayed and any already-created entities
+     * will be rolled back.
      *
      * @param {ParseResult} parseResult
      *     The result of parsing the user-supplied import file.
      */
     function handleParseSuccess(parseResult) {
 
-        $scope.processing = false;
         $scope.parseResult = parseResult;
 
         // If errors were encounted during file parsing, abort further
@@ -370,8 +377,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
         const dataSource = $routeParams.dataSource;
 
-        console.log("parseResult", parseResult);
-
         // First, attempt to create the connections
         connectionService.patchConnections(dataSource, parseResult.patches)
                 .then(connectionResponse => {
@@ -381,13 +386,39 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                     ({userResponse, groupResponse}) => 
 
                 grantConnectionPermissions(parseResult, connectionResponse)
-                        .then(() =>
+                        .then(() => {
                    
                     // TODON'T: Delete the stuff so we can test over and over
                     cleanUpAll(connectionResponse, userResponse, groupResponse)
-                        .then(resetUploadState)
+                        .then(() => {
+                            
+                            $scope.processing = false;
 
-                ));
+                            // Display a success message if everything worked
+                            guacNotification.showStatus({
+                                className  : 'success',
+                                title      : 'IMPORT.DIALOG_HEADER_SUCCESS',
+                                text       : {
+                                    key: 'IMPORT.CONNECTIONS_IMPORTED_SUCCESS',
+                                    variables: { NUMBER: parseResult.patches.length }
+                                },
+
+                                // Add a button to acknowledge and redirect to
+                                // the connection listing page
+                                actions    : [{
+                                    name      : 'IMPORT.ACTION_ACKNOWLEDGE',
+                                    callback  : () => {
+
+                                        // Close the notification
+                                        guacNotification.showStatus(false);
+
+                                        // Redirect to connection list page
+                                        $location.url('/settings/' + dataSource + '/connections');
+                                    }
+                                }]
+                            })
+                        });
+                }));
         })
 
         // If an error occured when the call to create the connections was made,
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index e33959e66..bab6485c7 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -48,6 +48,8 @@
         </button>
     </div>
 
+    <div ng-show="isLoading()" class="loading"></div>
+
     <!-- Connection specific errors, if there are any -->
     <connection-import-errors parse-result="parseResult" patch-failure="patchFailure" />
 
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index f52da91b5..e8ed65455 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -185,12 +185,17 @@
     },
 
     "IMPORT": {
+        
+        "ACTION_ACKNOWLEDGE"          : "@:APP.ACTION_ACKNOWLEDGE",
 
         "BUTTON_CANCEL": "Cancel",
         "BUTTON_CLEAR" : "Clear",
         "BUTTON_IMPORT": "Import Connections",
 
+        "CONNECTIONS_IMPORTED_SUCCESS": "{NUMBER} connections imported successfully.",
+
         "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
+        "DIALOG_HEADER_SUCCESS": "Success",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 

From f8fb95fbc8a25326450a6e695007d8dc34d73fb2 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 14 Mar 2023 02:20:51 +0000
Subject: [PATCH 163/289] GUACAMOLE-926: Finalize automatic cleanup on failure.

---
 .../importConnectionsController.js            | 205 ++++++++----------
 .../main/frontend/src/translations/en.json    |   1 -
 guacamole/src/main/frontend/webpack.config.js |  16 +-
 3 files changed, 104 insertions(+), 118 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index e35726f4e..e1bfbed48 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -43,6 +43,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     
     // Required types
     const DirectoryPatch      = $injector.get('DirectoryPatch');
+    const Error               = $injector.get('Error');
     const ParseError          = $injector.get('ParseError');
     const PermissionSet       = $injector.get('PermissionSet');
     const User                = $injector.get('User');
@@ -117,9 +118,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         $scope.parseResult = null;
         $scope.patchFailure = null;
         $scope.fileName = null;
-
-        // Broadcast an event to clear the file upload UI
-        $scope.$broadcast('clearFile');
         
     }
 
@@ -127,18 +125,21 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     // has been provided but not yet fully uploaded, or if the the file is
     // fully loaded and is currently being processed.
     $scope.isLoading = () => (
-            ($scope.fileName && !$scope.dataReady) || $scope.processing);
+            ($scope.fileName && !$scope.dataReady && !$scope.patchFailure)
+            || $scope.processing);
 
     /**
      * Create all users and user groups mentioned in the import file that don't
-     * already exist in the current data source.
+     * already exist in the current data source. If either creation fails, any
+     * already-created entities will be cleaned up, and the returned promise
+     * will be rejected.
      *
      * @param {ParseResult} parseResult
      *     The result of parsing the user-supplied import file.
      *
-     * @return {Object}
-     *     An object containing the results of the calls to create the users
-     *     and groups.
+     * @return {Promise.<Object>}
+     *     A promise resolving to an object containing the results of the calls
+     *     to create the users and groups.
      */
     function createUsersAndGroups(parseResult) {
 
@@ -173,11 +174,32 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                     value: new UserGroup({ identifier })
                 }));
 
-            return $q.all({
-                userResponse: userService.patchUsers(dataSource, userPatches),
-                groupResponse: userGroupService.patchUserGroups(dataSource, groupPatches)
-            });
+            // First, create any required users and groups, automatically cleaning
+            // up any created already-created entities if a call fails.
+            // NOTE: Generally we'd want to do these calls in parallel, using
+            // `$q.all()`. However, `$q.all()` rejects immediately if any of the
+            // wrapped promises reject, so the users may not be ready for cleanup
+            // at the time that the group promise rejects, or vice versa. While
+            // it would be possible to juggle promises and still do these calls
+            // in parallel, the code gets pretty complex, so for readability and
+            // simplicity, they are executed serially. The performance cost of
+            // doing so should be low.
+            return userService.patchUsers(dataSource, userPatches).then(userResponse => {
+
+                // Then, if that succeeds, create any required groups
+                return userGroupService.patchUserGroups(dataSource, groupPatches).then(
+
+                    // If user group creation succeeds, resolve the returned promise
+                    userGroupResponse => ({ userResponse, userGroupResponse}))
             
+                // If the group creation request fails, clean up any created users
+                .catch(groupFailure => {
+                    cleanUpUsers(userResponse);
+                    return groupFailure;
+                });
+
+            });
+
         });
         
     }
@@ -298,63 +320,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
     }
 
-    /**
-     * Given a successful response to a user group PATCH request, make another
-     * request to delete every created user group in the provided request.
-     *
-     * @param {DirectoryPatchResponse} creationResponse
-     *     The response to the user group PATCH creation request.
-     *
-     * @returns {DirectoryPatchResponse}
-     *     The response to the PATCH deletion request.
-     */
-    function cleanUpUserGroups(creationResponse) {
-
-        return userGroupService.patchUserGroups(
-            $routeParams.dataSource, createDeletionPatches(creationResponse));
-
-    }
-
-    /**
-     * Make requests to delete all connections, users, and/or groups from any
-     * provided PATCH API responses. If any responses are not provided, no
-     * cleanup will be attempted.
-     *
-     * @param {DirectoryPatchResponse} connectionResponse
-     *     The response to the connection PATCH creation request.
-     *
-     * @param {DirectoryPatchResponse} userResponse
-     *     The response to the user PATCH creation request.
-     *
-     * @param {DirectoryPatchResponse} userGroupResponse
-     *     The response to the user group PATCH creation request.
-     * 
-     * @returns {Promise.<Object>}
-     *     A promise resolving to an object containing PATCH deletion responses
-     *     corresponding to any provided connection, user, and/or user group
-     *     creation responses.
-     */
-    function cleanUpAll(connectionResponse, userResponse, userGroupResponse) {
-
-        // All cleanup requests that need to be made
-        const requests = {};
-
-        // If the connection response was provided, clean up connections
-        if (connectionResponse)
-            requests.connectionCleanup = cleanUpConnections(connectionResponse);
-
-        // If the user response was provided, clean up users
-        if (userResponse)
-            requests.userCleanup = cleanUpUsers(userResponse);
-
-        // If the user group response was provided, clean up user groups
-        if (connectionResponse)
-            requests.userGroupCleanup = cleanUpUserGroups(userGroupResponse);
-
-        // Return when all cleanup is complete
-        return $q.all(requests);
-    }
-
     /**
      * Process a successfully parsed import file, creating any specified
      * connections, creating and granting permissions to any specified users
@@ -379,58 +344,63 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
         // First, attempt to create the connections
         connectionService.patchConnections(dataSource, parseResult.patches)
-                .then(connectionResponse => {
+                .then(connectionResponse => 
 
             // If connection creation is successful, create users and groups
-            createUsersAndGroups(parseResult).then(
-                    ({userResponse, groupResponse}) => 
+            createUsersAndGroups(parseResult).then(() => 
 
                 grantConnectionPermissions(parseResult, connectionResponse)
                         .then(() => {
-                   
-                    // TODON'T: Delete the stuff so we can test over and over
-                    cleanUpAll(connectionResponse, userResponse, groupResponse)
-                        .then(() => {
                             
-                            $scope.processing = false;
+                    $scope.processing = false;
 
-                            // Display a success message if everything worked
-                            guacNotification.showStatus({
-                                className  : 'success',
-                                title      : 'IMPORT.DIALOG_HEADER_SUCCESS',
-                                text       : {
-                                    key: 'IMPORT.CONNECTIONS_IMPORTED_SUCCESS',
-                                    variables: { NUMBER: parseResult.patches.length }
-                                },
+                    // Display a success message if everything worked
+                    guacNotification.showStatus({
+                        className  : 'success',
+                        title      : 'IMPORT.DIALOG_HEADER_SUCCESS',
+                        text       : {
+                            key: 'IMPORT.CONNECTIONS_IMPORTED_SUCCESS',
+                            variables: { NUMBER: parseResult.patches.length }
+                        },
 
-                                // Add a button to acknowledge and redirect to
-                                // the connection listing page
-                                actions    : [{
-                                    name      : 'IMPORT.ACTION_ACKNOWLEDGE',
-                                    callback  : () => {
+                        // Add a button to acknowledge and redirect to
+                        // the connection listing page
+                        actions    : [{
+                            name      : 'IMPORT.ACTION_ACKNOWLEDGE',
+                            callback  : () => {
 
-                                        // Close the notification
-                                        guacNotification.showStatus(false);
+                                // Close the notification
+                                guacNotification.showStatus(false);
 
-                                        // Redirect to connection list page
-                                        $location.url('/settings/' + dataSource + '/connections');
-                                    }
-                                }]
-                            })
-                        });
-                }));
-        })
+                                // Redirect to connection list page
+                                $location.url('/settings/' + dataSource + '/connections');
+                            }
+                        }]
+                    });
+                }))
+
+            // If an error occurs while trying to users or groups, or while trying
+            // to assign permissions to users or groups, clean up the already-created
+            // connections, displaying an error to the user along with a blank slate
+            // so they can fix their problems and try again.
+            .catch(error => {
+                cleanUpConnections(connectionResponse);
+                handleError(error);
+            }))
 
         // If an error occured when the call to create the connections was made,
         // skip any further processing - the user will have a chance to fix the
         // problems and try again
-        .catch(patchFailure => { $scope.patchFailure = patchFailure; });
+        .catch(patchFailure => {
+            $scope.processing = false;
+            $scope.patchFailure = patchFailure;
+        });
     }
     
     /**
      * Display the provided error to the user in a dismissable dialog.
      *
-     * @argument {ParseError} error
+     * @argument {ParseError|Error} error
      *     The error to display.
      */
     const handleError = error => {
@@ -439,19 +409,33 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         // all upload state to allow for a fresh retry
         resetUploadState();
 
+        let text;
+        
+        // If it's a import file parsing error
+        if (error instanceof ParseError)
+            text = {
+
+                // Use the translation key if available
+                key: error.key || error.message,
+                variables: error.variables
+            };
+
+        // If it's a generic REST error
+        else if (error instanceof Error)
+            text = error.translatableMessage;
+
+        // If it's an unknown type, just use the message directly
+        else
+            text = { key: error };
+
         guacNotification.showStatus({
             className  : 'error',
             title      : 'IMPORT.DIALOG_HEADER_ERROR',
-
-            // Use the translation key if available
-            text       : {
-                key: error.key || error.message,
-                variables: error.variables
-            },
+            text,
 
             // Add a button to hide the error
             actions    : [{
-                name      : 'IMPORT.BUTTON_CLEAR',
+                name      : 'IMPORT.ACTION_ACKNOWLEDGE',
                 callback  : () => guacNotification.showStatus(false)
             }]
         })
@@ -546,6 +530,9 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     };
 
     /**
+     * Returns true if cancellation should be disabled, or false if
+     * cancellation should be allowed.
+     *
      * @return {Boolean}
      *     True if cancellation should be disabled, or false if cancellation
      *     should be allowed.
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index e8ed65455..4b7c89b23 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -189,7 +189,6 @@
         "ACTION_ACKNOWLEDGE"          : "@:APP.ACTION_ACKNOWLEDGE",
 
         "BUTTON_CANCEL": "Cancel",
-        "BUTTON_CLEAR" : "Clear",
         "BUTTON_IMPORT": "Import Connections",
 
         "CONNECTIONS_IMPORTED_SUCCESS": "{NUMBER} connections imported successfully.",
diff --git a/guacamole/src/main/frontend/webpack.config.js b/guacamole/src/main/frontend/webpack.config.js
index 7f8f9da81..dc6ad08cf 100644
--- a/guacamole/src/main/frontend/webpack.config.js
+++ b/guacamole/src/main/frontend/webpack.config.js
@@ -95,14 +95,14 @@ module.exports = {
     optimization: {
         minimizer: [
 
-//            // Minify using Google Closure Compiler
-//            new ClosureWebpackPlugin({ mode: 'STANDARD' }, {
-//                languageIn: 'ECMASCRIPT_2020',
-//                languageOut: 'ECMASCRIPT5',
-//                compilationLevel: 'SIMPLE'
-//            }),
-//
-//            new CssMinimizerPlugin()
+            // Minify using Google Closure Compiler
+            new ClosureWebpackPlugin({ mode: 'STANDARD' }, {
+                languageIn: 'ECMASCRIPT_2020',
+                languageOut: 'ECMASCRIPT5',
+                compilationLevel: 'SIMPLE'
+            }),
+
+            new CssMinimizerPlugin()
 
         ],
         splitChunks: {

From 7f37d0b0d2592c7940b5100906ffe02209bb53dc Mon Sep 17 00:00:00 2001
From: Alex Leitner <leitnersalex@gmail.com>
Date: Thu, 30 Mar 2023 15:01:10 +0000
Subject: [PATCH 164/289] GUACAMOLE-1253: Update select all queries to process
 in batches.

---
 .../guacamole/auth/jdbc/JDBCEnvironment.java  | 13 +++++
 .../base/ModeledDirectoryObjectService.java   | 51 +++++++++++++------
 .../auth/mysql/conf/MySQLEnvironment.java     | 21 ++++++++
 .../mysql/conf/MySQLGuacamoleProperties.java  | 12 +++++
 .../conf/PostgreSQLEnvironment.java           | 19 +++++++
 .../conf/PostgreSQLGuacamoleProperties.java   | 12 +++++
 .../sqlserver/conf/SQLServerEnvironment.java  | 18 +++++++
 .../conf/SQLServerGuacamoleProperties.java    | 12 +++++
 8 files changed, 143 insertions(+), 15 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
index 77f038734..f7a890e49 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
@@ -67,6 +67,19 @@ public abstract class JDBCEnvironment extends DelegatingEnvironment {
      */
     public abstract int getAbsoluteMaxConnections() throws GuacamoleException;
 
+    /**
+     * Returns the maximum number of identifiers/parameters to be 
+     * included in a single batch when executing SQL statements.
+     *
+     * @return
+     *     The maximum number of identifiers/parameters to be included 
+     *     in a single batch.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while retrieving the property.
+     */
+    public abstract int getBatchSize() throws GuacamoleException;
+
     /**
      * Returns the default maximum number of concurrent connections to allow to
      * any one connection, unless specified differently on an individual
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java
index 80bc7eb5c..fe587160d 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/ModeledDirectoryObjectService.java
@@ -19,13 +19,18 @@
 
 package org.apache.guacamole.auth.jdbc.base;
 
+import com.google.common.collect.Lists;
+import com.google.inject.Inject;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.List;
 import java.util.Set;
+import java.util.stream.Collectors;
 import org.apache.guacamole.auth.jdbc.user.ModeledAuthenticatedUser;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleSecurityException;
+import org.apache.guacamole.auth.jdbc.JDBCEnvironment;
 import org.apache.guacamole.auth.jdbc.permission.ObjectPermissionMapper;
 import org.apache.guacamole.auth.jdbc.permission.ObjectPermissionModel;
 import org.apache.guacamole.auth.jdbc.user.UserModel;
@@ -66,6 +71,12 @@ public abstract class ModeledDirectoryObjectService<InternalType extends Modeled
         ObjectPermission.Type.ADMINISTER
     };
     
+    /**
+     * The environment of the Guacamole server.
+     */
+    @Inject
+    private JDBCEnvironment environment;
+    
     /**
      * Returns an instance of a mapper for the type of object used by this
      * service.
@@ -347,10 +358,10 @@ public abstract class ModeledDirectoryObjectService<InternalType extends Modeled
      *     A new collection containing only the strings within the provided
      *     collection which are valid identifiers.
      */
-    protected Collection<String> filterIdentifiers(Collection<String> identifiers) {
+    protected List<String> filterIdentifiers(Collection<String> identifiers) {
 
         // Obtain enough space for a full copy of the given identifiers
-        Collection<String> validIdentifiers = new ArrayList<String>(identifiers.size());
+        List<String> validIdentifiers = new ArrayList<>(identifiers.size());
 
         // Add only valid identifiers to the copy
         for (String identifier : identifiers) {
@@ -387,26 +398,36 @@ public abstract class ModeledDirectoryObjectService<InternalType extends Modeled
             Collection<String> identifiers) throws GuacamoleException {
 
         // Ignore invalid identifiers
-        identifiers = filterIdentifiers(identifiers);
+        List<String> filteredIdentifiers = filterIdentifiers(identifiers);
 
         // Do not query if no identifiers given
-        if (identifiers.isEmpty())
+        if (filteredIdentifiers.isEmpty())
             return Collections.<InternalType>emptyList();
 
-        Collection<ModelType> objects;
+        int batchSize = environment.getBatchSize();
 
-        // Bypass permission checks if the user is privileged
-        if (user.isPrivileged())
-            objects = getObjectMapper().select(identifiers);
+        boolean userIsPrivileged = user.isPrivileged();
+
+        // Process the filteredIdentifiers in batches using Lists.partition() and flatMap
+        Collection<ModelType> allObjects = Lists.partition(filteredIdentifiers, batchSize).stream()
+                .flatMap(chunk -> {
+                    Collection<ModelType> objects;
+
+                    // Bypass permission checks if the user is privileged
+                    if (userIsPrivileged)
+                        objects = getObjectMapper().select(chunk);
+
+                    // Otherwise only return explicitly readable identifiers
+                    else
+                        objects = getObjectMapper().selectReadable(user.getUser().getModel(),
+                                chunk, user.getEffectiveUserGroups());
+
+                    return objects.stream();
+                })
+                .collect(Collectors.toList());
 
-        // Otherwise only return explicitly readable identifiers
-        else
-            objects = getObjectMapper().selectReadable(user.getUser().getModel(),
-                    identifiers, user.getEffectiveUserGroups());
-        
         // Return collection of requested objects
-        return getObjectInstances(user, objects);
-        
+        return getObjectInstances(user, allObjects);
     }
 
     /**
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java
index 9ac722624..d5931e513 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java
@@ -104,6 +104,20 @@ public class MySQLEnvironment extends JDBCEnvironment {
      * The default SSL mode for connecting to MySQL servers.
      */
     private final MySQLSSLMode DEFAULT_SSL_MODE = MySQLSSLMode.PREFERRED;
+    
+    /**
+     * The default maximum number of identifiers/parameters to be included in a 
+     * single batch when executing SQL statements for MySQL and MariaDB.
+     * 
+     * MySQL and MariaDB impose a limit on the maximum size of a query, 
+     * determined by the max_allowed_packet configuration variable. A value of 
+     * 1000 is chosen to accommodate the max_allowed_packet limit without 
+     * exceeding it.
+     *
+     * @see https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_max_allowed_packet
+     * @see https://mariadb.com/kb/en/server-system-variables/#max_allowed_packet
+     */
+    private static final int DEFAULT_BATCH_SIZE = 1000;
 
     /**
      * Constructs a new MySQLEnvironment, providing access to MySQL-specific
@@ -134,6 +148,13 @@ public class MySQLEnvironment extends JDBCEnvironment {
             DEFAULT_ABSOLUTE_MAX_CONNECTIONS
         );
     }
+    
+    @Override
+    public int getBatchSize() throws GuacamoleException {
+        return getProperty(MySQLGuacamoleProperties.MYSQL_BATCH_SIZE,
+            DEFAULT_BATCH_SIZE
+        );
+    }
 
     @Override
     public int getDefaultMaxConnections() throws GuacamoleException {
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
index ca17757a4..5e20b52c6 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java
@@ -291,4 +291,16 @@ public class MySQLGuacamoleProperties {
 
     };
 
+    /**
+     * The maximum number of identifiers/parameters to be included in a single batch when
+     * executing SQL statements.
+     */
+    public static final IntegerGuacamoleProperty MYSQL_BATCH_SIZE =
+            new IntegerGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "mysql-batch-size"; }
+
+    };    
+    
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java
index 5e0a5a1fe..459282ff8 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLEnvironment.java
@@ -115,6 +115,18 @@ public class PostgreSQLEnvironment extends JDBCEnvironment {
      * The default value to use for SSL mode if none is explicitly configured.
      */
     private final PostgreSQLSSLMode DEFAULT_SSL_MODE = PostgreSQLSSLMode.PREFER;
+    
+    /**
+     * The default maximum number of identifiers/parameters to be included in a 
+     * single batch when executing SQL statements for PostgreSQL.
+     * 
+     * PostgreSQL has a maximum limit of 65535 parameters per prepared statement.
+     * A value of 5000 is chosen to avoid potential performance issues or query
+     * execution errors while staying well below the maximum limit.
+     *
+     * @see https://www.postgresql.org/docs/current/runtime-config-resource.html#GUC-MAX-PREPARED-STATEMENT-ARGS
+     */
+    private static final int DEFAULT_BATCH_SIZE = 5000;
 
     /**
      * Constructs a new PostgreSQLEnvironment, providing access to PostgreSQL-specific
@@ -146,6 +158,13 @@ public class PostgreSQLEnvironment extends JDBCEnvironment {
         );
     }
 
+    @Override
+    public int getBatchSize() throws GuacamoleException {
+        return getProperty(PostgreSQLGuacamoleProperties.POSTGRESQL_BATCH_SIZE,
+            DEFAULT_BATCH_SIZE
+        );
+    }    
+    
     @Override
     public int getDefaultMaxConnections() throws GuacamoleException {
         return getProperty(
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
index 3f33ec44f..707b83ca1 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/java/org/apache/guacamole/auth/postgresql/conf/PostgreSQLGuacamoleProperties.java
@@ -302,5 +302,17 @@ public class PostgreSQLGuacamoleProperties {
         public String getName() { return "postgresql-enforce-access-windows-for-active-sessions"; }
 
     };
+    
+    /**
+     * The maximum number of identifiers/parameters to be included in a single batch when
+     * executing SQL statements.
+     */
+    public static final IntegerGuacamoleProperty POSTGRESQL_BATCH_SIZE =
+            new IntegerGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "postgresql-batch-size"; }
+
+    };
 
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
index 7d88d7399..5aedec784 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
@@ -88,6 +88,17 @@ public class SQLServerEnvironment extends JDBCEnvironment {
      */
     public static final SQLServerDriver SQLSERVER_DEFAULT_DRIVER = SQLServerDriver.MICROSOFT_2005;
 
+    /**
+     * The default maximum number of identifiers/parameters to be included in a 
+     * single batch when executing SQL statements for SQL Server.
+     * 
+     * SQL Server supports a maximum of 2100 parameters per query. A value of
+     * 1000 is chosen to stay within this limit and avoid query execution errors.
+     *
+     * @see https://docs.microsoft.com/en-us/sql/sql-server/maximum-capacity-specifications-for-sql-server
+     */
+    private static final int DEFAULT_BATCH_SIZE = 1000;
+    
     /**
      * Constructs a new SQLServerEnvironment, providing access to SQLServer-specific
      * configuration options.
@@ -117,6 +128,13 @@ public class SQLServerEnvironment extends JDBCEnvironment {
             DEFAULT_ABSOLUTE_MAX_CONNECTIONS
         );
     }
+    
+    @Override
+    public int getBatchSize() throws GuacamoleException {
+        return getProperty(SQLServerGuacamoleProperties.SQLSERVER_BATCH_SIZE,
+            DEFAULT_BATCH_SIZE
+        );
+    }    
 
     @Override
     public int getDefaultMaxConnections() throws GuacamoleException {
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
index 1f2500350..721b3345a 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
@@ -232,5 +232,17 @@ public class SQLServerGuacamoleProperties {
         public String getName() { return "sqlserver-enforce-access-windows-for-active-sessions"; }
 
     };
+    
+    /**
+     * The maximum number of identifiers/parameters to be included in a single batch when
+     * executing SQL statements.
+     */
+    public static final IntegerGuacamoleProperty SQLSERVER_BATCH_SIZE =
+            new IntegerGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "sqlserver-batch-size"; }
+
+    };
 
 }

From 520edb32eef0acaa0ecf00b83738ba63aafd3319 Mon Sep 17 00:00:00 2001
From: Mike Jumper <mjumper@apache.org>
Date: Mon, 10 Apr 2023 09:05:22 -0700
Subject: [PATCH 165/289] GUACAMOLE-1767: Correct parent project version
 (bumped to 1.5.1).

---
 extensions/guacamole-auth-ban/pom.xml                       | 6 +++---
 .../src/main/resources/guac-manifest.json                   | 2 +-
 .../modules/guacamole-auth-sso-dist/pom.xml                 | 2 +-
 .../modules/guacamole-auth-sso-ssl/pom.xml                  | 4 ++--
 .../src/main/resources/guac-manifest.json                   | 2 +-
 extensions/guacamole-display-statistics/pom.xml             | 4 ++--
 .../src/main/resources/guac-manifest.json                   | 2 +-
 7 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/extensions/guacamole-auth-ban/pom.xml b/extensions/guacamole-auth-ban/pom.xml
index fcc2a272d..0c1cc1c3d 100644
--- a/extensions/guacamole-auth-ban/pom.xml
+++ b/extensions/guacamole-auth-ban/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-auth-ban</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.0</version>
+    <version>1.5.1</version>
     <name>guacamole-auth-ban</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.5.0</version>
+        <version>1.5.1</version>
         <relativePath>../</relativePath>
     </parent>
 
@@ -51,7 +51,7 @@
         <dependency>
             <groupId>org.apache.guacamole</groupId>
             <artifactId>guacamole-ext</artifactId>
-            <version>1.5.0</version>
+            <version>1.5.1</version>
             <scope>provided</scope>
 
             <!-- Exclude transitive dependencies that will be overridden by
diff --git a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
index b7d4524d6..57b3f739a 100644
--- a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.0",
+    "guacamoleVersion" : "1.5.1",
 
     "name"      : "Brute-force Authentication Detection/Prevention",
     "namespace" : "ban",
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
index 1a0020f64..2ee745cb5 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
@@ -63,7 +63,7 @@
         <dependency>
             <groupId>org.apache.guacamole</groupId>
             <artifactId>guacamole-auth-sso-ssl</artifactId>
-            <version>1.5.0</version>
+            <version>1.5.1</version>
         </dependency>
 
     </dependencies>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
index 7ece6b40e..d0636b9a9 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-auth-sso-ssl</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.0</version>
+    <version>1.5.1</version>
     <name>guacamole-auth-sso-ssl</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>guacamole-auth-sso</artifactId>
-        <version>1.5.0</version>
+        <version>1.5.1</version>
         <relativePath>../../</relativePath>
     </parent>
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
index 7b8099427..9ed99833f 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.0",
+    "guacamoleVersion" : "1.5.1",
 
     "name"      : "SSL Authentication Extension",
     "namespace" : "ssl",
diff --git a/extensions/guacamole-display-statistics/pom.xml b/extensions/guacamole-display-statistics/pom.xml
index 929c0311c..e726a941d 100644
--- a/extensions/guacamole-display-statistics/pom.xml
+++ b/extensions/guacamole-display-statistics/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-display-statistics</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.0</version>
+    <version>1.5.1</version>
     <name>guacamole-display-statistics</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.5.0</version>
+        <version>1.5.1</version>
         <relativePath>../</relativePath>
     </parent>
 
diff --git a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
index ada097116..cd10ea49c 100644
--- a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.0",
+    "guacamoleVersion" : "1.5.1",
 
     "name"      : "Display Statistic Toolbar",
     "namespace" : "display-stats",

From d657d2b90a20529ee02e34facf78c1c6a22cdf2a Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 15 Mar 2023 18:19:44 +0000
Subject: [PATCH 166/289] GUACAMOLE-926: Clean up unneeded code, trailing
 whitespace; fix bugs, styling, comments and licenses.

---
 doc/licenses/core-util-is-1.0.3/README        |   2 +-
 doc/licenses/csv-6.2.5/README                 |   2 +-
 doc/licenses/events-3.3.0/README              |   2 +-
 doc/licenses/ieee754-1.2.1/README             |   2 +-
 .../process-nextick-args-2.0.1/README         |   2 +-
 doc/licenses/readable-stream-2.3.7/README     |   2 +-
 doc/licenses/setimmediate-1.0.5/README        |   2 +-
 doc/licenses/stream-browserify-2.0.2/README   |   2 +-
 doc/licenses/string_decoder-1.1.1/README      |   2 +-
 doc/licenses/timers-browserify-2.0.12/README  |   4 +-
 .../auth/jdbc/base/JDBCDirectory.java         |   1 +
 .../net/auth/AtomicDirectoryOperation.java    |  10 +-
 .../importConnectionsController.js            | 116 +++++++----
 .../directives/connectionImportErrors.js      |  30 +--
 .../import/services/connectionCSVService.js   | 187 ++++++++----------
 .../import/services/connectionParseService.js |  68 ++++---
 .../frontend/src/app/import/styles/help.css   |   4 +-
 .../frontend/src/app/import/styles/import.css |  10 +
 .../import/templates/connectionErrors.html    |   2 +-
 .../import/templates/connectionImport.html    |  24 +--
 .../templates/connectionImportFileHelp.html   |  80 +-------
 .../src/app/import/types/DisplayErrorList.js  |  26 ++-
 .../src/app/import/types/ImportConnection.js  |   4 +-
 .../app/import/types/ImportConnectionError.js |  42 +---
 .../src/app/import/types/ParseResult.js       |   8 +-
 .../src/app/index/config/indexRouteConfig.js  |   2 +-
 .../app/rest/services/connectionService.js    |   9 +-
 .../src/app/rest/services/userGroupService.js |   6 +-
 .../src/app/rest/services/userService.js      |   6 +-
 .../src/app/rest/types/DirectoryPatch.js      |   4 +-
 .../templates/settingsConnections.html        |   2 +-
 .../main/frontend/src/translations/en.json    | 115 +++++------
 .../org/apache/guacamole/rest/APIError.java   |   1 -
 .../rest/directory/DirectoryResource.java     |  24 +--
 .../rest/jsonpatch/APIPatchOutcome.java       |   6 +-
 35 files changed, 373 insertions(+), 436 deletions(-)

diff --git a/doc/licenses/core-util-is-1.0.3/README b/doc/licenses/core-util-is-1.0.3/README
index 411c1f1e9..7db659198 100644
--- a/doc/licenses/core-util-is-1.0.3/README
+++ b/doc/licenses/core-util-is-1.0.3/README
@@ -2,6 +2,6 @@ core-util-is (https://github.com/isaacs/core-util-is)
 ---------------------------------------------
 
     Version: 1.0.3
-    From: 'isaacs' (https://github.com/isaacs)
+    From: 'Node.js contributors'
     License(s):
         MIT (bundled/core-util-is-1.0.3/LICENSE)
diff --git a/doc/licenses/csv-6.2.5/README b/doc/licenses/csv-6.2.5/README
index 5fb35fae4..8a8d6debb 100644
--- a/doc/licenses/csv-6.2.5/README
+++ b/doc/licenses/csv-6.2.5/README
@@ -2,6 +2,6 @@ node-csv (https://github.com/adaltas/node-csv)
 ---------------------------------------------
 
     Version: 6.2.5
-    From: 'adaltas' (https://github.com/adaltas)
+    From: 'Adaltas' (https://github.com/adaltas)
     License(s):
         MIT (bundled/csv-6.2.5/LICENSE)
diff --git a/doc/licenses/events-3.3.0/README b/doc/licenses/events-3.3.0/README
index 274b952ab..b53924d9c 100644
--- a/doc/licenses/events-3.3.0/README
+++ b/doc/licenses/events-3.3.0/README
@@ -2,6 +2,6 @@ events (https://github.com/browserify/events)
 ---------------------------------------------
 
     Version: 3.3.0
-    From: 'browserify' (https://github.com/browserify)
+    From: 'Node.js contributors, Joyent, Inc., and other Node contributors'
     License(s):
         MIT (bundled/events-3.3.0/LICENSE)
diff --git a/doc/licenses/ieee754-1.2.1/README b/doc/licenses/ieee754-1.2.1/README
index 06d856f16..f15f63240 100644
--- a/doc/licenses/ieee754-1.2.1/README
+++ b/doc/licenses/ieee754-1.2.1/README
@@ -2,6 +2,6 @@ ieee754 (https://github.com/feross/ieee754)
 ---------------------------------------------
 
     Version: 1.2.1
-    From: 'Feross Aboukhadijeh' (https://github.com/feross)
+    From: 'Fair Oaks Labs, Inc'
     License(s):
         MIT (bundled/ieee754-1.2.1/LICENSE)
diff --git a/doc/licenses/process-nextick-args-2.0.1/README b/doc/licenses/process-nextick-args-2.0.1/README
index d7c0f6b3b..84417dcce 100644
--- a/doc/licenses/process-nextick-args-2.0.1/README
+++ b/doc/licenses/process-nextick-args-2.0.1/README
@@ -4,5 +4,5 @@ process-nextick-args (https://github.com/calvinmetcalf/process-nextick-args)
     Version: 2.0.1
     From: 'Calvin Metcalf' (https://github.com/calvinmetcalf)
     License(s):
-        MIT (bundled/process-nextick-args-2.0.1/LICENSE)
+        MIT (bundled/process-nextick-args-2.0.1/license.md)
 
diff --git a/doc/licenses/readable-stream-2.3.7/README b/doc/licenses/readable-stream-2.3.7/README
index cb58f728b..6e09569c1 100644
--- a/doc/licenses/readable-stream-2.3.7/README
+++ b/doc/licenses/readable-stream-2.3.7/README
@@ -2,7 +2,7 @@ readable-stream (https://github.com/nodejs/readable-stream)
 ---------------------------------------------
 
     Version: 2.3.7
-    From: 'Node.js' (https://github.com/nodejs)
+    From: 'Node.js contributors, Joyent, Inc., and other Node contributors'
     License(s):
         MIT (bundled/readable-stream-2.3.7/LICENSE)
 
diff --git a/doc/licenses/setimmediate-1.0.5/README b/doc/licenses/setimmediate-1.0.5/README
index 0fe5638ee..8bd3389be 100644
--- a/doc/licenses/setimmediate-1.0.5/README
+++ b/doc/licenses/setimmediate-1.0.5/README
@@ -4,5 +4,5 @@ setImmediate.js (https://github.com/YuzuJS/setImmediate)
     Version: 1.0.5
     From: 'Yuzu (by Barnes & Noble Education)' (https://github.com/YuzuJS)
     License(s):
-        MIT (bundled/setimmediate-1.0.5/LICENSE)
+        MIT (bundled/setimmediate-1.0.5/LICENSE.txt)
 
diff --git a/doc/licenses/stream-browserify-2.0.2/README b/doc/licenses/stream-browserify-2.0.2/README
index 8ab34a47f..4116876af 100644
--- a/doc/licenses/stream-browserify-2.0.2/README
+++ b/doc/licenses/stream-browserify-2.0.2/README
@@ -2,7 +2,7 @@ stream-browserify (https://github.com/browserify/stream-browserify)
 ---------------------------------------------
 
     Version: 2.0.2
-    From: 'browserify' (https://github.com/browserify)
+    From: 'James Halliday'
     License(s):
         MIT (bundled/stream-browserify-2.0.2/LICENSE)
 
diff --git a/doc/licenses/string_decoder-1.1.1/README b/doc/licenses/string_decoder-1.1.1/README
index a64b3299f..48ee14c03 100644
--- a/doc/licenses/string_decoder-1.1.1/README
+++ b/doc/licenses/string_decoder-1.1.1/README
@@ -2,7 +2,7 @@ string_decoder (https://github.com/nodejs/string_decoder)
 ---------------------------------------------
 
     Version: 1.1.1
-    From: 'Node.js' (https://github.com/nodejs)
+    From: 'Node.js contributors, Joyent, Inc., and other Node contributors'
     License(s):
         MIT (bundled/string_decoder-1.1.1/LICENSE)
 
diff --git a/doc/licenses/timers-browserify-2.0.12/README b/doc/licenses/timers-browserify-2.0.12/README
index 0e1eb4e8a..9ed389891 100644
--- a/doc/licenses/timers-browserify-2.0.12/README
+++ b/doc/licenses/timers-browserify-2.0.12/README
@@ -2,7 +2,7 @@ timers-browserify (https://github.com/browserify/timers-browserify)
 ---------------------------------------------
 
     Version: 2.0.12
-    From: 'browserify' (https://github.com/browserify)
+    From: 'J. Ryan Stinnett' (https://github.com/jryans)
     License(s):
-        MIT (bundled/timers-browserify-2.0.12/LICENSE)
+        MIT (bundled/timers-browserify-2.0.12/LICENSE.md)
 
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/JDBCDirectory.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/JDBCDirectory.java
index fcba2f678..3ed6d8a50 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/JDBCDirectory.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/base/JDBCDirectory.java
@@ -32,6 +32,7 @@ import org.mybatis.guice.transactional.Transactional;
 public abstract class JDBCDirectory<ObjectType extends Identifiable>
         extends RestrictedObject implements Directory<ObjectType>  {
 
+    @Override
     @Transactional
     public void tryAtomically(AtomicDirectoryOperation<ObjectType> operation)
             throws GuacamoleException {
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AtomicDirectoryOperation.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AtomicDirectoryOperation.java
index 1d5e196eb..0e081f003 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AtomicDirectoryOperation.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AtomicDirectoryOperation.java
@@ -23,7 +23,7 @@ import org.apache.guacamole.GuacamoleException;
 
 /**
  * An operation that should be attempted atomically when passed to
- * {@link Directory#tryAtomically()}, if atomic operations are supported by
+ * {@link Directory#tryAtomically}, if atomic operations are supported by
  * the Directory.
  */
 public interface AtomicDirectoryOperation<ObjectType extends Identifiable>  {
@@ -36,12 +36,12 @@ public interface AtomicDirectoryOperation<ObjectType extends Identifiable>  {
      * provided directory outside this function, or of the directory invoking
      * this function are not guaranteed.
      *
-     * NOTE: If atomicity is required for this operation, a GuacamoleException
-     * may be thrown by this function before any changes are made, ensuring the
-     * operation will only ever be performed atomically.
+     * <p>NOTE: If atomicity is required for this operation, a 
+     * GuacamoleException may be thrown by this function before any changes are
+     * made, ensuring the operation will only ever be performed atomically.
      *
      * @param atomic
-     *     True if the provided directory is guaranteed to peform the operation
+     *     True if the provided directory is guaranteed to perform the operation
      *     atomically within the context of this function.
      *
      * @param directory
diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index e1bfbed48..1ed354698 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -19,15 +19,49 @@
 
 /* global _ */
 
+/**
+ * The allowed MIME type for CSV files.
+ * 
+ * @type String
+ */
+const CSV_MIME_TYPE = 'text/csv';
+
+/**
+ * The allowed MIME type for JSON files.
+ *
+ * @type String
+ */
+const JSON_MIME_TYPE = 'application/json';
+
+/**
+ * The allowed MIME types for YAML files.
+ * NOTE: There is no registered MIME type for YAML files. This may result in a
+ * wide variety of possible browser-supplied MIME types.
+ *
+ * @type String[]
+ */
+const YAML_MIME_TYPES = [
+    'text/x-yaml',
+    'text/yaml',
+    'text/yml',
+    'application/x-yaml',
+    'application/x-yml',
+    'application/yaml',
+    'application/yml'
+];
+
+/*
+ * All file types supported for connection import.
+ * 
+ * @type {String[]}
+ */
+const LEGAL_MIME_TYPES = [CSV_MIME_TYPE, JSON_MIME_TYPE, ...YAML_MIME_TYPES];
+
 /**
  * The controller for the connection import page.
  */
 angular.module('import').controller('importConnectionsController', ['$scope', '$injector',
         function importConnectionsController($scope, $injector) {
-
-    // The file types supported for connection import
-    const LEGAL_FILE_TYPES = ['csv', 'json', 'yaml'];
-
     // Required services
     const $document              = $injector.get('$document');
     const $location              = $injector.get('$location');
@@ -40,7 +74,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     const permissionService      = $injector.get('permissionService');
     const userService            = $injector.get('userService');
     const userGroupService       = $injector.get('userGroupService');
-    
+
     // Required types
     const DirectoryPatch      = $injector.get('DirectoryPatch');
     const Error               = $injector.get('Error');
@@ -48,7 +82,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     const PermissionSet       = $injector.get('PermissionSet');
     const User                = $injector.get('User');
     const UserGroup           = $injector.get('UserGroup');
-    
+
     /**
      * The result of parsing the current upload, if successful.
      *
@@ -118,7 +152,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         $scope.parseResult = null;
         $scope.patchFailure = null;
         $scope.fileName = null;
-        
+
     }
 
     // Indicate that data is currently being loaded / processed if the the file
@@ -191,7 +225,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
                     // If user group creation succeeds, resolve the returned promise
                     userGroupResponse => ({ userResponse, userGroupResponse}))
-            
+
                 // If the group creation request fails, clean up any created users
                 .catch(groupFailure => {
                     cleanUpUsers(userResponse);
@@ -201,7 +235,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
             });
 
         });
-        
+
     }
 
     /**
@@ -237,9 +271,9 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                         PermissionSet.ObjectPermissionType.READ];
                 return permissions;
             }, {}) });
-        
+
         // Now that we've created all the users, grant access to each
-        _.forEach(parseResult.users, (connectionIndices, identifier) => 
+        _.forEach(parseResult.users, (connectionIndices, identifier) =>
 
             // Grant the permissions - note the group flag is `false`
             userRequests[identifier] = permissionService.patchPermissions(
@@ -255,7 +289,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                 false));
 
         // Now that we've created all the groups, grant access to each
-        _.forEach(parseResult.groups, (connectionIndices, identifier) => 
+        _.forEach(parseResult.groups, (connectionIndices, identifier) =>
 
             // Grant the permissions - note the group flag is `true`
             groupRequests[identifier] = permissionService.patchPermissions(
@@ -337,21 +371,21 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         // If errors were encounted during file parsing, abort further
         // processing - the user will have a chance to fix the errors and try
         // again
-        if (parseResult.hasErrors) 
+        if (parseResult.hasErrors)
             return;
 
         const dataSource = $routeParams.dataSource;
 
         // First, attempt to create the connections
         connectionService.patchConnections(dataSource, parseResult.patches)
-                .then(connectionResponse => 
+                .then(connectionResponse =>
 
             // If connection creation is successful, create users and groups
-            createUsersAndGroups(parseResult).then(() => 
+            createUsersAndGroups(parseResult).then(() =>
 
                 grantConnectionPermissions(parseResult, connectionResponse)
                         .then(() => {
-                            
+
                     $scope.processing = false;
 
                     // Display a success message if everything worked
@@ -359,7 +393,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                         className  : 'success',
                         title      : 'IMPORT.DIALOG_HEADER_SUCCESS',
                         text       : {
-                            key: 'IMPORT.CONNECTIONS_IMPORTED_SUCCESS',
+                            key: 'IMPORT.INFO_CONNECTIONS_IMPORTED_SUCCESS',
                             variables: { NUMBER: parseResult.patches.length }
                         },
 
@@ -388,7 +422,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                 handleError(error);
             }))
 
-        // If an error occured when the call to create the connections was made,
+        // If an error occurred when the call to create the connections was made,
         // skip any further processing - the user will have a chance to fix the
         // problems and try again
         .catch(patchFailure => {
@@ -396,7 +430,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
             $scope.patchFailure = patchFailure;
         });
     }
-    
+
     /**
      * Display the provided error to the user in a dismissable dialog.
      *
@@ -410,7 +444,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         resetUploadState();
 
         let text;
-        
+
         // If it's a import file parsing error
         if (error instanceof ParseError)
             text = {
@@ -438,18 +472,18 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                 name      : 'IMPORT.ACTION_ACKNOWLEDGE',
                 callback  : () => guacNotification.showStatus(false)
             }]
-        })
+        });
 
     };
 
     /**
      * Process the uploaded import file, importing the connections, granting
-     * connection permissions, or displaying errors to the user if there are 
+     * connection permissions, or displaying errors to the user if there are
      * problems with the provided file.
      *
      * @param {String} mimeType
      *     The MIME type of the uploaded data file.
-     * 
+     *
      * @param {String} data
      *     The raw string contents of the import file.
      */
@@ -457,19 +491,19 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
         // Data processing has begun
         $scope.processing = true;
-        
+
         // The function that will process all the raw data and return a list of
         // patches to be submitted to the API
         let processDataCallback;
 
         // Choose the appropriate parse function based on the mimetype
-        if (mimeType.endsWith("json"))
+        if (mimeType === JSON_MIME_TYPE)
             processDataCallback = connectionParseService.parseJSON;
 
-        else if (mimeType.endsWith("csv"))
+        else if (mimeType === CSV_MIME_TYPE)
             processDataCallback = connectionParseService.parseCSV;
 
-        else if (mimeType.endsWith("yaml"))
+        else if (YAML_MIME_TYPES.indexOf(mimeType) >= 0)
             processDataCallback = connectionParseService.parseYAML;
 
         // The file type was validated before being uploaded - this should
@@ -498,12 +532,14 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     $scope.import = () => processData($scope.mimeType, $scope.fileData);
 
     /**
+     * Returns true if import should be disabled, or false if import should be
+     * allowed.
+     *
      * @return {Boolean}
-     *     True if import should be disabled, or false if import should be
-     *     allowed.
+     *     True if import should be disabled, otherwise false.
      */
     $scope.importDisabled = () =>
-        
+
         // Disable import if no data is ready
         !$scope.dataReady ||
 
@@ -524,7 +560,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         }
 
         // Clear any upload state - there's no FileReader handler to do it
-        else 
+        else
             resetUploadState();
 
     };
@@ -560,19 +596,19 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         // The MIME type of the provided file
         const mimeType = file.type;
 
-        // Check if the mimetype ends with one of the supported types,
+        // Check if the mimetype is one of the supported types,
         // e.g. "application/json" or "text/csv"
-        if (_.every(LEGAL_FILE_TYPES.map(
-                type => !mimeType.endsWith(type)))) {
+        if (LEGAL_MIME_TYPES.indexOf(mimeType) < 0) {
 
             // If the provided file is not one of the supported types,
             // display an error and abort processing
             handleError(new ParseError({
                 message: "Invalid file type: " + mimeType,
-                key: 'IMPORT.ERROR_INVALID_FILE_TYPE',
+                key: 'IMPORT.ERROR_INVALID_MIME_TYPE',
                 variables: { TYPE: mimeType }
             }));
             return;
+            
         }
 
         $scope.fileName = file.name;
@@ -592,17 +628,17 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
             // If the upload was explicitly aborted, clear any upload state and
             // do not process the data
-            if ($scope.aborted) 
+            if ($scope.aborted)
                 resetUploadState();
 
             else {
-                
+
                 // Save the uploaded data
                 $scope.fileData = e.target.result;
 
                 // Mark the data as ready
                 $scope.dataReady = true;
-                
+
                 // Clear the file reader from the scope now that this file is
                 // fully uploaded
                 $scope.fileReader = null;
@@ -610,10 +646,10 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
             }
         });
 
-        // Read all the data into memory 
+        // Read all the data into memory
         $scope.fileReader.readAsBinaryString(file);
     };
-   
+
     /**
      * Whether a drag/drop operation is currently in progress (the user has
      * dragged a file over the Guacamole connection but has not yet
diff --git a/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js b/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
index dcf42695a..65b4403fe 100644
--- a/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
+++ b/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
@@ -20,7 +20,7 @@
 /* global _ */
 
 /**
- * A directive that displays errors that occured during parsing of a connection
+ * A directive that displays errors that occurred during parsing of a connection
  * import file, or errors that were returned from the API during the connection
  * batch creation attempt.
  */
@@ -124,7 +124,7 @@ angular.module('import').directive('connectionImportErrors', [
          *     given parse result.
          */
         const generateConnectionError = (parseResult, index) => {
-            
+
             // Get the patch associated with the current row
             const patch = parseResult.patches[index];
 
@@ -140,18 +140,6 @@ angular.module('import').directive('connectionImportErrors', [
                 name: connection.name,
                 protocol: connection.protocol,
 
-                // The group and parent identifiers, if any are set. Include
-                // both since these could be a potential source of conflict.
-                // TODO: Should we _really_ have both of these here?
-                group: connection.group,
-                parentIdentifier: connection.parentIdentifier,
-
-                // Get the list of user and group identifiers from the parse
-                // result. There should one entry in each of these lists for
-                // each patch.
-                users: parseResult.users[index],
-                groups: parseResult.groups[index],
-
                 // The human-readable error messages
                 errors: new DisplayErrorList(
                         [ ...(parseResult.errors[index] || []) ])
@@ -159,7 +147,7 @@ angular.module('import').directive('connectionImportErrors', [
         };
 
         // If a new connection patch failure is seen, update the display list
-        $scope.$watch('patchFailure', async function patchFailureChanged(patchFailure) {
+        $scope.$watch('patchFailure', function patchFailureChanged(patchFailure) {
 
             const { parseResult } = $scope;
 
@@ -176,8 +164,6 @@ angular.module('import').directive('connectionImportErrors', [
                 const connectionError = generateConnectionError(parseResult, index);
 
                 // Set the error from the PATCH request, if there is one
-                // TODO: These generally aren't translated from the backend -
-                // should we even bother trying to translate them?
                 const error = _.get(patchFailure, ['patches', index, 'error']);
                 if (error)
                     connectionError.errors = new DisplayErrorList([error]);
@@ -187,7 +173,7 @@ angular.module('import').directive('connectionImportErrors', [
         });
 
         // If a new parse result with errors is seen, update the display list
-        $scope.$watch('parseResult', async function parseResultChanged(parseResult) {
+        $scope.$watch('parseResult', function parseResultChanged(parseResult) {
 
             // Do not process if there are no errors in the provided result
             if (!parseResult || !parseResult.hasErrors)
@@ -226,11 +212,11 @@ angular.module('import').directive('connectionImportErrors', [
                             .then(translatedError => {
                                 connectionError.errors.getArray()[errorIndex] = translatedError;
                             }));
-                    
+
                 });
-                
+
                 return connectionError;
-                
+
             });
 
             // Once all the translations have been completed, update the
@@ -245,4 +231,4 @@ angular.module('import').directive('connectionImportErrors', [
 
     return directive;
 
-}]);
\ No newline at end of file
+}]);
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
index 389749555..9ab6a46d0 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
@@ -30,72 +30,75 @@ const ATTRIBUTE_SUFFIX = ' (attribute)';
  */
 angular.module('import').factory('connectionCSVService',
         ['$injector', function connectionCSVService($injector) {
-                
+
     // Required types
     const ParseError          = $injector.get('ParseError');
-    const ImportConnection     = $injector.get('ImportConnection');
+    const ImportConnection    = $injector.get('ImportConnection');
     const TranslatableMessage = $injector.get('TranslatableMessage');
-    
+
     // Required services
     const $q            = $injector.get('$q');
     const $routeParams  = $injector.get('$routeParams');
     const schemaService = $injector.get('schemaService');
-    
+
     const service = {};
-    
+
     /**
      * Returns a promise that resolves to a object detailing the connection
      * attributes for the current data source, as well as the connection
      * paremeters for every protocol, for the current data source.
-     * 
+     *
      * The object that the promise will contain an "attributes" key that maps to
      * a set of attribute names, and a "protocolParameters" key that maps to an
      * object mapping protocol names to sets of parameter names for that protocol.
-     * 
+     *
      * The intended use case for this object is to determine if there is a
      * connection parameter or attribute with a given name, by e.g. checking the
      * path `.protocolParameters[protocolName]` to see if a protocol exists,
      * checking the path `.protocolParameters[protocolName][fieldName]` to see
      * if a parameter exists for a given protocol, or checking the path
      * `.attributes[fieldName]` to check if a connection attribute exists.
-     * 
+     *
      * @returns {Promise.<Object>}
+     *     A promise that resolves to a object detailing the connection
+     *     attributes and parameters for every protocol, for the current data
+     *     source.
      */
     function getFieldLookups() {
-        
+
         // The current data source - the one that the connections will be
         // imported into
         const dataSource = $routeParams.dataSource;
-        
+
         // Fetch connection attributes and protocols for the current data source
         return $q.all({
             attributes : schemaService.getConnectionAttributes(dataSource),
             protocols  : schemaService.getProtocols(dataSource)
         })
         .then(function connectionStructureRetrieved({attributes, protocols}) {
-            
+
             return {
-                
+
                 // Translate the forms and fields into a flat map of attribute
                 // name to `true` boolean value
                 attributes: attributes.reduce(
                     (attributeMap, form) => {
                         form.fields.forEach(
-                            field => attributeMap[field.name] = true); 
+                            field => attributeMap[field.name] = true);
                         return attributeMap
                     }, {}),
-                  
+
                 // Translate the protocol definitions into a map of protocol
                 // name to map of field name to `true` boolean value
                 protocolParameters: _.mapValues(
                     protocols, protocol => protocol.connectionForms.reduce(
                         (protocolFieldMap, form) => {
                             form.fields.forEach(
-                                field => protocolFieldMap[field.name] = true); 
+                                field => protocolFieldMap[field.name] = true);
                             return protocolFieldMap;
                         }, {}))
             };
-        }); 
+        });
     }
 
     /**
@@ -104,7 +107,7 @@ angular.module('import').factory('connectionCSVService',
      * escaped with backslashes, and backslashes can also be escaped using other
      * backslashes.
      *
-     * @param {type} rawIdentifiers
+     * @param {String} rawIdentifiers
      *     The raw string value as fetched from the CSV.
      *
      * @returns {Array.<String>}
@@ -151,18 +154,18 @@ angular.module('import').factory('connectionCSVService',
         .filter(identifier => identifier.length);
 
     }
-    
+
     /**
      * Given a CSV header row, create and return a promise that will resolve to
      * a function that can take a CSV data row and return a ImportConnection
-     * object. If an error occurs while parsing a particular row, the resolved 
+     * object. If an error occurs while parsing a particular row, the resolved
      * function will throw a ParseError describing the failure.
-     * 
+     *
      * The provided CSV must contain columns for name and protocol. Optionally,
      * the parentIdentifier of the target parent connection group, or a connection
-     * name path e.g. "ROOT/parent/child" may be included. Additionallty, 
+     * name path e.g. "ROOT/parent/child" may be included. Additionallty,
      * connection parameters or attributes can be included.
-     * 
+     *
      * The names of connection attributes and parameters are not guaranteed to
      * be mutually exclusive, so the CSV import format supports a distinguishing
      * suffix. A column may be explicitly declared to be a parameter using a
@@ -173,39 +176,33 @@ angular.module('import').factory('connectionCSVService',
      * If a parameter or attribute name conflicts with the standard
      * "name", "protocol", "group", or "parentIdentifier" fields, the suffix is
      * required.
-     * 
-     * This returned object will be very similar to the Connection type, with
-     * the exception that a human-readable "group" field may be present, in
-     * addition to "user" and "userGroup" fields containing arrays of user and
-     * user group identifiers for whom read access should be granted to this
-     * connection.
-     * 
+     *
      * If a failure occurs while attempting to create the transformer function,
      * the promise will be rejected with a ParseError describing the failure.
-     * 
-     * @returns {Promise.<Function.<String[], Object>>}
+     *
+     * @returns {Promise.<Function.<String[], ImportConnection>>}
      *     A promise that will resolve to a function that translates a CSV data
      *     row (array of strings) to a ImportConnection object.
      */
     service.getCSVTransformer = function getCSVTransformer(headerRow) {
-        
+
         // A promise that will be resolved with the transformer or rejected if
         // an error occurs
         const deferred = $q.defer();
-        
+
         getFieldLookups().then(({attributes, protocolParameters}) => {
-            
+
             // All configuration required to generate a function that can
             // transform a row of CSV into a connection object.
             // NOTE: This is a single object instead of a collection of variables
             // to ensure that no stale references are used - e.g. when one getter
             // invokes another getter
             const transformConfig = {
-                
+
                 // Callbacks for required fields
                 nameGetter: undefined,
                 protocolGetter: undefined,
-                
+
                 // Callbacks for a parent group ID or group path
                 groupGetter: undefined,
                 parentIdentifierGetter: undefined,
@@ -214,25 +211,25 @@ angular.module('import').factory('connectionCSVService',
                 usersGetter: () => [],
                 userGroupsGetter: () => [],
 
-                // Callbacks that will generate either connection attributes or 
+                // Callbacks that will generate either connection attributes or
                 // parameters. These callbacks will return a {type, name, value}
                 // object containing the type ("parameter" or "attribute"),
                 // the name of the attribute or parameter, and the corresponding
                 // value.
                 parameterOrAttributeGetters: []
-                
+
             };
-            
+
             // A set of all headers that have been seen so far. If any of these
             // are duplicated, the CSV is invalid.
             const headerSet = {};
-            
+
             // Iterate through the headers one by one
             headerRow.forEach((rawHeader, index) => {
-                
+
                 // Trim to normalize all headers
                 const header = rawHeader.trim();
-                
+
                 // Check if the header is duplicated
                 if (headerSet[header]) {
                     deferred.reject(new ParseError({
@@ -244,34 +241,33 @@ angular.module('import').factory('connectionCSVService',
                     }));
                     return;
                 }
-                
+
                 // Mark that this particular header has already been seen
                 headerSet[header] = true;
-                
+
                 // A callback that returns the field at the current index
                 const fetchFieldAtIndex = row => row[index];
 
-                // A callback that splits identifier lists by semicolon
-                // characters into a javascript list of identifiers
-                const identifierListCallback = row => 
+                // A callback that splits raw string identifier lists by
+                // semicolon characters into an array of identifiers
+                const identifierListCallback = row =>
                     splitIdentifiers(fetchFieldAtIndex(row));
-                
+
                 // Set up the name callback
                 if (header == 'name')
                     transformConfig.nameGetter = fetchFieldAtIndex;
-                
+
                 // Set up the protocol callback
-                else if (header == 'protocol') 
+                else if (header == 'protocol')
                     transformConfig.protocolGetter = fetchFieldAtIndex;
-                
+
                 // Set up the group callback
                 else if (header == 'group')
                     transformConfig.groupGetter = fetchFieldAtIndex;
-                
+
                 // Set up the group parent ID callback
                 else if (header == 'parentIdentifier')
-                    transformConfig.parentIdentifierGetter = (
-                        identifierListCallback);
+                    transformConfig.parentIdentifierGetter = fetchFieldAtIndex;
 
                 // Set the user identifiers callback
                 else if (header == 'users')
@@ -283,7 +279,7 @@ angular.module('import').factory('connectionCSVService',
                     transformConfig.userGroupsGetter = (
                         identifierListCallback);
 
-                // At this point, any other header might refer to a connection 
+                // At this point, any other header might refer to a connection
                 // parameter or to an attribute
 
                 // A field may be explicitly specified as a parameter
@@ -293,7 +289,7 @@ angular.module('import').factory('connectionCSVService',
                     const parameterName = header.replace(PARAMETER_SUFFIX);
                     transformConfig.parameterOrAttributeGetters.push(
                         row => ({
-                            type: 'parameter',
+                            type: 'parameters',
                             name: parameterName,
                             value: fetchFieldAtIndex(row)
                         })
@@ -307,35 +303,35 @@ angular.module('import').factory('connectionCSVService',
                     const attributeName = header.replace(ATTRIBUTE_SUFFIX);
                     transformConfig.parameterOrAttributeGetters.push(
                         row => ({
-                            type: 'attribute',
+                            type: 'attributes',
                             name: parameterName,
                             value: fetchFieldAtIndex(row)
                         })
                     );
                 }
-                
+
                 // The field is ambiguous, either an attribute or parameter,
                 // so the getter will have to determine this for every row
-                else 
+                else
                     transformConfig.parameterOrAttributeGetters.push(row => {
-                        
+
                         // The name is just the value of the current header
                         const name = header;
-                        
+
                         // The value is at the index that matches the position
                         // of the header
                         const value = fetchFieldAtIndex(row);
-                           
+
                         // The protocol may determine whether a field is
                         // a parameter or an attribute (or both)
                         const protocol = transformConfig.protocolGetter(row);
-                        
+
                         // Determine if the field refers to an attribute or a
                         // parameter (or both, which is an error)
                         const isAttribute = !!attributes[name];
                         const isParameter = !!_.get(
                                 protocolParameters, [protocol, name]);
-                        
+
                         // If there is both an attribute and a protocol-specific
                         // parameter with the provided name, it's impossible to
                         // figure out which this should be
@@ -345,7 +341,7 @@ angular.module('import').factory('connectionCSVService',
                                 key: 'IMPORT.ERROR_AMBIGUOUS_CSV_HEADER',
                                 variables: { HEADER: header }
                             });
-                        
+
                         // It's neither an attribute or a parameter
                         else if (!isAttribute && !isParameter)
                             throw new ParseError({
@@ -353,10 +349,10 @@ angular.module('import').factory('connectionCSVService',
                                 key: 'IMPORT.ERROR_INVALID_CSV_HEADER',
                                 variables: { HEADER: header }
                             });
-                        
+
                         // Choose the appropriate type
                         const type = isAttribute ? 'attributes' : 'parameters';
-                      
+
                         return { type, name, value };
                     });
             });
@@ -367,14 +363,14 @@ angular.module('import').factory('connectionCSVService',
                 usersGetter, userGroupsGetter,
                 parameterOrAttributeGetters
             } = transformConfig;
-            
+
             // Fail if the name wasn't provided
-            if (!nameGetter) 
+            if (!nameGetter)
                 return deferred.reject(new ParseError({
                     message: 'The connection name must be provided',
                     key: 'IMPORT.ERROR_REQUIRED_NAME'
                 }));
-            
+
             // Fail if the protocol wasn't provided
             if (!protocolGetter)
                 return deferred.reject(new ParseError({
@@ -382,16 +378,9 @@ angular.module('import').factory('connectionCSVService',
                     key: 'IMPORT.ERROR_REQUIRED_PROTOCOL'
                 }));
 
-            // If both are specified, the parent group is ambigious
-            if (parentIdentifierGetter && groupGetter)
-                throw new ParseError({
-                    message: 'Only one of group or parentIdentifier can be set',
-                    key: 'IMPORT.ERROR_AMBIGUOUS_PARENT_GROUP'
-                });
-            
             // The function to transform a CSV row into a connection object
             deferred.resolve(function transformCSVRow(row) {
-                
+
                 // Get name and protocol
                 const name = nameGetter(row);
                 const protocol = protocolGetter(row);
@@ -399,47 +388,45 @@ angular.module('import').factory('connectionCSVService',
                 // Get any users or user groups who should be granted access
                 const users = usersGetter(row);
                 const groups = userGroupsGetter(row);
-                
+
                 // Get the parent group ID and/or group path
                 const group = groupGetter && groupGetter(row);
                 const parentIdentifier = (
                         parentIdentifierGetter && parentIdentifierGetter(row));
-               
+
                 return new ImportConnection({
-                    
+
                     // Fields that are not protocol-specific
-                    ...{
-                        name,
-                        protocol,
-                        parentIdentifier,
-                        group,
-                        users,
-                        groups
-                    },
-                    
+                    name,
+                    protocol,
+                    parentIdentifier,
+                    group,
+                    users,
+                    groups,
+
                     // Fields that might potentially be either attributes or
                     // parameters, depending on the protocol
                     ...parameterOrAttributeGetters.reduce((values, getter) => {
-                        
+
                         // Determine the type, name, and value
                         const { type, name, value } = getter(row);
-                        
+
                         // Set the value and continue on to the next attribute
                         // or parameter
                         values[type][name] = value;
                         return values;
-                        
+
                     }, {parameters: {}, attributes: {}})
-                   
+
                 });
-                
+
             });
-            
+
         });
-        
+
         return deferred.promise;
     };
-    
+
     return service;
-    
-}]);
\ No newline at end of file
+
+}]);
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index dd9f49593..ad90145d5 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -35,7 +35,7 @@ angular.module('import').factory('connectionParseService',
     const ParseError          = $injector.get('ParseError');
     const ParseResult         = $injector.get('ParseResult');
     const TranslatableMessage = $injector.get('TranslatableMessage');
-    
+
     // Required services
     const $q                     = $injector.get('$q');
     const $routeParams           = $injector.get('$routeParams');
@@ -44,18 +44,18 @@ angular.module('import').factory('connectionParseService',
     const connectionGroupService = $injector.get('connectionGroupService');
 
     const service = {};
-    
+
     /**
      * Perform basic checks, common to all file types - namely that the parsed
-     * data is an array, and contains at least one connection entry. Returns an 
+     * data is an array, and contains at least one connection entry. Returns an
      * error if any of these basic checks fails.
-     * 
-     * returns {ParseError}
+     *
+     * @returns {ParseError}
      *     An error describing the parsing failure, if one of the basic checks
      *     fails.
      */
     function performBasicChecks(parsedData) {
-        
+
         // Make sure that the file data parses to an array (connection list)
         if (!(parsedData instanceof Array))
             return new ParseError({
@@ -71,64 +71,67 @@ angular.module('import').factory('connectionParseService',
                 key: 'IMPORT.ERROR_EMPTY_FILE'
             });
     }
-    
-    
+
+
     /**
      * Returns a promise that resolves to an object mapping potential groups
      * that might be encountered in an imported connection to group identifiers.
-     * 
+     *
      * The idea is that a user-provided import file might directly specify a
      * parentIdentifier, or it might specify a named group path like "ROOT",
-     * "ROOT/parent", or "ROOT/parent/child". This object resolved by the 
-     * promise returned from this function will map all of the above to the 
+     * "ROOT/parent", or "ROOT/parent/child". This object resolved by the
+     * promise returned from this function will map all of the above to the
      * identifier of the appropriate group, if defined.
-     * 
+     *
      * @returns {Promise.<Object>}
+     *     A promise that resolves to an object mapping groups to group
+     *     identifiers.
      */
     function getGroupLookups() {
-        
+
         // The current data source - defines all the groups that the connections
         // might be imported into
         const dataSource = $routeParams.dataSource;
-        
+
         const deferredGroupLookups = $q.defer();
-        
+
         connectionGroupService.getConnectionGroupTree(dataSource).then(
                 rootGroup => {
-            
+
             const groupLookup = {};
-            
+
             // Add the specified group to the lookup, appending all specified
             // prefixes, and then recursively call saveLookups for all children
             // of the group, appending to the prefix for each level
-            function saveLookups(prefix, group) {
-                
+            const saveLookups = (prefix, group) => {
+
                 // To get the path for the current group, add the name
                 const currentPath = prefix + group.name;
-                
+
                 // Add the current path to the lookup
                 groupLookup[currentPath] = group.identifier;
-                
+
                 // Add each child group to the lookup
                 const nextPrefix = currentPath + "/";
                 _.forEach(group.childConnectionGroups,
                         childGroup => saveLookups(nextPrefix, childGroup));
+
             }
-            
+
             // Start at the root group
             saveLookups("", rootGroup);
-            
+
             // Resolve with the now fully-populated lookups
             deferredGroupLookups.resolve(groupLookup);
-            
+
         });
-        
+
         return deferredGroupLookups.promise;
     }
 
     /**
      * Returns a promise that will resolve to a transformer function that will
-     * take an object that may contain a "group" field, replacing it if present 
+     * take an object that may contain a "group" field, replacing it if present
      * with a "parentIdentifier". If both a "group" and "parentIdentifier" field
      * are present on the provided object, or if no group exists at the specified
      * path, the function will throw a ParseError describing the failure.
@@ -189,7 +192,7 @@ angular.module('import').factory('connectionParseService',
      *     parsing all provided connection data.
      */
     function parseConnectionData(connectionData, transformFunctions) {
-        
+
         // Check that the provided connection data array is not empty
         const checkError = performBasicChecks(connectionData);
         if (checkError) {
@@ -198,6 +201,7 @@ angular.module('import').factory('connectionParseService',
             return deferred.promise;
         }
 
+        // Get the group transformer to apply to each connection
         return getGroupTransformer().then(groupTransformer =>
                 connectionData.reduce((parseResult, data, index) => {
 
@@ -261,7 +265,7 @@ angular.module('import').factory('connectionParseService',
                 value: connection
             }));
 
-            // If there are any errors for this connection fail the whole batch 
+            // If there are any errors for this connection, fail the whole batch
             if (connectionErrors.length)
                 parseResult.hasErrors = true;
 
@@ -284,14 +288,14 @@ angular.module('import').factory('connectionParseService',
      *     parsing all provided connection data.
      */
     service.parseCSV = function parseCSV(csvData) {
-        
+
         // Convert to an array of arrays, one per CSV row (including the header)
         // NOTE: skip_empty_lines is required, or a trailing newline will error
         let parsedData;
         try {
             parsedData = parseCSVData(csvData, {skip_empty_lines: true});
-        } 
-        
+        }
+
         // If the CSV parser throws an error, reject with that error. No
         // translation key will be available here.
         catch(error) {
@@ -346,7 +350,7 @@ angular.module('import').factory('connectionParseService',
             deferred.reject(new ParseError({ message: error.message }));
             return deferred.promise;
         }
-        
+
         // Produce a ParseResult
         return parseConnectionData(connectionData);
     };
diff --git a/guacamole/src/main/frontend/src/app/import/styles/help.css b/guacamole/src/main/frontend/src/app/import/styles/help.css
index a73b43afa..9cbdb5b18 100644
--- a/guacamole/src/main/frontend/src/app/import/styles/help.css
+++ b/guacamole/src/main/frontend/src/app/import/styles/help.css
@@ -55,5 +55,5 @@
     padding-top: 1em;
     width: fit-content;
     margin-left: 1em;
-    
-}
\ No newline at end of file
+
+}
diff --git a/guacamole/src/main/frontend/src/app/import/styles/import.css b/guacamole/src/main/frontend/src/app/import/styles/import.css
index 656571c63..15d08d6d7 100644
--- a/guacamole/src/main/frontend/src/app/import/styles/import.css
+++ b/guacamole/src/main/frontend/src/app/import/styles/import.css
@@ -27,15 +27,21 @@
 }
 
 .import .errors table {
+
     width: 100%;
+
 }
 
 .import .errors .error-message {
+
     color: red;
+
 }
 
 .import .errors .error-message ul {
+
     margin: 0px;
+
 }
 
 .file-upload-container {
@@ -56,13 +62,17 @@
 }
 
 .file-upload-container.file-selected {
+
     display: flex;
     flex-direction: row;
     gap: 100px;
+
 }
 
 .file-upload-container .clear {
+
     margin: 0;
+
 }
 
 .file-upload-container .upload-header {
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html b/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
index eee23c260..f521d1996 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
@@ -5,7 +5,7 @@
                  placeholder="'IMPORT.FIELD_PLACEHOLDER_FILTER' | translate"
                  properties="filteredErrorProperties"></guac-filter>
 
-    <!-- List of current u -->
+    <!-- List of connection import errors -->
     <table class="sorted">
         <thead>
             <tr>
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index bab6485c7..ae937a200 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -1,34 +1,34 @@
-<div class="settings-view import">
+<div class="settings-view view import">
 
     <div class="header">
-        <h2>{{'IMPORT.HEADER' | translate}}</h2>
+        <h2>{{'IMPORT.SECTION_HEADER_CONNECTION_IMPORT' | translate}}</h2>
         <guac-user-menu></guac-user-menu>
     </div>
 
     <div ng-show="fileName" class="file-upload-container file-selected">
         <div class="file-name"> {{fileName}} </div>
         <button class="danger clear" ng-click="cancel()">
-            {{'IMPORT.BUTTON_CLEAR' | translate}}
+            {{'IMPORT.ACTION_CLEAR' | translate}}
         </button>
     </div>
-    
+
     <div ng-show="!fileName" class="file-upload-container">
 
         <div class="upload-header">
-            <span class="file-options">{{'IMPORT.UPLOAD_FILE_TYPES' | translate}}</span>
+            <span class="file-options">{{'IMPORT.HELP_UPLOAD_FILE_TYPES' | translate}}</span>
             <a
                 href="#/import/connection/file-format-help" target="_blank"
-                class="file-help-link">{{'IMPORT.UPLOAD_HELP_LINK' | translate}}
+                class="file-help-link">{{'IMPORT.ACTION_VIEW_FORMAT_HELP' | translate}}
             </a>
         </div>
 
         <div class="drop-target" ng-class="{ 'drop-pending': dropPending, 'file-present': fileName}">
 
-            <div class="title">{{'IMPORT.UPLOAD_DROP_TITLE' | translate}}</div>
+            <div class="title">{{'IMPORT.HELP_UPLOAD_DROP_TITLE' | translate}}</div>
 
             <input type="file" class="file-upload-input"/>
             <a ng-click="openFileBrowser()" class="browse-link">
-                {{'IMPORT.UPLOAD_BROWSE_LINK' | translate}}
+                {{'IMPORT.ACTION_BROWSE' | translate}}
             </a>
 
             <div class="file-name"> {{fileName}} </div>
@@ -38,13 +38,13 @@
     </div>
 
     <div class="import-buttons">
-        <button 
-            ng-click="import()" ng-disabled="importDisabled()" class="import">
-                {{'IMPORT.BUTTON_IMPORT' | translate}}
+        <button
+            ng-click="import()" ng-disabled="importDisabled()" class="save import">
+                {{'IMPORT.ACTION_IMPORT' | translate}}
         </button>
         <button
             ng-click="cancel()" ng-disabled="cancelDisabled()" class="cancel">
-                {{'IMPORT.BUTTON_CANCEL' | translate}}
+                {{'IMPORT.ACTION_CANCEL' | translate}}
         </button>
     </div>
 
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html
index 8e88d235a..d3abda1db 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImportFileHelp.html
@@ -1,90 +1,26 @@
-<div class="import help">
+<div class="import view help">
 
     <div class="header">
-        <h2>{{'IMPORT.HELP_HEADER' | translate}}</h2>
+        <h2>{{'IMPORT.SECTION_HEADER_HELP_CONNECTION_IMPORT_FILE' | translate}}</h2>
         <guac-user-menu></guac-user-menu>
     </div>
 
     <h2>{{'IMPORT.HELP_FILE_TYPE_HEADER' | translate}}</h2>
     <p>{{'IMPORT.HELP_FILE_TYPE_DESCRIPTION' | translate}}</p>
 
-    <h2>{{'IMPORT.HELP_CSV_HEADER' | translate}}</h2>
+    <h2>{{'IMPORT.SECTION_HEADER_CSV' | translate}}</h2>
     <p>{{'IMPORT.HELP_CSV_DESCRIPTION' | translate}}</p>
     <p>{{'IMPORT.HELP_CSV_MORE_DETAILS' | translate}}</p>
-    <pre>name,protocol,hostname,group,users,groups,guacd-encryption (attribute)
-conn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none
-conn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl
-conn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,
-conn4,kubernetes,,,,,</pre>
+    <pre>{{'IMPORT.HELP_CSV_EXAMPLE' | translate }}</pre>
 
-    <h2>{{'IMPORT.HELP_JSON_HEADER' | translate}}</h2>
+    <h2>{{'IMPORT.SECTION_HEADER_JSON' | translate}}</h2>
     <p>{{'IMPORT.HELP_JSON_DESCRIPTION' | translate}}</p>
     <p>{{'IMPORT.HELP_JSON_MORE_DETAILS' | translate}}</p>
-    <pre>[
-  {
-    "name": "conn1",
-    "protocol": "vnc",
-    "parameters": { "hostname": "conn1.web.com" },
-    "parentIdentifier": "ROOT",
-    "users": [ "guac user 1", "guac user 2" ],
-    "groups": [ "Connection 1 Users" ],
-    "attributes": { "guacd-encryption": "none" }
-  },
-  {
-    "name": "conn2",
-    "protocol": "rdp",
-    "parameters": { "hostname": "conn2.web.com" },
-    "group": "ROOT/Parent Group",
-    "users": [ "guac user 1" ],
-    "attributes": { "guacd-encryption": "none" }
-  },
-  {
-    "name": "conn3",
-    "protocol": "ssh",
-    "parameters": { "hostname": "conn3.web.com" },
-    "group": "ROOT/Parent Group/Child Group",
-    "users": [ "guac user 2", "guac user 3" ]
-  },
-  {
-    "name": "conn4",
-    "protocol": "kubernetes"
-  }
-]</pre>
+    <pre>{{'IMPORT.HELP_JSON_EXAMPLE' | translate }}</pre>
 
-    <h2>{{'IMPORT.HELP_YAML_HEADER' | translate}}</h2>
+    <h2>{{'IMPORT.SECTION_HEADER_YAML' | translate}}</h2>
     <p>{{'IMPORT.HELP_YAML_DESCRIPTION' | translate}}</p>
-    <pre>---
-  - name: conn1
-    protocol: vnc
-    parameters:
-      hostname: conn1.web.com
-    group: ROOT
-    users:
-    - guac user 1
-    - guac user 2
-    groups:
-    - Connection 1 Users
-    attributes:
-      guacd-encryption: none
-  - name: conn2
-    protocol: rdp
-    parameters:
-      hostname: conn2.web.com
-    group: ROOT/Parent Group
-    users:
-    - guac user 1
-    attributes:
-      guacd-encryption: none
-  - name: conn3
-    protocol: ssh
-    parameters:
-      hostname: conn3.web.com
-    group: ROOT/Parent Group/Child Group
-    users:
-    - guac user 2
-    - guac user 3
-  - name: conn4
-    protocol: kubernetes</pre>
+    <pre>{{'IMPORT.HELP_YAML_EXAMPLE' | translate}}</pre>
 
     <ol class="footnotes">
         <li>{{'IMPORT.HELP_SEMICOLON_FOOTNOTE' | translate}}</li>
diff --git a/guacamole/src/main/frontend/src/app/import/types/DisplayErrorList.js b/guacamole/src/main/frontend/src/app/import/types/DisplayErrorList.js
index d775c5734..26ee65d82 100644
--- a/guacamole/src/main/frontend/src/app/import/types/DisplayErrorList.js
+++ b/guacamole/src/main/frontend/src/app/import/types/DisplayErrorList.js
@@ -33,25 +33,33 @@ angular.module('import').factory('DisplayErrorList', [
      */
     const DisplayErrorList = function DisplayErrorList(messages) {
 
-        // Use empty message list by default
+        /**
+         * The error messages that should be prepared for display.
+         *
+         * @type {String[]}
+         */
         this.messages = messages || [];
 
-        // The single String message composed of all messages concatenated
-        // together. This will be used for filtering / sorting, and should only
-        // be calculated once.
-        this.cachedMessage = null;
+        /**
+         * The single String message composed of all messages concatenated
+         * together. This will be used for filtering / sorting, and should only
+         * be calculated once, when toString() is called.
+         *
+         * @type {String}
+         */
+        this.concatenatedMessage = null;
 
     };
 
     /**
      * Return a sortable / filterable representation of all the error messages
-     * wrapped by this DisplayErrorList. 
-     * 
+     * wrapped by this DisplayErrorList.
+     *
      * NOTE: Once this method is called, any changes to the underlying array
      * will have no effect. This is to ensure that repeated calls to toString()
      * by sorting / filtering UI code will not regenerate the concatenated
      * message every time.
-     * 
+     *
      * @returns {String}
      *     A sortable / filterable representation of the error messages wrapped
      *     by this DisplayErrorList
@@ -80,4 +88,4 @@ angular.module('import').factory('DisplayErrorList', [
 
     return DisplayErrorList;
 
-}]);
\ No newline at end of file
+}]);
diff --git a/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js b/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
index 5639ba1c6..1c1f5b81d 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
@@ -71,9 +71,7 @@ angular.module('import').factory('ImportConnection', [
 
         /**
          * Connection configuration parameters, as dictated by the protocol in
-         * use, arranged as name/value pairs. This information may not be
-         * available until directly queried. If this information is
-         * unavailable, this property will be null or undefined.
+         * use, arranged as name/value pairs.
          *
          * @type Object.<String, String>
          */
diff --git a/guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js b/guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js
index 4d4fd3661..bd77f8c25 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js
@@ -27,13 +27,15 @@ angular.module('import').factory('ImportConnectionError', ['$injector',
     const DisplayErrorList = $injector.get('DisplayErrorList');
 
     /**
-     * A representation of a connection to be imported, as parsed from an
+     * A representation of the errors associated with a connection to be
+     * imported, along with some basic information connection information to
+     * identify the connection having the error, as returned from a parsed
      * user-supplied import file.
      *
      * @constructor
-     * @param {ImportConnection|Object} [template={}]
+     * @param {ImportConnectionError|Object} [template={}]
      *     The object whose properties should be copied within the new
-     *     Connection.
+     *     ImportConnectionError.
      */
     const ImportConnectionError = function ImportConnectionError(template) {
 
@@ -46,22 +48,6 @@ angular.module('import').factory('ImportConnectionError', ['$injector',
          */
         this.rowNumber = template.rowNumber;
 
-        /**
-         * The unique identifier of the connection group that contains this
-         * connection.
-         *
-         * @type String
-         */
-        this.parentIdentifier = template.parentIdentifier;
-
-        /**
-         * The path to the connection group that contains this connection,
-         * written as e.g. "ROOT/parent/child/group".
-         *
-         * @type String
-         */
-        this.group = template.group;
-
         /**
          * The human-readable name of this connection, which is not necessarily
          * unique.
@@ -78,22 +64,6 @@ angular.module('import').factory('ImportConnectionError', ['$injector',
          */
         this.protocol = template.protocol;
 
-        /**
-         * The identifiers of all users who should be granted read access to
-         * this connection.
-         *
-         * @type String[]
-         */
-        this.users = template.users || [];
-
-        /**
-         * The identifiers of all user groups who should be granted read access
-         * to this connection.
-         *
-         * @type String[]
-         */
-        this.groups = template.groups || [];
-
         /**
          * The error messages associated with this particular connection, if any.
          *
@@ -105,4 +75,4 @@ angular.module('import').factory('ImportConnectionError', ['$injector',
 
     return ImportConnectionError;
 
-}]);
\ No newline at end of file
+}]);
diff --git a/guacamole/src/main/frontend/src/app/import/types/ParseResult.js b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
index 1a5abd14d..6e28f20f3 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
@@ -26,7 +26,7 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
      * The result of parsing a connection import file - containing a list of
      * API patches ready to be submitted to the PATCH REST API for batch
      * connection creation, a set of users and user groups to grant access to
-     * each connection, and any errors that may have occured while parsing
+     * each connection, and any errors that may have occurred while parsing
      * each connection.
      *
      * @constructor
@@ -49,7 +49,7 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
 
         /**
          * An object whose keys are the user identifiers of users specified
-         * in the batch import. and the keys are an array of indices of
+         * in the batch import, and whose values are an array of indices of
          * connections to which those users should be granted access.
          *
          * @type {Object.<String, Integer[]>}
@@ -68,7 +68,7 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
         /**
          * An array of errors encountered while parsing the corresponding
          * connection (at the same array index). Each connection should have a
-         * an array of errors. If empty, no errors occured for this connection.
+         * an array of errors. If empty, no errors occurred for this connection.
          *
          * @type {ParseError[][]}
          */
@@ -85,5 +85,5 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
     };
 
     return ParseResult;
-    
+
 }]);
diff --git a/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js b/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
index 7caeee526..d24df9179 100644
--- a/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
+++ b/guacamole/src/main/frontend/src/app/index/config/indexRouteConfig.js
@@ -135,7 +135,7 @@ angular.module('index').config(['$routeProvider', '$locationProvider',
             resolve       : { updateCurrentToken: updateCurrentToken }
         })
 
-        // Connection import page
+        // Connection import file format help page
         .when('/import/connection/file-format-help', {
             title         : 'APP.NAME',
             bodyClassName : 'settings',
diff --git a/guacamole/src/main/frontend/src/app/rest/services/connectionService.js b/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
index c46874ea4..9d41db6da 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/connectionService.js
@@ -26,9 +26,6 @@ angular.module('rest').factory('connectionService', ['$injector',
     // Required services
     var authenticationService = $injector.get('authenticationService');
     var cacheService          = $injector.get('cacheService');
-
-    // Required types
-    const Error = $injector.get('Error');
     
     var service = {};
     
@@ -166,6 +163,10 @@ angular.module('rest').factory('connectionService', ['$injector',
      * connection patching process, the entire request will fail, and no 
      * changes will be persisted.
      *
+     * @param {String} dataSource
+     *     The identifier of the data source associated with the connections to
+     *     be patched.
+     *
      * @param {DirectoryPatch.<Connection>[]} patches 
      *     An array of patches to apply.
      *
@@ -194,7 +195,7 @@ angular.module('rest').factory('connectionService', ['$injector',
             
         });
 
-    }
+    };
     
     /**
      * Makes a request to the REST API to delete a connection,
diff --git a/guacamole/src/main/frontend/src/app/rest/services/userGroupService.js b/guacamole/src/main/frontend/src/app/rest/services/userGroupService.js
index 987f8383a..147621878 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/userGroupService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/userGroupService.js
@@ -199,6 +199,10 @@ angular.module('rest').factory('userGroupService', ['$injector',
      * connection patching process, the entire request will fail, and no
      * changes will be persisted.
      *
+     * @param {String} dataSource
+     *     The identifier of the data source associated with the user groups to
+     *     be patched.
+     *
      * @param {DirectoryPatch.<UserGroup>[]} patches
      *     An array of patches to apply.
      *
@@ -221,7 +225,7 @@ angular.module('rest').factory('userGroupService', ['$injector',
             return patchResponse;
         });
 
-    }
+    };
 
     return service;
 
diff --git a/guacamole/src/main/frontend/src/app/rest/services/userService.js b/guacamole/src/main/frontend/src/app/rest/services/userService.js
index 252aead3a..c1d3c3572 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/userService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/userService.js
@@ -245,6 +245,10 @@ angular.module('rest').factory('userService', ['$injector',
      * connection patching process, the entire request will fail, and no
      * changes will be persisted.
      *
+     * @param {String} dataSource
+     *     The identifier of the data source associated with the users to be
+     *     patched.
+     *
      * @param {DirectoryPatch.<User>[]} patches
      *     An array of patches to apply.
      *
@@ -267,7 +271,7 @@ angular.module('rest').factory('userService', ['$injector',
             return patchResponse;
         });
 
-    }
+    };
     
     return service;
 
diff --git a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
index 05874d4fc..fb2a3c050 100644
--- a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
+++ b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
@@ -75,12 +75,12 @@ angular.module('rest').factory('DirectoryPatch', [function defineDirectoryPatch(
         /**
          * Adds the specified object to the relation.
          */
-        ADD : "add",
+        ADD : 'add',
 
         /**
          * Removes the specified object from the relation.
          */
-        REMOVE : "remove"
+        REMOVE : 'remove'
 
     };
 
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
index 0718307a1..004faa31c 100644
--- a/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
@@ -11,7 +11,7 @@
 
             <a class="import-connections button"
                 ng-show="canCreateConnections()"
-                href="#/import/{{dataSource | escape}}/connection/">{{'SETTINGS_CONNECTIONS.ACTION_IMPORT_CONNECTIONS' | translate}}</a>
+                href="#/import/{{dataSource | escape}}/connection/">{{'SETTINGS_CONNECTIONS.ACTION_IMPORT' | translate}}</a>
 
             <a class="add-connection button"
                ng-show="canCreateConnections()"
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 4b7c89b23..0347def96 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -5,15 +5,17 @@
     "APP" : {
 
         "NAME"    : "Apache Guacamole",
-        "VERSION" : "1.5.0",
+        "VERSION" : "${project.version}",
 
         "ACTION_ACKNOWLEDGE"        : "OK",
         "ACTION_CANCEL"             : "Cancel",
+        "ACTION_CLEAR"              : "Clear",
         "ACTION_CLONE"              : "Clone",
         "ACTION_CONTINUE"           : "Continue",
         "ACTION_DELETE"             : "Delete",
         "ACTION_DELETE_SESSIONS"    : "Kill Sessions",
         "ACTION_DOWNLOAD"           : "Download",
+        "ACTION_IMPORT"             : "Import",
         "ACTION_LOGIN"              : "Login",
         "ACTION_LOGIN_AGAIN"        : "Re-login",
         "ACTION_LOGOUT"             : "Logout",
@@ -60,8 +62,8 @@
 
         "ACTION_ACKNOWLEDGE"               : "@:APP.ACTION_ACKNOWLEDGE",
         "ACTION_CANCEL"                    : "@:APP.ACTION_CANCEL",
-        "ACTION_CLEAR_CLIENT_MESSAGES"     : "Clear",
-        "ACTION_CLEAR_COMPLETED_TRANSFERS" : "Clear",
+        "ACTION_CLEAR_CLIENT_MESSAGES"     : "@:APP.ACTION_CLEAR",
+        "ACTION_CLEAR_COMPLETED_TRANSFERS" : "@:APP.ACTION_CLEAR",
         "ACTION_CONTINUE"                  : "@:APP.ACTION_CONTINUE",
         "ACTION_DISCONNECT"                : "Disconnect",
         "ACTION_LOGOUT"                    : "@:APP.ACTION_LOGOUT",
@@ -185,75 +187,60 @@
     },
 
     "IMPORT": {
-        
-        "ACTION_ACKNOWLEDGE"          : "@:APP.ACTION_ACKNOWLEDGE",
 
-        "BUTTON_CANCEL": "Cancel",
-        "BUTTON_IMPORT": "Import Connections",
+        "ACTION_ACKNOWLEDGE": "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_BROWSE": "Browse for File",
+        "ACTION_CANCEL": "@:APP.ACTION_CANCEL",
+        "ACTION_CLEAR": "@:APP.ACTION_CLEAR",
+        "ACTION_VIEW_FORMAT_HELP": "View Format Tips",
+        "ACTION_IMPORT": "@:APP.ACTION_IMPORT",
+        "ACTION_IMPORT_CONNECTIONS": "Import Connections",
 
-        "CONNECTIONS_IMPORTED_SUCCESS": "{NUMBER} connections imported successfully.",
-
-        "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
+        "DIALOG_HEADER_ERROR": "@:APP.DIALOG_HEADER_ERROR",
         "DIALOG_HEADER_SUCCESS": "Success",
 
-        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
-
-        "HEADER": "Connection Import",
-
-        "HELP_HEADER": "Connection Import File Format",
-
-        "HELP_FILE_TYPE_HEADER": "File Types",
-        "HELP_FILE_TYPE_DESCRIPTION" : "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created.",
-
-        "HELP_CSV_HEADER": "CSV Format",
-        "HELP_CSV_DESCRIPTION": "A connection import CSV file has one connection record per row. Each column will specify a connection field. At minimum the connection name and protocol must be specified.",
-        "HELP_CSV_MORE_DETAILS": "The CSV header for each row specifies the connection field. The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. In most cases, there should be no conflict between fields, but if needed, an \" (attribute)\" or \" (parameter)\" suffix may be added to disambiguate. Lists of user or user group identifiers must be semicolon-seperated.¹",
-
-        "HELP_JSON_HEADER": "JSON Format",
-        "HELP_JSON_DESCRIPTION": "A connection import JSON file is a list of connection objects. At minimum the connection name and protocol must be specified in each connection object.",
-        "HELP_JSON_MORE_DETAILS": "The connection group ID that the connection should be imported into may be directly specified with a \"parentIdentifier\" field, or the path to the parent group may be specified using a \"group\" field as shown below. An array of user and user group identifiers to grant access to may be specified per connection.",
-
-        "HELP_YAML_HEADER": "YAML Format",
-        "HELP_YAML_DESCRIPTION": "A connection import YAML file is a list of connection objects with exactly the same structure as the JSON format.",
-        
-        "HELP_SEMICOLON_FOOTNOTE": "If present, semicolons can be escaped with a backslash, e.g. \"first\\\\;last\"",
-
-        "ERROR_AMBIGUOUS_CSV_HEADER": 
-            "Ambiguous CSV Header \"{HEADER}\" could be either a connection attribute or parameter",
-        "ERROR_ARRAY_REQUIRED": 
-            "The provided file must contain a list of connections",
-        "ERROR_DUPLICATE_CSV_HEADER": 
-            "Duplicate CSV Header: {HEADER}",
+        "ERROR_AMBIGUOUS_CSV_HEADER": "Ambiguous CSV Header \"{HEADER}\" could be either a connection attribute or parameter",
+        "ERROR_AMBIGUOUS_PARENT_GROUP": "Both group and parentIdentifier may be not specified at the same time",
+        "ERROR_ARRAY_REQUIRED": "The provided file must contain a list of connections",
+        "ERROR_DUPLICATE_CSV_HEADER": "Duplicate CSV Header: {HEADER}",
         "ERROR_EMPTY_FILE": "The provided file is empty",
-        "ERROR_INVALID_CSV_HEADER": 
-            "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
-        "ERROR_INVALID_GROUP": "No group matching \"{GROUP}\" found",
-        "ERROR_INVALID_FILE_TYPE": 
-            "Unsupported file type: \"{TYPE}\"",
-        "ERROR_INVALID_USER_IDENTIFIERS":
-            "Users not found: {IDENTIFIER_LIST}",
-        "ERROR_INVALID_USER_GROUP_IDENTIFIERS":
-            "User Groups not found: {IDENTIFIER_LIST}",
-        "ERROR_NO_FILE_SUPPLIED": "Please select a file to import",
-        "ERROR_AMBIGUOUS_PARENT_GROUP":
-            "Both group and parentIdentifier may be not specified at the same time",
-        "ERROR_REQUIRED_PROTOCOL": 
-            "No connection protocol found in the provided file",
-        "ERROR_REQUIRED_NAME": 
-            "No connection name found in the provided file",
-
         "ERROR_FILE_SINGLE_ONLY": "Please upload only a single file at a time",
+        "ERROR_INVALID_CSV_HEADER": "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
+        "ERROR_INVALID_FILE_TYPE": "Unsupported file type: \"{TYPE}\"",
+        "ERROR_INVALID_GROUP": "No group matching \"{GROUP}\" found",
+        "ERROR_INVALID_USER_GROUP_IDENTIFIERS": "User Groups not found: {IDENTIFIER_LIST}",
+        "ERROR_INVALID_USER_IDENTIFIERS": "Users not found: {IDENTIFIER_LIST}",
+        "ERROR_NO_FILE_SUPPLIED": "Please select a file to import",
+        "ERROR_REQUIRED_NAME": "No connection name found in the provided file",
+        "ERROR_REQUIRED_PROTOCOL": "No connection protocol found in the provided file",
 
-        "TABLE_HEADER_NAME" : "Name",
-        "TABLE_HEADER_PROTOCOL" : "Protocol",
-        "TABLE_HEADER_ERRORS" : "Errors",
-        "TABLE_HEADER_ROW_NUMBER": "Row #",
+        "FIELD_PLACEHOLDER_FILTER": "@:APP.FIELD_PLACEHOLDER_FILTER",
 
-        "UPLOAD_FILE_TYPES": "CSV, JSON, or YAML",
-        "UPLOAD_HELP_LINK": "View Format Tips",
-        "UPLOAD_DROP_TITLE": "Drop a File Here",
-        "UPLOAD_BROWSE_LINK": "Browse for File"
+        "HELP_CSV_DESCRIPTION": "A connection import CSV file has one connection record per row. Each column will specify a connection field. At minimum the connection name and protocol must be specified.",
+        "HELP_CSV_EXAMPLE": "name,protocol,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,",
+        "HELP_CSV_MORE_DETAILS": "The CSV header for each row specifies the connection field. The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. In most cases, there should be no conflict between fields, but if needed, an \" (attribute)\" or \" (parameter)\" suffix may be added to disambiguate. Lists of user or user group identifiers must be semicolon-seperated.¹",
+        "HELP_FILE_TYPE_DESCRIPTION": "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created.",
+        "HELP_FILE_TYPE_HEADER": "File Types",
+        "HELP_JSON_DESCRIPTION": "A connection import JSON file is a list of connection objects. At minimum the connection name and protocol must be specified in each connection object.",
+        "HELP_JSON_EXAMPLE": "[\n  \\{\n    \"name\": \"conn1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"hostname\": \"conn1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac user 1\", \"guac user 2\" ],\n    \"groups\": [ \"Connection 1 Users\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"hostname\": \"conn2.web.com\" \\},\n    \"group\": \"ROOT/Parent Group\",\n    \"users\": [ \"guac user 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"hostname\": \"conn3.web.com\" \\},\n    \"group\": \"ROOT/Parent Group/Child Group\",\n    \"users\": [ \"guac user 2\", \"guac user 3\" ]\n  \\},\n  \\{\n    \"name\": \"conn4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
+        "HELP_JSON_MORE_DETAILS": "The connection group ID that the connection should be imported into may be directly specified with a \"parentIdentifier\" field, or the path to the parent group may be specified using a \"group\" field as shown below. An array of user and user group identifiers to grant access to may be specified per connection.",
+        "HELP_SEMICOLON_FOOTNOTE": "If present, semicolons can be escaped with a backslash, e.g. \"first\\\\;last\"",
+        "HELP_UPLOAD_DROP_TITLE": "Drop a File Here",
+        "HELP_UPLOAD_FILE_TYPES": "CSV, JSON, or YAML",
+        "HELP_YAML_DESCRIPTION": "A connection import YAML file is a list of connection objects with exactly the same structure as the JSON format.",
+        "HELP_YAML_EXAMPLE": "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n    - guac user 1\n    - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n    - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n    - guac user 2\n    - guac user 3\n  - name: conn4\n    protocol: kubernetes",
+        "INFO_CONNECTIONS_IMPORTED_SUCCESS": "{NUMBER} {NUMBER, plural, one{connection} other{connections}} imported successfully.",
         
+        "SECTION_HEADER_CONNECTION_IMPORT": "Connection Import",
+        "SECTION_HEADER_HELP_CONNECTION_IMPORT_FILE": "Connection Import File Format",
+        "SECTION_HEADER_CSV": "CSV Format",
+        "SECTION_HEADER_JSON": "JSON Format",
+        "SECTION_HEADER_YAML": "YAML Format",
+
+        "TABLE_HEADER_ERRORS": "Errors",
+        "TABLE_HEADER_NAME": "Name",
+        "TABLE_HEADER_PROTOCOL": "Protocol",
+        "TABLE_HEADER_ROW_NUMBER": "Row #"
     },
 
     "DATA_SOURCE_DEFAULT" : {
@@ -978,7 +965,7 @@
     "SETTINGS_CONNECTIONS" : {
 
         "ACTION_ACKNOWLEDGE"          : "@:APP.ACTION_ACKNOWLEDGE",
-        "ACTION_IMPORT_CONNECTIONS"   : "Import",
+        "ACTION_IMPORT"               : "@:APP.ACTION_IMPORT",
         "ACTION_NEW_CONNECTION"       : "New Connection",
         "ACTION_NEW_CONNECTION_GROUP" : "New Group",
         "ACTION_NEW_SHARING_PROFILE"  : "New Sharing Profile",
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java b/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java
index 63b55289b..b4ee59f59 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/APIError.java
@@ -22,7 +22,6 @@ package org.apache.guacamole.rest;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
-
 import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index 72ddf2ff5..0cfa8cb0f 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -441,7 +441,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
         // An outcome for each patch included in the request. This list
         // may include both success and failure responses, though the
-        // presense of any failure would indicated that the entire
+        // presence of any failure would indicated that the entire
         // request has failed and no changes have been made.
         List<APIPatchOutcome> patchOutcomes = new ArrayList<>();
 
@@ -457,8 +457,9 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                 // endpoint requires that operations be performed atomically.
                 if (!atomic)
                     throw new GuacamoleUnsupportedException(
-                            "Atomic operations are not supported. " +
-                            "The patch cannot be executed.");
+                            "The extension providing this directory does not " +
+                            "support Atomic Operations. The patch cannot be " +
+                            "executed.");
 
                 // Keep a list of all objects that have been successfully
                 // added or removed
@@ -482,7 +483,9 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                     if (!path.startsWith("/"))
                         throw new GuacamoleClientException("Patch paths must start with \"/\".");
 
-                    if(patch.getOp() == APIPatch.Operation.add) {
+                    APIPatch.Operation op = patch.getOp();
+
+                    if (op == APIPatch.Operation.add) {
 
                         // Filter/sanitize object contents
                         InternalType internal = filterAndTranslate(patch.getValue());
@@ -497,7 +500,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                             // Add a success outcome describing the object creation
                             APIPatchOutcome response = new APIPatchOutcome(
-                                    patch.getOp(), internal.getIdentifier(), path);
+                                    op, internal.getIdentifier(), path);
                             patchOutcomes.add(response);
                             creationSuccesses.add(response);
 
@@ -515,7 +518,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                              */
                             if (e instanceof GuacamoleException)
                                 patchOutcomes.add(new APIPatchError(
-                                        patch.getOp(), null, path,
+                                        op, null, path,
                                         ((GuacamoleException) e).getMessage()));
 
                             // If an unexpected failure occurs, fall through to the
@@ -527,7 +530,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                     }
 
                     // Append each identifier to the list, to be removed atomically
-                    else if (patch.getOp() == APIPatch.Operation.remove) {
+                    else if (op == APIPatch.Operation.remove) {
 
                         String identifier = path.substring(1);
 
@@ -541,7 +544,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                             // Add a success outcome describing the object removal
                             APIPatchOutcome response = new APIPatchOutcome(
-                                    patch.getOp(), identifier, path);
+                                    op, identifier, path);
                             patchOutcomes.add(response);
                             creationSuccesses.add(response);
                         }
@@ -557,7 +560,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                              */
                             if (e instanceof GuacamoleException)
                                 patchOutcomes.add(new APIPatchError(
-                                        patch.getOp(), identifier, path,
+                                        op, identifier, path,
                                         ((GuacamoleException) e).getMessage()));
 
                             // If an unexpected failure occurs, fall through to the
@@ -569,8 +572,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                     
                     else {
                         throw new GuacamoleUnsupportedException(
-                                "Unsupported patch operation \""
-                                + patch.getOp() + "\". "
+                                "Unsupported patch operation \"" + op + "\". "
                                 + "Only add and remove are supported.");
                     }
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchOutcome.java b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchOutcome.java
index 245664cbc..f40d53f74 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchOutcome.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchOutcome.java
@@ -31,7 +31,6 @@ import org.apache.guacamole.rest.jsonpatch.APIPatch.Operation;
  * the user who submitted the Patch request. Rather than including the full
  * contents of the value, only the identifier is included, allowing the user to
  * determine the identifier of any newly-created objects as part of the request.
- *
  */
 public class APIPatchOutcome {
 
@@ -56,8 +55,13 @@ public class APIPatchOutcome {
      * patch API request.
      *
      * @param op
+     *     The requested operation for the patch corresponding to this outcome.
+     *
      * @param identifier
+     *     The identifier for the value in patch corresponding to this outcome.
+     *
      * @param path
+     *     The path for the patch corresponding to this outcome.
      */
     public APIPatchOutcome(Operation op, String identifier, String path) {
         this.op = op;

From 8aaa63670537ca390155670b7b58760e78e55b9a Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 6 Apr 2023 00:39:19 +0000
Subject: [PATCH 167/289] GUACAMOLE-926: Always use translation system for
 errors.

---
 .../directives/connectionImportErrors.js      |  20 +++-
 .../src/app/import/types/ParseError.js        |   7 ++
 .../app/rest/types/DirectoryPatchOutcome.js   |   2 +-
 .../rest/directory/DirectoryResource.java     | 100 ++++++++++++++----
 .../rest/jsonpatch/APIPatchError.java         |   8 +-
 .../jsonpatch/APIPatchFailureException.java   |   2 +-
 6 files changed, 113 insertions(+), 26 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js b/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
index 65b4403fe..aae51db63 100644
--- a/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
+++ b/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
@@ -155,6 +155,10 @@ angular.module('import').directive('connectionImportErrors', [
             if (!patchFailure || !parseResult)
                 return;
 
+            // All promises from all translation requests. The scope will not be
+            // updated until all translations are ready.
+            const translationPromises = [];
+
             // Set up the list of connection errors based on the existing parse
             // result, with error messages fetched from the patch failure
             $scope.connectionErrors = parseResult.patches.map(
@@ -166,10 +170,24 @@ angular.module('import').directive('connectionImportErrors', [
                 // Set the error from the PATCH request, if there is one
                 const error = _.get(patchFailure, ['patches', index, 'error']);
                 if (error)
-                    connectionError.errors = new DisplayErrorList([error]);
+
+                    // Fetch the translation and update it when it's ready
+                    translationPromises.push($translate(
+                        error.key, error.variables)
+                        .then(translatedError =>
+                            connectionError.errors.getArray().push(translatedError)
+                        ));
 
                 return connectionError;
+                
             });
+
+            // Once all the translations have been completed, update the
+            // connectionErrors all in one go, to ensure no excessive reloading
+            $q.all(translationPromises).then(() => {
+                $scope.connectionErrors = connectionErrors;
+            });
+            
         });
 
         // If a new parse result with errors is seen, update the display list
diff --git a/guacamole/src/main/frontend/src/app/import/types/ParseError.js b/guacamole/src/main/frontend/src/app/import/types/ParseError.js
index 33fd07765..b4b3dd647 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ParseError.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ParseError.js
@@ -61,6 +61,13 @@ angular.module('import').factory('ParseError', [function defineParseError() {
          */
         this.variables = template.variables;
 
+        // If no translation key is available, fall back to the untranslated
+        // key, passing the raw message directly through the translation system
+        if (!this.key) {
+            this.key = 'APP.TEXT_UNTRANSLATED';
+            this.variables = { MESSAGE: this.message };
+        }
+
     };
 
     return ParseError;
diff --git a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js
index e6710c2ca..324f1ae18 100644
--- a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js
+++ b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatchOutcome.js
@@ -68,7 +68,7 @@ angular.module('rest').factory('DirectoryPatchOutcome', [
          * The error message associated with the failure, if the patch failed to
          * apply.
          *
-         * @type {String}
+         * @type {TranslatableMessage}
          */
         this.error = template.error;
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index 0cfa8cb0f..0230051a9 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -21,10 +21,13 @@ package org.apache.guacamole.rest.directory;
 
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.inject.Inject;
 import javax.ws.rs.Consumes;
 import javax.ws.rs.GET;
@@ -39,6 +42,8 @@ import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleResourceNotFoundException;
 import org.apache.guacamole.GuacamoleUnsupportedException;
+import org.apache.guacamole.language.Translatable;
+import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.net.auth.AtomicDirectoryOperation;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.AuthenticationProvider;
@@ -53,6 +58,7 @@ import org.apache.guacamole.net.auth.permission.SystemPermissionSet;
 import org.apache.guacamole.net.event.DirectoryEvent;
 import org.apache.guacamole.net.event.DirectoryFailureEvent;
 import org.apache.guacamole.net.event.DirectorySuccessEvent;
+import org.apache.guacamole.rest.APIError;
 import org.apache.guacamole.rest.event.ListenerService;
 import org.apache.guacamole.rest.jsonpatch.APIPatch;
 import org.apache.guacamole.rest.jsonpatch.APIPatchError;
@@ -415,6 +421,61 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
     }
 
+    /**
+     * If the provided throwable is a known Guacamole-specific type, create and
+     * return a APIPatchError with an error message extracted from the error.
+     * If the provided throwable is not a known type, null will be returned.
+     *
+     * @param op
+     *     The operation being attempted when the error occurred.
+     *
+     * @param identifier
+     *     The identifier of the object in question, if any.
+     *
+     * @param path
+     *     The path for the patch that was being applied when the error occurred.
+     *
+     * @param t
+     *     The error that occurred while attempting to apply the patch.
+     *
+     * @return
+     *     A APIPatchError with an error message extracted from the provided
+     *     throwable - if it's a known type, otherwise null.
+     */
+    @Nullable
+    private APIPatchError createPatchFailure(
+            @Nonnull APIPatch.Operation op, @Nullable String identifier,
+            @Nonnull String path, @Nonnull Throwable t) {
+
+        /*
+         * If the failure is a translatable type, use the translation directly
+         * in the patch error.
+         */
+        if (t instanceof Translatable)
+            return new APIPatchError(
+                op, identifier, path,
+                ((Translatable) t).getTranslatableMessage());
+
+        /*
+         * If the failure represents a known Guacamole exception but is not
+         * translateable, create a patch error containing the raw untranslated
+         * exception message.
+         */
+        if (t instanceof GuacamoleException) {
+
+            // Create a translated message that will fall
+            // through to the untranslated message
+            TranslatableMessage message = new TranslatableMessage(
+                    "APP.TEXT_UNTRANSLATED", Collections.singletonMap(
+                            "MESSAGE", ((GuacamoleException) t).getMessage()));
+
+            return new APIPatchError(op, identifier, path, message);
+        }
+
+        // The error is not a known type - no patch error can be generated
+        return null;
+    }
+
     /**
      * Applies the given object patches, updating the underlying directory
      * accordingly. This operation supports addition and removal of objects
@@ -512,19 +573,19 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                                     DirectoryEvent.Operation.ADD,
                                     internal.getIdentifier(), internal, e);
 
-                            /*
-                             * If the failure represents an understood issue,
-                             * create a failure outcome for this failed patch.
-                             */
-                            if (e instanceof GuacamoleException)
-                                patchOutcomes.add(new APIPatchError(
-                                        op, null, path,
-                                        ((GuacamoleException) e).getMessage()));
+                            // Attempt to generate an API Patch error using the
+                            // caught exception
+                            APIPatchError patchError = createPatchFailure(
+                                    op, null, path, e);
 
-                            // If an unexpected failure occurs, fall through to the
-                            // standard API error handling
+                            if (patchError != null)
+                                patchOutcomes.add(patchError);
+
+                            // If an unexpected failure occurs, fall through to
+                            // the standard API error handling
                             else
                                 throw e;
+
                         }
 
                     }
@@ -554,17 +615,16 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                                     DirectoryEvent.Operation.REMOVE,
                                     identifier, null, e);
 
-                            /*
-                             * If the failure represents an understood issue,
-                             * create a failure outcome for this failed patch.
-                             */
-                            if (e instanceof GuacamoleException)
-                                patchOutcomes.add(new APIPatchError(
-                                        op, identifier, path,
-                                        ((GuacamoleException) e).getMessage()));
+                            // Attempt to generate an API Patch error using the
+                            // caught exception
+                            APIPatchError patchError = createPatchFailure(
+                                    op, identifier, path, e);
 
-                            // If an unexpected failure occurs, fall through to the
-                            // standard API error handling
+                            if (patchError != null)
+                                patchOutcomes.add(patchError);
+
+                            // If an unexpected failure occurs, fall through to
+                            // the standard API error handling
                             else
                                 throw e;
                         }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchError.java b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchError.java
index 85d28a714..45dcd5be4 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchError.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchError.java
@@ -19,6 +19,7 @@
 
 package org.apache.guacamole.rest.jsonpatch;
 
+import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.rest.jsonpatch.APIPatch.Operation;
 
 /**
@@ -33,7 +34,7 @@ public class APIPatchError extends APIPatchOutcome {
     /**
      * The error associated with the submitted patch.
      */
-    private final String error;
+    private final TranslatableMessage error;
 
     /**
      * Create a failure status associated with a submitted patch from a JSON
@@ -54,7 +55,8 @@ public class APIPatchError extends APIPatchOutcome {
      *     patch from applying.
      */
     public APIPatchError(
-            Operation op, String identifier, String path, String error) {
+            Operation op, String identifier, String path,
+            TranslatableMessage error) {
         super(op, identifier, path);
         this.error = error;
     }
@@ -65,7 +67,7 @@ public class APIPatchError extends APIPatchOutcome {
      * @return
      *     The error associated with the patch failure.
      */
-    public String getError() {
+    public TranslatableMessage getError() {
         return error;
     }
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchFailureException.java b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchFailureException.java
index fa40bffc6..e77be6d46 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchFailureException.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/jsonpatch/APIPatchFailureException.java
@@ -51,7 +51,7 @@ public class APIPatchFailureException extends GuacamoleClientException {
     public APIPatchFailureException(
             String message, List<APIPatchOutcome> patches) {
 
-        super(message );
+        super(message);
         this.patches = patches;
     }
 

From 45dc611ab18f7e2f38f7d67b4a46ec3e3fd8f880 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 6 Apr 2023 22:52:04 +0000
Subject: [PATCH 168/289] GUACAMOLE-926: Switch out connection icon to a better
 looking one.

---
 .../src/app/settings/styles/buttons.css       |  2 +-
 .../images/action-icons/guac-file-import.svg  |  1 +
 .../action-icons/guac-monitor-add-many.svg    | 77 -------------------
 3 files changed, 2 insertions(+), 78 deletions(-)
 create mode 100644 guacamole/src/main/frontend/src/images/action-icons/guac-file-import.svg
 delete mode 100644 guacamole/src/main/frontend/src/images/action-icons/guac-monitor-add-many.svg

diff --git a/guacamole/src/main/frontend/src/app/settings/styles/buttons.css b/guacamole/src/main/frontend/src/app/settings/styles/buttons.css
index 167e46a06..294bbefa6 100644
--- a/guacamole/src/main/frontend/src/app/settings/styles/buttons.css
+++ b/guacamole/src/main/frontend/src/app/settings/styles/buttons.css
@@ -63,5 +63,5 @@ a.button.add-connection-group::before {
 }
 
 a.button.import-connections::before {
-    background-image: url('images/action-icons/guac-monitor-add-many.svg');
+    background-image: url('images/action-icons/guac-file-import.svg');
 }
diff --git a/guacamole/src/main/frontend/src/images/action-icons/guac-file-import.svg b/guacamole/src/main/frontend/src/images/action-icons/guac-file-import.svg
new file mode 100644
index 000000000..4b29411c7
--- /dev/null
+++ b/guacamole/src/main/frontend/src/images/action-icons/guac-file-import.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64"><path d="M8.813 0A1.813 1.813 0 0 0 7 1.814v60.373C7 63.188 7.812 64 8.813 64h48.374C58.188 64 59 63.188 59 62.187V13.89c0-.482-.19-.943-.531-1.284L46.375.531c-.34-.34-.8-.53-1.281-.531H8.812zm37.49 3.02 10.885 10.867H46.303V3.02zM32.422 12a1.642 1.642 0 0 1 1.258.586L50.459 32.6a1.642 1.642 0 0 1-1.258 2.697h-8.84v17.98a1.642 1.642 0 0 1-1.64 1.643H26.623a1.642 1.642 0 0 1-1.643-1.643v-17.98h-9.337a1.642 1.642 0 0 1-1.258-2.697l16.78-20.014A1.642 1.642 0 0 1 32.421 12z" style="fill:#fff;stroke-width:1.35948"/></svg>
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/images/action-icons/guac-monitor-add-many.svg b/guacamole/src/main/frontend/src/images/action-icons/guac-monitor-add-many.svg
deleted file mode 100644
index 95ab14b76..000000000
--- a/guacamole/src/main/frontend/src/images/action-icons/guac-monitor-add-many.svg
+++ /dev/null
@@ -1,77 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<svg
-   width="64"
-   height="64"
-   viewBox="0 0 64 64"
-   version="1.1"
-   id="svg3828"
-   sodipodi:docname="guac-monitor-add-many.svg"
-   inkscape:version="1.1.2 (0a00cf5339, 2022-02-04)"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:svg="http://www.w3.org/2000/svg">
-  <defs
-     id="defs3832" />
-  <sodipodi:namedview
-     id="namedview3830"
-     pagecolor="#5b5b5b"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageshadow="2"
-     inkscape:pageopacity="0"
-     inkscape:pagecheckerboard="true"
-     showgrid="false"
-     inkscape:zoom="6.546875"
-     inkscape:cx="33.603819"
-     inkscape:cy="22.377088"
-     inkscape:window-width="2048"
-     inkscape:window-height="1025"
-     inkscape:window-x="0"
-     inkscape:window-y="28"
-     inkscape:window-maximized="1"
-     inkscape:current-layer="svg3828" />
-  <g
-     transform="translate(-19.073 1.734) scale(.10947)"
-     style="fill:#fff"
-     id="g3822">
-    <path
-       style="fill:#fff;fill-opacity:1;stroke:#000;stroke-width:.00956892;stroke-linecap:round;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0"
-       d="M4 .656c-2.215 0-4 1.927-4 4.313V48.03c0 2.386 1.785 4.282 4 4.282h56c2.215 0 4-1.896 4-4.282V4.97c0-2.386-1.785-4.313-4-4.313H4zm10.313 10.938h35.374c1.4 0 2.532 1.093 2.532 2.469v24.843c0 1.376-1.132 2.469-2.532 2.469H14.313c-1.4 0-2.532-1.093-2.532-2.469V14.063c0-1.376 1.132-2.47 2.531-2.47z"
-       transform="translate(174.22 231.813) scale(5.22525)"
-       id="path3818" />
-    <rect
-       ry="18"
-       rx="18"
-       y="524.187"
-       x="244.268"
-       height="38.636"
-       width="197.179"
-       style="fill:#fff;fill-opacity:1;stroke:#000;stroke-width:.05000001;stroke-linecap:round;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0"
-       id="rect3820" />
-  </g>
-  <path
-     style="fill:#ffffff;stroke:none"
-     d="m 48.309,0.865 h 7.518 V 23 h -7.518 z"
-     id="path3824" />
-  <path
-     style="fill:#ffffff;stroke:none"
-     d="m 63.135,8.173 v 7.518 H 41 V 8.173 Z"
-     id="path3826" />
-  <path
-     style="fill:#ffffff;stroke:none"
-     d="m 48.309,27 h 7.518 v 22.135 h -7.518 z"
-     id="path3824-2" />
-  <path
-     style="fill:#ffffff;stroke:none"
-     d="m 63.135,34.308 v 7.518 H 41 v -7.518 z"
-     id="path3826-8" />
-  <path
-     style="fill:#ffffff;stroke:none"
-     d="m 22.174,0.865 h 7.518 V 23 h -7.518 z"
-     id="path3824-4" />
-  <path
-     style="fill:#ffffff;stroke:none"
-     d="m 37,8.173 v 7.518 H 14.865 V 8.173 Z"
-     id="path3826-7" />
-</svg>

From b831d0a82bc4f105f2047fada0c8a001aa6282bd Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 7 Apr 2023 22:00:09 +0000
Subject: [PATCH 169/289] GUACAMOLE-926: Factor file input and drag/drop out
 into directives.

---
 .../src/app/element/directives/guacDrop.js    | 171 ++++++++++++++++++
 .../src/app/element/directives/guacUpload.js  |  29 ++-
 .../importConnectionsController.js            | 155 ++--------------
 .../directives/connectionImportErrors.js      |   2 +-
 .../frontend/src/app/import/importModule.js   |   2 +-
 .../import/templates/connectionImport.html    |   5 +-
 .../main/frontend/src/translations/en.json    |   4 +-
 7 files changed, 211 insertions(+), 157 deletions(-)
 create mode 100644 guacamole/src/main/frontend/src/app/element/directives/guacDrop.js

diff --git a/guacamole/src/main/frontend/src/app/element/directives/guacDrop.js b/guacamole/src/main/frontend/src/app/element/directives/guacDrop.js
new file mode 100644
index 000000000..3f7070694
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/element/directives/guacDrop.js
@@ -0,0 +1,171 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * A directive which allows multiple files to be uploaded. Dragging files onto
+ * the associated element will call the provided callback function with any
+ * dragged files.
+ */
+angular.module('element').directive('guacDrop', ['$injector', function guacDrop($injector) {
+
+    // Required services
+    const guacNotification = $injector.get('guacNotification');
+
+    return {
+        restrict: 'A',
+
+        link: function linkGuacDrop($scope, $element, $attrs) {
+
+            /**
+             * The function to call whenever files are dragged. The callback is
+             * provided a single parameter: the FileList containing all dragged
+             * files.
+             *
+             * @type Function
+             */
+            const guacDrop = $scope.$eval($attrs.guacDrop);
+
+            /**
+             * Any number of space-seperated classes to be applied to the
+             * element a drop is pending: when the user has dragged something
+             * over the element, but not yet dropped. These classes will be 
+             * removed when a drop is not pending.
+             *
+             * @type String
+             */
+            const guacDraggedClass = $scope.$eval($attrs.guacDraggedClass);
+
+            /**
+             * Whether upload of multiple files should be allowed. If false, an
+             * error will be displayed explaining the restriction, otherwise
+             * any number of files may be dragged. Defaults to true if not set.
+             *
+             * @type Boolean
+             */
+            const guacMultiple = 'guacMultiple' in $attrs
+                ? $scope.$eval($attrs.guacMultiple) : true;
+
+            /**
+             * The element which will register drag event.
+             *
+             * @type Element
+             */
+            const element = $element[0];
+
+            /**
+             * Applies any classes provided in the guacDraggedClass attribute.
+             * Further propagation and default behavior of the given event is
+             * automatically prevented.
+             *
+             * @param {Event} e
+             *     The event related to the in-progress drag/drop operation.
+             */
+            const notifyDragStart = function notifyDragStart(e) {
+
+                e.preventDefault();
+                e.stopPropagation();
+
+                // Skip further processing if no classes were provided
+                if (!guacDraggedClass)
+                    return;
+
+                // Add each provided class
+                guacDraggedClass.split(' ').forEach(classToApply =>
+                    element.classList.add(classToApply));
+
+            };
+
+            /**
+             * Removes any classes provided in the guacDraggedClass attribute.
+             * Further propagation and default behavior of the given event is
+             * automatically prevented.
+             *
+             * @param {Event} e
+             *     The event related to the end of the drag/drop operation.
+             */
+            const notifyDragEnd = function notifyDragEnd(e) {
+
+                e.preventDefault();
+                e.stopPropagation();
+
+                // Skip further processing if no classes were provided
+                if (!guacDraggedClass)
+                    return;
+
+                // Remove each provided class
+                guacDraggedClass.split(' ').forEach(classToRemove =>
+                    element.classList.remove(classToRemove));
+
+            };
+
+            // Add listeners to the drop target to ensure that the visual state
+            // stays up to date
+            element.addEventListener('dragenter', notifyDragStart);
+            element.addEventListener('dragover',  notifyDragStart);
+            element.addEventListener('dragleave', notifyDragEnd);
+
+            /**
+             * Event listener that will be invoked if the user drops anything
+             * onto the event. If a valid file is provided, the onFile callback
+             * provided to this directive will be called; otherwise an error
+             * will be displayed, if appropriate.
+             *
+             * @param {Event} e
+             *     The drop event that triggered this handler.
+             */
+            element.addEventListener('drop', e => {
+
+                notifyDragEnd(e);
+
+                const files = e.dataTransfer.files;
+
+                // Ignore any non-files that are dragged into the drop area
+                if (files.length < 1)
+                    return;
+
+                // If multi-file upload is disabled, If more than one file was
+                // provided, print an error explaining the problem
+                if (!guacMultiple && files.length >= 2) {
+
+                    guacNotification.showStatus({
+                        className   : 'error',
+                        title       : 'APP.DIALOG_HEADER_ERROR',
+                        text: { key : 'APP.ERROR_SINGLE_FILE_ONLY'},
+
+                        // Add a button to hide the error
+                        actions    : [{
+                            name      : 'APP.ACTION_ACKNOWLEDGE',
+                            callback  : () => guacNotification.showStatus(false)
+                        }]
+                    });
+                    return;
+
+                }
+
+                // Invoke the callback with the files. Note that if guacMultiple
+                // is set to false, this will always be a single file.
+                guacDrop(files);
+
+            });
+
+        } // end guacDrop link function
+
+    };
+
+}]);
diff --git a/guacamole/src/main/frontend/src/app/element/directives/guacUpload.js b/guacamole/src/main/frontend/src/app/element/directives/guacUpload.js
index b7d75e95d..d1c10a9da 100644
--- a/guacamole/src/main/frontend/src/app/element/directives/guacUpload.js
+++ b/guacamole/src/main/frontend/src/app/element/directives/guacUpload.js
@@ -18,9 +18,9 @@
  */
 
 /**
- * A directive which allows multiple files to be uploaded. Clicking on the
- * associated element will result in a file selector dialog, which then calls
- * the provided callback function with any chosen files.
+ * A directive which allows files to be uploaded. Clicking on the associated
+ * element will result in a file selector dialog, which then calls the provided
+ * callback function with any chosen files.
  */
 angular.module('element').directive('guacUpload', ['$document', function guacUpload($document) {
 
@@ -36,32 +36,43 @@ angular.module('element').directive('guacUpload', ['$document', function guacUpl
              *
              * @type Function 
              */
-            var guacUpload = $scope.$eval($attrs.guacUpload);
+            const guacUpload = $scope.$eval($attrs.guacUpload);
 
             /**
-             * The element which will register the drag gesture.
+             * Whether upload of multiple files should be allowed. If false, the
+             * file dialog will only allow a single file to be chosen at once,
+             * otherwise any number of files may be chosen. Defaults to true if
+             * not set.
+             *
+             * @type Boolean
+             */
+            const guacMultiple = 'guacMultiple' in $attrs
+                ? $scope.$eval($attrs.guacMultiple) : true;
+
+            /**
+             * The element which will register the click.
              *
              * @type Element
              */
-            var element = $element[0];
+            const element = $element[0];
 
             /**
              * Internal form, containing a single file input element.
              *
              * @type HTMLFormElement
              */
-            var form = $document[0].createElement('form');
+            const form = $document[0].createElement('form');
 
             /**
              * Internal file input element.
              *
              * @type HTMLInputElement
              */
-            var input = $document[0].createElement('input');
+            const input = $document[0].createElement('input');
 
             // Init input element
             input.type = 'file';
-            input.multiple = true;
+            input.multiple = guacMultiple;
 
             // Add input element to internal form
             form.appendChild(input);
diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 1ed354698..993a8e534 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -62,12 +62,11 @@ const LEGAL_MIME_TYPES = [CSV_MIME_TYPE, JSON_MIME_TYPE, ...YAML_MIME_TYPES];
  */
 angular.module('import').controller('importConnectionsController', ['$scope', '$injector',
         function importConnectionsController($scope, $injector) {
+            
     // Required services
-    const $document              = $injector.get('$document');
     const $location              = $injector.get('$location');
     const $q                     = $injector.get('$q');
     const $routeParams           = $injector.get('$routeParams');
-    const $timeout               = $injector.get('$timeout');
     const connectionParseService = $injector.get('connectionParseService');
     const connectionService      = $injector.get('connectionService');
     const guacNotification       = $injector.get('guacNotification');
@@ -586,12 +585,19 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
     /**
      * Handle a provided File upload, reading all data onto the scope for
-     * import processing, should the user request an import.
+     * import processing, should the user request an import. Note that this
+     * function is used as a callback for directives that invoke it with a file
+     * list, but directive-level checking should ensure that there is only ever
+     * one file provided at a time.
      *
-     * @argument {File} file
-     *     The file to upload onto the scope for further processing.
+     * @argument {File[]} files
+     *     The files to upload onto the scope for further processing. There
+     *     should only ever be a single file in the array.
      */
-    const handleFile = file => {
+    $scope.handleFiles = files => {
+
+        // There should only ever be a single file in the array
+        const file = files[0];
 
         // The MIME type of the provided file
         const mimeType = file.type;
@@ -650,147 +656,10 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         $scope.fileReader.readAsBinaryString(file);
     };
 
-    /**
-     * Whether a drag/drop operation is currently in progress (the user has
-     * dragged a file over the Guacamole connection but has not yet
-     * dropped it).
-     *
-     * @type boolean
-     */
-    $scope.dropPending = false;
-
     /**
      * The name of the file that's currently being uploaded, or has yet to
      * be imported, if any.
      */
     $scope.fileName = null;
 
-    /**
-     * The container for the file upload UI.
-     *
-     * @type Element
-     *
-     */
-    const uploadContainer = angular.element(
-            $document.find('.file-upload-container'));
-
-    /**
-     * The location where files can be dragged-and-dropped to.
-     *
-     * @type Element
-     */
-    const dropTarget = uploadContainer.find('.drop-target');
-
-    /**
-     * Displays a visual indication that dropping the file currently
-     * being dragged is possible. Further propagation and default behavior
-     * of the given event is automatically prevented.
-     *
-     * @param {Event} e
-     *     The event related to the in-progress drag/drop operation.
-     */
-    const notifyDragStart = function notifyDragStart(e) {
-
-        e.preventDefault();
-        e.stopPropagation();
-
-        $scope.$apply(() => {
-            $scope.dropPending = true;
-        });
-
-    };
-
-    /**
-     * Removes the visual indication that dropping the file currently
-     * being dragged is possible. Further propagation and default behavior
-     * of the given event is automatically prevented.
-     *
-     * @param {Event} e
-     *     The event related to the end of the former drag/drop operation.
-     */
-    const notifyDragEnd = function notifyDragEnd(e) {
-
-        e.preventDefault();
-        e.stopPropagation();
-
-        $scope.$apply(() => {
-            $scope.dropPending = false;
-        });
-
-    };
-
-    // Add listeners to the drop target to ensure that the visual state
-    // stays up to date
-    dropTarget.on('dragenter', notifyDragStart);
-    dropTarget.on('dragover',  notifyDragStart);
-    dropTarget.on('dragleave', notifyDragEnd);
-
-    /**
-     * Drop target event listener that will be invoked if the user drops
-     * anything onto the drop target. If a valid file is provided, the
-     * onFile callback provided to this directive will be called; otherwise
-     * an error will be displayed, if appropriate.
-     *
-     * @param {Event} e
-     *     The drop event that triggered this handler.
-     */
-    dropTarget.on('drop', e => {
-
-        notifyDragEnd(e);
-
-        const files = e.originalEvent.dataTransfer.files;
-
-        // Ignore any non-files that are dragged into the drop area
-        if (files.length < 1)
-            return;
-
-        if (files.length >= 2) {
-
-            // If more than one file was provided, print an error explaining
-            // that only a single file is allowed and abort processing
-            handleError(new ParseError({
-                message: 'Only a single file may be imported at once',
-                key: 'IMPORT.ERROR_FILE_SINGLE_ONLY'
-            }));
-            return;
-        }
-
-        handleFile(files[0]);
-
-    });
-
-    /**
-     * The hidden file input used to create a file browser.
-     *
-     * @type Element
-     */
-    const fileUploadInput = uploadContainer.find('.file-upload-input');
-
-    /**
-     * A function that will click on the hidden file input to open a file
-     * browser to allow the user to select a file for upload.
-     */
-    $scope.openFileBrowser = () =>
-            $timeout(() => fileUploadInput.click(), 0, false);
-
-    /**
-     * A handler that will be invoked when a user selectes a file in the
-     * file browser. After some error checking, the file will be passed to
-     * the onFile callback provided to this directive.
-     *
-     * @param {Event} e
-     *     The event that was triggered when the user selected a file in
-     *     their file browser.
-     */
-    fileUploadInput.on('change', e => {
-
-        // Process the uploaded file
-        handleFile(e.target.files[0]);
-
-        // Clear the value to ensure that the change event will be fired
-        // if the user selects the same file again
-        fileUploadInput.value = null;
-
-    });
-
 }]);
diff --git a/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js b/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
index aae51db63..d6a14c45e 100644
--- a/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
+++ b/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
@@ -161,7 +161,7 @@ angular.module('import').directive('connectionImportErrors', [
 
             // Set up the list of connection errors based on the existing parse
             // result, with error messages fetched from the patch failure
-            $scope.connectionErrors = parseResult.patches.map(
+            const connectionErrors = parseResult.patches.map(
                     (patch, index) => {
 
                 // Generate a connection error for display
diff --git a/guacamole/src/main/frontend/src/app/import/importModule.js b/guacamole/src/main/frontend/src/app/import/importModule.js
index 164ec2b16..45551e323 100644
--- a/guacamole/src/main/frontend/src/app/import/importModule.js
+++ b/guacamole/src/main/frontend/src/app/import/importModule.js
@@ -21,4 +21,4 @@
  * The module for code supporting importing user-supplied files. Currently, only
  * connection import is supported.
  */
-angular.module('import', ['rest', 'list', 'notification']);
+angular.module('import', ['element', 'list', 'notification', 'rest']);
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index ae937a200..bc2ecc2a1 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -22,7 +22,10 @@
             </a>
         </div>
 
-        <div class="drop-target" ng-class="{ 'drop-pending': dropPending, 'file-present': fileName}">
+        <div class="drop-target" guac-upload="handleFiles" 
+             guac-drop="handleFiles" guac-multiple="false"
+             guac-dragged-class="'drop-pending'"
+             ng-class="{'file-present': fileName}">
 
             <div class="title">{{'IMPORT.HELP_UPLOAD_DROP_TITLE' | translate}}</div>
 
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 0347def96..5fb530e56 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -41,6 +41,7 @@
         "ERROR_PAGE_UNAVAILABLE"  : "An error has occurred and this action cannot be completed. If the problem persists, please notify your system administrator or check your system logs.",
         "ERROR_PASSWORD_BLANK"    : "Your password cannot be blank.",
         "ERROR_PASSWORD_MISMATCH" : "The provided passwords do not match.",
+        "ERROR_SINGLE_FILE_ONLY"  : "Please upload only a single file at a time",
         
         "FIELD_HEADER_PASSWORD"       : "Password:",
         "FIELD_HEADER_PASSWORD_AGAIN" : "Re-enter Password:",
@@ -204,9 +205,8 @@
         "ERROR_ARRAY_REQUIRED": "The provided file must contain a list of connections",
         "ERROR_DUPLICATE_CSV_HEADER": "Duplicate CSV Header: {HEADER}",
         "ERROR_EMPTY_FILE": "The provided file is empty",
-        "ERROR_FILE_SINGLE_ONLY": "Please upload only a single file at a time",
         "ERROR_INVALID_CSV_HEADER": "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
-        "ERROR_INVALID_FILE_TYPE": "Unsupported file type: \"{TYPE}\"",
+        "ERROR_INVALID_MIME_TYPE": "Unsupported file type: \"{TYPE}\"",
         "ERROR_INVALID_GROUP": "No group matching \"{GROUP}\" found",
         "ERROR_INVALID_USER_GROUP_IDENTIFIERS": "User Groups not found: {IDENTIFIER_LIST}",
         "ERROR_INVALID_USER_IDENTIFIERS": "Users not found: {IDENTIFIER_LIST}",

From 449675c79a8fa64be69c55822fa2bc6163572244 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 11 Apr 2023 22:05:47 +0000
Subject: [PATCH 170/289] GUACAMOLE-926: Add class to error rows with actual
 errors for easier restyling.

---
 .../frontend/src/app/import/templates/connectionErrors.html     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html b/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
index f521d1996..5142b49b2 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
@@ -28,7 +28,7 @@
                 <td>{{error.rowNumber}}</td>
                 <td>{{error.name}}</td>
                 <td>{{error.protocol}}</td>
-                <td class="error-message">
+                <td class="error-message" ng-class="{ 'has-errors' : error.errors.getArray().length }">
                     <ul>
                         <li ng-repeat="message in error.errors.getArray()">
                             {{ message }}

From d58149ed05ba14b00f89b5963a6d21e078e35822 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 13 Apr 2023 18:34:58 +0000
Subject: [PATCH 171/289] GUACAMOLE-926: Ensure loading style is always removed
 when file processing is complete.

---
 .../src/app/import/controllers/importConnectionsController.js    | 1 +
 1 file changed, 1 insertion(+)

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 993a8e534..e30344e52 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -365,6 +365,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      */
     function handleParseSuccess(parseResult) {
 
+        $scope.processing = false;
         $scope.parseResult = parseResult;
 
         // If errors were encounted during file parsing, abort further

From 341f359c6f39e8608d09199e5956be2abe03a3c8 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 13 Apr 2023 19:01:22 +0000
Subject: [PATCH 172/289] GUACAMOLE-926: Allow a bit more leeway in import
 group declaration.

---
 .../import/services/connectionParseService.js | 31 ++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index ad90145d5..476c78f69 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -45,6 +45,14 @@ angular.module('import').factory('connectionParseService',
 
     const service = {};
 
+    /**
+     * The identifier of the root connection group, under which all other groups
+     * and connections exist.
+     * 
+     * @type String
+     */
+    const ROOT_GROUP_IDENTIFIER = 'ROOT';
+
     /**
      * Perform basic checks, common to all file types - namely that the parsed
      * data is an array, and contains at least one connection entry. Returns an
@@ -136,6 +144,10 @@ angular.module('import').factory('connectionParseService',
      * are present on the provided object, or if no group exists at the specified
      * path, the function will throw a ParseError describing the failure.
      *
+     * The group may begin with the root identifier, a leading slash, or may omit
+     * the root identifier entirely. Additionally, the group may optionally end
+     * with a trailing slash.
+     *
      * @returns {Promise.<Function<Object, Object>>}
      *     A promise that will resolve to a function that will transform a
      *     "group" field into a "parentIdentifier" field if possible.
@@ -154,8 +166,25 @@ angular.module('import').factory('connectionParseService',
                     key: 'IMPORT.ERROR_AMBIGUOUS_PARENT_GROUP'
                 });
 
+            // The group path extracted from the user-provided connection, to be
+            // translated if needed into an absolute path from the root group
+            let group = connection.group;
+
+            // Allow the group to start with a leading slash instead instead of
+            // explicitly requiring the root connection group
+            if (group.startsWith('/'))
+                group = ROOT_GROUP_IDENTIFIER + group;
+
+            // Allow groups to begin directly with the path underneath the root
+            else if (!group.startsWith(ROOT_GROUP_IDENTIFIER))
+                group = ROOT_GROUP_IDENTIFIER + '/' + group;
+
+            // Allow groups to end with a trailing slash
+            if (group.endsWith('/'))
+                group = group.slice(0, -1);
+
             // Look up the parent identifier for the specified group path
-            const identifier = lookups[connection.group];
+            const identifier = lookups[group];
 
             // If the group doesn't match anything in the tree
             if (!identifier)

From 6f6f8d44b8fd6adab8814e8ff48d70256d877eb6 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 13 Apr 2023 23:17:21 +0000
Subject: [PATCH 173/289] GUACAMOLE-926: Validate parentIdentifiers before
 attempting connection import.

---
 .../import/services/connectionParseService.js | 63 ++++++++++++++-----
 .../main/frontend/src/translations/en.json    |  3 +-
 2 files changed, 47 insertions(+), 19 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index 476c78f69..4951a5f83 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -80,20 +80,25 @@ angular.module('import').factory('connectionParseService',
             });
     }
 
-
     /**
-     * Returns a promise that resolves to an object mapping potential groups
-     * that might be encountered in an imported connection to group identifiers.
+     * Returns a promise that resolves to an object containing both a map of
+     * connection group paths to group identifiers and a set of all known group
+     * identifiers.
+     *
+     * The resolved object will contain a "groupLookups" key with a map of group
+     * paths to group identifier, as well as a "identifierSet" key containing a
+     * set of all known group identifiers.
      *
      * The idea is that a user-provided import file might directly specify a
      * parentIdentifier, or it might specify a named group path like "ROOT",
-     * "ROOT/parent", or "ROOT/parent/child". This object resolved by the
-     * promise returned from this function will map all of the above to the
-     * identifier of the appropriate group, if defined.
+     * "ROOT/parent", or "ROOT/parent/child". The resolved "groupLookups" field
+     * will map all of the above to the identifier of the appropriate group, if
+     * defined. The "identifierSet" field can be used to check if a given group
+     * identifier is known.
      *
      * @returns {Promise.<Object>}
-     *     A promise that resolves to an object mapping groups to group
-     *     identifiers.
+     *     A promise that resolves to an object containing a map of group paths
+     *     to group identifiers, as well as set of all known group identifiers.
      */
     function getGroupLookups() {
 
@@ -106,7 +111,12 @@ angular.module('import').factory('connectionParseService',
         connectionGroupService.getConnectionGroupTree(dataSource).then(
                 rootGroup => {
 
-            const groupLookup = {};
+            // An object mapping group paths to group identifiers
+            const groupLookups = {};
+
+            // An object mapping group identifiers to the boolean value true,
+            // i.e. a set of all known group identifiers
+            const identifierSet = {};
 
             // Add the specified group to the lookup, appending all specified
             // prefixes, and then recursively call saveLookups for all children
@@ -117,7 +127,10 @@ angular.module('import').factory('connectionParseService',
                 const currentPath = prefix + group.name;
 
                 // Add the current path to the lookup
-                groupLookup[currentPath] = group.identifier;
+                groupLookups[currentPath] = group.identifier;
+
+                // Add this group identifier to the set
+                identifierSet[group.identifier] = true;
 
                 // Add each child group to the lookup
                 const nextPrefix = currentPath + "/";
@@ -130,7 +143,7 @@ angular.module('import').factory('connectionParseService',
             saveLookups("", rootGroup);
 
             // Resolve with the now fully-populated lookups
-            deferredGroupLookups.resolve(groupLookup);
+            deferredGroupLookups.resolve({ groupLookups, identifierSet });
 
         });
 
@@ -153,14 +166,30 @@ angular.module('import').factory('connectionParseService',
      *     "group" field into a "parentIdentifier" field if possible.
      */
     function getGroupTransformer() {
-        return getGroupLookups().then(lookups => connection => {
+        return getGroupLookups().then(({groupLookups, identifierSet}) =>
+                connection => {
 
-            // If there's no group to translate, do nothing
-            if (!connection.group)
-                return connection;
+            const parentIdentifier = connection.parentIdentifier;
+
+            // If there's no group path defined for this connection
+            if (!connection.group) {
+
+                // If the specified parentIdentifier is not specified
+                // at all, or valid, there's nothing to be done
+                if (!parentIdentifier || identifierSet[parentIdentifier])
+                    return connection;
+
+                // If a parent group identifier is present, but not valid
+                if (parentIdentifier)
+                    throw new ParseError({
+                        message: 'No group with identifier: ' + parentIdentifier,
+                        key: 'IMPORT.ERROR_INVALID_GROUP_IDENTIFIER',
+                        variables: { IDENTIFIER: parentIdentifier }
+                    });
+            }
 
             // If both are specified, the parent group is ambigious
-            if (connection.parentIdentifier)
+            if (parentIdentifier)
                 throw new ParseError({
                     message: 'Only one of group or parentIdentifier can be set',
                     key: 'IMPORT.ERROR_AMBIGUOUS_PARENT_GROUP'
@@ -184,7 +213,7 @@ angular.module('import').factory('connectionParseService',
                 group = group.slice(0, -1);
 
             // Look up the parent identifier for the specified group path
-            const identifier = lookups[group];
+            const identifier = groupLookups[group];
 
             // If the group doesn't match anything in the tree
             if (!identifier)
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 5fb530e56..0dd455b04 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -208,8 +208,7 @@
         "ERROR_INVALID_CSV_HEADER": "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
         "ERROR_INVALID_MIME_TYPE": "Unsupported file type: \"{TYPE}\"",
         "ERROR_INVALID_GROUP": "No group matching \"{GROUP}\" found",
-        "ERROR_INVALID_USER_GROUP_IDENTIFIERS": "User Groups not found: {IDENTIFIER_LIST}",
-        "ERROR_INVALID_USER_IDENTIFIERS": "Users not found: {IDENTIFIER_LIST}",
+        "ERROR_INVALID_GROUP_IDENTIFIER": "No connection group with identifier \"{IDENTIFIER}\" found",
         "ERROR_NO_FILE_SUPPLIED": "Please select a file to import",
         "ERROR_REQUIRED_NAME": "No connection name found in the provided file",
         "ERROR_REQUIRED_PROTOCOL": "No connection protocol found in the provided file",

From 769ae25899081f5156f383bf693e884b19f4f423 Mon Sep 17 00:00:00 2001
From: vanntile <33692650+vanntile@users.noreply.github.com>
Date: Fri, 14 Apr 2023 08:46:49 +0300
Subject: [PATCH 174/289] GUACAMOLE-1771: add RDP Portuguese keyboard layout

---
 .../src/main/resources/org/apache/guacamole/protocols/rdp.json | 1 +
 guacamole/src/main/frontend/src/translations/ca.json           | 1 +
 guacamole/src/main/frontend/src/translations/cs.json           | 1 +
 guacamole/src/main/frontend/src/translations/de.json           | 1 +
 guacamole/src/main/frontend/src/translations/en.json           | 1 +
 guacamole/src/main/frontend/src/translations/es.json           | 1 +
 guacamole/src/main/frontend/src/translations/fr.json           | 1 +
 guacamole/src/main/frontend/src/translations/ko.json           | 1 +
 guacamole/src/main/frontend/src/translations/pl.json           | 3 ++-
 guacamole/src/main/frontend/src/translations/pt.json           | 1 +
 guacamole/src/main/frontend/src/translations/zh.json           | 1 +
 11 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
index c51f76209..eab2125a3 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
@@ -108,6 +108,7 @@
                         "no-no-qwerty",
                         "pl-pl-qwerty",
                         "pt-br-qwerty",
+                        "pt-pt-qwerty",
                         "sv-se-qwerty",
                         "da-dk-qwerty",
                         "tr-tr-qwerty"
diff --git a/guacamole/src/main/frontend/src/translations/ca.json b/guacamole/src/main/frontend/src/translations/ca.json
index 1a7ed517b..21e0d48cf 100644
--- a/guacamole/src/main/frontend/src/translations/ca.json
+++ b/guacamole/src/main/frontend/src/translations/ca.json
@@ -554,6 +554,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japonès (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polonès (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portuguès brasiler (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portuguès (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Suec (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danès (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Q-Turc (Qwerty)",
diff --git a/guacamole/src/main/frontend/src/translations/cs.json b/guacamole/src/main/frontend/src/translations/cs.json
index 67df484e7..53ba7f543 100644
--- a/guacamole/src/main/frontend/src/translations/cs.json
+++ b/guacamole/src/main/frontend/src/translations/cs.json
@@ -599,6 +599,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_NO_NO_QWERTY" : "Norština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polské (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portugalská Brazilština (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugalská (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Švédština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dánština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turečtina (Qwerty)",
diff --git a/guacamole/src/main/frontend/src/translations/de.json b/guacamole/src/main/frontend/src/translations/de.json
index 982cf599f..f252c6192 100644
--- a/guacamole/src/main/frontend/src/translations/de.json
+++ b/guacamole/src/main/frontend/src/translations/de.json
@@ -459,6 +459,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japanisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polnisches (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portugiesisch (BR) (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugiesisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Schwedisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Türkisch (Qwerty)",
 
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 0dd455b04..12ccd97de 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -660,6 +660,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_NO_NO_QWERTY" : "Norwegian (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portuguese Brazilian (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portuguese (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Swedish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turkish-Q (Qwerty)",
diff --git a/guacamole/src/main/frontend/src/translations/es.json b/guacamole/src/main/frontend/src/translations/es.json
index 896d3651a..24e58c9c5 100644
--- a/guacamole/src/main/frontend/src/translations/es.json
+++ b/guacamole/src/main/frontend/src/translations/es.json
@@ -562,6 +562,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY"    : "Japones (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY"    : "Polaco (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY"    : "Portugués Brazileño (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY"    : "Portugués (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY"    : "Sueco (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY"    : "Danés (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY"    : "Turco-Q (Qwerty)",
diff --git a/guacamole/src/main/frontend/src/translations/fr.json b/guacamole/src/main/frontend/src/translations/fr.json
index 3c8dc2712..4a19ef4b8 100644
--- a/guacamole/src/main/frontend/src/translations/fr.json
+++ b/guacamole/src/main/frontend/src/translations/fr.json
@@ -558,6 +558,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japonais (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polonais (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portugais Brésilien (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugais (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Suédois (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danois (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turque (Qwerty)",
diff --git a/guacamole/src/main/frontend/src/translations/ko.json b/guacamole/src/main/frontend/src/translations/ko.json
index 6c43ff991..957b3b571 100644
--- a/guacamole/src/main/frontend/src/translations/ko.json
+++ b/guacamole/src/main/frontend/src/translations/ko.json
@@ -551,6 +551,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japanese (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portuguese Brazilian (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portuguese (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Swedish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turkish-Q (Qwerty)",
diff --git a/guacamole/src/main/frontend/src/translations/pl.json b/guacamole/src/main/frontend/src/translations/pl.json
index 00afb3e70..2be8d8fb6 100644
--- a/guacamole/src/main/frontend/src/translations/pl.json
+++ b/guacamole/src/main/frontend/src/translations/pl.json
@@ -592,6 +592,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_NO_NO_QWERTY" : "Norweski (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polski (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portugalski Brazylijski (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugalski (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Szwecki (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Duński (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turecki-Q (Qwerty)",
@@ -1048,4 +1049,4 @@
 
     }
 
-}
\ No newline at end of file
+}
diff --git a/guacamole/src/main/frontend/src/translations/pt.json b/guacamole/src/main/frontend/src/translations/pt.json
index e7f09d811..77b956404 100644
--- a/guacamole/src/main/frontend/src/translations/pt.json
+++ b/guacamole/src/main/frontend/src/translations/pt.json
@@ -560,6 +560,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japonês (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polonês (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Português Brasileiro (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Português (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Sueco (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dinamarquês (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turco-Q (Qwerty)",
diff --git a/guacamole/src/main/frontend/src/translations/zh.json b/guacamole/src/main/frontend/src/translations/zh.json
index a56f3936e..3d74553f7 100644
--- a/guacamole/src/main/frontend/src/translations/zh.json
+++ b/guacamole/src/main/frontend/src/translations/zh.json
@@ -545,6 +545,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japanese (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portuguese Brazilian (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portuguese (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Swedish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turkish-Q (Qwerty)",

From 6ff2ec0e72bcff07c85dffcdeccbec902cc77a6c Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 14 Apr 2023 18:42:29 +0000
Subject: [PATCH 175/289] GUACAMOLE-926: Fix attribute disambiguation suffix
 handling.

---
 .../frontend/src/app/import/services/connectionCSVService.js    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
index 9ab6a46d0..07af37e89 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
@@ -304,7 +304,7 @@ angular.module('import').factory('connectionCSVService',
                     transformConfig.parameterOrAttributeGetters.push(
                         row => ({
                             type: 'attributes',
-                            name: parameterName,
+                            name: attributeName,
                             value: fetchFieldAtIndex(row)
                         })
                     );

From d3f4bf06cc608aa401cd5a709aff76159334c95f Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 14 Apr 2023 18:42:48 +0000
Subject: [PATCH 176/289] GUACAMOLE-926: Better handling for invalid import
 files.

---
 .../importConnectionsController.js            | 32 ++++++++++++++++++-
 .../import/services/connectionParseService.js | 27 ++++++++++------
 .../main/frontend/src/translations/en.json    |  6 +++-
 3 files changed, 54 insertions(+), 11 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index e30344e52..f78f262e6 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -50,6 +50,21 @@ const YAML_MIME_TYPES = [
     'application/yml'
 ];
 
+/**
+ * Possible signatures for zip files (which include most modern Microsoft office
+ * documents - most notable excel). If any file, regardless of extension, has
+ * these starting bytes, it's invalid and must be rejected.
+ * For more, see https://en.wikipedia.org/wiki/List_of_file_signatures and
+ * https://en.wikipedia.org/wiki/Magic_number_(programming)#Magic_numbers_in_files.
+ *
+ * @type String[]
+ */
+const ZIP_SIGNATURES = [
+    'PK\u0003\u0004',
+    'PK\u0005\u0006',
+    'PK\u0007\u0008'
+];
+
 /*
  * All file types supported for connection import.
  * 
@@ -640,8 +655,23 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
             else {
 
+                const fileData = e.target.result;
+
+                // Check if the file has a header of a known-bad type
+                if (_.some(ZIP_SIGNATURES,
+                        signature => fileData.startsWith(signature))) {
+
+                    // Throw an error and abort processing
+                    handleError(new ParseError({
+                        message: "Invalid file type detected",
+                        key: 'IMPORT.ERROR_DETECTED_INVALID_TYPE'
+                    }));
+                    return;
+
+                }
+
                 // Save the uploaded data
-                $scope.fileData = e.target.result;
+                $scope.fileData = fileData;
 
                 // Mark the data as ready
                 $scope.dataReady = true;
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index 4951a5f83..61abd848e 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -354,12 +354,15 @@ angular.module('import').factory('connectionParseService',
             parsedData = parseCSVData(csvData, {skip_empty_lines: true});
         }
 
-        // If the CSV parser throws an error, reject with that error. No
-        // translation key will be available here.
+        // If the CSV parser throws an error, reject with that error
         catch(error) {
             console.error(error);
             const deferred = $q.defer();
-            deferred.reject(new ParseError({ message: error.message }));
+            deferred.reject(new ParseError({
+                message: "CSV Parse Failure: "+ error.message,
+                key: "IMPORT.ERROR_PARSE_FAILURE_CSV",
+                variables: { ERROR: error.message }
+            }));
             return deferred.promise;
         }
 
@@ -400,12 +403,15 @@ angular.module('import').factory('connectionParseService',
             connectionData = parseYAMLData(yamlData);
         }
 
-        // If the YAML parser throws an error, reject with that error. No
-        // translation key will be available here.
+        // If the YAML parser throws an error, reject with that error
         catch(error) {
             console.error(error);
             const deferred = $q.defer();
-            deferred.reject(new ParseError({ message: error.message }));
+            deferred.reject(new ParseError({
+                message: "YAML Parse Failure: "+ error.message,
+                key: "IMPORT.ERROR_PARSE_FAILURE_YAML",
+                variables: { ERROR: error.message }
+            }));
             return deferred.promise;
         }
 
@@ -434,12 +440,15 @@ angular.module('import').factory('connectionParseService',
             connectionData = JSON.parse(jsonData);
         }
 
-        // If the JSON parse attempt throws an error, reject with that error.
-        // No translation key will be available here.
+        // If the JSON parse attempt throws an error, reject with that error
         catch(error) {
             console.error(error);
             const deferred = $q.defer();
-            deferred.reject(new ParseError({ message: error.message }));
+            deferred.reject(new ParseError({
+                message: "JSON Parse Failure: "+ error.message,
+                key: "IMPORT.ERROR_PARSE_FAILURE_JSON",
+                variables: { ERROR: error.message }
+            }));
             return deferred.promise;
         }
 
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 0dd455b04..12f126c9e 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -207,9 +207,13 @@
         "ERROR_EMPTY_FILE": "The provided file is empty",
         "ERROR_INVALID_CSV_HEADER": "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
         "ERROR_INVALID_MIME_TYPE": "Unsupported file type: \"{TYPE}\"",
+        "ERROR_DETECTED_INVALID_TYPE": "Unsupported file type. Please make sure the file is valid CSV, JSON, or YAML.",
         "ERROR_INVALID_GROUP": "No group matching \"{GROUP}\" found",
         "ERROR_INVALID_GROUP_IDENTIFIER": "No connection group with identifier \"{IDENTIFIER}\" found",
         "ERROR_NO_FILE_SUPPLIED": "Please select a file to import",
+        "ERROR_PARSE_FAILURE_CSV": "Please make sure your file is valid CSV. Parsing failed with error \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_JSON": "Please make sure your file is valid JSON. Parsing failed with error \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_YAML": "Please make sure your file is valid YAML. Parsing failed with error \"{ERROR}\". ",
         "ERROR_REQUIRED_NAME": "No connection name found in the provided file",
         "ERROR_REQUIRED_PROTOCOL": "No connection protocol found in the provided file",
 
@@ -217,7 +221,7 @@
 
         "HELP_CSV_DESCRIPTION": "A connection import CSV file has one connection record per row. Each column will specify a connection field. At minimum the connection name and protocol must be specified.",
         "HELP_CSV_EXAMPLE": "name,protocol,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,",
-        "HELP_CSV_MORE_DETAILS": "The CSV header for each row specifies the connection field. The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. In most cases, there should be no conflict between fields, but if needed, an \" (attribute)\" or \" (parameter)\" suffix may be added to disambiguate. Lists of user or user group identifiers must be semicolon-seperated.¹",
+        "HELP_CSV_MORE_DETAILS": "The CSV header for each row specifies the connection field. The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. In most cases, there should be no conflict between fields, but if needed, an \" (attribute)\" or \" (parameter)\" suffix may be added to disambiguate. Lists of user or user group identifiers must be semicolon-separated.¹",
         "HELP_FILE_TYPE_DESCRIPTION": "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created.",
         "HELP_FILE_TYPE_HEADER": "File Types",
         "HELP_JSON_DESCRIPTION": "A connection import JSON file is a list of connection objects. At minimum the connection name and protocol must be specified in each connection object.",

From 3417b612c408cbf2d63d1b360f67ccf4620f5372 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Sat, 15 Apr 2023 04:15:24 +0000
Subject: [PATCH 177/289] GUACAMOLE-926: Explicitly catch expected CSV binary
 parse error and display generic error instead.

---
 .../import/services/connectionParseService.js | 41 +++++++++++++++----
 1 file changed, 34 insertions(+), 7 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index 61abd848e..e332ab781 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -22,6 +22,17 @@
 import { parse as parseCSVData } from 'csv-parse/lib/sync'
 import { parse as parseYAMLData } from 'yaml'
 
+/**
+ * A particularly unfriendly looking error that the CSV parser throws if a
+ * binary file parse attempt is made. If at all possible, this message should
+ * never be displayed to the user since it makes it look like the application
+ * is broken. As such, the code will attempt to filter out this error and print
+ * something a bit more generic. Lowercased for slightly fuzzier matching.
+ *
+ * @type String
+ */
+const BINARY_CSV_ERROR_MESSAGE = "Argument must be a Buffer".toLowerCase();
+
 /**
  * A service for parsing user-provided JSON, YAML, or JSON connection data into
  * an appropriate format for bulk uploading using the PATCH REST endpoint.
@@ -356,13 +367,29 @@ angular.module('import').factory('connectionParseService',
 
         // If the CSV parser throws an error, reject with that error
         catch(error) {
+
+            const message = error.message;
             console.error(error);
+
             const deferred = $q.defer();
-            deferred.reject(new ParseError({
-                message: "CSV Parse Failure: "+ error.message,
-                key: "IMPORT.ERROR_PARSE_FAILURE_CSV",
-                variables: { ERROR: error.message }
-            }));
+
+            // If the error message looks like the expected (and ugly) message
+            // that's thrown when a binary file is provided, throw a more
+            // friendy error.
+            if (_.trim(message).toLowerCase() == BINARY_CSV_ERROR_MESSAGE)
+                deferred.reject(new ParseError({
+                    message: "CSV binary parse attempt error: " + error.message,
+                    key: "IMPORT.ERROR_DETECTED_INVALID_TYPE"
+                }));
+
+            // Otherwise, pass the error from the library through to the user
+            else
+                deferred.reject(new ParseError({
+                    message: "CSV Parse Failure: " + error.message,
+                    key: "IMPORT.ERROR_PARSE_FAILURE_CSV",
+                    variables: { ERROR: error.message }
+                }));
+
             return deferred.promise;
         }
 
@@ -408,7 +435,7 @@ angular.module('import').factory('connectionParseService',
             console.error(error);
             const deferred = $q.defer();
             deferred.reject(new ParseError({
-                message: "YAML Parse Failure: "+ error.message,
+                message: "YAML Parse Failure: " + error.message,
                 key: "IMPORT.ERROR_PARSE_FAILURE_YAML",
                 variables: { ERROR: error.message }
             }));
@@ -445,7 +472,7 @@ angular.module('import').factory('connectionParseService',
             console.error(error);
             const deferred = $q.defer();
             deferred.reject(new ParseError({
-                message: "JSON Parse Failure: "+ error.message,
+                message: "JSON Parse Failure: " + error.message,
                 key: "IMPORT.ERROR_PARSE_FAILURE_JSON",
                 variables: { ERROR: error.message }
             }));

From b1225894f6e725531d2006f4d3d1160dcdd6f0c8 Mon Sep 17 00:00:00 2001
From: vanntile <33692650+vanntile@users.noreply.github.com>
Date: Fri, 14 Apr 2023 08:55:44 +0300
Subject: [PATCH 178/289] GUACAMOLE-1770: add RDP Romanian keyboard layout

---
 .../src/main/resources/org/apache/guacamole/protocols/rdp.json   | 1 +
 guacamole/src/main/frontend/src/translations/en.json             | 1 +
 guacamole/src/main/frontend/src/translations/es.json             | 1 +
 guacamole/src/main/frontend/src/translations/fr.json             | 1 +
 guacamole/src/main/frontend/src/translations/it.json             | 1 +
 5 files changed, 5 insertions(+)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
index eab2125a3..b46a8a80c 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
@@ -109,6 +109,7 @@
                         "pl-pl-qwerty",
                         "pt-br-qwerty",
                         "pt-pt-qwerty",
+                        "ro-ro-qwerty",
                         "sv-se-qwerty",
                         "da-dk-qwerty",
                         "tr-tr-qwerty"
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 12ccd97de..9de550837 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -661,6 +661,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portuguese Brazilian (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portuguese (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY" : "Romanian (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Swedish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turkish-Q (Qwerty)",
diff --git a/guacamole/src/main/frontend/src/translations/es.json b/guacamole/src/main/frontend/src/translations/es.json
index 24e58c9c5..ffbb25c0d 100644
--- a/guacamole/src/main/frontend/src/translations/es.json
+++ b/guacamole/src/main/frontend/src/translations/es.json
@@ -563,6 +563,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY"    : "Polaco (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY"    : "Portugués Brazileño (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY"    : "Portugués (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY"    : "Rumano (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY"    : "Sueco (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY"    : "Danés (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY"    : "Turco-Q (Qwerty)",
diff --git a/guacamole/src/main/frontend/src/translations/fr.json b/guacamole/src/main/frontend/src/translations/fr.json
index 4a19ef4b8..2c7d5bc8e 100644
--- a/guacamole/src/main/frontend/src/translations/fr.json
+++ b/guacamole/src/main/frontend/src/translations/fr.json
@@ -559,6 +559,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polonais (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portugais Brésilien (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugais (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY" : "Roumaine (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Suédois (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danois (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turque (Qwerty)",
diff --git a/guacamole/src/main/frontend/src/translations/it.json b/guacamole/src/main/frontend/src/translations/it.json
index 64aad1f8a..51f584651 100644
--- a/guacamole/src/main/frontend/src/translations/it.json
+++ b/guacamole/src/main/frontend/src/translations/it.json
@@ -329,6 +329,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_FR_FR_AZERTY" : "French (Azerty)",
         "FIELD_OPTION_SERVER_LAYOUT_IT_IT_QWERTY" : "Italian (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polacca (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY" : "Rumeno (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Swedish (Qwerty)",
 
         "NAME" : "RDP",

From a736e062c7fbf13b705205e97a052ae6a952579f Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 17 Apr 2023 15:42:15 +0000
Subject: [PATCH 179/289] GUACAMOLE-926: Correct spacing in import
 translations.

---
 .../main/frontend/src/translations/en.json    | 98 +++++++++----------
 1 file changed, 49 insertions(+), 49 deletions(-)

diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 12f126c9e..e8013e93d 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -189,61 +189,61 @@
 
     "IMPORT": {
 
-        "ACTION_ACKNOWLEDGE": "@:APP.ACTION_ACKNOWLEDGE",
-        "ACTION_BROWSE": "Browse for File",
-        "ACTION_CANCEL": "@:APP.ACTION_CANCEL",
-        "ACTION_CLEAR": "@:APP.ACTION_CLEAR",
-        "ACTION_VIEW_FORMAT_HELP": "View Format Tips",
-        "ACTION_IMPORT": "@:APP.ACTION_IMPORT",
-        "ACTION_IMPORT_CONNECTIONS": "Import Connections",
+        "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_BROWSE"             : "Browse for File",
+        "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
+        "ACTION_CLEAR"              : "@:APP.ACTION_CLEAR",
+        "ACTION_VIEW_FORMAT_HELP"   : "View Format Tips",
+        "ACTION_IMPORT"             : "@:APP.ACTION_IMPORT",
+        "ACTION_IMPORT_CONNECTIONS" : "Import Connections",
 
-        "DIALOG_HEADER_ERROR": "@:APP.DIALOG_HEADER_ERROR",
-        "DIALOG_HEADER_SUCCESS": "Success",
+        "DIALOG_HEADER_ERROR"   : "@:APP.DIALOG_HEADER_ERROR",
+        "DIALOG_HEADER_SUCCESS" : "Success",
 
-        "ERROR_AMBIGUOUS_CSV_HEADER": "Ambiguous CSV Header \"{HEADER}\" could be either a connection attribute or parameter",
-        "ERROR_AMBIGUOUS_PARENT_GROUP": "Both group and parentIdentifier may be not specified at the same time",
-        "ERROR_ARRAY_REQUIRED": "The provided file must contain a list of connections",
-        "ERROR_DUPLICATE_CSV_HEADER": "Duplicate CSV Header: {HEADER}",
-        "ERROR_EMPTY_FILE": "The provided file is empty",
-        "ERROR_INVALID_CSV_HEADER": "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
-        "ERROR_INVALID_MIME_TYPE": "Unsupported file type: \"{TYPE}\"",
-        "ERROR_DETECTED_INVALID_TYPE": "Unsupported file type. Please make sure the file is valid CSV, JSON, or YAML.",
-        "ERROR_INVALID_GROUP": "No group matching \"{GROUP}\" found",
-        "ERROR_INVALID_GROUP_IDENTIFIER": "No connection group with identifier \"{IDENTIFIER}\" found",
-        "ERROR_NO_FILE_SUPPLIED": "Please select a file to import",
-        "ERROR_PARSE_FAILURE_CSV": "Please make sure your file is valid CSV. Parsing failed with error \"{ERROR}\". ",
-        "ERROR_PARSE_FAILURE_JSON": "Please make sure your file is valid JSON. Parsing failed with error \"{ERROR}\". ",
-        "ERROR_PARSE_FAILURE_YAML": "Please make sure your file is valid YAML. Parsing failed with error \"{ERROR}\". ",
-        "ERROR_REQUIRED_NAME": "No connection name found in the provided file",
-        "ERROR_REQUIRED_PROTOCOL": "No connection protocol found in the provided file",
+        "ERROR_AMBIGUOUS_CSV_HEADER"     : "Ambiguous CSV Header \"{HEADER}\" could be either a connection attribute or parameter",
+        "ERROR_AMBIGUOUS_PARENT_GROUP"   : "Both group and parentIdentifier may be not specified at the same time",
+        "ERROR_ARRAY_REQUIRED"           : "The provided file must contain a list of connections",
+        "ERROR_DUPLICATE_CSV_HEADER"     : "Duplicate CSV Header: {HEADER}",
+        "ERROR_EMPTY_FILE"               : "The provided file is empty",
+        "ERROR_INVALID_CSV_HEADER"       : "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
+        "ERROR_INVALID_MIME_TYPE"        : "Unsupported file type: \"{TYPE}\"",
+        "ERROR_DETECTED_INVALID_TYPE"    : "Unsupported file type. Please make sure the file is valid CSV, JSON, or YAML.",
+        "ERROR_INVALID_GROUP"            : "No group matching \"{GROUP}\" found",
+        "ERROR_INVALID_GROUP_IDENTIFIER" : "No connection group with identifier \"{IDENTIFIER}\" found",
+        "ERROR_NO_FILE_SUPPLIED"         : "Please select a file to import",
+        "ERROR_PARSE_FAILURE_CSV"        : "Please make sure your file is valid CSV. Parsing failed with error \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_JSON"       : "Please make sure your file is valid JSON. Parsing failed with error \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_YAML"       : "Please make sure your file is valid YAML. Parsing failed with error \"{ERROR}\". ",
+        "ERROR_REQUIRED_NAME"            : "No connection name found in the provided file",
+        "ERROR_REQUIRED_PROTOCOL"        : "No connection protocol found in the provided file",
 
-        "FIELD_PLACEHOLDER_FILTER": "@:APP.FIELD_PLACEHOLDER_FILTER",
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
-        "HELP_CSV_DESCRIPTION": "A connection import CSV file has one connection record per row. Each column will specify a connection field. At minimum the connection name and protocol must be specified.",
-        "HELP_CSV_EXAMPLE": "name,protocol,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,",
-        "HELP_CSV_MORE_DETAILS": "The CSV header for each row specifies the connection field. The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. In most cases, there should be no conflict between fields, but if needed, an \" (attribute)\" or \" (parameter)\" suffix may be added to disambiguate. Lists of user or user group identifiers must be semicolon-separated.¹",
-        "HELP_FILE_TYPE_DESCRIPTION": "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created.",
-        "HELP_FILE_TYPE_HEADER": "File Types",
-        "HELP_JSON_DESCRIPTION": "A connection import JSON file is a list of connection objects. At minimum the connection name and protocol must be specified in each connection object.",
-        "HELP_JSON_EXAMPLE": "[\n  \\{\n    \"name\": \"conn1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"hostname\": \"conn1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac user 1\", \"guac user 2\" ],\n    \"groups\": [ \"Connection 1 Users\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"hostname\": \"conn2.web.com\" \\},\n    \"group\": \"ROOT/Parent Group\",\n    \"users\": [ \"guac user 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"hostname\": \"conn3.web.com\" \\},\n    \"group\": \"ROOT/Parent Group/Child Group\",\n    \"users\": [ \"guac user 2\", \"guac user 3\" ]\n  \\},\n  \\{\n    \"name\": \"conn4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
-        "HELP_JSON_MORE_DETAILS": "The connection group ID that the connection should be imported into may be directly specified with a \"parentIdentifier\" field, or the path to the parent group may be specified using a \"group\" field as shown below. An array of user and user group identifiers to grant access to may be specified per connection.",
-        "HELP_SEMICOLON_FOOTNOTE": "If present, semicolons can be escaped with a backslash, e.g. \"first\\\\;last\"",
-        "HELP_UPLOAD_DROP_TITLE": "Drop a File Here",
-        "HELP_UPLOAD_FILE_TYPES": "CSV, JSON, or YAML",
-        "HELP_YAML_DESCRIPTION": "A connection import YAML file is a list of connection objects with exactly the same structure as the JSON format.",
-        "HELP_YAML_EXAMPLE": "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n    - guac user 1\n    - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n    - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n    - guac user 2\n    - guac user 3\n  - name: conn4\n    protocol: kubernetes",
-        "INFO_CONNECTIONS_IMPORTED_SUCCESS": "{NUMBER} {NUMBER, plural, one{connection} other{connections}} imported successfully.",
+        "HELP_CSV_DESCRIPTION"              : "A connection import CSV file has one connection record per row. Each column will specify a connection field. At minimum the connection name and protocol must be specified.",
+        "HELP_CSV_EXAMPLE"                  : "name,protocol,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,",
+        "HELP_CSV_MORE_DETAILS"             : "The CSV header for each row specifies the connection field. The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. In most cases, there should be no conflict between fields, but if needed, an \" (attribute)\" or \" (parameter)\" suffix may be added to disambiguate. Lists of user or user group identifiers must be semicolon-separated.¹",
+        "HELP_FILE_TYPE_DESCRIPTION"        : "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created.",
+        "HELP_FILE_TYPE_HEADER"             : "File Types",
+        "HELP_JSON_DESCRIPTION"             : "A connection import JSON file is a list of connection objects. At minimum the connection name and protocol must be specified in each connection object.",
+        "HELP_JSON_EXAMPLE"                 : "[\n  \\{\n    \"name\": \"conn1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"hostname\": \"conn1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac user 1\", \"guac user 2\" ],\n    \"groups\": [ \"Connection 1 Users\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"hostname\": \"conn2.web.com\" \\},\n    \"group\": \"ROOT/Parent Group\",\n    \"users\": [ \"guac user 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"hostname\": \"conn3.web.com\" \\},\n    \"group\": \"ROOT/Parent Group/Child Group\",\n    \"users\": [ \"guac user 2\", \"guac user 3\" ]\n  \\},\n  \\{\n    \"name\": \"conn4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
+        "HELP_JSON_MORE_DETAILS"            :  "The connection group ID that the connection should be imported into may be directly specified with a \"parentIdentifier\" field, or the path to the parent group may be specified using a \"group\" field as shown below. An array of user and user group identifiers to grant access to may be specified per connection.",
+        "HELP_SEMICOLON_FOOTNOTE"           : "If present, semicolons can be escaped with a backslash, e.g. \"first\\\\;last\"",
+        "HELP_UPLOAD_DROP_TITLE"            : "Drop a File Here",
+        "HELP_UPLOAD_FILE_TYPES"            : "CSV, JSON, or YAML",
+        "HELP_YAML_DESCRIPTION"             : "A connection import YAML file is a list of connection objects with exactly the same structure as the JSON format.",
+        "HELP_YAML_EXAMPLE"                 : "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n    - guac user 1\n    - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n    - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n    - guac user 2\n    - guac user 3\n  - name: conn4\n    protocol: kubernetes",
+        "INFO_CONNECTIONS_IMPORTED_SUCCESS" : "{NUMBER} {NUMBER, plural, one{connection} other{connections}} imported successfully.",
         
-        "SECTION_HEADER_CONNECTION_IMPORT": "Connection Import",
-        "SECTION_HEADER_HELP_CONNECTION_IMPORT_FILE": "Connection Import File Format",
-        "SECTION_HEADER_CSV": "CSV Format",
-        "SECTION_HEADER_JSON": "JSON Format",
-        "SECTION_HEADER_YAML": "YAML Format",
+        "SECTION_HEADER_CONNECTION_IMPORT"           : "Connection Import",
+        "SECTION_HEADER_HELP_CONNECTION_IMPORT_FILE" : "Connection Import File Format",
+        "SECTION_HEADER_CSV"                         : "CSV Format",
+        "SECTION_HEADER_JSON"                        : "JSON Format",
+        "SECTION_HEADER_YAML"                        : "YAML Format",
 
-        "TABLE_HEADER_ERRORS": "Errors",
-        "TABLE_HEADER_NAME": "Name",
-        "TABLE_HEADER_PROTOCOL": "Protocol",
-        "TABLE_HEADER_ROW_NUMBER": "Row #"
+        "TABLE_HEADER_ERRORS"     : "Errors",
+        "TABLE_HEADER_NAME"       : "Name",
+        "TABLE_HEADER_PROTOCOL"   : "Protocol",
+        "TABLE_HEADER_ROW_NUMBER" : "Row #"
     },
 
     "DATA_SOURCE_DEFAULT" : {

From d0876cdc712a26eb233601f9fc527b0a116f38e8 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 17 Apr 2023 21:57:30 +0000
Subject: [PATCH 180/289] GUACAMOLE-926: Allow updating objects via directory
 patch.

---
 .../src/app/rest/types/DirectoryPatch.js      |  7 +-
 .../rest/directory/DirectoryResource.java     | 81 ++++++++++++++++---
 2 files changed, 77 insertions(+), 11 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
index fb2a3c050..664dcdcdf 100644
--- a/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
+++ b/guacamole/src/main/frontend/src/app/rest/types/DirectoryPatch.js
@@ -59,7 +59,7 @@ angular.module('rest').factory('DirectoryPatch', [function defineDirectoryPatch(
         this.path = template.path || '/';
 
         /**
-         * The object being added, or undefined if deleting.
+         * The object being added/replaced, or undefined if deleting.
          *
          * @type {DirectoryObject}
          */
@@ -77,6 +77,11 @@ angular.module('rest').factory('DirectoryPatch', [function defineDirectoryPatch(
          */
         ADD : 'add',
 
+        /**
+         * Replaces (updates) the specified object from the relation.
+         */
+        REPLACE : 'replace',
+
         /**
          * Removes the specified object from the relation.
          */
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index 0230051a9..0ea12c3ef 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -478,18 +478,18 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
     /**
      * Applies the given object patches, updating the underlying directory
-     * accordingly. This operation supports addition and removal of objects
-     * through the "add" and "remove" patch operation. The path of each patch
-     * operation is of the form "/ID" where ID is the identifier of the object
-     * being modified. In the case of object creation, the identifier is
-     * ignored, as the identifier will be automatically provided. This operation
-     * is atomic.
+     * accordingly. This operation supports addition, replacement, and removal of
+     * objects through the "add", "replace", or "remove" patch operations. The
+     * path of each patch operation is of the form "/ID" where ID is the 
+     * identifier of the object being modified. In the case of object creation, 
+     * the identifier is ignored, as the identifier will be automatically 
+     * provided. This operation is atomic.
      *
      * @param patches
      *     The patches to apply for this request.
      *
      * @throws GuacamoleException
-     *     If an error occurs while adding, updating, or removing objects.
+     *     If an error occurs while adding, replacing, or removing objects.
      *
      * @return
      *     A response describing the outcome of each patch. Only the identifier
@@ -523,8 +523,9 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                             "executed.");
 
                 // Keep a list of all objects that have been successfully
-                // added or removed
+                // added, replaced, or removed
                 Collection<InternalType> addedObjects = new ArrayList<>();
+                Collection<InternalType> replacedObjects = new ArrayList<>();
                 Collection<String> removedIdentifiers = new ArrayList<>();
 
                 // A list of all responses associated with the successful
@@ -590,7 +591,56 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                     }
 
-                    // Append each identifier to the list, to be removed atomically
+                    else if (op == APIPatch.Operation.replace) {
+
+                        // The identifier of the object to be replaced
+                        String identifier = path.substring(1);
+
+                        InternalType original = null;
+
+                        try {
+
+                            // Fetch the object to be updated
+                            original = directory.get(identifier);
+                            
+                            // Apply the changes to the original object
+                            translator.applyExternalChanges(
+                                    original, patch.getValue());
+
+                            // Update the directory
+                            directory.update(original);
+
+                            replacedObjects.add(original);
+
+                            // Add a success outcome describing the replacement
+                            APIPatchOutcome response = new APIPatchOutcome(
+                                    op, identifier, path);
+                            patchOutcomes.add(response);
+                            
+                        }
+
+                        catch (GuacamoleException | RuntimeException | Error e) {
+                            failed = true;
+                            fireDirectoryFailureEvent(
+                                    DirectoryEvent.Operation.UPDATE,
+                                    identifier, original, e);
+
+                            // Attempt to generate an API Patch error using the
+                            // caught exception
+                            APIPatchError patchError = createPatchFailure(
+                                    op, identifier, path, e);
+
+                            if (patchError != null)
+                                patchOutcomes.add(patchError);
+
+                            // If an unexpected failure occurs, fall through to
+                            // the standard API error handling
+                            else
+                                throw e;
+
+                        }
+                    }
+
                     else if (op == APIPatch.Operation.remove) {
 
                         String identifier = path.substring(1);
@@ -633,7 +683,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
                     else {
                         throw new GuacamoleUnsupportedException(
                                 "Unsupported patch operation \"" + op + "\". "
-                                + "Only add and remove are supported.");
+                                + "Only add, replace, and remove are supported.");
                     }
 
 
@@ -666,6 +716,17 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                 }
 
+                // Fire directory success events for each updated object
+                Iterator<InternalType> updatedIterator = replacedObjects.iterator();
+                while (updatedIterator.hasNext()) {
+
+                    InternalType internal = updatedIterator.next();
+                    fireDirectorySuccessEvent(
+                            DirectoryEvent.Operation.UPDATE,
+                            internal.getIdentifier(), internal);
+
+                }
+
                 // Fire directory success events for each removed object
                 Iterator<String> removedIterator = removedIdentifiers.iterator();
                 while (removedIterator.hasNext()) {

From 896cd48eca786f9016fd2e296bbed1a87eb9b1e6 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 17 Apr 2023 18:24:56 +0000
Subject: [PATCH 181/289] GUACAMOLE-926: Add user-selectable options for
 connection batch import to allow connection / permission replacement.

---
 .../importConnectionsController.js            | 168 +++----
 .../directives/connectionImportErrors.js      | 109 ++++-
 .../import/services/connectionParseService.js | 429 ++++++++++++------
 .../frontend/src/app/import/styles/import.css |  30 ++
 .../import/templates/connectionErrors.html    |   4 +
 .../import/templates/connectionImport.html    |  22 +
 .../import/types/ConnectionImportConfig.js    | 103 +++++
 .../src/app/import/types/ImportConnection.js  |  35 +-
 .../app/import/types/ImportConnectionError.js |   8 +
 .../src/app/import/types/ParseResult.js       |  38 +-
 .../directives/guacSettingsConnections.js     |  18 +
 .../templates/settingsConnections.html        |   2 +-
 .../src/main/frontend/src/images/question.svg |  64 +++
 .../main/frontend/src/translations/en.json    |  51 ++-
 14 files changed, 808 insertions(+), 273 deletions(-)
 create mode 100644 guacamole/src/main/frontend/src/app/import/types/ConnectionImportConfig.js
 create mode 100644 guacamole/src/main/frontend/src/images/question.svg

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index f78f262e6..41f13fb55 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -90,12 +90,13 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     const userGroupService       = $injector.get('userGroupService');
 
     // Required types
-    const DirectoryPatch      = $injector.get('DirectoryPatch');
-    const Error               = $injector.get('Error');
-    const ParseError          = $injector.get('ParseError');
-    const PermissionSet       = $injector.get('PermissionSet');
-    const User                = $injector.get('User');
-    const UserGroup           = $injector.get('UserGroup');
+    const ConnectionImportConfig = $injector.get('ConnectionImportConfig');
+    const DirectoryPatch         = $injector.get('DirectoryPatch');
+    const Error                  = $injector.get('Error');
+    const ParseError             = $injector.get('ParseError');
+    const PermissionSet          = $injector.get('PermissionSet');
+    const User                   = $injector.get('User');
+    const UserGroup              = $injector.get('UserGroup');
 
     /**
      * The result of parsing the current upload, if successful.
@@ -137,6 +138,14 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      */
     $scope.mimeType = null;
 
+    /**
+     * The name of the file that's currently being uploaded, or has yet to
+     * be imported, if any.
+     *
+     * @type {String}
+     */
+    $scope.fileName = null;
+
     /**
      * The raw string contents of the uploaded file, if any.
      *
@@ -152,6 +161,13 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
      */
     $scope.fileReader = null;
 
+    /**
+     * The configuration options for this import, to be chosen by the user.
+     *
+     * @type {ConnectionImportConfig}
+     */
+    $scope.importConfig = new ConnectionImportConfig();
+
     /**
      * Clear all file upload state.
      */
@@ -178,10 +194,9 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
 
     /**
      * Create all users and user groups mentioned in the import file that don't
-     * already exist in the current data source. If either creation fails, any
-     * already-created entities will be cleaned up, and the returned promise
-     * will be rejected.
-     *
+     * already exist in the current data source. Return an object describing the
+     * result of the creation requests.
+     * 
      * @param {ParseResult} parseResult
      *     The result of parsing the user-supplied import file.
      *
@@ -222,30 +237,11 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                     value: new UserGroup({ identifier })
                 }));
 
-            // First, create any required users and groups, automatically cleaning
-            // up any created already-created entities if a call fails.
-            // NOTE: Generally we'd want to do these calls in parallel, using
-            // `$q.all()`. However, `$q.all()` rejects immediately if any of the
-            // wrapped promises reject, so the users may not be ready for cleanup
-            // at the time that the group promise rejects, or vice versa. While
-            // it would be possible to juggle promises and still do these calls
-            // in parallel, the code gets pretty complex, so for readability and
-            // simplicity, they are executed serially. The performance cost of
-            // doing so should be low.
-            return userService.patchUsers(dataSource, userPatches).then(userResponse => {
-
-                // Then, if that succeeds, create any required groups
-                return userGroupService.patchUserGroups(dataSource, groupPatches).then(
-
-                    // If user group creation succeeds, resolve the returned promise
-                    userGroupResponse => ({ userResponse, userGroupResponse}))
-
-                // If the group creation request fails, clean up any created users
-                .catch(groupFailure => {
-                    cleanUpUsers(userResponse);
-                    return groupFailure;
-                });
-
+            // Create all the users and groups
+            return $q.all({
+                userResponse: userService.patchUsers(dataSource, userPatches),
+                userGroupResponse: userGroupService.patchUserGroups(
+                        dataSource, groupPatches)
             });
 
         });
@@ -322,52 +318,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         return $q.all({ ...userRequests, ...groupRequests });
     }
 
-    // Given a PATCH API response, create an array of patches to delete every
-    // entity created in the original request that generated this response
-    const createDeletionPatches = creationResponse =>
-        creationResponse.patches.map(patch =>
-
-            // Add one deletion patch per original creation patch
-            new DirectoryPatch({
-                op: 'remove',
-                path: '/' + patch.identifier
-            }));
-
-    /**
-     * Given a successful response to a connection PATCH request, make another
-     * request to delete every created connection in the provided request, i.e.
-     * clean up every connection that was created.
-     *
-     * @param {DirectoryPatchResponse} creationResponse
-     *     The response to the connection PATCH request.
-     *
-     * @returns {DirectoryPatchResponse}
-     *     The response to the PATCH deletion request.
-     */
-    function cleanUpConnections(creationResponse) {
-
-        return connectionService.patchConnections(
-            $routeParams.dataSource, createDeletionPatches(creationResponse));
-
-    }
-
-    /**
-     * Given a successful response to a user PATCH request, make another
-     * request to delete every created user in the provided request.
-     *
-     * @param {DirectoryPatchResponse} creationResponse
-     *     The response to the user PATCH request.
-     *
-     * @returns {DirectoryPatchResponse}
-     *     The response to the PATCH deletion request.
-     */
-    function cleanUpUsers(creationResponse) {
-
-        return userService.patchUsers(
-            $routeParams.dataSource, createDeletionPatches(creationResponse));
-
-    }
-
     /**
      * Process a successfully parsed import file, creating any specified
      * connections, creating and granting permissions to any specified users
@@ -398,6 +348,9 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
             // If connection creation is successful, create users and groups
             createUsersAndGroups(parseResult).then(() =>
 
+                // Grant any new permissions to users and groups. NOTE: Any
+                // existing permissions for updated connections will NOT be
+                // removed - only new permissions will be added.
                 grantConnectionPermissions(parseResult, connectionResponse)
                         .then(() => {
 
@@ -409,7 +362,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                         title      : 'IMPORT.DIALOG_HEADER_SUCCESS',
                         text       : {
                             key: 'IMPORT.INFO_CONNECTIONS_IMPORTED_SUCCESS',
-                            variables: { NUMBER: parseResult.patches.length }
+                            variables: { NUMBER: parseResult.connectionCount }
                         },
 
                         // Add a button to acknowledge and redirect to
@@ -428,14 +381,10 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
                     });
                 }))
 
-            // If an error occurs while trying to users or groups, or while trying
-            // to assign permissions to users or groups, clean up the already-created
-            // connections, displaying an error to the user along with a blank slate
-            // so they can fix their problems and try again.
-            .catch(error => {
-                cleanUpConnections(connectionResponse);
-                handleError(error);
-            }))
+            // If an error occurs while trying to create users or groups, 
+            // display the error to the user.
+            .catch(handleError)
+        )
 
         // If an error occurred when the call to create the connections was made,
         // skip any further processing - the user will have a chance to fix the
@@ -531,7 +480,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
             };
 
         // Make the call to process the data into a series of patches
-        processDataCallback(data)
+        processDataCallback($scope.importConfig, data)
 
             // Send the data off to be imported if parsing is successful
             .then(handleParseSuccess)
@@ -688,9 +637,42 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
     };
 
     /**
-     * The name of the file that's currently being uploaded, or has yet to
-     * be imported, if any.
+     * Display a modal with the given title and text keys.
+     *
+     * @param {String} titleKey
+     *     The translation key to use for the title of the modal.
+     *
+     * @param {String} contentKey
+     *     The translation key to use for the text contents of the modal.
      */
-    $scope.fileName = null;
+    const showModal = (titleKey, contentKey) => guacNotification.showStatus({
+
+        // The provided modal contents
+        title: titleKey,
+        text: { key: contentKey },
+
+        // Add a button to hide the modal
+        actions    : [{
+            name      : 'IMPORT.ACTION_ACKNOWLEDGE',
+            callback  : () => guacNotification.showStatus(false)
+        }]
+
+    });
+
+    /**
+     * Display a modal with information about the existing connection
+     * replacement option.
+     */
+    $scope.showConnectionReplaceHelp = () => showModal(
+            'IMPORT.HELP_REPLACE_CONNECTION_TITLE',
+            'IMPORT.HELP_REPLACE_CONNECTION_CONTENT');
+
+    /**
+     * Display a modal with information about the existing connection permission
+     * replacement option.
+     */
+    $scope.showPermissionReplaceHelp = () => showModal(
+            'IMPORT.HELP_REPLACE_PERMISSION_TITLE',
+            'IMPORT.HELP_REPLACE_PERMISSION_CONTENT');
 
 }]);
diff --git a/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js b/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
index d6a14c45e..17d2fef4b 100644
--- a/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
+++ b/guacamole/src/main/frontend/src/app/import/directives/connectionImportErrors.js
@@ -59,6 +59,7 @@ angular.module('import').directive('connectionImportErrors', [
             function connectionImportErrorsController($scope, $injector) {
 
         // Required types
+        const DirectoryPatch        = $injector.get('DirectoryPatch');
         const DisplayErrorList      = $injector.get('DisplayErrorList');
         const ImportConnectionError = $injector.get('ImportConnectionError');
         const ParseError            = $injector.get('ParseError');
@@ -93,6 +94,7 @@ angular.module('import').directive('connectionImportErrors', [
         $scope.errorOrder = new SortOrder([
             'rowNumber',
             'name',
+            'group',
             'protocol',
             'errors',
         ]);
@@ -105,6 +107,7 @@ angular.module('import').directive('connectionImportErrors', [
         $scope.filteredErrorProperties = [
             'rowNumber',
             'name',
+            'group',
             'protocol',
             'errors',
         ];
@@ -117,13 +120,18 @@ angular.module('import').directive('connectionImportErrors', [
          *     The result of parsing the connection import file.
          *
          * @param {Integer} index
-         *     The current row within the import file, 0-indexed.
+         *     The current row within the patches array, 0-indexed.
+         *
+         * @param {Integer} row
+         *     The current row within the original connection, 0-indexed.
+         *     If any REMOVE patches are present, this may be greater than
+         *     the index.
          *
          * @returns {ImportConnectionError}
          *     The connection error object associated with the given row in the
          *     given parse result.
          */
-        const generateConnectionError = (parseResult, index) => {
+        const generateConnectionError = (parseResult, index, row) => {
 
             // Get the patch associated with the current row
             const patch = parseResult.patches[index];
@@ -133,11 +141,12 @@ angular.module('import').directive('connectionImportErrors', [
 
             return new ImportConnectionError({
 
-                // Add 1 to the index to get the position in the file
-                rowNumber: index + 1,
+                // Add 1 to the provided row to get the position in the file
+                rowNumber: row + 1,
 
-                // Basic connection information - name and protocol.
+                // Basic connection information - name, group, and protocol.
                 name: connection.name,
+                group: parseResult.groupPaths[index],
                 protocol: connection.protocol,
 
                 // The human-readable error messages
@@ -159,28 +168,67 @@ angular.module('import').directive('connectionImportErrors', [
             // updated until all translations are ready.
             const translationPromises = [];
 
+            // Any error returned from the API specifically associated with the
+            // preceding REMOVE patch
+            let removeError = null;
+
+            // Fetch the API error, if any, of the patch at the given index
+            const getAPIError = index =>
+                    _.get(patchFailure, ['patches', index, 'error']);
+
+            // The row number for display. Unlike the index, this number will
+            // skip any REMOVE patches. In other words, this is the index of
+            // connections within the original import file.
+            let row = 0;
+
             // Set up the list of connection errors based on the existing parse
             // result, with error messages fetched from the patch failure
-            const connectionErrors = parseResult.patches.map(
-                    (patch, index) => {
+            const connectionErrors = parseResult.patches.reduce(
+                    (errors, patch, index) => {
+
+                // Do not process display REMOVE patches - they are always
+                // followed by ADD patches containing the actual content
+                // (and errors, if any)
+                if (patch.op === DirectoryPatch.Operation.REMOVE) {
+
+                    // Save the API error, if any, so it can be displayed
+                    // alongside the connection information associated with the
+                    // following ADD patch
+                    removeError = getAPIError(index);
+
+                    // Do not add an entry for this remove patch - it should
+                    // always be followed by a corresponding CREATE patch
+                    // containing the relevant connection information
+                    return errors;
+                    
+                }
 
                 // Generate a connection error for display
-                const connectionError = generateConnectionError(parseResult, index);
+                const connectionError = generateConnectionError(
+                        parseResult, index, row++);
 
-                // Set the error from the PATCH request, if there is one
-                const error = _.get(patchFailure, ['patches', index, 'error']);
-                if (error)
+                // Add the error associated with the previous REMOVE patch, if
+                // any, to the error associated with the current patch, if any
+                const apiErrors = [ removeError, getAPIError(index) ];
 
-                    // Fetch the translation and update it when it's ready
-                    translationPromises.push($translate(
+                // Clear the previous REMOVE patch error after consuming it
+                removeError = null;
+
+                // Go through each potential API error
+                apiErrors.forEach(error =>
+
+                    // If the API error exists, fetch the translation and
+                    // update it when it's ready
+                    error && translationPromises.push($translate(
                         error.key, error.variables)
                         .then(translatedError =>
                             connectionError.errors.getArray().push(translatedError)
-                        ));
+                        )));
 
-                return connectionError;
+                errors.push(connectionError);
+                return errors;
                 
-            });
+            }, []);
 
             // Once all the translations have been completed, update the
             // connectionErrors all in one go, to ensure no excessive reloading
@@ -206,13 +254,25 @@ angular.module('import').directive('connectionImportErrors', [
             // entirely - if set, they will be from the previous file and no
             // longer relevant.
 
+            // The row number for display. Unlike the index, this number will
+            // skip any REMOVE patches. In other words, this is the index of
+            // connections within the original import file.
+            let row = 0;
+
             // Set up the list of connection errors based on the updated parse
             // result
-            const connectionErrors = parseResult.patches.map(
-                    (patch, index) => {
+            const connectionErrors = parseResult.patches.reduce(
+                    (errors, patch, index) => {
+
+                // Do not process display REMOVE patches - they are always
+                // followed by ADD patches containing the actual content
+                // (and errors, if any)
+                if (patch.op === DirectoryPatch.Operation.REMOVE)
+                    return errors;
 
                 // Generate a connection error for display
-                const connectionError = generateConnectionError(parseResult, index);
+                const connectionError = generateConnectionError(
+                        parseResult, index, row++);
 
                 // Go through the errors and check if any are translateable
                 connectionError.errors.getArray().forEach(
@@ -231,11 +291,18 @@ angular.module('import').directive('connectionImportErrors', [
                                 connectionError.errors.getArray()[errorIndex] = translatedError;
                             }));
 
+                    // If the error is not a known translatable type, add the
+                    // message directly to the error array
+                    else
+                         connectionError.errors.getArray()[errorIndex] = (
+                             error.message ? error.message : error);
+
                 });
 
-                return connectionError;
+                errors.push(connectionError);
+                return errors;
 
-            });
+            }, []);
 
             // Once all the translations have been completed, update the
             // connectionErrors all in one go, to ensure no excessive reloading
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index e332ab781..90d1bf27b 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -41,11 +41,13 @@ angular.module('import').factory('connectionParseService',
         ['$injector', function connectionParseService($injector) {
 
     // Required types
-    const Connection          = $injector.get('Connection');
-    const DirectoryPatch      = $injector.get('DirectoryPatch');
-    const ParseError          = $injector.get('ParseError');
-    const ParseResult         = $injector.get('ParseResult');
-    const TranslatableMessage = $injector.get('TranslatableMessage');
+    const Connection             = $injector.get('Connection');
+    const ConnectionImportConfig = $injector.get('ConnectionImportConfig');
+    const DirectoryPatch         = $injector.get('DirectoryPatch');
+    const ImportConnection       = $injector.get('ImportConnection');
+    const ParseError             = $injector.get('ParseError');
+    const ParseResult            = $injector.get('ParseResult');
+    const TranslatableMessage    = $injector.get('TranslatableMessage');
 
     // Required services
     const $q                     = $injector.get('$q');
@@ -92,42 +94,69 @@ angular.module('import').factory('connectionParseService',
     }
 
     /**
-     * Returns a promise that resolves to an object containing both a map of
-     * connection group paths to group identifiers and a set of all known group
-     * identifiers.
+     * A collection of connection-group-tree-derived maps that are useful for
+     * processing connections.
      *
-     * The resolved object will contain a "groupLookups" key with a map of group
-     * paths to group identifier, as well as a "identifierSet" key containing a
-     * set of all known group identifiers.
-     *
-     * The idea is that a user-provided import file might directly specify a
-     * parentIdentifier, or it might specify a named group path like "ROOT",
-     * "ROOT/parent", or "ROOT/parent/child". The resolved "groupLookups" field
-     * will map all of the above to the identifier of the appropriate group, if
-     * defined. The "identifierSet" field can be used to check if a given group
-     * identifier is known.
-     *
-     * @returns {Promise.<Object>}
-     *     A promise that resolves to an object containing a map of group paths
-     *     to group identifiers, as well as set of all known group identifiers.
+     * @constructor
+     * @param {TreeLookups|{}} template
+     *     The object whose properties should be copied within the new
+     *     ConnectionImportConfig.
      */
-    function getGroupLookups() {
+    const TreeLookups = template => ({
+
+        /**
+         * A map of all known group paths to the corresponding identifier for
+         * that group. The is that a user-provided import file might directly
+         * specify a named group path like "ROOT", "ROOT/parent", or
+         * "ROOT/parent/child". This field field will map all of the above to
+         * the identifier of the appropriate group, if defined.
+         *
+         * @type Object.<String, String>
+         */
+        groupPathsByIdentifier: template.groupPathsByIdentifier || {},
+
+        /**
+         * A map of all known group identifiers to the path of the corresponding
+         * group. These paths are all of the form "ROOT/parent/child".
+         *
+         * @type Object.<String, String>
+         */
+        groupIdentifiersByPath: template.groupIdentifiersByPath || {},
+
+        /**
+         * A map of group identifier, to connection name, to connection 
+         * identifier. These paths are all of the form "ROOT/parent/child". The 
+         * idea is that existing connections can be found by checking if a
+         * connection already exists with the same parent group, and with the
+         * same name as an user-supplied import connection.
+         *
+         * @type Object.<String, String>
+         */
+        connectionIdsByGroupAndName : template.connectionIdsByGroupAndName || {}
+
+    });
+
+    /**
+     * Returns a promise that resolves to a TreeLookups object containing maps
+     * useful for processing user-supplied connections to be imported, derived
+     * from the current connection group tree, starting at the ROOT group.
+     *
+     * @returns {Promise.<TreeLookups>}
+     *     A promise that resolves to a TreeLookups object containing maps
+     *     useful for processing connections.
+     */
+    function getTreeLookups() {
 
         // The current data source - defines all the groups that the connections
         // might be imported into
         const dataSource = $routeParams.dataSource;
 
-        const deferredGroupLookups = $q.defer();
+        const deferredTreeLookups = $q.defer();
 
         connectionGroupService.getConnectionGroupTree(dataSource).then(
                 rootGroup => {
 
-            // An object mapping group paths to group identifiers
-            const groupLookups = {};
-
-            // An object mapping group identifiers to the boolean value true,
-            // i.e. a set of all known group identifiers
-            const identifierSet = {};
+            const lookups = new TreeLookups({});
 
             // Add the specified group to the lookup, appending all specified
             // prefixes, and then recursively call saveLookups for all children
@@ -137,11 +166,18 @@ angular.module('import').factory('connectionParseService',
                 // To get the path for the current group, add the name
                 const currentPath = prefix + group.name;
 
-                // Add the current path to the lookup
-                groupLookups[currentPath] = group.identifier;
+                // Add the current path to the identifier map
+                lookups.groupPathsByIdentifier[currentPath] = group.identifier;
 
-                // Add this group identifier to the set
-                identifierSet[group.identifier] = true;
+                // Add the current identifier to the path map
+                lookups.groupIdentifiersByPath[group.identifier] = currentPath;
+
+                // Add each connection to the connection map
+                _.forEach(group.childConnections,
+                    connection => _.setWith(
+                        lookups.connectionIdsByGroupAndName,
+                        [group.identifier, connection.name],
+                        connection.identifier, Object));
 
                 // Add each child group to the lookup
                 const nextPrefix = currentPath + "/";
@@ -154,100 +190,175 @@ angular.module('import').factory('connectionParseService',
             saveLookups("", rootGroup);
 
             // Resolve with the now fully-populated lookups
-            deferredGroupLookups.resolve({ groupLookups, identifierSet });
+            deferredTreeLookups.resolve(lookups);
 
         });
 
-        return deferredGroupLookups.promise;
+        return deferredTreeLookups.promise;
     }
 
     /**
      * Returns a promise that will resolve to a transformer function that will
-     * take an object that may contain a "group" field, replacing it if present
-     * with a "parentIdentifier". If both a "group" and "parentIdentifier" field
-     * are present on the provided object, or if no group exists at the specified
-     * path, the function will throw a ParseError describing the failure.
+     * perform various checks and transforms relating to the connection group
+     * tree heirarchy. It will:
+     * - Ensure that a connection specifies either a valid group path (no path
+     *   defaults to ROOT), or a valid parent group identifier, but not both
+     * - Ensure that this connection does not duplicate another connection
+     *   earlier in the import file
+     * - Handle import connections that match existing connections connections
+     *   based on the provided import config.
      *
-     * The group may begin with the root identifier, a leading slash, or may omit
-     * the root identifier entirely. Additionally, the group may optionally end
-     * with a trailing slash.
+     * The group set on the connection may begin with the root identifier, a
+     * leading slash, or may omit the root identifier entirely. The group may
+     * optionally end with a trailing slash.
      *
-     * @returns {Promise.<Function<Object, Object>>}
-     *     A promise that will resolve to a function that will transform a
-     *     "group" field into a "parentIdentifier" field if possible.
+     * @param {ConnectionImportConfig} importConfig
+     *     The configuration options selected by the user prior to import.
+     *
+     * @returns {Promise.<Function<ImportConnection, ImportConnection>>}
+     *     A promise that will resolve to a function that will apply various
+     *     connection tree based checks and transforms to this connection.
      */
-    function getGroupTransformer() {
-        return getGroupLookups().then(({groupLookups, identifierSet}) =>
-                connection => {
+    function getTreeTransformer(importConfig) {
 
-            const parentIdentifier = connection.parentIdentifier;
+        // A map of group path with connection name, to connection object, used
+        // for detecting duplicate connections within the import file itself
+        const connectionsInFile = {};
 
-            // If there's no group path defined for this connection
-            if (!connection.group) {
+        return getTreeLookups().then(treeLookups => connection => {
 
-                // If the specified parentIdentifier is not specified
-                // at all, or valid, there's nothing to be done
-                if (!parentIdentifier || identifierSet[parentIdentifier])
-                    return connection;
+            const { groupPathsByIdentifier, groupIdentifiersByPath,
+                    connectionIdsByGroupAndName } = treeLookups;
 
-                // If a parent group identifier is present, but not valid
-                if (parentIdentifier)
-                    throw new ParseError({
-                        message: 'No group with identifier: ' + parentIdentifier,
-                        key: 'IMPORT.ERROR_INVALID_GROUP_IDENTIFIER',
-                        variables: { IDENTIFIER: parentIdentifier }
-                    });
-            }
+            const providedIdentifier = connection.parentIdentifier;
+
+            // The normalized group path for this connection, of the form
+            // "ROOT/parent/child"
+            let group;
+            
+            // The identifier for the parent group of this connection
+            let parentIdentifier;
+            
+            // The operator to apply for this connection
+            let op = DirectoryPatch.Operation.ADD;
 
             // If both are specified, the parent group is ambigious
-            if (parentIdentifier)
+            if (providedIdentifier && connection.group)
                 throw new ParseError({
                     message: 'Only one of group or parentIdentifier can be set',
                     key: 'IMPORT.ERROR_AMBIGUOUS_PARENT_GROUP'
                 });
 
-            // The group path extracted from the user-provided connection, to be
-            // translated if needed into an absolute path from the root group
-            let group = connection.group;
-
-            // Allow the group to start with a leading slash instead instead of
-            // explicitly requiring the root connection group
-            if (group.startsWith('/'))
-                group = ROOT_GROUP_IDENTIFIER + group;
-
-            // Allow groups to begin directly with the path underneath the root
-            else if (!group.startsWith(ROOT_GROUP_IDENTIFIER))
-                group = ROOT_GROUP_IDENTIFIER + '/' + group;
-
-            // Allow groups to end with a trailing slash
-            if (group.endsWith('/'))
-                group = group.slice(0, -1);
-
-            // Look up the parent identifier for the specified group path
-            const identifier = groupLookups[group];
-
-            // If the group doesn't match anything in the tree
-            if (!identifier)
+            // If a parent group identifier is present, but not valid
+            else if (providedIdentifier && !groupPathsByIdentifier[providedIdentifier])
                 throw new ParseError({
-                    message: 'No group found named: ' + connection.group,
-                    key: 'IMPORT.ERROR_INVALID_GROUP',
-                    variables: { GROUP: connection.group }
+                    message: 'No group with identifier: ' + parentIdentifier,
+                    key: 'IMPORT.ERROR_INVALID_GROUP_IDENTIFIER',
+                    variables: { IDENTIFIER: parentIdentifier }
                 });
 
-            // Set the parent identifier now that it's known
-            return {
-                ...connection,
-                parentIdentifier: identifier
-            };
+            // If the parent identifier is valid, use it to determine the path
+            else if (providedIdentifier) {
+                parentIdentifier = providedIdentifier;
+                group = groupPathsByIdentifier[providedIdentifier];
+            }
+
+            // If a user-supplied group path is provided, attempt to normalize
+            // and match it to an existing connection group
+            else if (connection.group) {
+
+                // The group path extracted from the user-provided connection,
+                // to be translated into an absolute path starting at the root
+                group = connection.group;
+
+                // Allow the group to start with a leading slash instead instead
+                // of explicitly requiring the root connection group
+                if (group.startsWith('/'))
+                    group = ROOT_GROUP_IDENTIFIER + group;
+
+                // Allow groups to begin directly with the path under the root
+                else if (!group.startsWith(ROOT_GROUP_IDENTIFIER))
+                    group = ROOT_GROUP_IDENTIFIER + '/' + group;
+
+                // Allow groups to end with a trailing slash
+                if (group.endsWith('/'))
+                    group = group.slice(0, -1);
+
+                // Look up the parent identifier for the specified group path
+                parentIdentifier = groupPathsByIdentifier[group];
+
+                // If the group doesn't match anything in the tree
+                if (!parentIdentifier)
+                    throw new ParseError({
+                        message: 'No group found named: ' + connection.group,
+                        key: 'IMPORT.ERROR_INVALID_GROUP',
+                        variables: { GROUP: connection.group }
+                    });
+
+            }
+
+            // If no group is specified at all, default to the root group
+            else {
+                parentIdentifier = ROOT_GROUP_IDENTIFIER;
+                group = ROOT_GROUP_IDENTIFIER;
+            }
+
+            // The full path, of the form "ROOT/Child Group/Connection Name"
+            const path = group + '/' + connection.name;
+
+            // Error out if this is a duplicate of a connection already in the
+            // file
+            if (!!_.get(connectionsInFile, path))
+                throw new ParseError({
+                    message: 'Duplicate connection in file: ' + path,
+                    key: 'IMPORT.ERROR_DUPLICATE_CONNECTION_IN_FILE',
+                    variables: { PATH: path }
+                });
+
+            // Mark the current path as already seen in the file
+            _.setWith(connectionsInFile, path, connection, Object);
+
+            // Check if this would be an update to an existing connection
+            const existingIdentifier = _.get(connectionIdsByGroupAndName,
+                    [parentIdentifier, connection.name]);
+
+            let importMode;
+            let identifier;
+
+            // If updates to existing connections are disallowed
+            if (existingIdentifier && importConfig.replaceConnectionMode ===
+                    ConnectionImportConfig.ReplaceConnectionMode.REJECT)
+                throw new ParseError({
+                    message: 'Rejecting update to existing connection: ' + path,
+                    key: 'IMPORT.ERROR_REJECT_UPDATE_CONNECTION',
+                    variables: { PATH: path }
+                });
+
+            // If the connection is being replaced, set the existing identifer
+            else if (existingIdentifier) {
+                identifier = existingIdentifier;
+                importMode = ImportConnection.ImportMode.REPLACE;
+            }
+
+            // Otherwise, just create a new connection
+            else
+                importMode = ImportConnection.ImportMode.CREATE;
+
+            // Set the import mode, normalized path, and validated identifier
+            return new ImportConnection({ ...connection, 
+                    importMode, group, identifier, parentIdentifier });
 
         });
     }
 
     /**
-     * Convert a provided ImportConnection array into a ParseResult. Any provided
+     * Convert a provided connection array into a ParseResult. Any provided
      * transform functions will be run on each entry in `connectionData` before
      * any other processing is done.
      *
+     * @param {ConnectionImportConfig} importConfig
+     *     The configuration options selected by the user prior to import.
+     *
      * @param {*[]} connectionData
      *     An arbitrary array of data. This must evaluate to a ImportConnection
      *     object after being run through all functions in `transformFunctions`.
@@ -256,11 +367,12 @@ angular.module('import').factory('connectionParseService',
      *     An array of transformation functions to run on each entry in
      *     `connection` data.
      *
-     * @return {Promise.<Object>}
+     * @return {Promise.<ParseResult>}
      *     A promise resolving to ParseResult object representing the result of
      *     parsing all provided connection data.
      */
-    function parseConnectionData(connectionData, transformFunctions) {
+    function parseConnectionData(
+            importConfig, connectionData, transformFunctions) {
 
         // Check that the provided connection data array is not empty
         const checkError = performBasicChecks(connectionData);
@@ -270,11 +382,13 @@ angular.module('import').factory('connectionParseService',
             return deferred.promise;
         }
 
-        // Get the group transformer to apply to each connection
-        return getGroupTransformer().then(groupTransformer =>
-                connectionData.reduce((parseResult, data, index) => {
+        let index = 0;
 
-            const { patches, users, groups } = parseResult;
+        // Get the group transformer to apply to each connection
+        return getTreeTransformer(importConfig).then(treeTransformer =>
+                connectionData.reduce((parseResult, data) => {
+
+            const { patches, users, groups, groupPaths } = parseResult;
 
             // Run the array data through each provided transform
             let connectionObject = data;
@@ -284,24 +398,77 @@ angular.module('import').factory('connectionParseService',
 
             // All errors found while parsing this connection
             const connectionErrors = [];
-            parseResult.errors.push(connectionErrors);
 
-            // Translate the group on the object to a parentIdentifier
+            // Determine the connection's place in the connection group tree
             try {
-                connectionObject = groupTransformer(connectionObject);
+                connectionObject = treeTransformer(connectionObject);
             }
 
-            // If there was a problem with the group or parentIdentifier
+            // If there was a problem with the connection group heirarchy
             catch (error) {
                 connectionErrors.push(error);
             }
 
-            // The users and user groups that should be granted access
-            const connectionUsers = connectionObject.users || [];
-            const connectionGroups = connectionObject.groups || [];
+            // If there are any errors for this connection, fail the whole batch
+            if (connectionErrors.length)
+                parseResult.hasErrors = true;
+
+            // The value for the patch is a full-fledged Connection
+            const value = new Connection(connectionObject);
+
+            // If a new connection is being created
+            if (connectionObject.importMode 
+                    === ImportConnection.ImportMode.CREATE) 
+
+                // Add a patch for creating the connection
+                patches.push(new DirectoryPatch({
+                    op: DirectoryPatch.Operation.ADD,
+                    path: '/',
+                    value
+                }));
+
+            // The connection is being replaced, and permissions are only being
+            // added, not replaced
+            else if (importConfig.existingPermissionMode ===
+                    ConnectionImportConfig.ExistingPermissionMode.ADD)
+
+                // Add a patch for replacing the connection
+                patches.push(new DirectoryPatch({
+                    op: DirectoryPatch.Operation.REPLACE,
+                    path: '/' + connectionObject.identifier,
+                    value
+                }));
+
+            // The connection is being replaced, and permissions are also being
+            // replaced
+            else {
+
+                // Add a patch for removing the existing connection
+                patches.push(new DirectoryPatch({
+                    op: DirectoryPatch.Operation.REMOVE,
+                    path: '/' + connectionObject.identifier
+                }));
+
+                // Increment the index for the additional remove patch
+                index += 1;
+
+                // Add a second patch for creating the replacement connection
+                patches.push(new DirectoryPatch({
+                    op: DirectoryPatch.Operation.ADD,
+                    path: '/',
+                    value
+                }));
+
+            }
+
+            // Save the connection group path into the parse result
+            groupPaths[index] = connectionObject.group;
+
+            // Save the errors for this connection into the parse result
+            parseResult.errors[index] = connectionErrors;
 
             // Add this connection index to the list for each user
-            connectionUsers.forEach(identifier => {
+            _.forEach(connectionObject.users, identifier => {
 
                 // If there's an existing list, add the index to that
                 if (users[identifier])
@@ -313,7 +480,7 @@ angular.module('import').factory('connectionParseService',
             });
 
             // Add this connection index to the list for each group
-            connectionGroups.forEach(identifier => {
+            _.forEach(connectionObject.groups, identifier => {
 
                 // If there's an existing list, add the index to that
                 if (groups[identifier])
@@ -324,20 +491,10 @@ angular.module('import').factory('connectionParseService',
                     groups[identifier] = [index];
             });
 
-            // Translate to a full-fledged Connection
-            const connection = new Connection(connectionObject);
-
-            // Finally, add a patch for creating the connection
-            patches.push(new DirectoryPatch({
-                op: 'add',
-                path: '/',
-                value: connection
-            }));
-
-            // If there are any errors for this connection, fail the whole batch
-            if (connectionErrors.length)
-                parseResult.hasErrors = true;
-
+            // Return the existing parse result state and continue on to the
+            // next connection in the file
+            index++;
+            parseResult.connectionCount++;
             return parseResult;
 
         }, new ParseResult()));
@@ -349,6 +506,9 @@ angular.module('import').factory('connectionParseService',
      * objects containing lists of user and user group identifiers to be granted
      * to each connection.
      *
+     * @param {ConnectionImportConfig} importConfig
+     *     The configuration options selected by the user prior to import.
+     *
      * @param {String} csvData
      *     The CSV-encoded connection list to process.
      *
@@ -356,7 +516,7 @@ angular.module('import').factory('connectionParseService',
      *     A promise resolving to ParseResult object representing the result of
      *     parsing all provided connection data.
      */
-    service.parseCSV = function parseCSV(csvData) {
+    service.parseCSV = function parseCSV(importConfig, csvData) {
 
         // Convert to an array of arrays, one per CSV row (including the header)
         // NOTE: skip_empty_lines is required, or a trailing newline will error
@@ -405,7 +565,8 @@ angular.module('import').factory('connectionParseService',
             csvTransformer =>
 
                 // Apply the CSV transform to every row
-                parseConnectionData(connectionData, [csvTransformer]));
+                parseConnectionData(
+                        importConfig, connectionData, [csvTransformer]));
 
     };
 
@@ -415,6 +576,9 @@ angular.module('import').factory('connectionParseService',
      * objects containing lists of user and user group identifiers to be granted
      * to each connection.
      *
+     * @param {ConnectionImportConfig} importConfig
+     *     The configuration options selected by the user prior to import.
+     *
      * @param {String} yamlData
      *     The YAML-encoded connection list to process.
      *
@@ -422,7 +586,7 @@ angular.module('import').factory('connectionParseService',
      *     A promise resolving to ParseResult object representing the result of
      *     parsing all provided connection data.
      */
-    service.parseYAML = function parseYAML(yamlData) {
+    service.parseYAML = function parseYAML(importConfig, yamlData) {
 
         // Parse from YAML into a javascript array
         let connectionData;
@@ -443,7 +607,7 @@ angular.module('import').factory('connectionParseService',
         }
 
         // Produce a ParseResult
-        return parseConnectionData(connectionData);
+        return parseConnectionData(importConfig, connectionData);
     };
 
     /**
@@ -452,6 +616,9 @@ angular.module('import').factory('connectionParseService',
      * as a list of objects containing lists of user and user group identifiers
      * to be granted to each connection.
      *
+     * @param {ConnectionImportConfig} importConfig
+     *     The configuration options selected by the user prior to import.
+     *
      * @param {String} jsonData
      *     The JSON-encoded connection list to process.
      *
@@ -459,7 +626,7 @@ angular.module('import').factory('connectionParseService',
      *     A promise resolving to ParseResult object representing the result of
      *     parsing all provided connection data.
      */
-    service.parseJSON = function parseJSON(jsonData) {
+    service.parseJSON = function parseJSON(importConfig, jsonData) {
 
         // Parse from JSON into a javascript array
         let connectionData;
@@ -480,7 +647,7 @@ angular.module('import').factory('connectionParseService',
         }
 
         // Produce a ParseResult
-        return parseConnectionData(connectionData);
+        return parseConnectionData(importConfig, connectionData);
 
     };
 
diff --git a/guacamole/src/main/frontend/src/app/import/styles/import.css b/guacamole/src/main/frontend/src/app/import/styles/import.css
index 15d08d6d7..36e63d69b 100644
--- a/guacamole/src/main/frontend/src/app/import/styles/import.css
+++ b/guacamole/src/main/frontend/src/app/import/styles/import.css
@@ -158,3 +158,33 @@
     cursor: pointer;
 
 }
+
+.file-upload-container .import-config {
+
+    margin-top: 0.5em;
+    list-style: none;
+    width: 100%;
+    padding-left: 0;
+
+}
+
+.file-upload-container .import-config .help {
+
+    visibility: hidden;
+    cursor: pointer;
+    
+}
+
+.file-upload-container .import-config .help::after {
+
+    content: '';
+    visibility: visible;
+    display: inline-block;
+    background-image: url('images/question.svg');
+    background-size: contain;
+    width: 20px;
+    height: 20px;
+    position: relative;
+    top: 4px;
+
+}
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html b/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
index 5142b49b2..f2d486cb0 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionErrors.html
@@ -15,6 +15,9 @@
                 <th guac-sort-order="errorOrder" guac-sort-property="'name'">
                     {{'IMPORT.TABLE_HEADER_NAME' | translate}}
                 </th>
+                <th guac-sort-order="errorOrder" guac-sort-property="'group'">
+                    {{'IMPORT.TABLE_HEADER_GROUP' | translate}}
+                </th>
                 <th guac-sort-order="errorOrder" guac-sort-property="'protocol'">
                     {{'IMPORT.TABLE_HEADER_PROTOCOL' | translate}}
                 </th>
@@ -27,6 +30,7 @@
             <tr ng-repeat="error in errorPage">
                 <td>{{error.rowNumber}}</td>
                 <td>{{error.name}}</td>
+                <td>{{error.group}}</td>
                 <td>{{error.protocol}}</td>
                 <td class="error-message" ng-class="{ 'has-errors' : error.errors.getArray().length }">
                     <ul>
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index bc2ecc2a1..2d3b8abc7 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -38,6 +38,28 @@
 
         </div>
 
+        <ul class="import-config">
+            <li>
+                <input type="checkbox"
+                    id="replace-connections" ng-model="importConfig.replaceConnectionMode"
+                    ng-true-value="'REPLACE'" ng-false-value="'REJECT'" />
+                <label for="replace-connections">
+                    {{'IMPORT.FIELD_HEADER_REPLACE_CONNECTIONS' | translate}}
+                </label>
+                <span ng-click="showConnectionReplaceHelp()" class="help"></span>
+            </li>
+            <li>
+                <input type="checkbox"
+                    id="replace-permissions" ng-model="importConfig.existingPermissionMode"
+                    ng-disabled="importConfig.replaceConnectionMode === 'REJECT'"
+                    ng-true-value="'REPLACE'" ng-false-value="'ADD'" />
+                <label for="replace-permissions">
+                    {{'IMPORT.FIELD_HEADER_REPLACE_PERMISSIONS' | translate}}
+                </label>
+                <span ng-click="showPermissionReplaceHelp()" class="help"></span>
+            </li>
+        </ul>
+
     </div>
 
     <div class="import-buttons">
diff --git a/guacamole/src/main/frontend/src/app/import/types/ConnectionImportConfig.js b/guacamole/src/main/frontend/src/app/import/types/ConnectionImportConfig.js
new file mode 100644
index 000000000..fa7ce8118
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/import/types/ConnectionImportConfig.js
@@ -0,0 +1,103 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Service which defines the ConnectionImportConfig class.
+ */
+angular.module('import').factory('ConnectionImportConfig', [
+        function defineConnectionImportConfig() {
+
+    /**
+     * A representation of any user-specified configuration when
+     * batch-importing connections.
+     *
+     * @constructor
+     * @param {ConnectionImportConfig|Object} [template={}]
+     *     The object whose properties should be copied within the new
+     *     ConnectionImportConfig.
+     */
+    const ConnectionImportConfig = function ConnectionImportConfig(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * The mode for handling connections that match existing connections.
+         *
+         * @type ConnectionImportConfig.ReplaceConnectionMode
+         */
+        this.replaceConnectionMode = template.replaceConnectionMode
+                || ConnectionImportConfig.ReplaceConnectionMode.REJECT;
+
+        /**
+         * The mode for handling permissions on existing connections that are
+         * being updated. Only meaningful if the importer is configured to
+         * replace existing connections.
+         *
+         * @type ConnectionImportConfig.ExistingPermissionMode
+         */
+        this.existingPermissionMode = template.existingPermissionMode
+                || ConnectionImportConfig.ExistingPermissionMode.ADD;
+
+    };
+
+    /**
+     * Valid modes for the behavior of the importer when attempts are made to
+     * update existing connections.
+     */
+    ConnectionImportConfig.ReplaceConnectionMode = {
+
+        /**
+         * Any attempt to update existing connections will cause the entire 
+         * import to be rejected with an error.
+         */
+        REJECT : "REJECT",
+
+        /**
+         * Replace/update any existing connections.
+         */
+        REPLACE : "REPLACE"
+
+    };
+
+    /**
+     * Valid modes for the behavior of the importer with respect to connection
+     * permissions when existing connections are being replaced.
+     */
+    ConnectionImportConfig.ExistingPermissionMode = {
+
+        /**
+         * Any new permissions specified in the imported connection will be
+         * added to the existing connection, without removing any existing
+         * permissions.
+         */
+        ADD : "ADD",
+
+        /**
+         * Any existing permissions will be removed, ensuring that only the
+         * users or groups specified in the import file will be granted to the
+         * replaced connection after import.
+         */
+        REPLACE : "REPLACE"
+
+    };
+
+    return ConnectionImportConfig;
+
+}]);
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js b/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
index 1c1f5b81d..9a519dedb 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
@@ -20,8 +20,8 @@
 /**
  * Service which defines the ImportConnection class.
  */
-angular.module('import').factory('ImportConnection', [
-        function defineImportConnection() {
+angular.module('import').factory('ImportConnection', ['$injector',
+        function defineImportConnection($injector) {
 
     /**
      * A representation of a connection to be imported, as parsed from an
@@ -53,6 +53,12 @@ angular.module('import').factory('ImportConnection', [
          */
         this.group = template.group;
 
+        /**
+         * The identifier of the connection being updated. Only meaningful if
+         * the replace operation is set.
+         */
+        this.identifier = template.identifier;
+
         /**
          * The human-readable name of this connection, which is not necessarily
          * unique.
@@ -102,6 +108,31 @@ angular.module('import').factory('ImportConnection', [
          */
         this.groups = template.groups || [];
 
+        /**
+         * The mode import mode for this connection. If not otherwise specified,
+         * a brand new connection should be created.
+         */
+        this.importMode = template.importMode || ImportConnection.ImportMode.CREATE;
+        
+    };
+
+    /**
+     * The possible import modes for a given connection.
+     */
+    ImportConnection.ImportMode = {
+
+        /**
+         * The connection should be created fresh. This mode is valid IFF there
+         * is no existing connection with the same name and parent group.
+         */
+        CREATE : "CREATE",
+
+        /**
+         * This connection will replace the existing connection with the same
+         * name and parent group.
+         */
+        REPLACE : "REPLACE"
+
     };
 
     return ImportConnection;
diff --git a/guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js b/guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js
index bd77f8c25..9fabe2313 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ImportConnectionError.js
@@ -56,6 +56,14 @@ angular.module('import').factory('ImportConnectionError', ['$injector',
          */
         this.name = template.name;
 
+        /**
+         * The human-readable connection group path for this connection, of the
+         * form "ROOT/Parent/Child".
+         *
+         * @type String
+         */
+        this.group = template.group;
+
         /**
          * The name of the protocol associated with this connection, such as
          * "vnc" or "rdp".
diff --git a/guacamole/src/main/frontend/src/app/import/types/ParseResult.js b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
index 6e28f20f3..d78ad866e 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
@@ -25,9 +25,9 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
     /**
      * The result of parsing a connection import file - containing a list of
      * API patches ready to be submitted to the PATCH REST API for batch
-     * connection creation, a set of users and user groups to grant access to
-     * each connection, and any errors that may have occurred while parsing
-     * each connection.
+     * connection creation/replacement, a set of users and user groups to grant
+     * access to each connection, a group path for every connection, and any
+     * errors that may have occurred while parsing each connection.
      *
      * @constructor
      * @param {ParseResult|Object} [template={}]
@@ -41,7 +41,10 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
 
         /**
          * An array of patches, ready to be submitted to the PATCH REST API for
-         * batch connection creation.
+         * batch connection creation / replacement. Note that this array may 
+         * contain more patches than connections from the original file - in the 
+         * case that connections are being fully replaced, there will be a 
+         * remove and a create patch for each replaced connection.
          *
          * @type {DirectoryPatch[]}
          */
@@ -50,7 +53,8 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
         /**
          * An object whose keys are the user identifiers of users specified
          * in the batch import, and whose values are an array of indices of
-         * connections to which those users should be granted access.
+         * connections within the patches array to which those users should be
+         * granted access.
          *
          * @type {Object.<String, Integer[]>}
          */
@@ -65,10 +69,19 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
          */
         this.groups = template.users || {};
 
+        /**
+         * A map of connection index within the patch array, to connection group
+         * path for that connection, of the form "ROOT/Parent/Child".
+         *
+         * @type {Object.<String, String>}
+         */
+        this.groupPaths = template.groupPaths || {};
+
         /**
          * An array of errors encountered while parsing the corresponding
-         * connection (at the same array index). Each connection should have a
-         * an array of errors. If empty, no errors occurred for this connection.
+         * connection (at the same array index in the patches array). Each 
+         * connection should have a an array of errors. If empty, no errors
+         * occurred for this connection.
          *
          * @type {ParseError[][]}
          */
@@ -79,9 +92,20 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
          * represented by this ParseResult. This should always be true if there
          * are a non-zero number of elements in the errors list for any
          * connection, or false otherwise.
+         *
+         * @type {Boolean}
          */
         this.hasErrors = template.hasErrors || false;
 
+        /**
+         * The integer number of unique connections present in the parse result.
+         * This may be less than the length of the patches array, if any REMOVE
+         * patches are present.
+         *
+         * @Type {Number}
+         */
+        this.connectionCount = template.connectionCount || 0;
+
     };
 
     return ParseResult;
diff --git a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsConnections.js b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsConnections.js
index 05c86ef5d..38bb343b1 100644
--- a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsConnections.js
+++ b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsConnections.js
@@ -110,6 +110,24 @@ angular.module('settings').directive('guacSettingsConnections', [function guacSe
 
             };
 
+            /**
+             * Returns whether the current user has the ADMINISTER system
+             * permission (i.e. they are an administrator).
+             *
+             * @return {Boolean}
+             *     true if the current user is an administrator.
+             */
+            $scope.canAdminister = function canAdminister() {
+
+                // Abort if permissions have not yet loaded
+                if (!$scope.permissions)
+                    return false;
+
+                // Return whether the current user is an administrator
+                return PermissionSet.hasSystemPermission(
+                        $scope.permissions, PermissionSet.SystemPermissionType.ADMINISTER);
+            };
+
             /**
              * Returns whether the current user can create new connections
              * within the current data source.
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
index 004faa31c..e90d30cad 100644
--- a/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsConnections.html
@@ -10,7 +10,7 @@
         <div class="action-buttons">
 
             <a class="import-connections button"
-                ng-show="canCreateConnections()"
+                ng-show="canAdminister()"
                 href="#/import/{{dataSource | escape}}/connection/">{{'SETTINGS_CONNECTIONS.ACTION_IMPORT' | translate}}</a>
 
             <a class="add-connection button"
diff --git a/guacamole/src/main/frontend/src/images/question.svg b/guacamole/src/main/frontend/src/images/question.svg
new file mode 100644
index 000000000..e3c800f85
--- /dev/null
+++ b/guacamole/src/main/frontend/src/images/question.svg
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   width="64"
+   height="64"
+   viewBox="0 0 64 64"
+   version="1.1"
+   id="svg10"
+   sodipodi:docname="question.svg"
+   inkscape:version="1.1.2 (0a00cf5339, 2022-02-04)"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg">
+  <defs
+     id="defs14" />
+  <sodipodi:namedview
+     id="namedview12"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageshadow="2"
+     inkscape:pageopacity="0.0"
+     inkscape:pagecheckerboard="0"
+     showgrid="false"
+     inkscape:zoom="8"
+     inkscape:cx="38.5625"
+     inkscape:cy="31.0625"
+     inkscape:window-width="2048"
+     inkscape:window-height="1025"
+     inkscape:window-x="0"
+     inkscape:window-y="28"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="g8" />
+  <g
+     style="stroke-width:1.04766"
+     id="g8">
+    <g
+       style="font-style:normal;font-weight:400;font-size:142.558px;line-height:100%;font-family:Sans;letter-spacing:0;word-spacing:0;fill:#000000;fill-opacity:1;stroke:none;stroke-width:3.20748px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
+       id="g6">
+      <path
+         d="m 169.301,354.693 c -60.57527,-41.3594 -30.28763,-20.6797 0,0 z m -0.627,90.839 c -60.15727,-101.91873 -30.07863,-50.95937 0,0 z"
+         style="font-style:normal;font-variant:normal;font-weight:900;font-stretch:normal;font-size:142.558px;line-height:100%;font-family:Roboto;-inkscape-font-specification:'Roboto Heavy';text-align:center;text-anchor:middle;fill:#000000;stroke-width:3.20748px"
+         transform="matrix(0.3118,0,0,0.31173,-24.457,-91.229)"
+         aria-label="!"
+         id="path4"
+         sodipodi:nodetypes="cccc" />
+    </g>
+    <path
+       id="path2540"
+       style="fill:#000000"
+       d="M 32,0.75 A 31.25,31.25 0 0 0 0.75,32 31.25,31.25 0 0 0 32,63.25 31.25,31.25 0 0 0 63.25,32 31.25,31.25 0 0 0 32,0.75 Z m 0,5 A 26.25,26.25 0 0 1 58.25,32 26.25,26.25 0 0 1 32,58.25 26.25,26.25 0 0 1 5.75,32 26.25,26.25 0 0 1 32,5.75 Z" />
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:40px;line-height:1.25;font-family:sans-serif;fill:#000000;fill-opacity:1;stroke:none"
+       x="17.083984"
+       y="52.78125"
+       id="text4900"><tspan
+         id="tspan4898"
+         x="17.083984"
+         y="52.78125"
+         sodipodi:role="line"
+         style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:56px;font-family:sans-serif;-inkscape-font-specification:'sans-serif, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal">?</tspan></text>
+  </g>
+</svg>
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 610f3165a..1aeea1df6 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -200,38 +200,52 @@
         "DIALOG_HEADER_ERROR"   : "@:APP.DIALOG_HEADER_ERROR",
         "DIALOG_HEADER_SUCCESS" : "Success",
 
-        "ERROR_AMBIGUOUS_CSV_HEADER"     : "Ambiguous CSV Header \"{HEADER}\" could be either a connection attribute or parameter",
-        "ERROR_AMBIGUOUS_PARENT_GROUP"   : "Both group and parentIdentifier may be not specified at the same time",
-        "ERROR_ARRAY_REQUIRED"           : "The provided file must contain a list of connections",
-        "ERROR_DUPLICATE_CSV_HEADER"     : "Duplicate CSV Header: {HEADER}",
-        "ERROR_EMPTY_FILE"               : "The provided file is empty",
-        "ERROR_INVALID_CSV_HEADER"       : "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
-        "ERROR_INVALID_MIME_TYPE"        : "Unsupported file type: \"{TYPE}\"",
-        "ERROR_DETECTED_INVALID_TYPE"    : "Unsupported file type. Please make sure the file is valid CSV, JSON, or YAML.",
-        "ERROR_INVALID_GROUP"            : "No group matching \"{GROUP}\" found",
-        "ERROR_INVALID_GROUP_IDENTIFIER" : "No connection group with identifier \"{IDENTIFIER}\" found",
-        "ERROR_NO_FILE_SUPPLIED"         : "Please select a file to import",
-        "ERROR_PARSE_FAILURE_CSV"        : "Please make sure your file is valid CSV. Parsing failed with error \"{ERROR}\". ",
-        "ERROR_PARSE_FAILURE_JSON"       : "Please make sure your file is valid JSON. Parsing failed with error \"{ERROR}\". ",
-        "ERROR_PARSE_FAILURE_YAML"       : "Please make sure your file is valid YAML. Parsing failed with error \"{ERROR}\". ",
-        "ERROR_REQUIRED_NAME"            : "No connection name found in the provided file",
-        "ERROR_REQUIRED_PROTOCOL"        : "No connection protocol found in the provided file",
+        "ERROR_AMBIGUOUS_CSV_HEADER"         : "Ambiguous CSV Header \"{HEADER}\" could be either a connection attribute or parameter",
+        "ERROR_AMBIGUOUS_PARENT_GROUP"       : "Both group and parentIdentifier may be not specified at the same time",
+        "ERROR_ARRAY_REQUIRED"               : "The provided file must contain a list of connections",
+        "ERROR_DETECTED_INVALID_TYPE"        : "Unsupported file type. Please make sure the file is valid CSV, JSON, or YAML.",
+        "ERROR_DUPLICATE_CONNECTION_IN_FILE" : "Duplicate connection in file at \"{PATH}\"",
+        "ERROR_DUPLICATE_CSV_HEADER"         : "Duplicate CSV Header: {HEADER}",
+        "ERROR_EMPTY_FILE"                   : "The provided file is empty",
+        "ERROR_INVALID_CSV_HEADER"           : "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
+        "ERROR_INVALID_MIME_TYPE"            : "Unsupported file type: \"{TYPE}\"",
+        "ERROR_INVALID_GROUP"                : "No group matching \"{GROUP}\" found",
+        "ERROR_INVALID_GROUP_IDENTIFIER"     : "No connection group with identifier \"{IDENTIFIER}\" found",
+        "ERROR_NO_FILE_SUPPLIED"             : "Please select a file to import",
+        "ERROR_PARSE_FAILURE_CSV"            : "Please make sure your file is valid CSV. Parsing failed with error \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_JSON"           : "Please make sure your file is valid JSON. Parsing failed with error \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_YAML"           : "Please make sure your file is valid YAML. Parsing failed with error \"{ERROR}\". ",
+        "ERROR_REJECT_UPDATE_CONNECTION"     : "Disallowed update to existing connection at \"{PATH}\"",
+        "ERROR_REQUIRED_NAME"                : "No connection name found in the provided file",
+        "ERROR_REQUIRED_PROTOCOL"            : "No connection protocol found in the provided file",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
+        "FIELD_HEADER_REPLACE_CONNECTIONS" : "Replace/Update existing connections",
+        "FIELD_HEADER_REPLACE_PERMISSIONS" : "Reset permissions",
+
+        "FIELD_OPTION_DUPLICATE_REPLACE" : "Replace duplicates",
+        "FIELD_OPTION_DUPLICATE_IGNORE"  : "Ignore duplicates",
+        "FIELD_OPTION_DUPLICATE_ERROR"   : "Disallow duplicates",
+
         "HELP_CSV_DESCRIPTION"              : "A connection import CSV file has one connection record per row. Each column will specify a connection field. At minimum the connection name and protocol must be specified.",
         "HELP_CSV_EXAMPLE"                  : "name,protocol,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,",
         "HELP_CSV_MORE_DETAILS"             : "The CSV header for each row specifies the connection field. The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. In most cases, there should be no conflict between fields, but if needed, an \" (attribute)\" or \" (parameter)\" suffix may be added to disambiguate. Lists of user or user group identifiers must be semicolon-separated.¹",
-        "HELP_FILE_TYPE_DESCRIPTION"        : "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created.",
+        "HELP_FILE_TYPE_DESCRIPTION"        : "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created. Note that any existing connection permissions will not be removed for updated connections.",
         "HELP_FILE_TYPE_HEADER"             : "File Types",
         "HELP_JSON_DESCRIPTION"             : "A connection import JSON file is a list of connection objects. At minimum the connection name and protocol must be specified in each connection object.",
         "HELP_JSON_EXAMPLE"                 : "[\n  \\{\n    \"name\": \"conn1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"hostname\": \"conn1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac user 1\", \"guac user 2\" ],\n    \"groups\": [ \"Connection 1 Users\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"hostname\": \"conn2.web.com\" \\},\n    \"group\": \"ROOT/Parent Group\",\n    \"users\": [ \"guac user 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"hostname\": \"conn3.web.com\" \\},\n    \"group\": \"ROOT/Parent Group/Child Group\",\n    \"users\": [ \"guac user 2\", \"guac user 3\" ]\n  \\},\n  \\{\n    \"name\": \"conn4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
-        "HELP_JSON_MORE_DETAILS"            :  "The connection group ID that the connection should be imported into may be directly specified with a \"parentIdentifier\" field, or the path to the parent group may be specified using a \"group\" field as shown below. An array of user and user group identifiers to grant access to may be specified per connection.",
+        "HELP_JSON_MORE_DETAILS"            : "The connection group ID that the connection should be imported into may be directly specified with a \"parentIdentifier\" field, or the path to the parent group may be specified using a \"group\" field as shown below. An array of user and user group identifiers to grant access to may be specified per connection.",
+        "HELP_REPLACE_CONNECTION_TITLE"     : "Replacing existing connections",
+        "HELP_REPLACE_CONNECTION_CONTENT"   : "Checking this box will allow existing connections to be updated, if an imported connection has the same name and parent group as an existing connection. If unchecked, attempts to update existing connections will be treated as an error.",
+        "HELP_REPLACE_PERMISSION_TITLE"     : "Replacing connection permissions",
+        "HELP_REPLACE_PERMISSION_CONTENT"   : "If replacement of existing connections is enabled, checking this box will allow full replacement of connection permissions. If checked, access permission will only be granted to users and groups specified in the import file for this connection. If unchecked, specified users and groups will be granted access in addition to any existing permissions.",
         "HELP_SEMICOLON_FOOTNOTE"           : "If present, semicolons can be escaped with a backslash, e.g. \"first\\\\;last\"",
         "HELP_UPLOAD_DROP_TITLE"            : "Drop a File Here",
         "HELP_UPLOAD_FILE_TYPES"            : "CSV, JSON, or YAML",
         "HELP_YAML_DESCRIPTION"             : "A connection import YAML file is a list of connection objects with exactly the same structure as the JSON format.",
         "HELP_YAML_EXAMPLE"                 : "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n    - guac user 1\n    - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n    - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n    - guac user 2\n    - guac user 3\n  - name: conn4\n    protocol: kubernetes",
+
         "INFO_CONNECTIONS_IMPORTED_SUCCESS" : "{NUMBER} {NUMBER, plural, one{connection} other{connections}} imported successfully.",
         
         "SECTION_HEADER_CONNECTION_IMPORT"           : "Connection Import",
@@ -241,6 +255,7 @@
         "SECTION_HEADER_YAML"                        : "YAML Format",
 
         "TABLE_HEADER_ERRORS"     : "Errors",
+        "TABLE_HEADER_GROUP"      : "Group",
         "TABLE_HEADER_NAME"       : "Name",
         "TABLE_HEADER_PROTOCOL"   : "Protocol",
         "TABLE_HEADER_ROW_NUMBER" : "Row #"

From a2b3bb6461872e7aa2786c2581448f7bba15a5f4 Mon Sep 17 00:00:00 2001
From: Ares Li <mli@harriscomputer.com>
Date: Wed, 19 Apr 2023 15:43:18 -0700
Subject: [PATCH 182/289] GUACAMOLE-1775: Use header for auth token instead of
 a parameter in "session/tunnels/<tunnel ID>/protocol" request

---
 .../frontend/src/app/rest/services/tunnelService.js   | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js b/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
index 5cc547b40..2ebb08bd7 100644
--- a/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
+++ b/guacamole/src/main/frontend/src/app/rest/services/tunnelService.js
@@ -97,17 +97,10 @@ angular.module('rest').factory('tunnelService', ['$injector',
      */
     service.getProtocol = function getProtocol(tunnel) {
 
-        // Build HTTP parameters set
-        var httpParameters = {
-            token : authenticationService.getCurrentToken()
-        };
-
-        // Retrieve the protocol details of the specified tunnel
-        return requestService({
+        return authenticationService.request({
             method  : 'GET',
             url     : 'api/session/tunnels/' + encodeURIComponent(tunnel)
-                        + '/protocol',
-            params  : httpParameters
+                        + '/protocol'
         });
 
     };

From 6dab100b429a1d76fe7e64756e07073e64ebd50d Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 20 Apr 2023 17:40:59 +0000
Subject: [PATCH 183/289] GUACAMOLE-926: Fix styling, option semantics, and
 directory patch endpoint logging/handling.

---
 .../importConnectionsController.js            | 41 +-----------
 .../import/services/connectionParseService.js | 10 +--
 .../frontend/src/app/import/styles/import.css |  2 +-
 .../import/templates/connectionImport.html    | 18 ++---
 .../import/types/ConnectionImportConfig.js    | 20 +++---
 .../src/app/import/types/ParseResult.js       |  2 +-
 .../src/main/frontend/src/images/question.svg | 65 +------------------
 .../main/frontend/src/translations/en.json    | 20 ++----
 .../rest/directory/DirectoryResource.java     | 60 +++++++++++++----
 9 files changed, 82 insertions(+), 156 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index 41f13fb55..cc99e9653 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -635,44 +635,5 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         // Read all the data into memory
         $scope.fileReader.readAsBinaryString(file);
     };
-
-    /**
-     * Display a modal with the given title and text keys.
-     *
-     * @param {String} titleKey
-     *     The translation key to use for the title of the modal.
-     *
-     * @param {String} contentKey
-     *     The translation key to use for the text contents of the modal.
-     */
-    const showModal = (titleKey, contentKey) => guacNotification.showStatus({
-
-        // The provided modal contents
-        title: titleKey,
-        text: { key: contentKey },
-
-        // Add a button to hide the modal
-        actions    : [{
-            name      : 'IMPORT.ACTION_ACKNOWLEDGE',
-            callback  : () => guacNotification.showStatus(false)
-        }]
-
-    });
-
-    /**
-     * Display a modal with information about the existing connection
-     * replacement option.
-     */
-    $scope.showConnectionReplaceHelp = () => showModal(
-            'IMPORT.HELP_REPLACE_CONNECTION_TITLE',
-            'IMPORT.HELP_REPLACE_CONNECTION_CONTENT');
-
-    /**
-     * Display a modal with information about the existing connection permission
-     * replacement option.
-     */
-    $scope.showPermissionReplaceHelp = () => showModal(
-            'IMPORT.HELP_REPLACE_PERMISSION_TITLE',
-            'IMPORT.HELP_REPLACE_PERMISSION_CONTENT');
-
+    
 }]);
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index 90d1bf27b..c5765c2c7 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -312,7 +312,7 @@ angular.module('import').factory('connectionParseService',
                 throw new ParseError({
                     message: 'Duplicate connection in file: ' + path,
                     key: 'IMPORT.ERROR_DUPLICATE_CONNECTION_IN_FILE',
-                    variables: { PATH: path }
+                    variables: { NAME: connection.name, PATH: group }
                 });
 
             // Mark the current path as already seen in the file
@@ -326,12 +326,12 @@ angular.module('import').factory('connectionParseService',
             let identifier;
 
             // If updates to existing connections are disallowed
-            if (existingIdentifier && importConfig.replaceConnectionMode ===
-                    ConnectionImportConfig.ReplaceConnectionMode.REJECT)
+            if (existingIdentifier && importConfig.existingConnectionMode ===
+                    ConnectionImportConfig.ExistingConnectionMode.REJECT)
                 throw new ParseError({
                     message: 'Rejecting update to existing connection: ' + path,
                     key: 'IMPORT.ERROR_REJECT_UPDATE_CONNECTION',
-                    variables: { PATH: path }
+                    variables: { NAME: connection.name, PATH: group }
                 });
 
             // If the connection is being replaced, set the existing identifer
@@ -430,7 +430,7 @@ angular.module('import').factory('connectionParseService',
             // The connection is being replaced, and permissions are only being
             // added, not replaced
             else if (importConfig.existingPermissionMode ===
-                    ConnectionImportConfig.ExistingPermissionMode.ADD)
+                    ConnectionImportConfig.ExistingPermissionMode.PRESERVE)
 
                 // Add a patch for replacing the connection
                 patches.push(new DirectoryPatch({
diff --git a/guacamole/src/main/frontend/src/app/import/styles/import.css b/guacamole/src/main/frontend/src/app/import/styles/import.css
index 36e63d69b..5e2cd71e1 100644
--- a/guacamole/src/main/frontend/src/app/import/styles/import.css
+++ b/guacamole/src/main/frontend/src/app/import/styles/import.css
@@ -171,7 +171,7 @@
 .file-upload-container .import-config .help {
 
     visibility: hidden;
-    cursor: pointer;
+    cursor: help;
     
 }
 
diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index 2d3b8abc7..2af6cad7f 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -41,22 +41,22 @@
         <ul class="import-config">
             <li>
                 <input type="checkbox"
-                    id="replace-connections" ng-model="importConfig.replaceConnectionMode"
+                    id="existing-connection-mode" ng-model="importConfig.existingConnectionMode"
                     ng-true-value="'REPLACE'" ng-false-value="'REJECT'" />
-                <label for="replace-connections">
-                    {{'IMPORT.FIELD_HEADER_REPLACE_CONNECTIONS' | translate}}
+                <label for="existing-connection-mode">
+                    {{'IMPORT.FIELD_HEADER_EXISTING_CONNECTION_MODE' | translate}}
                 </label>
-                <span ng-click="showConnectionReplaceHelp()" class="help"></span>
+                <span ng-attr-title="{{'IMPORT.HELP_EXISTING_CONNECTION_MODE' | translate}}" class="help"></span>
             </li>
             <li>
                 <input type="checkbox"
-                    id="replace-permissions" ng-model="importConfig.existingPermissionMode"
+                    id="existing-permission-mode" ng-model="importConfig.existingPermissionMode"
                     ng-disabled="importConfig.replaceConnectionMode === 'REJECT'"
-                    ng-true-value="'REPLACE'" ng-false-value="'ADD'" />
-                <label for="replace-permissions">
-                    {{'IMPORT.FIELD_HEADER_REPLACE_PERMISSIONS' | translate}}
+                    ng-true-value="'REPLACE'" ng-false-value="'PRESERVE'" />
+                <label for="existing-permission-mode">
+                    {{'IMPORT.FIELD_HEADER_EXISTING_PERMISSION_MODE' | translate}}
                 </label>
-                <span ng-click="showPermissionReplaceHelp()" class="help"></span>
+                <span ng-attr-title="{{'IMPORT.HELP_EXISTING_PERMISSION_MODE' | translate}}" class="help"></span>
             </li>
         </ul>
 
diff --git a/guacamole/src/main/frontend/src/app/import/types/ConnectionImportConfig.js b/guacamole/src/main/frontend/src/app/import/types/ConnectionImportConfig.js
index fa7ce8118..fb0673055 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ConnectionImportConfig.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ConnectionImportConfig.js
@@ -40,10 +40,10 @@ angular.module('import').factory('ConnectionImportConfig', [
         /**
          * The mode for handling connections that match existing connections.
          *
-         * @type ConnectionImportConfig.ReplaceConnectionMode
+         * @type ConnectionImportConfig.ExistingConnectionMode
          */
-        this.replaceConnectionMode = template.replaceConnectionMode
-                || ConnectionImportConfig.ReplaceConnectionMode.REJECT;
+        this.existingConnectionMode = template.existingConnectionMode
+                || ConnectionImportConfig.ExistingConnectionMode.REJECT;
 
         /**
          * The mode for handling permissions on existing connections that are
@@ -53,19 +53,19 @@ angular.module('import').factory('ConnectionImportConfig', [
          * @type ConnectionImportConfig.ExistingPermissionMode
          */
         this.existingPermissionMode = template.existingPermissionMode
-                || ConnectionImportConfig.ExistingPermissionMode.ADD;
+                || ConnectionImportConfig.ExistingPermissionMode.PRESERVE;
 
     };
 
     /**
-     * Valid modes for the behavior of the importer when attempts are made to
-     * update existing connections.
+     * Valid modes for the behavior of the importer when an imported connection
+     * already exists.
      */
-    ConnectionImportConfig.ReplaceConnectionMode = {
+    ConnectionImportConfig.ExistingConnectionMode = {
 
         /**
-         * Any attempt to update existing connections will cause the entire 
-         * import to be rejected with an error.
+         * Any Connection that has the same name and parent group as an existing
+         * connection will cause the entire import to be rejected with an error.
          */
         REJECT : "REJECT",
 
@@ -87,7 +87,7 @@ angular.module('import').factory('ConnectionImportConfig', [
          * added to the existing connection, without removing any existing
          * permissions.
          */
-        ADD : "ADD",
+        PRESERVE : "PRESERVE",
 
         /**
          * Any existing permissions will be removed, ensuring that only the
diff --git a/guacamole/src/main/frontend/src/app/import/types/ParseResult.js b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
index d78ad866e..3d15511cc 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ParseResult.js
@@ -80,7 +80,7 @@ angular.module('import').factory('ParseResult', [function defineParseResult() {
         /**
          * An array of errors encountered while parsing the corresponding
          * connection (at the same array index in the patches array). Each 
-         * connection should have a an array of errors. If empty, no errors
+         * connection should have an array of errors. If empty, no errors
          * occurred for this connection.
          *
          * @type {ParseError[][]}
diff --git a/guacamole/src/main/frontend/src/images/question.svg b/guacamole/src/main/frontend/src/images/question.svg
index e3c800f85..062ccfa35 100644
--- a/guacamole/src/main/frontend/src/images/question.svg
+++ b/guacamole/src/main/frontend/src/images/question.svg
@@ -1,64 +1 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<svg
-   width="64"
-   height="64"
-   viewBox="0 0 64 64"
-   version="1.1"
-   id="svg10"
-   sodipodi:docname="question.svg"
-   inkscape:version="1.1.2 (0a00cf5339, 2022-02-04)"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:svg="http://www.w3.org/2000/svg">
-  <defs
-     id="defs14" />
-  <sodipodi:namedview
-     id="namedview12"
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageshadow="2"
-     inkscape:pageopacity="0.0"
-     inkscape:pagecheckerboard="0"
-     showgrid="false"
-     inkscape:zoom="8"
-     inkscape:cx="38.5625"
-     inkscape:cy="31.0625"
-     inkscape:window-width="2048"
-     inkscape:window-height="1025"
-     inkscape:window-x="0"
-     inkscape:window-y="28"
-     inkscape:window-maximized="1"
-     inkscape:current-layer="g8" />
-  <g
-     style="stroke-width:1.04766"
-     id="g8">
-    <g
-       style="font-style:normal;font-weight:400;font-size:142.558px;line-height:100%;font-family:Sans;letter-spacing:0;word-spacing:0;fill:#000000;fill-opacity:1;stroke:none;stroke-width:3.20748px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
-       id="g6">
-      <path
-         d="m 169.301,354.693 c -60.57527,-41.3594 -30.28763,-20.6797 0,0 z m -0.627,90.839 c -60.15727,-101.91873 -30.07863,-50.95937 0,0 z"
-         style="font-style:normal;font-variant:normal;font-weight:900;font-stretch:normal;font-size:142.558px;line-height:100%;font-family:Roboto;-inkscape-font-specification:'Roboto Heavy';text-align:center;text-anchor:middle;fill:#000000;stroke-width:3.20748px"
-         transform="matrix(0.3118,0,0,0.31173,-24.457,-91.229)"
-         aria-label="!"
-         id="path4"
-         sodipodi:nodetypes="cccc" />
-    </g>
-    <path
-       id="path2540"
-       style="fill:#000000"
-       d="M 32,0.75 A 31.25,31.25 0 0 0 0.75,32 31.25,31.25 0 0 0 32,63.25 31.25,31.25 0 0 0 63.25,32 31.25,31.25 0 0 0 32,0.75 Z m 0,5 A 26.25,26.25 0 0 1 58.25,32 26.25,26.25 0 0 1 32,58.25 26.25,26.25 0 0 1 5.75,32 26.25,26.25 0 0 1 32,5.75 Z" />
-    <text
-       xml:space="preserve"
-       style="font-style:normal;font-weight:normal;font-size:40px;line-height:1.25;font-family:sans-serif;fill:#000000;fill-opacity:1;stroke:none"
-       x="17.083984"
-       y="52.78125"
-       id="text4900"><tspan
-         id="tspan4898"
-         x="17.083984"
-         y="52.78125"
-         sodipodi:role="line"
-         style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:56px;font-family:sans-serif;-inkscape-font-specification:'sans-serif, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal">?</tspan></text>
-  </g>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64"><g style="stroke-width:1.04766"><g style="font-style:normal;font-weight:400;font-size:142.558px;line-height:100%;font-family:Sans;letter-spacing:0;word-spacing:0;fill:#000;fill-opacity:1;stroke:none;stroke-width:3.20748px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"><path d="M169.301 354.693c-60.575-41.36-30.288-20.68 0 0zm-.627 90.839c-60.157-101.919-30.079-50.96 0 0z" aria-label="!" style="font-style:normal;font-variant:normal;font-weight:900;font-stretch:normal;font-size:142.558px;line-height:100%;font-family:Roboto;-inkscape-font-specification:&quot;Roboto Heavy&quot;;text-align:center;text-anchor:middle;fill:#000;stroke-width:3.20748px" transform="matrix(.3118 0 0 .31173 -24.457 -91.229)"/></g><path d="M32 .75A31.25 31.25 0 0 0 .75 32 31.25 31.25 0 0 0 32 63.25 31.25 31.25 0 0 0 63.25 32 31.25 31.25 0 0 0 32 .75Zm0 5A26.25 26.25 0 0 1 58.25 32 26.25 26.25 0 0 1 32 58.25 26.25 26.25 0 0 1 5.75 32 26.25 26.25 0 0 1 32 5.75Z" style="fill:#000"/><g style="font-size:40px;line-height:1.25"><path d="M27.775 45.836h5.551v6.945h-5.55zm5.387-4.02H27.94v-4.21q0-2.762.766-4.54.766-1.777 3.227-4.129l2.46-2.433q1.56-1.45 2.243-2.734.71-1.286.71-2.625 0-2.434-1.804-3.938-1.777-1.504-4.73-1.504-2.16 0-4.622.957-2.433.957-5.085 2.79v-5.141q2.57-1.559 5.195-2.325 2.652-.765 5.469-.765 5.03 0 8.066 2.652 3.062 2.652 3.062 7 0 2.078-.984 3.965-.984 1.86-3.445 4.21l-2.406 2.352q-1.286 1.286-1.832 2.024-.52.71-.739 1.394-.164.575-.246 1.395-.082.82-.082 2.242z" aria-label="?" style="font-size:56px;-inkscape-font-specification:&quot;sans-serif, Normal&quot;"/></g></g></svg>
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 1aeea1df6..972bab93d 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -204,7 +204,7 @@
         "ERROR_AMBIGUOUS_PARENT_GROUP"       : "Both group and parentIdentifier may be not specified at the same time",
         "ERROR_ARRAY_REQUIRED"               : "The provided file must contain a list of connections",
         "ERROR_DETECTED_INVALID_TYPE"        : "Unsupported file type. Please make sure the file is valid CSV, JSON, or YAML.",
-        "ERROR_DUPLICATE_CONNECTION_IN_FILE" : "Duplicate connection in file at \"{PATH}\"",
+        "ERROR_DUPLICATE_CONNECTION_IN_FILE" : "Duplicated connection \"{NAME}\" at \"{PATH}\" in import file",
         "ERROR_DUPLICATE_CSV_HEADER"         : "Duplicate CSV Header: {HEADER}",
         "ERROR_EMPTY_FILE"                   : "The provided file is empty",
         "ERROR_INVALID_CSV_HEADER"           : "Invalid CSV Header \"{HEADER}\" is neither an attribute or parameter",
@@ -215,31 +215,25 @@
         "ERROR_PARSE_FAILURE_CSV"            : "Please make sure your file is valid CSV. Parsing failed with error \"{ERROR}\". ",
         "ERROR_PARSE_FAILURE_JSON"           : "Please make sure your file is valid JSON. Parsing failed with error \"{ERROR}\". ",
         "ERROR_PARSE_FAILURE_YAML"           : "Please make sure your file is valid YAML. Parsing failed with error \"{ERROR}\". ",
-        "ERROR_REJECT_UPDATE_CONNECTION"     : "Disallowed update to existing connection at \"{PATH}\"",
+        "ERROR_REJECT_UPDATE_CONNECTION"     : "Connection \"{NAME}\" already exists at \"{PATH}\"",
         "ERROR_REQUIRED_NAME"                : "No connection name found in the provided file",
         "ERROR_REQUIRED_PROTOCOL"            : "No connection protocol found in the provided file",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
-        "FIELD_HEADER_REPLACE_CONNECTIONS" : "Replace/Update existing connections",
-        "FIELD_HEADER_REPLACE_PERMISSIONS" : "Reset permissions",
-
-        "FIELD_OPTION_DUPLICATE_REPLACE" : "Replace duplicates",
-        "FIELD_OPTION_DUPLICATE_IGNORE"  : "Ignore duplicates",
-        "FIELD_OPTION_DUPLICATE_ERROR"   : "Disallow duplicates",
+        "FIELD_HEADER_EXISTING_CONNECTION_MODE" : "Replace/Update existing connections",
+        "FIELD_HEADER_EXISTING_PERMISSION_MODE" : "Reset permissions",
 
         "HELP_CSV_DESCRIPTION"              : "A connection import CSV file has one connection record per row. Each column will specify a connection field. At minimum the connection name and protocol must be specified.",
         "HELP_CSV_EXAMPLE"                  : "name,protocol,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,",
         "HELP_CSV_MORE_DETAILS"             : "The CSV header for each row specifies the connection field. The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. In most cases, there should be no conflict between fields, but if needed, an \" (attribute)\" or \" (parameter)\" suffix may be added to disambiguate. Lists of user or user group identifiers must be semicolon-separated.¹",
-        "HELP_FILE_TYPE_DESCRIPTION"        : "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created. Note that any existing connection permissions will not be removed for updated connections.",
+        "HELP_FILE_TYPE_DESCRIPTION"        : "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created. Note that any existing connection permissions will not be removed for updated connections, unless \"Reset permissions\" is checked.",
         "HELP_FILE_TYPE_HEADER"             : "File Types",
         "HELP_JSON_DESCRIPTION"             : "A connection import JSON file is a list of connection objects. At minimum the connection name and protocol must be specified in each connection object.",
         "HELP_JSON_EXAMPLE"                 : "[\n  \\{\n    \"name\": \"conn1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"hostname\": \"conn1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac user 1\", \"guac user 2\" ],\n    \"groups\": [ \"Connection 1 Users\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"hostname\": \"conn2.web.com\" \\},\n    \"group\": \"ROOT/Parent Group\",\n    \"users\": [ \"guac user 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"hostname\": \"conn3.web.com\" \\},\n    \"group\": \"ROOT/Parent Group/Child Group\",\n    \"users\": [ \"guac user 2\", \"guac user 3\" ]\n  \\},\n  \\{\n    \"name\": \"conn4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
         "HELP_JSON_MORE_DETAILS"            : "The connection group ID that the connection should be imported into may be directly specified with a \"parentIdentifier\" field, or the path to the parent group may be specified using a \"group\" field as shown below. An array of user and user group identifiers to grant access to may be specified per connection.",
-        "HELP_REPLACE_CONNECTION_TITLE"     : "Replacing existing connections",
-        "HELP_REPLACE_CONNECTION_CONTENT"   : "Checking this box will allow existing connections to be updated, if an imported connection has the same name and parent group as an existing connection. If unchecked, attempts to update existing connections will be treated as an error.",
-        "HELP_REPLACE_PERMISSION_TITLE"     : "Replacing connection permissions",
-        "HELP_REPLACE_PERMISSION_CONTENT"   : "If replacement of existing connections is enabled, checking this box will allow full replacement of connection permissions. If checked, access permission will only be granted to users and groups specified in the import file for this connection. If unchecked, specified users and groups will be granted access in addition to any existing permissions.",
+        "HELP_EXISTING_CONNECTION_MODE"     : "Entirely replace/update existing connections if their names and parent connection groups match the values in the provided file. If unchecked, attempting to import a connection with the same name and parent connection group of an existing connection will be considered an error.",
+        "HELP_EXISTING_PERMISSION_MODE"     : "Fully reset the permissions granted for all connections in the provided file to the permissions specified in that file. If no permissions are specified, all relevant connection permissions will be revoked. If unchecked, existing permissions are preserved, and any permissions specified in the file will be added.",
         "HELP_SEMICOLON_FOOTNOTE"           : "If present, semicolons can be escaped with a backslash, e.g. \"first\\\\;last\"",
         "HELP_UPLOAD_DROP_TITLE"            : "Drop a File Here",
         "HELP_UPLOAD_FILE_TYPES"            : "CSV, JSON, or YAML",
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index 0ea12c3ef..e696f8f30 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -421,6 +421,45 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
     }
 
+    /**
+     * Retrieve and return the object having the given identifier from the
+     * directory, throwing a GuacamoleResourceNotFoundException and firing a
+     * directory GET failure event if no object exists with the given identifier
+     * in the directory.
+     *
+     * @param identifier
+     *     The identifier of the object to retrieve from the directory.
+     *
+     * @return
+     *     The object from the directory with the provided identifier.
+     *
+     * @throws GuacamoleException
+     *     If no object with the provided identifier exists within the
+     *     directory, or if any other error occurs while attempting to retrieve
+     *     the object.
+     */
+    @Nonnull
+    private InternalType getObjectByIdentifier(String identifier)
+            throws GuacamoleException {
+
+        // Retrieve the object having the given identifier
+        InternalType object;
+        try {
+            object = directory.get(identifier);
+            if (object == null)
+                throw new GuacamoleResourceNotFoundException(
+                        "Not found: \"" + identifier + "\"");
+        }
+        catch (GuacamoleException | RuntimeException | Error e) {
+            fireDirectoryFailureEvent(
+                    DirectoryEvent.Operation.GET, identifier, null, e);
+            throw e;
+        }
+
+        // Return the object; it is guaranteed to be non-null at this point
+        return object;
+    }
+
     /**
      * If the provided throwable is a known Guacamole-specific type, create and
      * return a APIPatchError with an error message extracted from the error.
@@ -600,8 +639,10 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                         try {
 
-                            // Fetch the object to be updated
-                            original = directory.get(identifier);
+                            // Fetch the object to be updated. If no object is
+                            // found, a directory GET failure event will be
+                            // logged, and the update attempt will be aborted.
+                            original = getObjectByIdentifier(identifier);
                             
                             // Apply the changes to the original object
                             translator.applyExternalChanges(
@@ -805,17 +846,10 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
         getObjectResource(@PathParam("identifier") String identifier)
             throws GuacamoleException {
 
-        // Retrieve the object having the given identifier
-        InternalType object;
-        try {
-            object = directory.get(identifier);
-            if (object == null)
-                throw new GuacamoleResourceNotFoundException("Not found: \"" + identifier + "\"");
-        }
-        catch (GuacamoleException | RuntimeException | Error e) {
-            fireDirectoryFailureEvent(DirectoryEvent.Operation.GET, identifier, null, e);
-            throw e;
-        }
+        // Fetch the object to be updated. If no object is found, a directory
+        // GET failure event will be logged. If no exception is thrown, the
+        // object is guaranteed to exist
+        InternalType object = getObjectByIdentifier(identifier);
 
         // Return a resource which provides access to the retrieved object
         DirectoryObjectResource<InternalType, ExternalType> resource = resourceFactory.create(authenticatedUser, userContext, directory, object);

From 9e54b58af380499c3ec18a90473a9e281ea96a38 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 21 Apr 2023 23:56:01 +0000
Subject: [PATCH 184/289] GUACAMOLE-926: Fix importer config checkbox behavior.

---
 .../frontend/src/app/import/templates/connectionImport.html     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
index 2af6cad7f..a6cc0fe03 100644
--- a/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
+++ b/guacamole/src/main/frontend/src/app/import/templates/connectionImport.html
@@ -51,7 +51,7 @@
             <li>
                 <input type="checkbox"
                     id="existing-permission-mode" ng-model="importConfig.existingPermissionMode"
-                    ng-disabled="importConfig.replaceConnectionMode === 'REJECT'"
+                    ng-disabled="importConfig.existingConnectionMode === 'REJECT'"
                     ng-true-value="'REPLACE'" ng-false-value="'PRESERVE'" />
                 <label for="existing-permission-mode">
                     {{'IMPORT.FIELD_HEADER_EXISTING_PERMISSION_MODE' | translate}}

From 8c19e6ca81e108875a899bced37be0e4c06e9e00 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Sat, 22 Apr 2023 00:32:19 +0000
Subject: [PATCH 185/289] GUACAMOLE-926: Ensure that the directory patch
 replace operation writes to the same directory it reads from.

---
 .../rest/directory/DirectoryResource.java     | 23 ++++++++++++++-----
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
index e696f8f30..7b8342451 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/directory/DirectoryResource.java
@@ -430,6 +430,10 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
      * @param identifier
      *     The identifier of the object to retrieve from the directory.
      *
+     * @param directory
+     *     The directory to fetch the object from. If null, the directory
+     *     associated with this DirectoryResource instance will be used.
+     *
      * @return
      *     The object from the directory with the provided identifier.
      *
@@ -439,9 +443,15 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
      *     the object.
      */
     @Nonnull
-    private InternalType getObjectByIdentifier(String identifier)
+    private InternalType getObjectByIdentifier(
+            String identifier, @Nullable Directory<InternalType> directory)
             throws GuacamoleException {
 
+        // Use the directory associated with this instance if not otherwise
+        // specified
+        if (directory == null)
+            directory = this.directory;
+
         // Retrieve the object having the given identifier
         InternalType object;
         try {
@@ -639,10 +649,11 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
 
                         try {
 
-                            // Fetch the object to be updated. If no object is
-                            // found, a directory GET failure event will be
-                            // logged, and the update attempt will be aborted.
-                            original = getObjectByIdentifier(identifier);
+                            // Fetch the object to be updated from the atomic
+                            // directory instance. If no object is found, a 
+                            // directory GET failure event will be logged, and
+                            // the update attempt will be aborted.
+                            original = getObjectByIdentifier(identifier, directory);
                             
                             // Apply the changes to the original object
                             translator.applyExternalChanges(
@@ -849,7 +860,7 @@ public abstract class DirectoryResource<InternalType extends Identifiable, Exter
         // Fetch the object to be updated. If no object is found, a directory
         // GET failure event will be logged. If no exception is thrown, the
         // object is guaranteed to exist
-        InternalType object = getObjectByIdentifier(identifier);
+        InternalType object = getObjectByIdentifier(identifier, null);
 
         // Return a resource which provides access to the retrieved object
         DirectoryObjectResource<InternalType, ExternalType> resource = resourceFactory.create(authenticatedUser, userContext, directory, object);

From 53ed39bd952ca2d1c428496481db85169612710e Mon Sep 17 00:00:00 2001
From: Sharuru <mave@foxmail.com>
Date: Tue, 25 Apr 2023 12:23:42 +0800
Subject: [PATCH 186/289] GUACAMOLE-1778: Update the Simplified Chinese
 translation

---
 .../main/frontend/src/translations/zh.json    | 199 ++++++++++++++++--
 1 file changed, 178 insertions(+), 21 deletions(-)

diff --git a/guacamole/src/main/frontend/src/translations/zh.json b/guacamole/src/main/frontend/src/translations/zh.json
index 3d74553f7..bb43a8487 100644
--- a/guacamole/src/main/frontend/src/translations/zh.json
+++ b/guacamole/src/main/frontend/src/translations/zh.json
@@ -4,14 +4,20 @@
     
     "APP" : {
 
+        "NAME"    : "Apache Guacamole",
+        "VERSION" : "${project.version}",
+
         "ACTION_ACKNOWLEDGE"        : "确定",
         "ACTION_CANCEL"             : "取消",
+        "ACTION_CLEAR"              : "清除",
         "ACTION_CLONE"              : "克隆",
         "ACTION_CONTINUE"           : "继续",
         "ACTION_DELETE"             : "删除",
         "ACTION_DELETE_SESSIONS"    : "删除会话",
         "ACTION_DOWNLOAD"           : "下载",
+        "ACTION_IMPORT"             : "导入",
         "ACTION_LOGIN"              : "登录",
+        "ACTION_LOGIN_AGAIN"        : "重新登录",
         "ACTION_LOGOUT"             : "登出",
         "ACTION_MANAGE_CONNECTIONS" : "连接",
         "ACTION_MANAGE_PREFERENCES" : "偏好",
@@ -21,18 +27,22 @@
         "ACTION_MANAGE_USER_GROUPS" : "用户组",
         "ACTION_NAVIGATE_BACK"      : "返回",
         "ACTION_NAVIGATE_HOME"      : "首页",
+        "ACTION_PAUSE"              : "暂停",
+        "ACTION_PLAY"               : "播放",
         "ACTION_SAVE"               : "保存",
         "ACTION_SEARCH"             : "搜索",
         "ACTION_SHARE"              : "共享",
         "ACTION_UPDATE_PASSWORD"    : "更新密码",
         "ACTION_VIEW_HISTORY"       : "历史",
+        "ACTION_VIEW_RECORDING"     : "查看",
 
-        "DIALOG_HEADER_ERROR" : "出错",
+        "DIALOG_HEADER_ERROR" : "错误",
 
         "ERROR_PAGE_UNAVAILABLE"  : "发生错误，此操作无法完成。 如果问题仍然存在，请通知系统管理员或检查系统日志。",
         "ERROR_PASSWORD_BLANK"    : "密码不能留空。",
         "ERROR_PASSWORD_MISMATCH" : "输入的密码不吻合。",
-        
+        "ERROR_SINGLE_FILE_ONLY"  : "请一次只上传一个文件",
+
         "FIELD_HEADER_PASSWORD"       : "密码：",
         "FIELD_HEADER_PASSWORD_AGAIN" : "重输密码：",
 
@@ -41,16 +51,21 @@
         "FORMAT_DATE_TIME_PRECISE" : "yyyy-MM-dd HH:mm:ss",
 
         "INFO_ACTIVE_USER_COUNT" : "正在被{USERS}用户使用。",
+        "INFO_LOGGED_OUT"        : "您已被登出。",
 
-        "TEXT_ANONYMOUS_USER"   : "匿名",
-        "TEXT_HISTORY_DURATION" : "{VALUE} {UNIT, select, second{秒} minute{分} hour{小时} day{天} other{}}"
+        "TEXT_ANONYMOUS_USER"   : "匿名用户",
+        "TEXT_HISTORY_DURATION" : "{VALUE} {UNIT, select, second{{VALUE, plural, one{second} other{seconds}}} minute{{VALUE, plural, one{minute} other{minutes}}} hour{{VALUE, plural, one{hour} other{hours}}} day{{VALUE, plural, one{day} other{days}}} other{}}",
+        "TEXT_UNTRANSLATED" : "{MESSAGE}"
 
     },
 
     "CLIENT" : {
 
         "ACTION_ACKNOWLEDGE"               : "@:APP.ACTION_ACKNOWLEDGE",
-        "ACTION_CLEAR_COMPLETED_TRANSFERS" : "清除",
+        "ACTION_CANCEL"                    : "@:APP.ACTION_CANCEL",
+        "ACTION_CLEAR_CLIENT_MESSAGES"     : "@:APP.ACTION_CLEAR",
+        "ACTION_CLEAR_COMPLETED_TRANSFERS" : "@:APP.ACTION_CLEAR",
+        "ACTION_CONTINUE"                  : "@:APP.ACTION_CONTINUE",
         "ACTION_DISCONNECT"                : "断开连接",
         "ACTION_LOGOUT"                    : "@:APP.ACTION_LOGOUT",
         "ACTION_NAVIGATE_BACK"             : "@:APP.ACTION_NAVIGATE_BACK",
@@ -114,8 +129,10 @@
         "HELP_MOUSE_MODE_RELATIVE" : "拖拽时移动鼠标，再点击时触发按键。在鼠标当前所在的位置触发按键事件。",
         "HELP_SHARE_LINK"          : "正在共享当前连接，并可被使用以下链接的任何人使用：",
 
+        "INFO_ANONYMOUS_USER_COUNT" : "匿名用户{COUNT, plural, one{} other{ (#)}}",
         "INFO_CONNECTION_SHARED" : "此连接已被共享。",
         "INFO_NO_FILE_TRANSFERS" : "无文件传输任务。",
+        "INFO_USER_COUNT"           : "{USERNAME}{COUNT, plural, one{} other{ (#)}}",
 
         "NAME_INPUT_METHOD_NONE"   : "无输入法",
         "NAME_INPUT_METHOD_OSK"    : "屏幕键盘",
@@ -124,24 +141,31 @@
         "NAME_KEY_ALT"             : "Alt",
         "NAME_KEY_ESC"             : "Esc",
         "NAME_KEY_TAB"             : "Tab",
-        "NAME_MOUSE_MODE_ABSOLUTE" : "触控屏",
+        "NAME_MOUSE_MODE_ABSOLUTE" : "触摸屏",
         "NAME_MOUSE_MODE_RELATIVE" : "触控板",
 
+        "SECTION_HEADER_CLIENT_MESSAGES" : "消息",
         "SECTION_HEADER_CLIPBOARD"      : "剪贴板",
         "SECTION_HEADER_DEVICES"        : "设备",
         "SECTION_HEADER_DISPLAY"        : "显示",
         "SECTION_HEADER_FILE_TRANSFERS" : "文件传输",
         "SECTION_HEADER_INPUT_METHOD"   : "输入法",
+
         "SECTION_HEADER_MOUSE_MODE"     : "模拟鼠标模式",
 
+        "TEXT_ANONYMOUS_USER_JOINED"      : "有一名匿名用户已加入连接。",
+        "TEXT_ANONYMOUS_USER_LEFT"        : "有一名匿名用户断开了连接。",
         "TEXT_ZOOM_AUTO_FIT"              : "自适应浏览器窗口大小",
         "TEXT_CLIENT_STATUS_IDLE"         : "空闲。",
         "TEXT_CLIENT_STATUS_CONNECTING"   : "正在连接Guacamole……",
         "TEXT_CLIENT_STATUS_DISCONNECTED" : "您的连接已断开。",
         "TEXT_CLIENT_STATUS_UNSTABLE"     : "到Guacamole服务器的网络连接似乎不太稳定。",
         "TEXT_CLIENT_STATUS_WAITING"      : "已连接到Guacamole。正在等候应答……",
+        "TEXT_USER_JOINED"                : "用户 {USERNAME} 已加入连接。",
+        "TEXT_USER_LEFT"                  : "用户 {USERNAME} 断开了连接。",
         "TEXT_RECONNECT_COUNTDOWN"        : "在{REMAINING}秒后重连……",
         "TEXT_FILE_TRANSFER_PROGRESS"     : "{PROGRESS} {UNIT, select, b{B} kb{KB} mb{MB} gb{GB} other{}}",
+        "TEXT_CLIPBOARD_AWAITING_FOCUS"   : "点击以查看剪贴板内容……",
 
         "URL_OSK_LAYOUT" : "layouts/en-us-qwerty.json"
 
@@ -163,8 +187,76 @@
 
     },
 
+    "IMPORT": {
+
+        "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_BROWSE"             : "浏览文件",
+        "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
+        "ACTION_CLEAR"              : "@:APP.ACTION_CLEAR",
+        "ACTION_VIEW_FORMAT_HELP"   : "查看帮助",
+        "ACTION_IMPORT"             : "@:APP.ACTION_IMPORT",
+        "ACTION_IMPORT_CONNECTIONS" : "导入连接",
+
+        "DIALOG_HEADER_ERROR"   : "@:APP.DIALOG_HEADER_ERROR",
+        "DIALOG_HEADER_SUCCESS" : "成功",
+
+        "ERROR_AMBIGUOUS_CSV_HEADER"         : "存在冲突的 CSV 列名： \"{HEADER}\" ，可能是一个连接属性或者参数",
+        "ERROR_AMBIGUOUS_PARENT_GROUP"       : "连接组以其父连接组不能同时设置",
+        "ERROR_ARRAY_REQUIRED"               : "提供的文件必须包含有效的连接数据",
+        "ERROR_DETECTED_INVALID_TYPE"        : "不支持的文件类型。请确认您上传的文件是合法的 CSV，JSON 或者 YAML 文件。",
+        "ERROR_DUPLICATE_CONNECTION_IN_FILE" : "在导入的文件中发现了重复的连接： \"{NAME}\" 位于 \"{PATH}\"",
+        "ERROR_DUPLICATE_CSV_HEADER"         : "重复的 CSV 列名： {HEADER}",
+        "ERROR_EMPTY_FILE"                   : "提供的文件内容位空",
+        "ERROR_INVALID_CSV_HEADER"           : "非法的 CSV 列名： \"{HEADER}\" 不是一个可识别的属性或者参数。",
+        "ERROR_INVALID_MIME_TYPE"            : "不支持的文件类型： \"{TYPE}\"",
+        "ERROR_INVALID_GROUP"                : "未找到名称为： \"{GROUP}\"的连接组",
+        "ERROR_INVALID_GROUP_IDENTIFIER"     : "未找到识别为： \"{IDENTIFIER}\"的连接组",
+        "ERROR_NO_FILE_SUPPLIED"             : "请选择一个文件",
+        "ERROR_PARSE_FAILURE_CSV"            : "请确保您上传的是合法的 CSV 文件。解析错误： \"{ERROR}\" 。",
+        "ERROR_PARSE_FAILURE_JSON"           : "请确保您上传的是合法的 JSON 文件。解析错误： \"{ERROR}\" 。",
+        "ERROR_PARSE_FAILURE_YAML"           : "请确保您上传的是合法的 YAML 文件。解析错误： \"{ERROR}\" 。",
+        "ERROR_REJECT_UPDATE_CONNECTION"     : "连接 \"{NAME}\" 已存在于 \"{PATH}\"",
+        "ERROR_REQUIRED_NAME"                : "在提供的文件中未找到连接名",
+        "ERROR_REQUIRED_PROTOCOL"            : "在提供的文件中未找到连接协议",
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "FIELD_HEADER_EXISTING_CONNECTION_MODE" : "替换/更新 已存在的连接",
+        "FIELD_HEADER_EXISTING_PERMISSION_MODE" : "重置权限",
+
+        "HELP_CSV_DESCRIPTION"              : "当导入的文件格式为 CSV 时，一行记录为一条连接数据。每列为一个配置条目。每条记录至少需要提供连接名称以及协议。",
+        "HELP_CSV_EXAMPLE"                  : "name,protocol,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,",
+        "HELP_CSV_MORE_DETAILS"             : "CSV 列名与连接中的属性一一对应。The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. 在大多数场合下，属性之间不应当存在冲突。但如过这种情况发生时，在列名后加入 \" (attribute)\" 或者 \" (parameter)\" 即可避免混淆。用户或者用户组必须使用分号进行分割。¹",
+        "HELP_FILE_TYPE_DESCRIPTION"        : "目前系统支持三种文件格式：CSV，JSON 或者 YAML。文件格式之间支持的属性相同，至少需要连接名称以及协议。当然，连接组，哪些用户或者用户组有权限使用，连接参数等属性均可以被指定。不存在的用户或者用户组会被自动创建。注意，任何已存在的连接权限并不会根据导入的数据被清除，除非您勾选了“重置权限”选框。",
+        "HELP_FILE_TYPE_HEADER"             : "文件格式",
+        "HELP_JSON_DESCRIPTION"             : "当导入的文件格式为 JSON 时，每条记录至少需要提供连接名称以及协议。",
+        "HELP_JSON_EXAMPLE"                 : "[\n  \\{\n    \"name\": \"conn1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"hostname\": \"conn1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac user 1\", \"guac user 2\" ],\n    \"groups\": [ \"Connection 1 Users\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"hostname\": \"conn2.web.com\" \\},\n    \"group\": \"ROOT/Parent Group\",\n    \"users\": [ \"guac user 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"hostname\": \"conn3.web.com\" \\},\n    \"group\": \"ROOT/Parent Group/Child Group\",\n    \"users\": [ \"guac user 2\", \"guac user 3\" ]\n  \\},\n  \\{\n    \"name\": \"conn4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
+        "HELP_JSON_MORE_DETAILS"            : "需要被导入的连接组信息可以通过 \"parentIdentifier\" 属性直接指定，或者通过 \"group\" 属性进行指定。每条连接信息均可单独设置用户以及用户组的访问权限",
+        "HELP_EXISTING_CONNECTION_MODE"     : "如果提供文件中的信息匹配，将完全替换/更新已存在的连接信息。如果未勾选，尝试导入已存在的连接将会导致导入时发生错误。",
+        "HELP_EXISTING_PERMISSION_MODE"     : "根据提供文件中的设定完全重置权限。如果没有权限设定信息，所有已设定的连接权限将会被撤销。如果未勾选，已存在的权限会被保留，任何新权限设定会被自动添加。",
+        "HELP_SEMICOLON_FOOTNOTE"           : "如果需要，您可以通过反斜杠来转义分号，比如： \"first\\\\;last\"",
+        "HELP_UPLOAD_DROP_TITLE"            : "拖拽文件",
+        "HELP_UPLOAD_FILE_TYPES"            : "CSV，JSON 或者 YAML",
+        "HELP_YAML_DESCRIPTION"             : "当导入的文件格式为 YAML 时，其数据结构必须与使用 JSON 格式时保持一致。",
+        "HELP_YAML_EXAMPLE"                 : "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n    - guac user 1\n    - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n    - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n    - guac user 2\n    - guac user 3\n  - name: conn4\n    protocol: kubernetes",
+
+        "INFO_CONNECTIONS_IMPORTED_SUCCESS" : "{NUMBER} {NUMBER, plural, one{connection} other{connections}} imported successfully.",
+        
+        "SECTION_HEADER_CONNECTION_IMPORT"           : "导入连接",
+        "SECTION_HEADER_HELP_CONNECTION_IMPORT_FILE" : "Connection Import File Format",
+        "SECTION_HEADER_CSV"                         : "CSV 格式",
+        "SECTION_HEADER_JSON"                        : "JSON 格式",
+        "SECTION_HEADER_YAML"                        : "YAML 格式",
+
+        "TABLE_HEADER_ERRORS"     : "错误",
+        "TABLE_HEADER_GROUP"      : "分组",
+        "TABLE_HEADER_NAME"       : "名称",
+        "TABLE_HEADER_PROTOCOL"   : "协议",
+        "TABLE_HEADER_ROW_NUMBER" : "行 #"
+    },
+
     "DATA_SOURCE_DEFAULT" : {
-        "NAME" : "缺省（XML）"
+        "NAME" : "默认（XML）"
     },
 
     "FORM" : {
@@ -194,7 +286,7 @@
 
     "LIST" : {
 
-        "TEXT_ANONYMOUS_USER" : "匿名"
+        "TEXT_ANONYMOUS_USER" : "匿名用户"
 
     },
 
@@ -243,7 +335,7 @@
         "TABLE_HEADER_HISTORY_DURATION"   : "持续时间",
         "TABLE_HEADER_HISTORY_REMOTEHOST" : "远程主机",
 
-        "TEXT_CONFIRM_DELETE"   : "将无法恢复已被删除的连接。确定要删除这个连接吗？",
+        "TEXT_CONFIRM_DELETE"   : "连接被删除后将无法恢复。确定要删除这个连接吗？",
         "TEXT_HISTORY_DURATION" : "@:APP.TEXT_HISTORY_DURATION"
 
     },
@@ -321,7 +413,7 @@
 
         "HELP_NO_USER_GROUPS" : "该用户当前不属于任何组。 展开此部分以添加组。",
 	
-        "INFO_READ_ONLY" : "对不起，不能编辑此用户的账户。",
+        "INFO_READ_ONLY"                : "对不起，不能编辑此用户的账户。",
         "INFO_NO_USER_GROUPS_AVAILABLE" : "没用可用的用户组.",
 
         "SECTION_HEADER_ALL_CONNECTIONS"     : "全部连接",
@@ -374,7 +466,18 @@
         "SECTION_HEADER_PERMISSIONS"         : "@:MANAGE_USER.SECTION_HEADER_PERMISSIONS",
         "SECTION_HEADER_USER_GROUPS"         : "父用户组",
 
-        "TEXT_CONFIRM_DELETE" : "删除组后将无法还原。 您确定要删除该组吗？"
+        "TEXT_CONFIRM_DELETE" : "删除用户组后将无法还原。确定要删除该用户组吗？"
+
+    },
+
+    "PLAYER" : {
+
+        "ACTION_CANCEL" : "@:APP.ACTION_CANCEL",
+        "ACTION_PAUSE"  : "@:APP.ACTION_PAUSE",
+        "ACTION_PLAY"   : "@:APP.ACTION_PLAY",
+
+        "INFO_LOADING_RECORDING" : "录像已载入。请稍候……",
+        "INFO_SEEK_IN_PROGRESS"  : "正在跳转到指定位置。请稍候……"
 
     },
     
@@ -388,6 +491,7 @@
         "FIELD_HEADER_CONTAINER"       : "容器名称:",
         "FIELD_HEADER_CREATE_RECORDING_PATH" : "自动建立录像目录：",
         "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "自动建立打字稿目录：",
+        "FIELD_HEADER_EXEC_COMMAND"    : "命令 (exec):",
         "FIELD_HEADER_FONT_NAME"      : "字体名：",
         "FIELD_HEADER_FONT_SIZE"      : "字体大小：",
         "FIELD_HEADER_HOSTNAME"       : "主机名：",
@@ -455,7 +559,9 @@
         "FIELD_HEADER_DISABLE_AUDIO"   : "禁用音频：",
         "FIELD_HEADER_DISABLE_AUTH"    : "禁用认证：",
         "FIELD_HEADER_DISABLE_COPY"    : "禁用从远程桌面复制:",
+        "FIELD_HEADER_DISABLE_DOWNLOAD" : "禁用文件下载:",
         "FIELD_HEADER_DISABLE_PASTE"   : "禁用从客户端粘贴:",
+        "FIELD_HEADER_DISABLE_UPLOAD"   : "禁用文件上传:",
         "FIELD_HEADER_DOMAIN"          : "域：",
         "FIELD_HEADER_DPI"             : "分辨率（DPI）：",
         "FIELD_HEADER_DRIVE_NAME"      : "驱动器名称:",
@@ -466,13 +572,16 @@
         "FIELD_HEADER_ENABLE_FONT_SMOOTHING"      : "启用字体平滑（ClearType）：",
         "FIELD_HEADER_ENABLE_FULL_WINDOW_DRAG"    : "启用全窗口拖拽：",
         "FIELD_HEADER_ENABLE_MENU_ANIMATIONS"     : "启用菜单动画：",
-        "FIELD_HEADER_DISABLE_BITMAP_CACHING"     : "启用位图缓存：",
-        "FIELD_HEADER_DISABLE_OFFSCREEN_CACHING"  : "启用离屏缓存：",
+        "FIELD_HEADER_DISABLE_BITMAP_CACHING"     : "禁用位图缓存：",
+        "FIELD_HEADER_DISABLE_OFFSCREEN_CACHING"  : "禁用离屏缓存：",
         "FIELD_HEADER_DISABLE_GLYPH_CACHING"      : "禁用字形缓存：",
+        "FIELD_HEADER_DISABLE_GFX"                : "禁用图形管线拓展:",
         "FIELD_HEADER_ENABLE_PRINTING"            : "启用打印功能：",
         "FIELD_HEADER_ENABLE_SFTP"     : "启用SFTP：",
         "FIELD_HEADER_ENABLE_THEMING"             : "启用桌面主题：",
+        "FIELD_HEADER_ENABLE_TOUCH"               : "启用多点触控:",
         "FIELD_HEADER_ENABLE_WALLPAPER"           : "启用桌面墙纸：",
+        "FIELD_HEADER_FORCE_LOSSLESS"             : "强制无损压缩:",
         "FIELD_HEADER_GATEWAY_DOMAIN"   : "域：",
         "FIELD_HEADER_GATEWAY_HOSTNAME" : "主机名：",
         "FIELD_HEADER_GATEWAY_PASSWORD" : "密码：",
@@ -483,6 +592,7 @@
         "FIELD_HEADER_IGNORE_CERT"     : "忽略服务器证书：",
         "FIELD_HEADER_INITIAL_PROGRAM" : "初始程序：",
         "FIELD_HEADER_LOAD_BALANCE_INFO" : "负载平衡信息/cookie：",
+        "FIELD_HEADER_NORMALIZE_CLIPBOARD" : "换行符:",
         "FIELD_HEADER_PASSWORD"        : "密码：",
         "FIELD_HEADER_PORT"            : "端口：",
         "FIELD_HEADER_PRINTER_NAME"    : "重定向的打印机名称:",
@@ -491,6 +601,7 @@
         "FIELD_HEADER_READ_ONLY"      : "只读：",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "排除鼠标：",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "排除图像/数据流：",
+        "FIELD_HEADER_RECORDING_EXCLUDE_TOUCH"  : "排除触摸事件:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "包含按键事件：",
         "FIELD_HEADER_RECORDING_NAME" : "录像名：",
         "FIELD_HEADER_RECORDING_PATH" : "录像路径：",
@@ -501,6 +612,7 @@
         "FIELD_HEADER_SECURITY"        : "安全模式：",
         "FIELD_HEADER_SERVER_LAYOUT"   : "键盘布局：",
         "FIELD_HEADER_SFTP_DIRECTORY"             : "缺省文件上传目录：",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "禁用文件下载:",
         "FIELD_HEADER_SFTP_HOST_KEY"              : "公钥(Base64):",
         "FIELD_HEADER_SFTP_HOSTNAME"              : "主机名：",
         "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "SFTP keepalive时间间隔：",
@@ -509,11 +621,22 @@
         "FIELD_HEADER_SFTP_PORT"                  : "端口：",
         "FIELD_HEADER_SFTP_PRIVATE_KEY"           : "私钥：",
         "FIELD_HEADER_SFTP_ROOT_DIRECTORY"        : "文件浏览器根目录：",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "禁用文件上传:",
         "FIELD_HEADER_SFTP_USERNAME"              : "用户名：",
         "FIELD_HEADER_STATIC_CHANNELS" : "静态通道名：",
         "FIELD_HEADER_TIMEZONE"        : "时区:",
         "FIELD_HEADER_USERNAME"        : "用户名：",
         "FIELD_HEADER_WIDTH"           : "宽度：",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址 :",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "WoL 数据包 UDP 端口: ",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间:",
+
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_EMPTY"    : "",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_PRESERVE" : "保持原样",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_UNIX"     : "Linux/Mac/Unix (LF)",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_WINDOWS"  : "Windows (CRLF)",   
 
         "FIELD_OPTION_COLOR_DEPTH_16"    : "低色（16位）",
         "FIELD_OPTION_COLOR_DEPTH_24"    : "真彩（24位）",
@@ -530,6 +653,7 @@
         "FIELD_OPTION_SECURITY_NLA"   : "NLA（网络级别认证）",
         "FIELD_OPTION_SECURITY_RDP"   : "RDP加密",
         "FIELD_OPTION_SECURITY_TLS"   : "TLS加密",
+        "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Swiss German (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "German (Qwertz)",
@@ -537,15 +661,20 @@
         "FIELD_OPTION_SERVER_LAYOUT_EN_GB_QWERTY" : "UK English (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_EN_US_QWERTY" : "US English (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_ES_ES_QWERTY" : "Spanish (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_ES_LATAM_QWERTY" : "Latin American (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_FAILSAFE"     : "Unicode",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_BE_AZERTY" : "Belgian French (Azerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_CA_QWERTY" : "Canadian French (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_FR_CH_QWERTZ" : "Swiss French (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_FR_FR_AZERTY" : "French (Azerty)",
         "FIELD_OPTION_SERVER_LAYOUT_HU_HU_QWERTZ" : "Hungarian (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_IT_IT_QWERTY" : "Italian (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japanese (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_NO_NO_QWERTY" : "Norwegian (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portuguese Brazilian (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portuguese (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY" : "Romanian (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Swedish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turkish-Q (Qwerty)",
@@ -564,7 +693,8 @@
         "SECTION_HEADER_PRECONNECTION_PDU"  : "预连接PDU / Hyper-V",
         "SECTION_HEADER_RECORDING"          : "屏幕录像",
         "SECTION_HEADER_REMOTEAPP"          : "RemoteApp",
-        "SECTION_HEADER_SFTP"               : "SFTP"
+        "SECTION_HEADER_SFTP"               : "SFTP",
+        "SECTION_HEADER_WOL"                : "网络唤醒 (WoL)"
 
     },
 
@@ -596,12 +726,18 @@
         "FIELD_HEADER_RECORDING_NAME" : "录像名：",
         "FIELD_HEADER_RECORDING_PATH" : "录像路径：",
         "FIELD_HEADER_SERVER_ALIVE_INTERVAL" : "服务器keepalive时间间隔：",
-
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD" : "禁用文件下载:",
         "FIELD_HEADER_SFTP_ROOT_DIRECTORY"   : "文件浏览器根目录：",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"   : "禁用文件上传:",
         "FIELD_HEADER_TERMINAL_TYPE"   : "终端类型:",
         "FIELD_HEADER_TIMEZONE"        : "时区($TZ):",
         "FIELD_HEADER_TYPESCRIPT_NAME" : "打字稿名称：",
         "FIELD_HEADER_TYPESCRIPT_PATH" : "打字稿路径：",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址 :",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "WoL 数据包 UDP 端口: ",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间:",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
         "FIELD_OPTION_BACKSPACE_8"     : "退格键（Ctrl-H）",
@@ -647,7 +783,8 @@
         "SECTION_HEADER_RECORDING"      : "屏幕录像",
         "SECTION_HEADER_SESSION"        : "会话 / 环境",
         "SECTION_HEADER_TYPESCRIPT"     : "打字稿（文本会话录像）",
-        "SECTION_HEADER_SFTP"           : "SFTP"
+        "SECTION_HEADER_SFTP"           : "SFTP",
+        "SECTION_HEADER_WOL"            : "网络唤醒 (WoL)"
 
     },
 
@@ -679,6 +816,11 @@
         "FIELD_HEADER_TERMINAL_TYPE"   : "终端类型:",
         "FIELD_HEADER_TYPESCRIPT_NAME" : "打字稿名称:",
         "FIELD_HEADER_TYPESCRIPT_PATH" : "打字稿路径:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址 :",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "WoL 数据包 UDP 端口: ",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间:",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
         "FIELD_OPTION_BACKSPACE_8"     : "退格键(Ctrl-H)",
@@ -722,7 +864,8 @@
         "SECTION_HEADER_DISPLAY"        : "显示",
         "SECTION_HEADER_RECORDING"      : "屏幕录像",
         "SECTION_HEADER_TYPESCRIPT"     : "打字稿（文本会话录像）",
-        "SECTION_HEADER_NETWORK"        : "网络"
+        "SECTION_HEADER_NETWORK"        : "网络",
+        "SECTION_HEADER_WOL"            : "网络唤醒 (WoL)"
 
     },
 
@@ -739,6 +882,7 @@
         "FIELD_HEADER_DISABLE_PASTE"    : "禁用从客户端粘贴:",
         "FIELD_HEADER_ENABLE_AUDIO"     : "启用音频：",
         "FIELD_HEADER_ENABLE_SFTP"      : "启用SFTP：",
+        "FIELD_HEADER_FORCE_LOSSLESS"   : "强制无损压缩:",
         "FIELD_HEADER_HOSTNAME"         : "主机名：",
         "FIELD_HEADER_USERNAME"         : "用户名：",
         "FIELD_HEADER_PASSWORD"         : "密码：",
@@ -750,6 +894,7 @@
         "FIELD_HEADER_RECORDING_NAME" : "录像名：",
         "FIELD_HEADER_RECORDING_PATH" : "录像路径：",
         "FIELD_HEADER_SFTP_DIRECTORY"             : "缺省文件上传目录：",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "禁用文件下载:",
         "FIELD_HEADER_SFTP_HOST_KEY"              : "公钥(Base64):",
         "FIELD_HEADER_SFTP_HOSTNAME"              : "主机名：",
         "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "SFTP keepalive时间间隔：",
@@ -758,8 +903,14 @@
         "FIELD_HEADER_SFTP_PORT"                  : "端口：",
         "FIELD_HEADER_SFTP_PRIVATE_KEY"           : "私钥：",
         "FIELD_HEADER_SFTP_ROOT_DIRECTORY"        : "文件浏览器根目录：",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "禁用文件上传:",
         "FIELD_HEADER_SFTP_USERNAME"              : "用户名：",
         "FIELD_HEADER_SWAP_RED_BLUE"    : "交换红/蓝成分：",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址 :",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "WoL 数据包 UDP 端口: ",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间:",
 
         "FIELD_OPTION_COLOR_DEPTH_8"     : "256色",
         "FIELD_OPTION_COLOR_DEPTH_16"    : "低色（16位）",
@@ -786,7 +937,8 @@
         "SECTION_HEADER_NETWORK"        : "网络",
         "SECTION_HEADER_RECORDING"      : "屏幕录像",
         "SECTION_HEADER_REPEATER"       : "VNC中继",
-        "SECTION_HEADER_SFTP"           : "SFTP"
+        "SECTION_HEADER_SFTP"           : "SFTP",
+        "SECTION_HEADER_WOL"            : "网络唤醒 (WoL)"
 
     },
 
@@ -800,10 +952,11 @@
 
         "ACTION_DOWNLOAD" : "@:APP.ACTION_DOWNLOAD",
         "ACTION_SEARCH"   : "@:APP.ACTION_SEARCH",
+        "ACTION_VIEW_RECORDING" : "@:APP.ACTION_VIEW_RECORDING",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
-        "FILENAME_HISTORY_CSV" : "历史.csv",
+        "FILENAME_HISTORY_CSV" : "连接历史.csv",
 
         "FORMAT_DATE" : "@:APP.FORMAT_DATE_TIME_PRECISE",
 
@@ -814,6 +967,7 @@
 
         "TABLE_HEADER_SESSION_CONNECTION_NAME" : "连接名",
         "TABLE_HEADER_SESSION_DURATION"        : "持续时间",
+        "TABLE_HEADER_SESSION_LOGS"            : "日志",
         "TABLE_HEADER_SESSION_REMOTEHOST"      : "远程主机",
         "TABLE_HEADER_SESSION_STARTDATE"       : "起始时间",
         "TABLE_HEADER_SESSION_USERNAME"        : "用户名",
@@ -825,6 +979,7 @@
     "SETTINGS_CONNECTIONS" : {
 
         "ACTION_ACKNOWLEDGE"          : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_IMPORT"               : "@:APP.ACTION_IMPORT",
         "ACTION_NEW_CONNECTION"       : "新建连接",
         "ACTION_NEW_CONNECTION_GROUP" : "新建连接组",
         "ACTION_NEW_SHARING_PROFILE"  : "新建共享设定",
@@ -845,6 +1000,7 @@
 
         "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
         "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
+        "ACTION_SAVE"               : "@:APP.ACTION_SAVE",
         "ACTION_UPDATE_PASSWORD"    : "@:APP.ACTION_UPDATE_PASSWORD",
 
         "DIALOG_HEADER_ERROR"    : "@:APP.DIALOG_HEADER_ERROR",
@@ -865,12 +1021,13 @@
         "HELP_INPUT_METHOD_NONE"    : "@:CLIENT.HELP_INPUT_METHOD_NONE",
         "HELP_INPUT_METHOD_OSK"     : "@:CLIENT.HELP_INPUT_METHOD_OSK",
         "HELP_INPUT_METHOD_TEXT"    : "@:CLIENT.HELP_INPUT_METHOD_TEXT",
-        "HELP_LOCALE"             : "以下选项与用户的语言环境有关，并将影响界面各部分的显示方式。",
+        "HELP_LOCALE"               : "以下选项与用户的语言环境有关，并将影响界面各部分的显示方式。",
         "HELP_MOUSE_MODE_ABSOLUTE"  : "@:CLIENT.HELP_MOUSE_MODE_ABSOLUTE",
         "HELP_MOUSE_MODE_RELATIVE"  : "@:CLIENT.HELP_MOUSE_MODE_RELATIVE",
         "HELP_UPDATE_PASSWORD"      : "如需改变密码，请在下面输入您的当前密码与希望使用的新密码，并点击“更新密码” 。密码的改动会立即生效。",
 
         "INFO_PASSWORD_CHANGED" : "密码已更改。",
+        "INFO_PREFERENCE_ATTRIBUTES_CHANGED" : "用户设定已保存。",
 
         "NAME_INPUT_METHOD_NONE" : "@:CLIENT.NAME_INPUT_METHOD_NONE",
         "NAME_INPUT_METHOD_OSK"  : "@:CLIENT.NAME_INPUT_METHOD_OSK",
@@ -974,4 +1131,4 @@
 
     }
 
-}
+}
\ No newline at end of file

From c8fd6edcf51ff5729d242a49f6a5b45f2d1b1a71 Mon Sep 17 00:00:00 2001
From: Sharuru <mave@foxmail.com>
Date: Tue, 25 Apr 2023 16:07:53 +0800
Subject: [PATCH 187/289] GUACAMOLE-1778: Friendly with language users' habits

---
 .../main/frontend/src/translations/zh.json    | 350 +++++++++---------
 1 file changed, 175 insertions(+), 175 deletions(-)

diff --git a/guacamole/src/main/frontend/src/translations/zh.json b/guacamole/src/main/frontend/src/translations/zh.json
index bb43a8487..f9c261abc 100644
--- a/guacamole/src/main/frontend/src/translations/zh.json
+++ b/guacamole/src/main/frontend/src/translations/zh.json
@@ -39,8 +39,8 @@
         "DIALOG_HEADER_ERROR" : "错误",
 
         "ERROR_PAGE_UNAVAILABLE"  : "发生错误，此操作无法完成。 如果问题仍然存在，请通知系统管理员或检查系统日志。",
-        "ERROR_PASSWORD_BLANK"    : "密码不能留空。",
-        "ERROR_PASSWORD_MISMATCH" : "输入的密码不吻合。",
+        "ERROR_PASSWORD_BLANK"    : "密码不能为空。",
+        "ERROR_PASSWORD_MISMATCH" : "输入的密码不匹配。",
         "ERROR_SINGLE_FILE_ONLY"  : "请一次只上传一个文件",
 
         "FIELD_HEADER_PASSWORD"       : "密码：",
@@ -50,11 +50,11 @@
 
         "FORMAT_DATE_TIME_PRECISE" : "yyyy-MM-dd HH:mm:ss",
 
-        "INFO_ACTIVE_USER_COUNT" : "正在被{USERS}用户使用。",
-        "INFO_LOGGED_OUT"        : "您已被登出。",
+        "INFO_ACTIVE_USER_COUNT" : "正在被 {USERS} 个用户使用。",
+        "INFO_LOGGED_OUT"        : "您已登出。",
 
         "TEXT_ANONYMOUS_USER"   : "匿名用户",
-        "TEXT_HISTORY_DURATION" : "{VALUE} {UNIT, select, second{{VALUE, plural, one{second} other{seconds}}} minute{{VALUE, plural, one{minute} other{minutes}}} hour{{VALUE, plural, one{hour} other{hours}}} day{{VALUE, plural, one{day} other{days}}} other{}}",
+        "TEXT_HISTORY_DURATION" : "{VALUE} {UNIT, select, second{秒} minute{分} hour{小时} day{天} other{}}",
         "TEXT_UNTRANSLATED" : "{MESSAGE}"
 
     },
@@ -79,32 +79,32 @@
         "DIALOG_HEADER_CONNECTION_ERROR" : "连接出错",
         "DIALOG_HEADER_DISCONNECTED"     : "已断开连接",
 
-        "ERROR_CLIENT_201"     : "因服务器繁忙，本连接已被关闭。请稍候几分钟再重试。",
-        "ERROR_CLIENT_202"     : "因远程桌面太久没有应答，Guacamole服务器关闭了本连接。请重试或联系您的系统管理员。",
-        "ERROR_CLIENT_203"     : "远程桌面服务器因为出错而关闭了本连接。请重试或联系您的系统管理员。",
+        "ERROR_CLIENT_201"     : "因服务器繁忙，本连接已被关闭。请稍等几分钟后再尝试。",
+        "ERROR_CLIENT_202"     : "因远程桌面太久没有应答，Guacamole 服务器关闭了本连接。请重试或联系您的系统管理员。",
+        "ERROR_CLIENT_203"     : "远程桌面服务器因为发生错误而关闭了本连接。请重试或联系您的系统管理员。",
         "ERROR_CLIENT_207"     : "联系不上远程桌面服务器。如果问题持续，请通知您的系统管理员，或检查您的系统日志。",
         "ERROR_CLIENT_208"     : "远程桌面服务器不在线。如果问题持续，请通知您的系统管理员，或检查您的系统日志。",
         "ERROR_CLIENT_209"     : "因与另一个连接冲突，远程桌面服务器关闭了本连接。请稍后重试。",
         "ERROR_CLIENT_20A"     : "因长时间没有活动，远程桌面服务器关闭了本连接。如果这不是期望的设置，请通知您的系统管理员，或检查您的系统设置。",
-        "ERROR_CLIENT_20B"     : "远程桌面服务器强制关闭了本连接。如果这不是期望的配置，请通知您的系统管理员，或检查您的系统日志。",
-        "ERROR_CLIENT_301"     : "登录失败。请先重新连接再重试。",
+        "ERROR_CLIENT_20B"     : "远程桌面服务器强制关闭了本连接。如果这不是预期的情况，请通知您的系统管理员，或检查您的系统日志。",
+        "ERROR_CLIENT_301"     : "登录失败。请重新连接后再重试。",
         "ERROR_CLIENT_303"     : "远程桌面服务器拒绝了本连接。如果需要使用本连接，请联系您的系统管理员开放权限，或者检查您的系统设置。",
-        "ERROR_CLIENT_308"     : "因为您的浏览器长时间没有应答，Guacamole服务器关闭了本连接。这通常是因为网络问题（如不稳定的无线连接或网速太慢等）而导致的。请先检查您的网络连接再重试。",
-        "ERROR_CLIENT_31D"     : "因为您已超出了单一用户可同时使用的连接数量，Guacamole服务器拒绝了本连接。请先关闭至少一个连接再重试。",
-        "ERROR_CLIENT_DEFAULT" : "本连接因为Guacamole服务器出现了内部错误而被终止。如果问题持续，请通知您的系统管理员，或检查您的系统日志。",
+        "ERROR_CLIENT_308"     : "因为您的浏览器长时间没有应答，Guacamole 服务器关闭了本连接。这通常是因为网络问题（如不稳定的无线连接或网速太慢等）而导致的。请先检查您的网络连接再重试。",
+        "ERROR_CLIENT_31D"     : "因为您已超出了单一用户可同时使用的连接数量，Guacamole 服务器拒绝了本连接。请先关闭至少一个连接再重试。",
+        "ERROR_CLIENT_DEFAULT" : "本连接因为 Guacamole 服务器出现了内部错误而被终止。如果问题持续，请通知您的系统管理员，或检查您的系统日志。",
 
-        "ERROR_TUNNEL_201"     : "因为正在使用的活动连接太多，Guacamole服务器拒绝了本连接。请稍后再重试。",
+        "ERROR_TUNNEL_201"     : "因为正在使用的活动连接太多，Guacamole 服务器拒绝了本连接。请稍后再重试。",
         "ERROR_TUNNEL_202"     : "因服务器太久没有应答，本连接已被关闭。这通常是因为网络问题（如不稳定的无线连接或网速太慢等）而导致的。请先检查您的网络连接再重试，或者联系您的系统管理员。",
         "ERROR_TUNNEL_203"     : "服务器出错并关闭了本连接。请重试，或联系您的系统管理员。",
         "ERROR_TUNNEL_204"     : "请求的连接不存在。请先检查连接的名字再重试。",
         "ERROR_TUNNEL_205"     : "本连接正在使用中，并且不允许共享连接。请稍后重试。",
-        "ERROR_TUNNEL_207"     : "联系不上Guacamole服务器。请先检查您的网络连接再重试。",
-        "ERROR_TUNNEL_208"     : "Guacamole服务器不接受连接请求。请先检查您的网络连接再重试。",
+        "ERROR_TUNNEL_207"     : "联系不上 Guacamole 服务器。请先检查您的网络连接再重试。",
+        "ERROR_TUNNEL_208"     : "Guacamole 服务器不接受连接请求。请先检查您的网络连接再重试。",
         "ERROR_TUNNEL_301"     : "您还未登录，所以没有使用此连接的权限。请先登录再重试。",
         "ERROR_TUNNEL_303"     : "您没有使用此连接的权限。如果您的确需要使用此连接，请联系您的系统管理员开通权限，或检查您的系统设置。",
-        "ERROR_TUNNEL_308"     : "因为您的浏览器长时间没有应答，Guacamole服务器关闭了本连接。这通常是因为网络问题（如不稳定的无线连接或网速太慢等）而导致的。请先检查您的网络连接再重试。",
-        "ERROR_TUNNEL_31D"     : "因为您已超出了单一用户可同时使用的连接数量，Guacamole服务器拒绝了本连接。请先关闭至少一个连接再重试。",
-        "ERROR_TUNNEL_DEFAULT" : "本连接因为Guacamole服务器出现了内部错误而被终止。如果问题持续，请通知您的系统管理员，或检查您的系统日志。",
+        "ERROR_TUNNEL_308"     : "因为您的浏览器长时间没有应答，Guacamole 服务器关闭了本连接。这通常是因为网络问题（如不稳定的无线连接或网速太慢等）而导致的。请先检查您的网络连接再重试。",
+        "ERROR_TUNNEL_31D"     : "因为您已超出了单一用户可同时使用的连接数量，Guacamole 服务器拒绝了本连接。请先关闭至少一个连接再重试。",
+        "ERROR_TUNNEL_DEFAULT" : "本连接因为 Guacamole 服务器出现了内部错误而被终止。如果问题持续，请通知您的系统管理员，或检查您的系统日志。",
 
         "ERROR_UPLOAD_100"     : "不支持或不允许使用文件传输。请联系您的系统管理员，或检查您的系统日志。",
         "ERROR_UPLOAD_201"     : "正在同时传输太多文件。请等待当前的文件传输任务完成后，再重试。",
@@ -116,13 +116,13 @@
         "ERROR_UPLOAD_303"     : "您没有上传此文件的权限。如果您需要权限，请检查您的系统设置，或联系您的系统管理员。",
         "ERROR_UPLOAD_308"     : "文件传输已停止。这通常是因为网络问题（如不稳定的无线连接或网速太慢等）而导致的。请先检查您的网络连接再重试。",
         "ERROR_UPLOAD_31D"     : "正在同时传输太多文件。请等待当前的传输任务完成后，再重试。",
-        "ERROR_UPLOAD_DEFAULT" : "本连接因为Guacamole服务器出现了内部错误而被终止。如果问题持续，请通知您的系统管理员，或检查您的系统日志。",
+        "ERROR_UPLOAD_DEFAULT" : "本连接因为 Guacamole 服务器出现了内部错误而被终止。如果问题持续，请通知您的系统管理员，或检查您的系统日志。",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
         "HELP_CLIPBOARD"           : "复制/剪切的文本将出现在这里。对下面文本内容所作的修改将会影响远程电脑上的剪贴板。",
-        "HELP_INPUT_METHOD_NONE"   : "没有选择任何输入法。将从连接的物理键盘接受键盘输入。",
-        "HELP_INPUT_METHOD_OSK"    : "显示并从内建的Guacamole屏幕键盘接受输入。屏幕键盘可以输入平常无法输入的按键组合（如Ctrl-Alt-Del等）。",
+        "HELP_INPUT_METHOD_NONE"   : "没有选择任何输入方式。将从连接的物理键盘接受键盘输入。",
+        "HELP_INPUT_METHOD_OSK"    : "显示并从内建的 Guacamole 屏幕键盘接受输入。屏幕键盘可以输入平常无法输入的按键组合（如 Ctrl-Alt-Del 等）。",
         "HELP_INPUT_METHOD_TEXT"   : "允许输入文本，并根据所输入的文本模拟键盘事件。可用于没有物理键盘的设备，如手机等。",
         "HELP_MOUSE_MODE"          : "设置远程电脑上的鼠标对触控行为的反应。",
         "HELP_MOUSE_MODE_ABSOLUTE" : "点击时立即触发按键。在点击的位置触发鼠标按键事件。",
@@ -130,11 +130,11 @@
         "HELP_SHARE_LINK"          : "正在共享当前连接，并可被使用以下链接的任何人使用：",
 
         "INFO_ANONYMOUS_USER_COUNT" : "匿名用户{COUNT, plural, one{} other{ (#)}}",
-        "INFO_CONNECTION_SHARED" : "此连接已被共享。",
-        "INFO_NO_FILE_TRANSFERS" : "无文件传输任务。",
+        "INFO_CONNECTION_SHARED"    : "此连接已被共享。",
+        "INFO_NO_FILE_TRANSFERS"    : "无文件传输任务。",
         "INFO_USER_COUNT"           : "{USERNAME}{COUNT, plural, one{} other{ (#)}}",
 
-        "NAME_INPUT_METHOD_NONE"   : "无输入法",
+        "NAME_INPUT_METHOD_NONE"   : "无",
         "NAME_INPUT_METHOD_OSK"    : "屏幕键盘",
         "NAME_INPUT_METHOD_TEXT"   : "文本输入",
         "NAME_KEY_CTRL"            : "Ctrl",
@@ -145,11 +145,11 @@
         "NAME_MOUSE_MODE_RELATIVE" : "触控板",
 
         "SECTION_HEADER_CLIENT_MESSAGES" : "消息",
-        "SECTION_HEADER_CLIPBOARD"      : "剪贴板",
-        "SECTION_HEADER_DEVICES"        : "设备",
-        "SECTION_HEADER_DISPLAY"        : "显示",
-        "SECTION_HEADER_FILE_TRANSFERS" : "文件传输",
-        "SECTION_HEADER_INPUT_METHOD"   : "输入法",
+        "SECTION_HEADER_CLIPBOARD"       : "剪贴板",
+        "SECTION_HEADER_DEVICES"         : "设备",
+        "SECTION_HEADER_DISPLAY"         : "显示",
+        "SECTION_HEADER_FILE_TRANSFERS"  : "文件传输",
+        "SECTION_HEADER_INPUT_METHOD"    : "输入方式",
 
         "SECTION_HEADER_MOUSE_MODE"     : "模拟鼠标模式",
 
@@ -157,15 +157,15 @@
         "TEXT_ANONYMOUS_USER_LEFT"        : "有一名匿名用户断开了连接。",
         "TEXT_ZOOM_AUTO_FIT"              : "自适应浏览器窗口大小",
         "TEXT_CLIENT_STATUS_IDLE"         : "空闲。",
-        "TEXT_CLIENT_STATUS_CONNECTING"   : "正在连接Guacamole……",
+        "TEXT_CLIENT_STATUS_CONNECTING"   : "正在连接 Guacamole...",
         "TEXT_CLIENT_STATUS_DISCONNECTED" : "您的连接已断开。",
-        "TEXT_CLIENT_STATUS_UNSTABLE"     : "到Guacamole服务器的网络连接似乎不太稳定。",
-        "TEXT_CLIENT_STATUS_WAITING"      : "已连接到Guacamole。正在等候应答……",
+        "TEXT_CLIENT_STATUS_UNSTABLE"     : "到 Guacamole 服务器的网络连接似乎不太稳定。",
+        "TEXT_CLIENT_STATUS_WAITING"      : "已连接到 Guacamole。正在等待应答...",
         "TEXT_USER_JOINED"                : "用户 {USERNAME} 已加入连接。",
         "TEXT_USER_LEFT"                  : "用户 {USERNAME} 断开了连接。",
-        "TEXT_RECONNECT_COUNTDOWN"        : "在{REMAINING}秒后重连……",
+        "TEXT_RECONNECT_COUNTDOWN"        : "在 {REMAINING} 秒后重连...",
         "TEXT_FILE_TRANSFER_PROGRESS"     : "{PROGRESS} {UNIT, select, b{B} kb{KB} mb{MB} gb{GB} other{}}",
-        "TEXT_CLIPBOARD_AWAITING_FOCUS"   : "点击以查看剪贴板内容……",
+        "TEXT_CLIPBOARD_AWAITING_FOCUS"   : "点击以查看剪贴板内容...",
 
         "URL_OSK_LAYOUT" : "layouts/en-us-qwerty.json"
 
@@ -178,12 +178,12 @@
         "ACTION_SAVE"         : "@:APP.ACTION_SAVE",
         "ACTION_SHOW_DETAILS" : "显示",
 
-        "FIELD_HEADER_BACKGROUND" : "背景",
-        "FIELD_HEADER_FOREGROUND" : "前景",
+        "FIELD_HEADER_BACKGROUND" : "背景色",
+        "FIELD_HEADER_FOREGROUND" : "前景色",
 
         "FIELD_OPTION_CUSTOM" : "自定义...",
 
-        "SECTION_HEADER_DETAILS" : "详情:"
+        "SECTION_HEADER_DETAILS" : "详情："
 
     },
 
@@ -202,32 +202,32 @@
 
         "ERROR_AMBIGUOUS_CSV_HEADER"         : "存在冲突的 CSV 列名： \"{HEADER}\" ，可能是一个连接属性或者参数",
         "ERROR_AMBIGUOUS_PARENT_GROUP"       : "连接组以其父连接组不能同时设置",
-        "ERROR_ARRAY_REQUIRED"               : "提供的文件必须包含有效的连接数据",
+        "ERROR_ARRAY_REQUIRED"               : "上传的文件必须包含有效的连接数据",
         "ERROR_DETECTED_INVALID_TYPE"        : "不支持的文件类型。请确认您上传的文件是合法的 CSV，JSON 或者 YAML 文件。",
         "ERROR_DUPLICATE_CONNECTION_IN_FILE" : "在导入的文件中发现了重复的连接： \"{NAME}\" 位于 \"{PATH}\"",
         "ERROR_DUPLICATE_CSV_HEADER"         : "重复的 CSV 列名： {HEADER}",
-        "ERROR_EMPTY_FILE"                   : "提供的文件内容位空",
+        "ERROR_EMPTY_FILE"                   : "上传的文件内容为空",
         "ERROR_INVALID_CSV_HEADER"           : "非法的 CSV 列名： \"{HEADER}\" 不是一个可识别的属性或者参数。",
         "ERROR_INVALID_MIME_TYPE"            : "不支持的文件类型： \"{TYPE}\"",
-        "ERROR_INVALID_GROUP"                : "未找到名称为： \"{GROUP}\"的连接组",
-        "ERROR_INVALID_GROUP_IDENTIFIER"     : "未找到识别为： \"{IDENTIFIER}\"的连接组",
+        "ERROR_INVALID_GROUP"                : "未找到名称为： \"{GROUP}\" 的连接组",
+        "ERROR_INVALID_GROUP_IDENTIFIER"     : "未找到能识别为： \"{IDENTIFIER}\" 的连接组",
         "ERROR_NO_FILE_SUPPLIED"             : "请选择一个文件",
         "ERROR_PARSE_FAILURE_CSV"            : "请确保您上传的是合法的 CSV 文件。解析错误： \"{ERROR}\" 。",
         "ERROR_PARSE_FAILURE_JSON"           : "请确保您上传的是合法的 JSON 文件。解析错误： \"{ERROR}\" 。",
         "ERROR_PARSE_FAILURE_YAML"           : "请确保您上传的是合法的 YAML 文件。解析错误： \"{ERROR}\" 。",
         "ERROR_REJECT_UPDATE_CONNECTION"     : "连接 \"{NAME}\" 已存在于 \"{PATH}\"",
-        "ERROR_REQUIRED_NAME"                : "在提供的文件中未找到连接名",
-        "ERROR_REQUIRED_PROTOCOL"            : "在提供的文件中未找到连接协议",
+        "ERROR_REQUIRED_NAME"                : "在提供的文件中未找到连接名称",
+        "ERROR_REQUIRED_PROTOCOL"            : "在提供的文件中未找到协议",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
-        "FIELD_HEADER_EXISTING_CONNECTION_MODE" : "替换/更新 已存在的连接",
+        "FIELD_HEADER_EXISTING_CONNECTION_MODE" : "替换/更新已存在的连接",
         "FIELD_HEADER_EXISTING_PERMISSION_MODE" : "重置权限",
 
         "HELP_CSV_DESCRIPTION"              : "当导入的文件格式为 CSV 时，一行记录为一条连接数据。每列为一个配置条目。每条记录至少需要提供连接名称以及协议。",
         "HELP_CSV_EXAMPLE"                  : "name,protocol,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,",
-        "HELP_CSV_MORE_DETAILS"             : "CSV 列名与连接中的属性一一对应。The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. 在大多数场合下，属性之间不应当存在冲突。但如过这种情况发生时，在列名后加入 \" (attribute)\" 或者 \" (parameter)\" 即可避免混淆。用户或者用户组必须使用分号进行分割。¹",
-        "HELP_FILE_TYPE_DESCRIPTION"        : "目前系统支持三种文件格式：CSV，JSON 或者 YAML。文件格式之间支持的属性相同，至少需要连接名称以及协议。当然，连接组，哪些用户或者用户组有权限使用，连接参数等属性均可以被指定。不存在的用户或者用户组会被自动创建。注意，任何已存在的连接权限并不会根据导入的数据被清除，除非您勾选了“重置权限”选框。",
+        "HELP_CSV_MORE_DETAILS"             : "CSV 列名与连接中的属性一一对应。需要导入的连接组信息可以通过 \"parentIdentifier\" 属性直接设定，或者通过 \"group\" 属性进行指定。在大多数场合下，属性之间不应当存在冲突。但如过这种情况发生时，在列名后加入 \" (attribute)\" 或者 \" (parameter)\" 即可避免混淆。用户或者用户组必须使用分号进行分隔。¹",
+        "HELP_FILE_TYPE_DESCRIPTION"        : "目前系统支持三种文件格式：CSV，JSON 或者 YAML。文件格式之间支持的属性相同，即至少需要连接名称以及协议。当然，连接组，哪些用户或者用户组有权限使用，连接参数等属性均可以被指定。不存在的用户或者用户组会被自动创建。注意，任何已存在的连接权限并不会根据导入的数据被清除，除非您勾选了“重置权限”选框。",
         "HELP_FILE_TYPE_HEADER"             : "文件格式",
         "HELP_JSON_DESCRIPTION"             : "当导入的文件格式为 JSON 时，每条记录至少需要提供连接名称以及协议。",
         "HELP_JSON_EXAMPLE"                 : "[\n  \\{\n    \"name\": \"conn1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"hostname\": \"conn1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac user 1\", \"guac user 2\" ],\n    \"groups\": [ \"Connection 1 Users\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"hostname\": \"conn2.web.com\" \\},\n    \"group\": \"ROOT/Parent Group\",\n    \"users\": [ \"guac user 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"hostname\": \"conn3.web.com\" \\},\n    \"group\": \"ROOT/Parent Group/Child Group\",\n    \"users\": [ \"guac user 2\", \"guac user 3\" ]\n  \\},\n  \\{\n    \"name\": \"conn4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
@@ -240,10 +240,10 @@
         "HELP_YAML_DESCRIPTION"             : "当导入的文件格式为 YAML 时，其数据结构必须与使用 JSON 格式时保持一致。",
         "HELP_YAML_EXAMPLE"                 : "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n    - guac user 1\n    - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n    - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n    - guac user 2\n    - guac user 3\n  - name: conn4\n    protocol: kubernetes",
 
-        "INFO_CONNECTIONS_IMPORTED_SUCCESS" : "{NUMBER} {NUMBER, plural, one{connection} other{connections}} imported successfully.",
+        "INFO_CONNECTIONS_IMPORTED_SUCCESS" : "{NUMBER} 条连接已成功导入。",
         
         "SECTION_HEADER_CONNECTION_IMPORT"           : "导入连接",
-        "SECTION_HEADER_HELP_CONNECTION_IMPORT_FILE" : "Connection Import File Format",
+        "SECTION_HEADER_HELP_CONNECTION_IMPORT_FILE" : "导入连接文件格式",
         "SECTION_HEADER_CSV"                         : "CSV 格式",
         "SECTION_HEADER_JSON"                        : "JSON 格式",
         "SECTION_HEADER_YAML"                        : "YAML 格式",
@@ -445,15 +445,15 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
-        "FIELD_HEADER_USER_GROUP_NAME"               : "用户组名称:",
+        "FIELD_HEADER_USER_GROUP_NAME"               : "用户组名称：",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
-        "HELP_NO_USER_GROUPS"        : "该组当前不属于任何组。 展开此部分以添加组。",
-        "HELP_NO_MEMBER_USER_GROUPS" : "该组当前不包含任何组。 展开此部分以添加组。",
-        "HELP_NO_MEMBER_USERS"       : "该组当前不包含任何用户。 展开此部分以添加用户。",
+        "HELP_NO_USER_GROUPS"        : "该组当前不属于任何组。展开此部分以添加组。",
+        "HELP_NO_MEMBER_USER_GROUPS" : "该组当前不包含任何组。展开此部分以添加组。",
+        "HELP_NO_MEMBER_USERS"       : "该组当前不包含任何用户。展开此部分以添加用户。",
 
-        "INFO_READ_ONLY"                : "抱歉，无法编辑此组。",
+        "INFO_READ_ONLY"                : "抱歉，无法编辑此用户组。",
         "INFO_NO_USER_GROUPS_AVAILABLE" : "@:MANAGE_USER.INFO_NO_USER_GROUPS_AVAILABLE",
         "INFO_NO_USERS_AVAILABLE"       : "没有可用的用户。",
 
@@ -461,8 +461,8 @@
         "SECTION_HEADER_CONNECTIONS"         : "@:MANAGE_USER.SECTION_HEADER_CONNECTIONS",
         "SECTION_HEADER_CURRENT_CONNECTIONS" : "@:MANAGE_USER.SECTION_HEADER_CURRENT_CONNECTIONS",
         "SECTION_HEADER_EDIT_USER_GROUP"     : "编辑用户组",
-        "SECTION_HEADER_MEMBER_USERS"        : "会员用户",
-        "SECTION_HEADER_MEMBER_USER_GROUPS"  : "会员用户组",
+        "SECTION_HEADER_MEMBER_USERS"        : "成员用户",
+        "SECTION_HEADER_MEMBER_USER_GROUPS"  : "成员用户组",
         "SECTION_HEADER_PERMISSIONS"         : "@:MANAGE_USER.SECTION_HEADER_PERMISSIONS",
         "SECTION_HEADER_USER_GROUPS"         : "父用户组",
 
@@ -476,8 +476,8 @@
         "ACTION_PAUSE"  : "@:APP.ACTION_PAUSE",
         "ACTION_PLAY"   : "@:APP.ACTION_PLAY",
 
-        "INFO_LOADING_RECORDING" : "录像已载入。请稍候……",
-        "INFO_SEEK_IN_PROGRESS"  : "正在跳转到指定位置。请稍候……"
+        "INFO_LOADING_RECORDING" : "录像已载入。请稍候...",
+        "INFO_SEEK_IN_PROGRESS"  : "正在跳转到指定位置。请稍候..."
 
     },
     
@@ -485,19 +485,19 @@
 
         "FIELD_HEADER_BACKSPACE"      : "发送退格键：",
         "FIELD_HEADER_CA_CERT"         : "证书颁发机构证书：",
-        "FIELD_HEADER_CLIENT_CERT"     : "客户证书:",
-        "FIELD_HEADER_CLIENT_KEY"      : "客户端密钥:",
+        "FIELD_HEADER_CLIENT_CERT"     : "客户证书：",
+        "FIELD_HEADER_CLIENT_KEY"      : "客户端密钥：",
         "FIELD_HEADER_COLOR_SCHEME"   : "配色方案：",
-        "FIELD_HEADER_CONTAINER"       : "容器名称:",
+        "FIELD_HEADER_CONTAINER"       : "容器名称：",
         "FIELD_HEADER_CREATE_RECORDING_PATH" : "自动建立录像目录：",
-        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "自动建立打字稿目录：",
-        "FIELD_HEADER_EXEC_COMMAND"    : "命令 (exec):",
+        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "自动建立 Typescript 目录：",
+        "FIELD_HEADER_EXEC_COMMAND"    : "命令（exec）：",
         "FIELD_HEADER_FONT_NAME"      : "字体名：",
         "FIELD_HEADER_FONT_SIZE"      : "字体大小：",
         "FIELD_HEADER_HOSTNAME"       : "主机名：",
-        "FIELD_HEADER_IGNORE_CERT"     : "忽略服务器证书:",
-        "FIELD_HEADER_NAMESPACE"       : "命名空间:",
-        "FIELD_HEADER_POD"             : "Pod名称:",
+        "FIELD_HEADER_IGNORE_CERT"     : "忽略服务器证书：",
+        "FIELD_HEADER_NAMESPACE"       : "命名空间：",
+        "FIELD_HEADER_POD"             : "Pod 名称：",
         "FIELD_HEADER_PORT"           : "端口：",
         "FIELD_HEADER_READ_ONLY"      : "只读：",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "排除鼠标：",
@@ -505,10 +505,10 @@
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "包含按键事件：",
         "FIELD_HEADER_RECORDING_NAME" : "录像名：",
         "FIELD_HEADER_RECORDING_PATH" : "录像路径：",
-        "FIELD_HEADER_SCROLLBACK"      : "最大回滚尺寸:",
-        "FIELD_HEADER_TYPESCRIPT_NAME" : "打字稿名称：",
-        "FIELD_HEADER_TYPESCRIPT_PATH" : "打字稿路径：",
-        "FIELD_HEADER_USE_SSL"         : "使用SSL/TLS",
+        "FIELD_HEADER_SCROLLBACK"      : "最大回滚尺寸：",
+        "FIELD_HEADER_TYPESCRIPT_NAME" : "Typescript 名称：",
+        "FIELD_HEADER_TYPESCRIPT_PATH" : "Typescript 路径：",
+        "FIELD_HEADER_USE_SSL"         : "使用 SSL/TLS",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
         "FIELD_OPTION_BACKSPACE_8"     : "退格键（Ctrl-H）",
@@ -543,7 +543,7 @@
         "SECTION_HEADER_CONTAINER"      : "容器",
         "SECTION_HEADER_DISPLAY"        : "显示",
         "SECTION_HEADER_RECORDING"      : "屏幕录制",
-        "SECTION_HEADER_TYPESCRIPT"     : "打字稿(文本会话录制)",
+        "SECTION_HEADER_TYPESCRIPT"     : "Typescript（文本会话录制）",
         "SECTION_HEADER_NETWORK"        : "网络"
 
     },
@@ -558,30 +558,30 @@
         "FIELD_HEADER_CREATE_RECORDING_PATH" : "自动建立录像目录：",
         "FIELD_HEADER_DISABLE_AUDIO"   : "禁用音频：",
         "FIELD_HEADER_DISABLE_AUTH"    : "禁用认证：",
-        "FIELD_HEADER_DISABLE_COPY"    : "禁用从远程桌面复制:",
-        "FIELD_HEADER_DISABLE_DOWNLOAD" : "禁用文件下载:",
-        "FIELD_HEADER_DISABLE_PASTE"   : "禁用从客户端粘贴:",
-        "FIELD_HEADER_DISABLE_UPLOAD"   : "禁用文件上传:",
+        "FIELD_HEADER_DISABLE_COPY"    : "禁用从远程桌面复制：",
+        "FIELD_HEADER_DISABLE_DOWNLOAD" : "禁用文件下载：",
+        "FIELD_HEADER_DISABLE_PASTE"   : "禁用从客户端粘贴：",
+        "FIELD_HEADER_DISABLE_UPLOAD"   : "禁用文件上传：",
         "FIELD_HEADER_DOMAIN"          : "域：",
         "FIELD_HEADER_DPI"             : "分辨率（DPI）：",
-        "FIELD_HEADER_DRIVE_NAME"      : "驱动器名称:",
+        "FIELD_HEADER_DRIVE_NAME"      : "驱动器名称：",
         "FIELD_HEADER_DRIVE_PATH"      : "虚拟盘路径：",
         "FIELD_HEADER_ENABLE_AUDIO_INPUT"         : "启用音频输入（话筒）：",
         "FIELD_HEADER_ENABLE_DESKTOP_COMPOSITION" : "启用桌面合成效果（Aero）：",
-        "FIELD_HEADER_ENABLE_DRIVE"               : "启用虚拟盘：",
+        "FIELD_HEADER_ENABLE_DRIVE"               : "启用虚拟驱动器：",
         "FIELD_HEADER_ENABLE_FONT_SMOOTHING"      : "启用字体平滑（ClearType）：",
         "FIELD_HEADER_ENABLE_FULL_WINDOW_DRAG"    : "启用全窗口拖拽：",
         "FIELD_HEADER_ENABLE_MENU_ANIMATIONS"     : "启用菜单动画：",
         "FIELD_HEADER_DISABLE_BITMAP_CACHING"     : "禁用位图缓存：",
         "FIELD_HEADER_DISABLE_OFFSCREEN_CACHING"  : "禁用离屏缓存：",
         "FIELD_HEADER_DISABLE_GLYPH_CACHING"      : "禁用字形缓存：",
-        "FIELD_HEADER_DISABLE_GFX"                : "禁用图形管线拓展:",
+        "FIELD_HEADER_DISABLE_GFX"                : "禁用图形管线拓展：",
         "FIELD_HEADER_ENABLE_PRINTING"            : "启用打印功能：",
         "FIELD_HEADER_ENABLE_SFTP"     : "启用SFTP：",
         "FIELD_HEADER_ENABLE_THEMING"             : "启用桌面主题：",
-        "FIELD_HEADER_ENABLE_TOUCH"               : "启用多点触控:",
+        "FIELD_HEADER_ENABLE_TOUCH"               : "启用多点触控：",
         "FIELD_HEADER_ENABLE_WALLPAPER"           : "启用桌面墙纸：",
-        "FIELD_HEADER_FORCE_LOSSLESS"             : "强制无损压缩:",
+        "FIELD_HEADER_FORCE_LOSSLESS"             : "强制无损压缩：",
         "FIELD_HEADER_GATEWAY_DOMAIN"   : "域：",
         "FIELD_HEADER_GATEWAY_HOSTNAME" : "主机名：",
         "FIELD_HEADER_GATEWAY_PASSWORD" : "密码：",
@@ -591,17 +591,17 @@
         "FIELD_HEADER_HOSTNAME"        : "主机名：",
         "FIELD_HEADER_IGNORE_CERT"     : "忽略服务器证书：",
         "FIELD_HEADER_INITIAL_PROGRAM" : "初始程序：",
-        "FIELD_HEADER_LOAD_BALANCE_INFO" : "负载平衡信息/cookie：",
-        "FIELD_HEADER_NORMALIZE_CLIPBOARD" : "换行符:",
+        "FIELD_HEADER_LOAD_BALANCE_INFO" : "负载平衡信息/Cookie：",
+        "FIELD_HEADER_NORMALIZE_CLIPBOARD" : "换行符：",
         "FIELD_HEADER_PASSWORD"        : "密码：",
         "FIELD_HEADER_PORT"            : "端口：",
-        "FIELD_HEADER_PRINTER_NAME"    : "重定向的打印机名称:",
-        "FIELD_HEADER_PRECONNECTION_BLOB" : "预连接BLOB（VM标识）：",
-        "FIELD_HEADER_PRECONNECTION_ID"   : "RDP源标识：",
+        "FIELD_HEADER_PRINTER_NAME"    : "重定向的打印机名称：",
+        "FIELD_HEADER_PRECONNECTION_BLOB" : "预连接 BLOB（VM 标识）：",
+        "FIELD_HEADER_PRECONNECTION_ID"   : "RDP 源标识：",
         "FIELD_HEADER_READ_ONLY"      : "只读：",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "排除鼠标：",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "排除图像/数据流：",
-        "FIELD_HEADER_RECORDING_EXCLUDE_TOUCH"  : "排除触摸事件:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_TOUCH"  : "排除触摸事件：",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "包含按键事件：",
         "FIELD_HEADER_RECORDING_NAME" : "录像名：",
         "FIELD_HEADER_RECORDING_PATH" : "录像路径：",
@@ -612,36 +612,36 @@
         "FIELD_HEADER_SECURITY"        : "安全模式：",
         "FIELD_HEADER_SERVER_LAYOUT"   : "键盘布局：",
         "FIELD_HEADER_SFTP_DIRECTORY"             : "缺省文件上传目录：",
-        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "禁用文件下载:",
-        "FIELD_HEADER_SFTP_HOST_KEY"              : "公钥(Base64):",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "禁用文件下载：",
+        "FIELD_HEADER_SFTP_HOST_KEY"              : "公钥（Base64）：",
         "FIELD_HEADER_SFTP_HOSTNAME"              : "主机名：",
-        "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "SFTP keepalive时间间隔：",
+        "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "SFTP keepalive 时间间隔：",
         "FIELD_HEADER_SFTP_PASSPHRASE"            : "口令：",
         "FIELD_HEADER_SFTP_PASSWORD"              : "密码：",
         "FIELD_HEADER_SFTP_PORT"                  : "端口：",
         "FIELD_HEADER_SFTP_PRIVATE_KEY"           : "私钥：",
         "FIELD_HEADER_SFTP_ROOT_DIRECTORY"        : "文件浏览器根目录：",
-        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "禁用文件上传:",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "禁用文件上传：",
         "FIELD_HEADER_SFTP_USERNAME"              : "用户名：",
         "FIELD_HEADER_STATIC_CHANNELS" : "静态通道名：",
-        "FIELD_HEADER_TIMEZONE"        : "时区:",
+        "FIELD_HEADER_TIMEZONE"        : "时区：",
         "FIELD_HEADER_USERNAME"        : "用户名：",
         "FIELD_HEADER_WIDTH"           : "宽度：",
-        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址:",
-        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址 :",
-        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址：",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址：",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包：",
         "FIELD_HEADER_WOL_UDP_PORT"       : "WoL 数据包 UDP 端口: ",
-        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间:",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间：",
 
         "FIELD_OPTION_NORMALIZE_CLIPBOARD_EMPTY"    : "",
         "FIELD_OPTION_NORMALIZE_CLIPBOARD_PRESERVE" : "保持原样",
         "FIELD_OPTION_NORMALIZE_CLIPBOARD_UNIX"     : "Linux/Mac/Unix (LF)",
         "FIELD_OPTION_NORMALIZE_CLIPBOARD_WINDOWS"  : "Windows (CRLF)",   
 
-        "FIELD_OPTION_COLOR_DEPTH_16"    : "低色（16位）",
-        "FIELD_OPTION_COLOR_DEPTH_24"    : "真彩（24位）",
-        "FIELD_OPTION_COLOR_DEPTH_32"    : "真彩（32位）",
-        "FIELD_OPTION_COLOR_DEPTH_8"     : "256色",
+        "FIELD_OPTION_COLOR_DEPTH_16"    : "低彩色（16 位）",
+        "FIELD_OPTION_COLOR_DEPTH_24"    : "真彩色（24 位）",
+        "FIELD_OPTION_COLOR_DEPTH_32"    : "真彩色（32 位）",
+        "FIELD_OPTION_COLOR_DEPTH_8"     : "256 色",
         "FIELD_OPTION_COLOR_DEPTH_EMPTY" : "",
 
         "FIELD_OPTION_RESIZE_METHOD_DISPLAY_UPDATE" : "“显示更新”虚拟通道（RDP 8.1+）",
@@ -651,8 +651,8 @@
         "FIELD_OPTION_SECURITY_ANY"   : "任意",
         "FIELD_OPTION_SECURITY_EMPTY" : "",
         "FIELD_OPTION_SECURITY_NLA"   : "NLA（网络级别认证）",
-        "FIELD_OPTION_SECURITY_RDP"   : "RDP加密",
-        "FIELD_OPTION_SECURITY_TLS"   : "TLS加密",
+        "FIELD_OPTION_SECURITY_RDP"   : "RDP 加密",
+        "FIELD_OPTION_SECURITY_TLS"   : "TLS 加密",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Swiss German (Qwertz)",
@@ -690,11 +690,11 @@
         "SECTION_HEADER_LOAD_BALANCING"     : "负载平衡",
         "SECTION_HEADER_NETWORK"            : "网络",
         "SECTION_HEADER_PERFORMANCE"        : "性能",
-        "SECTION_HEADER_PRECONNECTION_PDU"  : "预连接PDU / Hyper-V",
+        "SECTION_HEADER_PRECONNECTION_PDU"  : "预连接 PDU / Hyper-V",
         "SECTION_HEADER_RECORDING"          : "屏幕录像",
         "SECTION_HEADER_REMOTEAPP"          : "RemoteApp",
         "SECTION_HEADER_SFTP"               : "SFTP",
-        "SECTION_HEADER_WOL"                : "网络唤醒 (WoL)"
+        "SECTION_HEADER_WOL"                : "网络唤醒（WoL）"
 
     },
 
@@ -704,40 +704,40 @@
         "FIELD_HEADER_COLOR_SCHEME" : "配色方案：",
         "FIELD_HEADER_COMMAND"      : "运行命令：",
         "FIELD_HEADER_CREATE_RECORDING_PATH" : "自动建立录像目录：",
-        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "自动建立打字稿目录：",
-        "FIELD_HEADER_DISABLE_COPY"  : "禁用从终端复制:",
-        "FIELD_HEADER_DISABLE_PASTE" : "禁用从客户端粘贴:",
+        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "自动建立 Typescript 目录：",
+        "FIELD_HEADER_DISABLE_COPY"  : "禁用从终端复制：",
+        "FIELD_HEADER_DISABLE_PASTE" : "禁用从客户端粘贴：",
         "FIELD_HEADER_FONT_NAME"   : "字体名：",
         "FIELD_HEADER_FONT_SIZE"   : "字体大小：",
         "FIELD_HEADER_ENABLE_SFTP" : "启用SFTP：",
-        "FIELD_HEADER_HOST_KEY"      : "公钥(Base64):",
+        "FIELD_HEADER_HOST_KEY"      : "公钥（Base64）：",
         "FIELD_HEADER_HOSTNAME"    : "主机名：",
-        "FIELD_HEADER_LOCALE"        : "语言/地区($LANG):",
+        "FIELD_HEADER_LOCALE"        : "语言/地区（$LANG）：",
         "FIELD_HEADER_USERNAME"    : "用户名：",
         "FIELD_HEADER_PASSWORD"    : "密码：",
         "FIELD_HEADER_PASSPHRASE"  : "口令：",
         "FIELD_HEADER_PORT"        : "端口：",
         "FIELD_HEADER_PRIVATE_KEY" : "私钥：",
-        "FIELD_HEADER_SCROLLBACK"    : "最大回滚尺寸:",
+        "FIELD_HEADER_SCROLLBACK"    : "最大回滚尺寸：",
         "FIELD_HEADER_READ_ONLY"   : "只读：",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "排除鼠标：",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "排除图像/数据流：",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "包含按键事件：",
         "FIELD_HEADER_RECORDING_NAME" : "录像名：",
         "FIELD_HEADER_RECORDING_PATH" : "录像路径：",
-        "FIELD_HEADER_SERVER_ALIVE_INTERVAL" : "服务器keepalive时间间隔：",
-        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD" : "禁用文件下载:",
+        "FIELD_HEADER_SERVER_ALIVE_INTERVAL" : "服务器 keepalive 时间间隔：",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD" : "禁用文件下载：",
         "FIELD_HEADER_SFTP_ROOT_DIRECTORY"   : "文件浏览器根目录：",
-        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"   : "禁用文件上传:",
-        "FIELD_HEADER_TERMINAL_TYPE"   : "终端类型:",
-        "FIELD_HEADER_TIMEZONE"        : "时区($TZ):",
-        "FIELD_HEADER_TYPESCRIPT_NAME" : "打字稿名称：",
-        "FIELD_HEADER_TYPESCRIPT_PATH" : "打字稿路径：",
-        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址:",
-        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址 :",
-        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包:",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"   : "禁用文件上传：",
+        "FIELD_HEADER_TERMINAL_TYPE"   : "终端类型：",
+        "FIELD_HEADER_TIMEZONE"        : "时区（$TZ）：",
+        "FIELD_HEADER_TYPESCRIPT_NAME" : "Typescript 名称：",
+        "FIELD_HEADER_TYPESCRIPT_PATH" : "Typescript 路径：",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址：",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址：",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包：",
         "FIELD_HEADER_WOL_UDP_PORT"       : "WoL 数据包 UDP 端口: ",
-        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间:",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间：",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
         "FIELD_OPTION_BACKSPACE_8"     : "退格键（Ctrl-H）",
@@ -782,45 +782,45 @@
         "SECTION_HEADER_NETWORK"        : "网络",
         "SECTION_HEADER_RECORDING"      : "屏幕录像",
         "SECTION_HEADER_SESSION"        : "会话 / 环境",
-        "SECTION_HEADER_TYPESCRIPT"     : "打字稿（文本会话录像）",
+        "SECTION_HEADER_TYPESCRIPT"     : "Typescript（文本会话录像）",
         "SECTION_HEADER_SFTP"           : "SFTP",
-        "SECTION_HEADER_WOL"            : "网络唤醒 (WoL)"
+        "SECTION_HEADER_WOL"            : "网络唤醒（WoL）"
 
     },
 
     "PROTOCOL_TELNET" : {
 
-        "FIELD_HEADER_BACKSPACE"      : "发送退格键:",
-        "FIELD_HEADER_COLOR_SCHEME"   : "配色方案:",
-        "FIELD_HEADER_CREATE_RECORDING_PATH" : "自动创建记录路径:",
-        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "自动创建typescript路径:",
+        "FIELD_HEADER_BACKSPACE"      : "发送退格键：",
+        "FIELD_HEADER_COLOR_SCHEME"   : "配色方案：",
+        "FIELD_HEADER_CREATE_RECORDING_PATH" : "自动创建记录路径：",
+        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "自动创建 Typescript 路径：",
         "FIELD_HEADER_DISABLE_COPY"   : "禁止从终端复制：",
         "FIELD_HEADER_DISABLE_PASTE"  : "禁用从客户端粘贴：",
-        "FIELD_HEADER_FONT_NAME"      : "字体名称:",
-        "FIELD_HEADER_FONT_SIZE"      : "字体大小:",
-        "FIELD_HEADER_HOSTNAME"       : "主机名:",
-        "FIELD_HEADER_LOGIN_FAILURE_REGEX" : "登录失败正则表达式:",
-        "FIELD_HEADER_LOGIN_SUCCESS_REGEX" : "登录成功正则表达式:",
-        "FIELD_HEADER_USERNAME"       : "用户名:",
-        "FIELD_HEADER_USERNAME_REGEX" : "用户名正则表达式:",
-        "FIELD_HEADER_PASSWORD"       : "密码:",
-        "FIELD_HEADER_PASSWORD_REGEX" : "密码正则表达式:",
-        "FIELD_HEADER_PORT"           : "端口:",
-        "FIELD_HEADER_READ_ONLY"      : "只读:",
-        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "排除鼠标:",
-        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "排除图形/流:",
-        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "包含关键事件:",
-        "FIELD_HEADER_RECORDING_NAME" : "记录名称:",
-        "FIELD_HEADER_RECORDING_PATH" : "记录路径:",
-        "FIELD_HEADER_SCROLLBACK"     : "最大回滚尺寸:",
-        "FIELD_HEADER_TERMINAL_TYPE"   : "终端类型:",
-        "FIELD_HEADER_TYPESCRIPT_NAME" : "打字稿名称:",
-        "FIELD_HEADER_TYPESCRIPT_PATH" : "打字稿路径:",
-        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址:",
-        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址 :",
-        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包:",
-        "FIELD_HEADER_WOL_UDP_PORT"       : "WoL 数据包 UDP 端口: ",
-        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间:",
+        "FIELD_HEADER_FONT_NAME"      : "字体名称：",
+        "FIELD_HEADER_FONT_SIZE"      : "字体大小：",
+        "FIELD_HEADER_HOSTNAME"       : "主机名：",
+        "FIELD_HEADER_LOGIN_FAILURE_REGEX" : "登录失败的正则表达式：",
+        "FIELD_HEADER_LOGIN_SUCCESS_REGEX" : "登录成功的正则表达式：",
+        "FIELD_HEADER_USERNAME"       : "用户名：",
+        "FIELD_HEADER_USERNAME_REGEX" : "用户名正则表达式：",
+        "FIELD_HEADER_PASSWORD"       : "密码：",
+        "FIELD_HEADER_PASSWORD_REGEX" : "密码正则表达式：",
+        "FIELD_HEADER_PORT"           : "端口：",
+        "FIELD_HEADER_READ_ONLY"      : "只读：",
+        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "排除鼠标：",
+        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "排除图形/流：",
+        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "包含关键事件：",
+        "FIELD_HEADER_RECORDING_NAME" : "记录名称：",
+        "FIELD_HEADER_RECORDING_PATH" : "记录路径：",
+        "FIELD_HEADER_SCROLLBACK"     : "最大回滚尺寸：",
+        "FIELD_HEADER_TERMINAL_TYPE"   : "终端类型：",
+        "FIELD_HEADER_TYPESCRIPT_NAME" : "Typescript 名称：",
+        "FIELD_HEADER_TYPESCRIPT_PATH" : "Typescript 路径：",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址：",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址：",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包：",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "WoL 数据包 UDP 端口：",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间：",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
         "FIELD_OPTION_BACKSPACE_8"     : "退格键(Ctrl-H)",
@@ -863,9 +863,9 @@
         "SECTION_HEADER_CLIPBOARD"      : "剪贴板",
         "SECTION_HEADER_DISPLAY"        : "显示",
         "SECTION_HEADER_RECORDING"      : "屏幕录像",
-        "SECTION_HEADER_TYPESCRIPT"     : "打字稿（文本会话录像）",
+        "SECTION_HEADER_TYPESCRIPT"     : "Typescript（文本会话录像）",
         "SECTION_HEADER_NETWORK"        : "网络",
-        "SECTION_HEADER_WOL"            : "网络唤醒 (WoL)"
+        "SECTION_HEADER_WOL"            : "网络唤醒（WoL）"
 
     },
 
@@ -878,11 +878,11 @@
         "FIELD_HEADER_CURSOR"           : "光标：",
         "FIELD_HEADER_DEST_HOST"        : "目标主机：",
         "FIELD_HEADER_DEST_PORT"        : "目标端口：",
-        "FIELD_HEADER_DISABLE_COPY"     : "禁用从远程桌面复制:",
-        "FIELD_HEADER_DISABLE_PASTE"    : "禁用从客户端粘贴:",
+        "FIELD_HEADER_DISABLE_COPY"     : "禁用从远程桌面复制：",
+        "FIELD_HEADER_DISABLE_PASTE"    : "禁用从客户端粘贴：",
         "FIELD_HEADER_ENABLE_AUDIO"     : "启用音频：",
-        "FIELD_HEADER_ENABLE_SFTP"      : "启用SFTP：",
-        "FIELD_HEADER_FORCE_LOSSLESS"   : "强制无损压缩:",
+        "FIELD_HEADER_ENABLE_SFTP"      : "启用 SFTP：",
+        "FIELD_HEADER_FORCE_LOSSLESS"   : "强制无损压缩：",
         "FIELD_HEADER_HOSTNAME"         : "主机名：",
         "FIELD_HEADER_USERNAME"         : "用户名：",
         "FIELD_HEADER_PASSWORD"         : "密码：",
@@ -894,28 +894,28 @@
         "FIELD_HEADER_RECORDING_NAME" : "录像名：",
         "FIELD_HEADER_RECORDING_PATH" : "录像路径：",
         "FIELD_HEADER_SFTP_DIRECTORY"             : "缺省文件上传目录：",
-        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "禁用文件下载:",
-        "FIELD_HEADER_SFTP_HOST_KEY"              : "公钥(Base64):",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "禁用文件下载：",
+        "FIELD_HEADER_SFTP_HOST_KEY"              : "公钥（Base64）：",
         "FIELD_HEADER_SFTP_HOSTNAME"              : "主机名：",
-        "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "SFTP keepalive时间间隔：",
+        "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "SFTP keepalive 时间间隔：",
         "FIELD_HEADER_SFTP_PASSPHRASE"            : "口令：",
         "FIELD_HEADER_SFTP_PASSWORD"              : "密码：",
         "FIELD_HEADER_SFTP_PORT"                  : "端口：",
         "FIELD_HEADER_SFTP_PRIVATE_KEY"           : "私钥：",
         "FIELD_HEADER_SFTP_ROOT_DIRECTORY"        : "文件浏览器根目录：",
-        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "禁用文件上传:",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "禁用文件上传：",
         "FIELD_HEADER_SFTP_USERNAME"              : "用户名：",
         "FIELD_HEADER_SWAP_RED_BLUE"    : "交换红/蓝成分：",
-        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址:",
-        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址 :",
-        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "WoL 数据包广播地址：",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "远程主机 MAC 地址：",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "发送 WoL 数据包：",
         "FIELD_HEADER_WOL_UDP_PORT"       : "WoL 数据包 UDP 端口: ",
-        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间:",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "主机启动等待时间：",
 
-        "FIELD_OPTION_COLOR_DEPTH_8"     : "256色",
-        "FIELD_OPTION_COLOR_DEPTH_16"    : "低色（16位）",
-        "FIELD_OPTION_COLOR_DEPTH_24"    : "真彩（24位）",
-        "FIELD_OPTION_COLOR_DEPTH_32"    : "真彩（32位）",
+        "FIELD_OPTION_COLOR_DEPTH_8"     : "256 色",
+        "FIELD_OPTION_COLOR_DEPTH_16"    : "低彩色（16 位）",
+        "FIELD_OPTION_COLOR_DEPTH_24"    : "真彩色（24 位）",
+        "FIELD_OPTION_COLOR_DEPTH_32"    : "真彩色（32 位）",
         "FIELD_OPTION_COLOR_DEPTH_EMPTY" : "",
 
         "FIELD_OPTION_CURSOR_EMPTY"  : "",
@@ -936,9 +936,9 @@
         "SECTION_HEADER_DISPLAY"        : "显示",
         "SECTION_HEADER_NETWORK"        : "网络",
         "SECTION_HEADER_RECORDING"      : "屏幕录像",
-        "SECTION_HEADER_REPEATER"       : "VNC中继",
+        "SECTION_HEADER_REPEATER"       : "VNC 中继",
         "SECTION_HEADER_SFTP"           : "SFTP",
-        "SECTION_HEADER_WOL"            : "网络唤醒 (WoL)"
+        "SECTION_HEADER_WOL"            : "网络唤醒（WoL）"
 
     },
 
@@ -960,7 +960,7 @@
 
         "FORMAT_DATE" : "@:APP.FORMAT_DATE_TIME_PRECISE",
 
-        "HELP_CONNECTION_HISTORY" : "下表中是过往的连接历史，可以点击列头来进行排序。如需搜索特定的记录，输入一个过滤字符串并点击”搜索“。列表中将只显示符合过滤条件的记录。",
+        "HELP_CONNECTION_HISTORY" : "下表中是过往的连接历史，可以点击列头来进行排序。如需搜索特定的记录，输入一个过滤字符串并点击“搜索”。列表中将只显示符合过滤条件的记录。",
 
         "INFO_CONNECTION_DURATION_UNKNOWN" : "--",
         "INFO_NO_HISTORY"                  : "无符合条件的记录",
@@ -1013,11 +1013,11 @@
         "FIELD_HEADER_PASSWORD_OLD"       : "当前密码：",
         "FIELD_HEADER_PASSWORD_NEW"       : "新密码：",
         "FIELD_HEADER_PASSWORD_NEW_AGAIN" : "确认新密码：",
-        "FIELD_HEADER_TIMEZONE"           : "时区:",
+        "FIELD_HEADER_TIMEZONE"           : "时区：",
         "FIELD_HEADER_USERNAME"           : "用户名：",
         
-        "HELP_DEFAULT_INPUT_METHOD" : "缺省输入法决定了Guacamole如何接收键盘事件。当使用移动设备或使用IME输入时，有可能需要更改设置。本设置可在Guacamole菜单内被单个连接的设定覆盖。",
-        "HELP_DEFAULT_MOUSE_MODE"   : "缺省鼠标模拟方式决定了新连接内的远程鼠标如何响应屏幕触控。本设置可在Guacamole菜单内被单个连接的设定覆盖。",
+        "HELP_DEFAULT_INPUT_METHOD" : "默认输入法决定了 Guacamole 如何接收键盘事件。当使用移动设备或使用 IME 输入时，有可能需要更改设置。本设置可在 Guacamole 菜单内被单个连接的设定覆盖。",
+        "HELP_DEFAULT_MOUSE_MODE"   : "默认鼠标模拟方式决定了新连接内的远程鼠标如何响应屏幕触控。本设置可在 Guacamole 菜单内被单个连接的设定覆盖。",
         "HELP_INPUT_METHOD_NONE"    : "@:CLIENT.HELP_INPUT_METHOD_NONE",
         "HELP_INPUT_METHOD_OSK"     : "@:CLIENT.HELP_INPUT_METHOD_OSK",
         "HELP_INPUT_METHOD_TEXT"    : "@:CLIENT.HELP_INPUT_METHOD_TEXT",

From bb92b2fa74205d6b04856fe60ec3a7ac22be8972 Mon Sep 17 00:00:00 2001
From: Sharuru <mave@foxmail.com>
Date: Tue, 25 Apr 2023 16:18:02 +0800
Subject: [PATCH 188/289] GUACAMOLE-1778: Remove fields that don't need to be
 translated

---
 guacamole/src/main/frontend/src/translations/zh.json | 1 -
 1 file changed, 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/translations/zh.json b/guacamole/src/main/frontend/src/translations/zh.json
index f9c261abc..1431ed9e0 100644
--- a/guacamole/src/main/frontend/src/translations/zh.json
+++ b/guacamole/src/main/frontend/src/translations/zh.json
@@ -5,7 +5,6 @@
     "APP" : {
 
         "NAME"    : "Apache Guacamole",
-        "VERSION" : "${project.version}",
 
         "ACTION_ACKNOWLEDGE"        : "确定",
         "ACTION_CANCEL"             : "取消",

From 9f2baeb1b874b2b2ff9038b54d8478c04025d366 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 26 Apr 2023 00:07:39 +0000
Subject: [PATCH 189/289] GUACAMOLE-926: Fix invalid group identifier error
 message and upgrade yaml npm dependency.

---
 guacamole/src/main/frontend/package-lock.json      | 14 +++++++-------
 guacamole/src/main/frontend/package.json           |  2 +-
 .../app/import/services/connectionParseService.js  |  4 ++--
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/guacamole/src/main/frontend/package-lock.json b/guacamole/src/main/frontend/package-lock.json
index 32b9bee38..9ad15bdce 100644
--- a/guacamole/src/main/frontend/package-lock.json
+++ b/guacamole/src/main/frontend/package-lock.json
@@ -19,7 +19,7 @@
                 "jquery": "^3.6.4",
                 "jstz": "^2.1.1",
                 "lodash": "^4.17.21",
-                "yaml": "^2.2.1"
+                "yaml": "^2.2.2"
             },
             "devDependencies": {
                 "@babel/core": "^7.20.12",
@@ -11419,9 +11419,9 @@
             "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
         },
         "node_modules/yaml": {
-            "version": "2.2.1",
-            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.1.tgz",
-            "integrity": "sha512-e0WHiYql7+9wr4cWMx3TVQrNwejKaEe7/rHNmQmqRjazfOP5W8PB6Jpebb5o6fIapbz9o9+2ipcaTM2ZwDI6lw==",
+            "version": "2.2.2",
+            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.2.tgz",
+            "integrity": "sha512-CBKFWExMn46Foo4cldiChEzn7S7SRV+wqiluAb6xmueD/fGyRHIhX8m14vVGgeFWjN540nKCNVj6P21eQjgTuA==",
             "engines": {
                 "node": ">= 14"
             }
@@ -20241,9 +20241,9 @@
             "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
         },
         "yaml": {
-            "version": "2.2.1",
-            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.1.tgz",
-            "integrity": "sha512-e0WHiYql7+9wr4cWMx3TVQrNwejKaEe7/rHNmQmqRjazfOP5W8PB6Jpebb5o6fIapbz9o9+2ipcaTM2ZwDI6lw=="
+            "version": "2.2.2",
+            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.2.tgz",
+            "integrity": "sha512-CBKFWExMn46Foo4cldiChEzn7S7SRV+wqiluAb6xmueD/fGyRHIhX8m14vVGgeFWjN540nKCNVj6P21eQjgTuA=="
         },
         "yocto-queue": {
             "version": "0.1.0",
diff --git a/guacamole/src/main/frontend/package.json b/guacamole/src/main/frontend/package.json
index 617cf308b..4b7f98630 100644
--- a/guacamole/src/main/frontend/package.json
+++ b/guacamole/src/main/frontend/package.json
@@ -18,7 +18,7 @@
         "jquery": "^3.6.4",
         "jstz": "^2.1.1",
         "lodash": "^4.17.21",
-        "yaml": "^2.2.1"
+        "yaml": "^2.2.2"
     },
     "devDependencies": {
         "@babel/core": "^7.20.12",
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index c5765c2c7..a9b2b7241 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -252,9 +252,9 @@ angular.module('import').factory('connectionParseService',
             // If a parent group identifier is present, but not valid
             else if (providedIdentifier && !groupPathsByIdentifier[providedIdentifier])
                 throw new ParseError({
-                    message: 'No group with identifier: ' + parentIdentifier,
+                    message: 'No group with identifier: ' + providedIdentifier,
                     key: 'IMPORT.ERROR_INVALID_GROUP_IDENTIFIER',
-                    variables: { IDENTIFIER: parentIdentifier }
+                    variables: { IDENTIFIER: providedIdentifier }
                 });
 
             // If the parent identifier is valid, use it to determine the path

From 540bbf7ac1b534156b9a6d6cc49ed245da86b8da Mon Sep 17 00:00:00 2001
From: Sharuru <mave@foxmail.com>
Date: Thu, 27 Apr 2023 10:58:37 +0800
Subject: [PATCH 190/289] GUACAMOLE-1781: Update Simplified Chinese translation
 for totp auth extension

---
 .../src/main/resources/translations/zh.json   | 42 +++++++++++++------
 1 file changed, 30 insertions(+), 12 deletions(-)

diff --git a/extensions/guacamole-auth-totp/src/main/resources/translations/zh.json b/extensions/guacamole-auth-totp/src/main/resources/translations/zh.json
index 9d27667be..edb01e5d1 100644
--- a/extensions/guacamole-auth-totp/src/main/resources/translations/zh.json
+++ b/extensions/guacamole-auth-totp/src/main/resources/translations/zh.json
@@ -1,7 +1,7 @@
 {
 
     "DATA_SOURCE_TOTP" : {
-        "NAME" : "TOTP TFA后端"
+        "NAME" : "TOTP TFA 后端"
     },
 
     "LOGIN" : {
@@ -13,22 +13,40 @@
         "ACTION_HIDE_DETAILS" : "隐藏",
         "ACTION_SHOW_DETAILS" : "显示",
 
-        "FIELD_HEADER_ALGORITHM"  : "算法:",
-        "FIELD_HEADER_DIGITS"     : "位数:",
-        "FIELD_HEADER_INTERVAL"   : "间隔:",
-        "FIELD_HEADER_SECRET_KEY" : "密钥:",
+        "FIELD_HEADER_ALGORITHM"  : "算法：",
+        "FIELD_HEADER_DIGITS"     : "数字位数：",
+        "FIELD_HEADER_INTERVAL"   : "时间间隔：",
+        "FIELD_HEADER_SECRET_KEY" : "密钥：",
 
-        "FIELD_PLACEHOLDER_CODE" : "授权码",
+        "FIELD_PLACEHOLDER_CODE" : "认证码",
 
-        "INFO_CODE_REQUIRED"       : "请输入您的授权码以验证您的身份。",
-        "INFO_ENROLL_REQUIRED"     : "您的帐户已启用多因素身份验证。",
-        "INFO_VERIFICATION_FAILED" : "验证失败， 请重试。",
+        "INFO_CODE_REQUIRED"       : "请输入您的认证码以验证您的身份。",
+        "INFO_ENROLL_REQUIRED"     : "您的账户已启用多因素身份验证。",
+        "INFO_VERIFICATION_FAILED" : "验证失败，请重试。",
 
-        "HELP_ENROLL_BARCODE" : "要完成注册过程，请使用手机或设备上的two-factor验证程序扫描下面的条形码。",
-        "HELP_ENROLL_VERIFY"  : "扫描条形码后，输入显示的{DIGITS}-数字授权码以验证注册是否成功。",
+        "HELP_ENROLL_BARCODE" : "为了完成注册流程，请使用您的手机或设备上的双因素身份验证应用程序扫描下面的条形码。",
+        "HELP_ENROLL_VERIFY"  : "扫描条形码后，输入显示的 {DIGITS} 位认证码以验证注册是否成功。",
 
-        "SECTION_HEADER_DETAILS" : "详情:"
+        "SECTION_HEADER_DETAILS" : "详细信息："
 
+    },
+
+    "USER_ATTRIBUTES" : {
+        
+        "FIELD_HEADER_GUAC_TOTP_DISABLED"      : "禁用 TOTP：",
+        "FIELD_HEADER_GUAC_TOTP_KEY_GENERATED" : "已生成密钥：",
+        "FIELD_HEADER_GUAC_TOTP_KEY_CONFIRMED" : "已确认身份验证设备：",
+        
+        "SECTION_HEADER_TOTP_ENROLLMENT_STATUS" : "TOTP 注册状态"
+        
+    },
+
+    "USER_GROUP_ATTRIBUTES" : {
+        
+        "FIELD_HEADER_GUAC_TOTP_DISABLED" : "禁用 TOTP：",
+        
+        "SECTION_HEADER_TOTP_USER_GROUP_CONFIG" : "TOTP 配置"
+        
     }
 
 }

From 4b570e9e63ba2dcdda636329269c306a8df25e87 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 28 Apr 2023 18:25:32 +0000
Subject: [PATCH 191/289] GUACAMOLE-926: Improve error handling for invalid,
 missing connection data.

---
 .../import/services/connectionCSVService.js   |  63 ++++++++---
 .../import/services/connectionParseService.js | 102 +++++++++++++++++-
 .../src/app/import/types/ImportConnection.js  |   7 ++
 .../main/frontend/src/translations/en.json    |  10 +-
 4 files changed, 159 insertions(+), 23 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
index 07af37e89..18a024865 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
@@ -322,10 +322,32 @@ angular.module('import').factory('connectionCSVService',
                         // of the header
                         const value = fetchFieldAtIndex(row);
 
+                        // If no value is provided, do not check the validity
+                        // of the parameter/attribute. Doing so would prevent
+                        // the import of a list of mixed protocol types, where
+                        // fields are only populated for protocols for which
+                        // they are valid parameters. If a value IS provided,
+                        // it must be a valid parameter or attribute for the
+                        // current protocol, which will be checked below.
+                        if (!value)
+                            return {};
+
                         // The protocol may determine whether a field is
                         // a parameter or an attribute (or both)
                         const protocol = transformConfig.protocolGetter(row);
 
+                        // Any errors encountered while processing this row
+                        const errors = [];
+
+                        // Before checking whether it's an attribute or protocol,
+                        // make sure this is a valid protocol to start
+                        if (!protocolParameters[protocol])
+
+                            // If the protocol is invalid, do not throw an error
+                            // here - this will be handled further downstream
+                            // by non-CSV-specific error handling
+                            return {};
+
                         // Determine if the field refers to an attribute or a
                         // parameter (or both, which is an error)
                         const isAttribute = !!attributes[name];
@@ -336,24 +358,24 @@ angular.module('import').factory('connectionCSVService',
                         // parameter with the provided name, it's impossible to
                         // figure out which this should be
                         if (isAttribute && isParameter)
-                            throw new ParseError({
+                            errors.push(new ParseError({
                                 message: 'Ambiguous CSV Header: ' + header,
                                 key: 'IMPORT.ERROR_AMBIGUOUS_CSV_HEADER',
                                 variables: { HEADER: header }
-                            });
+                            }));
 
                         // It's neither an attribute or a parameter
                         else if (!isAttribute && !isParameter)
-                            throw new ParseError({
+                            errors.push(new ParseError({
                                 message: 'Invalid CSV Header: ' + header,
                                 key: 'IMPORT.ERROR_INVALID_CSV_HEADER',
                                 variables: { HEADER: header }
-                            });
+                            }));
 
                         // Choose the appropriate type
                         const type = isAttribute ? 'attributes' : 'parameters';
 
-                        return { type, name, value };
+                        return { type, name, value, errors };
                     });
             });
 
@@ -364,19 +386,20 @@ angular.module('import').factory('connectionCSVService',
                 parameterOrAttributeGetters
             } = transformConfig;
 
-            // Fail if the name wasn't provided
+            // Fail if the name wasn't provided. Note that this is a file-level
+            // error, not specific to any connection.
             if (!nameGetter)
-                return deferred.reject(new ParseError({
+                throw new ParseError({
                     message: 'The connection name must be provided',
-                    key: 'IMPORT.ERROR_REQUIRED_NAME'
-                }));
+                    key: 'IMPORT.ERROR_REQUIRED_NAME_FILE'
+                });
 
             // Fail if the protocol wasn't provided
             if (!protocolGetter)
-                return deferred.reject(new ParseError({
+                throw new ParseError({
                     message: 'The connection protocol must be provided',
-                    key: 'IMPORT.ERROR_REQUIRED_PROTOCOL'
-                }));
+                    key: 'IMPORT.ERROR_REQUIRED_PROTOCOL_FILE'
+                });
 
             // The function to transform a CSV row into a connection object
             deferred.resolve(function transformCSVRow(row) {
@@ -409,14 +432,20 @@ angular.module('import').factory('connectionCSVService',
                     ...parameterOrAttributeGetters.reduce((values, getter) => {
 
                         // Determine the type, name, and value
-                        const { type, name, value } = getter(row);
+                        const { type, name, value, errors } = getter(row);
 
-                        // Set the value and continue on to the next attribute
-                        // or parameter
-                        values[type][name] = value;
+                        // Set the value if available
+                        if (type && name && value)
+                            values[type][name] = value;
+
+                        // If there were errors
+                        if (errors && errors.length)
+                            values.errors = [...values.errors, ...errors];
+
+                        // Continue on to the next attribute or parameter
                         return values;
 
-                    }, {parameters: {}, attributes: {}})
+                    }, {parameters: {}, attributes: {}, errors: []})
 
                 });
 
diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index a9b2b7241..acf444d5c 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -271,6 +271,13 @@ angular.module('import').factory('connectionParseService',
                 // to be translated into an absolute path starting at the root
                 group = connection.group;
 
+                // If the provided group isn't a string, it can never be valid
+                if (typeof group !== 'string')
+                    throw new ParseError({
+                        message: 'Invalid group type - must be a string',
+                        key: 'IMPORT.ERROR_INVALID_GROUP_TYPE'
+                    });
+
                 // Allow the group to start with a leading slash instead instead
                 // of explicitly requiring the root connection group
                 if (group.startsWith('/'))
@@ -351,6 +358,84 @@ angular.module('import').factory('connectionParseService',
         });
     }
 
+    /**
+     * Returns a promise that resolves to a map of all valid protocols to the
+     * boolean value "true", i.e. a set of all valid protocols.
+     *
+     * @returns {Promise.<Object.<String, Boolean>>}
+     *     A promise that resolves to a set of all valid protocols.
+     */
+    function getValidProtocols() {
+
+        // The current data source - the one that the connections will be
+        // imported into
+        const dataSource = $routeParams.dataSource;
+
+        // Fetch the protocols and convert to a set of valid protocol names
+        return schemaService.getProtocols(dataSource).then(
+                protocols => _.mapValues(protocols, () => true));
+    }
+
+    /**
+     * Return a list of field-level errors for the provided connection,
+     * such as missing or invalid fields that are not dependant on the
+     * connection group heirarchy.
+     *
+     * @param {ImportConnection} connection
+     *     The connection object to check field values on.
+     *
+     * @param {Object.<String, Boolean>} protocols
+     *     A set of valid protocols, such as the one returned by 
+     *     getValidProtocols().
+     *
+     * @returns {ParseError[]}
+     *     A list of field-level errors for the provided connection.
+     */
+    function getFieldErrors(connection, protocols) {
+        const connectionErrors = [];
+
+        // Ensure that a protocol was specified for this connection
+        const protocol = connection.protocol;
+        if (!protocol)
+            connectionErrors.push(new ParseError({
+                message: 'Missing required protocol field',
+                key: 'IMPORT.ERROR_REQUIRED_PROTOCOL_CONNECTION'
+            }));
+
+        // Ensure that a valid protocol was specified for this connection
+        if (!protocols[protocol])
+            connectionErrors.push(new ParseError({
+                message: 'Invalid protocol: ' + protocol,
+                key: 'IMPORT.ERROR_INVALID_PROTOCOL',
+                variables: { PROTOCOL: protocol }
+            }));
+
+        // Ensure that a name was specified for this connection
+        if (!connection.name)
+            connectionErrors.push(new ParseError({
+                message: 'Missing required name field',
+                key: 'IMPORT.ERROR_REQUIRED_NAME_CONNECTION'
+            }));
+
+        // Ensure that the specified user list, if any, is an array
+        const users = connection.users;
+        if (users && !Array.isArray(users))
+            connectionErrors.push(new ParseError({
+                message: 'Invalid users list - must be an array',
+                key: 'IMPORT.ERROR_INVALID_USERS_TYPE'
+            }));
+
+        // Ensure that the specified user list, if any, is an array
+        const groups = connection.groups;
+        if (groups && !Array.isArray(groups))
+            connectionErrors.push(new ParseError({
+                message: 'Invalid groups list - must be an array',
+                key: 'IMPORT.ERROR_INVALID_USER_GROUPS_TYPE'
+            }));
+
+        return connectionErrors;
+    }
+
     /**
      * Convert a provided connection array into a ParseResult. Any provided
      * transform functions will be run on each entry in `connectionData` before
@@ -384,8 +469,12 @@ angular.module('import').factory('connectionParseService',
 
         let index = 0;
 
-        // Get the group transformer to apply to each connection
-        return getTreeTransformer(importConfig).then(treeTransformer =>
+        // Get the tree transformer and valid protocol set
+        return $q.all({
+            treeTransformer : getTreeTransformer(importConfig),
+            protocols       : getValidProtocols()
+        })
+        .then(({treeTransformer, protocols}) =>
                 connectionData.reduce((parseResult, data) => {
 
             const { patches, users, groups, groupPaths } = parseResult;
@@ -396,8 +485,13 @@ angular.module('import').factory('connectionParseService',
                 connectionObject = transform(connectionObject);
             });
 
-            // All errors found while parsing this connection
-            const connectionErrors = [];
+            // All errors encountered while running the connection through the
+            // provided transform, starting with those encountered during
+            // the provided transforms, and any errors from missing fields
+            const connectionErrors = [
+                ..._.get(connectionObject, 'errors', []),
+                ...getFieldErrors(connectionObject, protocols)
+            ];
 
             // Determine the connection's place in the connection group tree
             try {
diff --git a/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js b/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
index 9a519dedb..47c13a8eb 100644
--- a/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
+++ b/guacamole/src/main/frontend/src/app/import/types/ImportConnection.js
@@ -113,6 +113,13 @@ angular.module('import').factory('ImportConnection', ['$injector',
          * a brand new connection should be created.
          */
         this.importMode = template.importMode || ImportConnection.ImportMode.CREATE;
+
+        /**
+         * Any errors specific to this connection encountered while parsing.
+         *
+         * @type ParseError[]
+         */
+        this.errors = template.errors || [];
         
     };
 
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 972bab93d..30782fc67 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -211,13 +211,19 @@
         "ERROR_INVALID_MIME_TYPE"            : "Unsupported file type: \"{TYPE}\"",
         "ERROR_INVALID_GROUP"                : "No group matching \"{GROUP}\" found",
         "ERROR_INVALID_GROUP_IDENTIFIER"     : "No connection group with identifier \"{IDENTIFIER}\" found",
+        "ERROR_INVALID_GROUP_TYPE"           : "Invalid group - must be a string.",
+        "ERROR_INVALID_PROTOCOL"             : "Invalid protocol \"{PROTOCOL}\"",
+        "ERROR_INVALID_USER_GROUPS_TYPE"     : "Invalid user groups - must be an array of user group identifiers.",
+        "ERROR_INVALID_USERS_TYPE"           : "Invalid users - must be an array of user identifiers.",
         "ERROR_NO_FILE_SUPPLIED"             : "Please select a file to import",
         "ERROR_PARSE_FAILURE_CSV"            : "Please make sure your file is valid CSV. Parsing failed with error \"{ERROR}\". ",
         "ERROR_PARSE_FAILURE_JSON"           : "Please make sure your file is valid JSON. Parsing failed with error \"{ERROR}\". ",
         "ERROR_PARSE_FAILURE_YAML"           : "Please make sure your file is valid YAML. Parsing failed with error \"{ERROR}\". ",
         "ERROR_REJECT_UPDATE_CONNECTION"     : "Connection \"{NAME}\" already exists at \"{PATH}\"",
-        "ERROR_REQUIRED_NAME"                : "No connection name found in the provided file",
-        "ERROR_REQUIRED_PROTOCOL"            : "No connection protocol found in the provided file",
+        "ERROR_REQUIRED_NAME_CONNECTION"     : "The connection name is required",
+        "ERROR_REQUIRED_PROTOCOL_CONNECTION" : "The connection protocol is required",
+        "ERROR_REQUIRED_NAME_FILE"           : "No connection name found in the provided file",
+        "ERROR_REQUIRED_PROTOCOL_FILE"       : "No connection protocol found in the provided file",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 

From 70b7b7bd42fb15c10262ddf27e3933bc9e98fce1 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 28 Apr 2023 21:50:58 +0000
Subject: [PATCH 192/289] GUACAMOLE-926: Add username and password to examples.

---
 guacamole/src/main/frontend/src/translations/en.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 30782fc67..1429360d6 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -231,12 +231,12 @@
         "FIELD_HEADER_EXISTING_PERMISSION_MODE" : "Reset permissions",
 
         "HELP_CSV_DESCRIPTION"              : "A connection import CSV file has one connection record per row. Each column will specify a connection field. At minimum the connection name and protocol must be specified.",
-        "HELP_CSV_EXAMPLE"                  : "name,protocol,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,",
+        "HELP_CSV_EXAMPLE"                  : "name,protocol,username,password,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,alice,pass1,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,bob,pass2,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,carol,pass3,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,,,",
         "HELP_CSV_MORE_DETAILS"             : "The CSV header for each row specifies the connection field. The connection group ID that the connection should be imported into may be directly specified with \"parentIdentifier\", or the path to the parent group may be specified using \"group\" as shown below. In most cases, there should be no conflict between fields, but if needed, an \" (attribute)\" or \" (parameter)\" suffix may be added to disambiguate. Lists of user or user group identifiers must be semicolon-separated.¹",
         "HELP_FILE_TYPE_DESCRIPTION"        : "Three file types are supported for connection import: CSV, JSON, and YAML. The same data may be specified by each file type. This must include the connection name and protocol. Optionally, a connection group location, a list of users and/or user groups to grant access, connection parameters, or connection protocols may also be specified. Any users or user groups that do not exist in the current data source will be automatically created. Note that any existing connection permissions will not be removed for updated connections, unless \"Reset permissions\" is checked.",
         "HELP_FILE_TYPE_HEADER"             : "File Types",
         "HELP_JSON_DESCRIPTION"             : "A connection import JSON file is a list of connection objects. At minimum the connection name and protocol must be specified in each connection object.",
-        "HELP_JSON_EXAMPLE"                 : "[\n  \\{\n    \"name\": \"conn1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"hostname\": \"conn1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac user 1\", \"guac user 2\" ],\n    \"groups\": [ \"Connection 1 Users\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"hostname\": \"conn2.web.com\" \\},\n    \"group\": \"ROOT/Parent Group\",\n    \"users\": [ \"guac user 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"hostname\": \"conn3.web.com\" \\},\n    \"group\": \"ROOT/Parent Group/Child Group\",\n    \"users\": [ \"guac user 2\", \"guac user 3\" ]\n  \\},\n  \\{\n    \"name\": \"conn4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
+        "HELP_JSON_EXAMPLE"                 : "[\n  \\{\n    \"name\": \"conn1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"username\": \"alice\", \"password\": \"pass1\", \"hostname\": \"conn1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac user 1\", \"guac user 2\" ],\n    \"groups\": [ \"Connection 1 Users\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"username\": \"bob\", \"password\": \"pass2\", \"hostname\": \"conn2.web.com\" \\},\n    \"group\": \"ROOT/Parent Group\",\n    \"users\": [ \"guac user 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"username\": \"carol\", \"password\": \"pass3\", \"hostname\": \"conn3.web.com\" \\},\n    \"group\": \"ROOT/Parent Group/Child Group\",\n    \"users\": [ \"guac user 2\", \"guac user 3\" ]\n  \\},\n  \\{\n    \"name\": \"conn4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
         "HELP_JSON_MORE_DETAILS"            : "The connection group ID that the connection should be imported into may be directly specified with a \"parentIdentifier\" field, or the path to the parent group may be specified using a \"group\" field as shown below. An array of user and user group identifiers to grant access to may be specified per connection.",
         "HELP_EXISTING_CONNECTION_MODE"     : "Entirely replace/update existing connections if their names and parent connection groups match the values in the provided file. If unchecked, attempting to import a connection with the same name and parent connection group of an existing connection will be considered an error.",
         "HELP_EXISTING_PERMISSION_MODE"     : "Fully reset the permissions granted for all connections in the provided file to the permissions specified in that file. If no permissions are specified, all relevant connection permissions will be revoked. If unchecked, existing permissions are preserved, and any permissions specified in the file will be added.",
@@ -244,7 +244,7 @@
         "HELP_UPLOAD_DROP_TITLE"            : "Drop a File Here",
         "HELP_UPLOAD_FILE_TYPES"            : "CSV, JSON, or YAML",
         "HELP_YAML_DESCRIPTION"             : "A connection import YAML file is a list of connection objects with exactly the same structure as the JSON format.",
-        "HELP_YAML_EXAMPLE"                 : "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n    - guac user 1\n    - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n    - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n    - guac user 2\n    - guac user 3\n  - name: conn4\n    protocol: kubernetes",
+        "HELP_YAML_EXAMPLE"                 : "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      username: alice\n      password: pass1\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n    - guac user 1\n    - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      username: bob\n      password: pass2\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n    - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      username: carol\n      password: pass3\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n    - guac user 2\n    - guac user 3\n  - name: conn4\n    protocol: kubernetes",
 
         "INFO_CONNECTIONS_IMPORTED_SUCCESS" : "{NUMBER} {NUMBER, plural, one{connection} other{connections}} imported successfully.",
         

From 00fc4b4270ff8872b07524c4d588a83b52d219de Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 2 May 2023 19:54:53 +0000
Subject: [PATCH 193/289] GUACAMOLE-926: Reject file-level errors in csv parser
 to ensure proper bubbling.

---
 .../src/app/import/services/connectionCSVService.js       | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
index 18a024865..641318b5b 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
@@ -389,17 +389,17 @@ angular.module('import').factory('connectionCSVService',
             // Fail if the name wasn't provided. Note that this is a file-level
             // error, not specific to any connection.
             if (!nameGetter)
-                throw new ParseError({
+                deferred.reject(new ParseError({
                     message: 'The connection name must be provided',
                     key: 'IMPORT.ERROR_REQUIRED_NAME_FILE'
-                });
+                }));
 
             // Fail if the protocol wasn't provided
             if (!protocolGetter)
-                throw new ParseError({
+                deferred.reject(new ParseError({
                     message: 'The connection protocol must be provided',
                     key: 'IMPORT.ERROR_REQUIRED_PROTOCOL_FILE'
-                });
+                }));
 
             // The function to transform a CSV row into a connection object
             deferred.resolve(function transformCSVRow(row) {

From d82508ffe77334b117fbb4ab627108f2e4fcb1f8 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 2 May 2023 21:16:11 +0000
Subject: [PATCH 194/289] GUACAMOLE-926: Correct parameter values in import
 file to correct case if possible.

---
 .../import/services/connectionParseService.js | 255 +++++++++++-------
 1 file changed, 154 insertions(+), 101 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index acf444d5c..b7c2923ec 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -200,7 +200,8 @@ angular.module('import').factory('connectionParseService',
     /**
      * Returns a promise that will resolve to a transformer function that will
      * perform various checks and transforms relating to the connection group
-     * tree heirarchy. It will:
+     * tree hierarchy, pushing any errors into the resolved connection object.
+     * It will:
      * - Ensure that a connection specifies either a valid group path (no path
      *   defaults to ROOT), or a valid parent group identifier, but not both
      * - Ensure that this connection does not duplicate another connection
@@ -243,19 +244,24 @@ angular.module('import').factory('connectionParseService',
             let op = DirectoryPatch.Operation.ADD;
 
             // If both are specified, the parent group is ambigious
-            if (providedIdentifier && connection.group)
-                throw new ParseError({
+            if (providedIdentifier && connection.group) {
+                connection.errors.push(new ParseError({
                     message: 'Only one of group or parentIdentifier can be set',
                     key: 'IMPORT.ERROR_AMBIGUOUS_PARENT_GROUP'
-                });
+                }));
+                return connection;
+            }
 
             // If a parent group identifier is present, but not valid
-            else if (providedIdentifier && !groupPathsByIdentifier[providedIdentifier])
-                throw new ParseError({
+            else if (providedIdentifier
+                    && !groupPathsByIdentifier[providedIdentifier]) {
+                connection.errors.push(new ParseError({
                     message: 'No group with identifier: ' + providedIdentifier,
                     key: 'IMPORT.ERROR_INVALID_GROUP_IDENTIFIER',
                     variables: { IDENTIFIER: providedIdentifier }
-                });
+                }));
+                return connection;
+            }
 
             // If the parent identifier is valid, use it to determine the path
             else if (providedIdentifier) {
@@ -272,11 +278,13 @@ angular.module('import').factory('connectionParseService',
                 group = connection.group;
 
                 // If the provided group isn't a string, it can never be valid
-                if (typeof group !== 'string')
-                    throw new ParseError({
+                if (typeof group !== 'string') {
+                    connection.errors.push(new ParseError({
                         message: 'Invalid group type - must be a string',
                         key: 'IMPORT.ERROR_INVALID_GROUP_TYPE'
-                    });
+                    }));
+                    return connection;
+                }
 
                 // Allow the group to start with a leading slash instead instead
                 // of explicitly requiring the root connection group
@@ -295,12 +303,14 @@ angular.module('import').factory('connectionParseService',
                 parentIdentifier = groupPathsByIdentifier[group];
 
                 // If the group doesn't match anything in the tree
-                if (!parentIdentifier)
-                    throw new ParseError({
+                if (!parentIdentifier) {
+                    connection.errors.push(new ParseError({
                         message: 'No group found named: ' + connection.group,
                         key: 'IMPORT.ERROR_INVALID_GROUP',
                         variables: { GROUP: connection.group }
-                    });
+                    }));
+                    return connection;
+                }
 
             }
 
@@ -315,12 +325,12 @@ angular.module('import').factory('connectionParseService',
 
             // Error out if this is a duplicate of a connection already in the
             // file
-            if (!!_.get(connectionsInFile, path))
-                throw new ParseError({
+            if (!!_.get(connectionsInFile, path)) 
+                connection.errors.push(new ParseError({
                     message: 'Duplicate connection in file: ' + path,
                     key: 'IMPORT.ERROR_DUPLICATE_CONNECTION_IN_FILE',
                     variables: { NAME: connection.name, PATH: group }
-                });
+                }));
 
             // Mark the current path as already seen in the file
             _.setWith(connectionsInFile, path, connection, Object);
@@ -329,17 +339,18 @@ angular.module('import').factory('connectionParseService',
             const existingIdentifier = _.get(connectionIdsByGroupAndName,
                     [parentIdentifier, connection.name]);
 
-            let importMode;
+            // The default behavior is to create connections if no conflict
+            let importMode = ImportConnection.ImportMode.CREATE;
             let identifier;
 
             // If updates to existing connections are disallowed
             if (existingIdentifier && importConfig.existingConnectionMode ===
                     ConnectionImportConfig.ExistingConnectionMode.REJECT)
-                throw new ParseError({
+                connection.errors.push(new ParseError({
                     message: 'Rejecting update to existing connection: ' + path,
                     key: 'IMPORT.ERROR_REJECT_UPDATE_CONNECTION',
                     variables: { NAME: connection.name, PATH: group }
-                });
+                }));
 
             // If the connection is being replaced, set the existing identifer
             else if (existingIdentifier) {
@@ -347,7 +358,6 @@ angular.module('import').factory('connectionParseService',
                 importMode = ImportConnection.ImportMode.REPLACE;
             }
 
-            // Otherwise, just create a new connection
             else
                 importMode = ImportConnection.ImportMode.CREATE;
 
@@ -359,13 +369,22 @@ angular.module('import').factory('connectionParseService',
     }
 
     /**
-     * Returns a promise that resolves to a map of all valid protocols to the
-     * boolean value "true", i.e. a set of all valid protocols.
+     * Returns a promise that resolves to a map of all valid protocols to a map
+     * of connection parameter names to a map of lower-cased and trimmed option
+     * values for that parameter to the actual valid option value.
      *
-     * @returns {Promise.<Object.<String, Boolean>>}
-     *     A promise that resolves to a set of all valid protocols.
+     * This format is designed for easy retrieval of corrected parameter values
+     * if the user-provided value matches a valid option except for case or
+     * leading/trailing whitespace.
+     *
+     * If a parameter has no options (i.e. any string value is allowed), the
+     * parameter name will map to a null value.
+     *
+     * @returns {Promise.<Object.<String, Object.<String, Object.<String, String>>>>}
+     *     A promise that resolves to a map of all valid protocols to parameter
+     *     names to valid values.
      */
-    function getValidProtocols() {
+    function getProtocolParameterOptions() {
 
         // The current data source - the one that the connections will be
         // imported into
@@ -373,67 +392,109 @@ angular.module('import').factory('connectionParseService',
 
         // Fetch the protocols and convert to a set of valid protocol names
         return schemaService.getProtocols(dataSource).then(
-                protocols => _.mapValues(protocols, () => true));
+                protocols => _.mapValues(protocols, ({connectionForms}) => {
+
+            const fieldMap = {};
+
+            // Go through all the connection forms and get the fields for each
+            connectionForms.forEach(({fields}) => fields.forEach(field => {
+
+                const { name, options } = field;
+
+                // Set the value to null to indicate that there are no options
+                if (!options)
+                    fieldMap[name] = null;
+
+                // Set the value to a map of lowercased/trimmed option values 
+                // to actual option values
+                else
+                    fieldMap[name] = _.mapKeys(
+                        options, option => option.trim().toLowerCase());
+               
+            }));
+
+            return fieldMap;
+        }));
     }
 
     /**
-     * Return a list of field-level errors for the provided connection,
-     * such as missing or invalid fields that are not dependant on the
-     * connection group heirarchy.
+     * Resolves to function that will perform field-level (not connection
+     * hierarchy dependent) checks and transforms to a provided connection,
+     * returning the transformed connection.
      *
-     * @param {ImportConnection} connection
-     *     The connection object to check field values on.
-     *
-     * @param {Object.<String, Boolean>} protocols
-     *     A set of valid protocols, such as the one returned by 
-     *     getValidProtocols().
-     *
-     * @returns {ParseError[]}
-     *     A list of field-level errors for the provided connection.
+     * @returns {Promise.<Function.<ImportConnection, ImportConnection>>}
+     *     A promise resolving to a function that will apply field-level
+     *     transforms and checks to a provided connection, returning the
+     *     transformed connection.
      */
-    function getFieldErrors(connection, protocols) {
-        const connectionErrors = [];
+    function getFieldTransformer() {
 
-        // Ensure that a protocol was specified for this connection
-        const protocol = connection.protocol;
-        if (!protocol)
-            connectionErrors.push(new ParseError({
-                message: 'Missing required protocol field',
-                key: 'IMPORT.ERROR_REQUIRED_PROTOCOL_CONNECTION'
-            }));
+        return getProtocolParameterOptions().then(protocols => connection => {
 
-        // Ensure that a valid protocol was specified for this connection
-        if (!protocols[protocol])
-            connectionErrors.push(new ParseError({
-                message: 'Invalid protocol: ' + protocol,
-                key: 'IMPORT.ERROR_INVALID_PROTOCOL',
-                variables: { PROTOCOL: protocol }
-            }));
+            // Ensure that a protocol was specified for this connection
+            const protocol = connection.protocol;
+            if (!protocol)
+                connection.errors.push(new ParseError({
+                    message: 'Missing required protocol field',
+                    key: 'IMPORT.ERROR_REQUIRED_PROTOCOL_CONNECTION'
+                }));
 
-        // Ensure that a name was specified for this connection
-        if (!connection.name)
-            connectionErrors.push(new ParseError({
-                message: 'Missing required name field',
-                key: 'IMPORT.ERROR_REQUIRED_NAME_CONNECTION'
-            }));
+            // Ensure that a valid protocol was specified for this connection
+            if (!protocols[protocol])
+                connection.errors.push(new ParseError({
+                    message: 'Invalid protocol: ' + protocol,
+                    key: 'IMPORT.ERROR_INVALID_PROTOCOL',
+                    variables: { PROTOCOL: protocol }
+                }));
 
-        // Ensure that the specified user list, if any, is an array
-        const users = connection.users;
-        if (users && !Array.isArray(users))
-            connectionErrors.push(new ParseError({
-                message: 'Invalid users list - must be an array',
-                key: 'IMPORT.ERROR_INVALID_USERS_TYPE'
-            }));
+            // Ensure that a name was specified for this connection
+            if (!connection.name)
+                connection.errors.push(new ParseError({
+                    message: 'Missing required name field',
+                    key: 'IMPORT.ERROR_REQUIRED_NAME_CONNECTION'
+                }));
 
-        // Ensure that the specified user list, if any, is an array
-        const groups = connection.groups;
-        if (groups && !Array.isArray(groups))
-            connectionErrors.push(new ParseError({
-                message: 'Invalid groups list - must be an array',
-                key: 'IMPORT.ERROR_INVALID_USER_GROUPS_TYPE'
-            }));
+            // Ensure that the specified user list, if any, is an array
+            const users = connection.users;
+            if (users && !Array.isArray(users))
+                connection.errors.push(new ParseError({
+                    message: 'Invalid users list - must be an array',
+                    key: 'IMPORT.ERROR_INVALID_USERS_TYPE'
+                }));
 
-        return connectionErrors;
+            // Ensure that the specified user list, if any, is an array
+            const groups = connection.groups;
+            if (groups && !Array.isArray(groups))
+                connection.errors.push(new ParseError({
+                    message: 'Invalid groups list - must be an array',
+                    key: 'IMPORT.ERROR_INVALID_USER_GROUPS_TYPE'
+                }));
+
+            // If the protocol is not valid, there's no point in trying to check
+            // parameter case sensitivity
+            if (!protocols[protocol])
+                return connection;
+
+            _.forEach(connection.parameters, (value, name) => {
+
+                // Convert the provided value to the format that would match
+                // the lookup object format
+                const comparisonValue = value.toLowerCase().trim();
+
+                // The validated / corrected option value for this connection
+                // parameter, if any
+                const validOptionValue = _.get(
+                        protocols, [protocol, name, comparisonValue]);
+
+                // If the provided value fuzzily matches a valid option value,
+                // use the valid option value instead
+                if (validOptionValue)
+                    connection.parameters[name] = validOptionValue;
+
+            });
+
+            return connection;
+        });
     }
 
     /**
@@ -469,12 +530,12 @@ angular.module('import').factory('connectionParseService',
 
         let index = 0;
 
-        // Get the tree transformer and valid protocol set
+        // Get the tree transformer and relevant protocol information
         return $q.all({
-            treeTransformer : getTreeTransformer(importConfig),
-            protocols       : getValidProtocols()
+            fieldTransformer : getFieldTransformer(),
+            treeTransformer  : getTreeTransformer(importConfig),
         })
-        .then(({treeTransformer, protocols}) =>
+        .then(({fieldTransformer, treeTransformer}) =>
                 connectionData.reduce((parseResult, data) => {
 
             const { patches, users, groups, groupPaths } = parseResult;
@@ -485,26 +546,14 @@ angular.module('import').factory('connectionParseService',
                 connectionObject = transform(connectionObject);
             });
 
-            // All errors encountered while running the connection through the
-            // provided transform, starting with those encountered during
-            // the provided transforms, and any errors from missing fields
-            const connectionErrors = [
-                ..._.get(connectionObject, 'errors', []),
-                ...getFieldErrors(connectionObject, protocols)
-            ];
+            // Apply the field level transforms
+            connectionObject = fieldTransformer(connectionObject);
 
-            // Determine the connection's place in the connection group tree
-            try {
-                connectionObject = treeTransformer(connectionObject);
-            }
-
-            // If there was a problem with the connection group heirarchy
-            catch (error) {
-                connectionErrors.push(error);
-            }
+            // Apply the connection group hierarchy transforms
+            connectionObject = treeTransformer(connectionObject);
 
             // If there are any errors for this connection, fail the whole batch
-            if (connectionErrors.length)
+            if (connectionObject.errors.length)
                 parseResult.hasErrors = true;
 
             // The value for the patch is a full-fledged Connection
@@ -559,7 +608,7 @@ angular.module('import').factory('connectionParseService',
             groupPaths[index] = connectionObject.group;
 
             // Save the errors for this connection into the parse result
-            parseResult.errors[index] = connectionErrors;
+            parseResult.errors[index] = connectionObject.errors;
 
             // Add this connection index to the list for each user
             _.forEach(connectionObject.users, identifier => {
@@ -700,8 +749,10 @@ angular.module('import').factory('connectionParseService',
             return deferred.promise;
         }
 
-        // Produce a ParseResult
-        return parseConnectionData(importConfig, connectionData);
+        // Produce a ParseResult, making sure that each record is converted to
+        // the ImportConnection type before further parsing
+        return parseConnectionData(importConfig, connectionData,
+                [connection => new ImportConnection(connection)]);
     };
 
     /**
@@ -740,8 +791,10 @@ angular.module('import').factory('connectionParseService',
             return deferred.promise;
         }
 
-        // Produce a ParseResult
-        return parseConnectionData(importConfig, connectionData);
+        // Produce a ParseResult, making sure that each record is converted to
+        // the ImportConnection type before further parsing
+        return parseConnectionData(importConfig, connectionData,
+                [connection => new ImportConnection(connection)]);
 
     };
 

From ea6aa49a13a92bda3e42f2aad1b9e4751a627a90 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 8 May 2023 22:16:09 +0000
Subject: [PATCH 195/289] GUACAMOLE-926: Fix indendation in YAML example.

---
 guacamole/src/main/frontend/src/translations/en.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 1429360d6..0826f3354 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -244,7 +244,7 @@
         "HELP_UPLOAD_DROP_TITLE"            : "Drop a File Here",
         "HELP_UPLOAD_FILE_TYPES"            : "CSV, JSON, or YAML",
         "HELP_YAML_DESCRIPTION"             : "A connection import YAML file is a list of connection objects with exactly the same structure as the JSON format.",
-        "HELP_YAML_EXAMPLE"                 : "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      username: alice\n      password: pass1\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n    - guac user 1\n    - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      username: bob\n      password: pass2\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n    - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      username: carol\n      password: pass3\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n    - guac user 2\n    - guac user 3\n  - name: conn4\n    protocol: kubernetes",
+        "HELP_YAML_EXAMPLE"                 : "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      username: alice\n      password: pass1\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n      - guac user 1\n      - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      username: bob\n      password: pass2\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n      - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      username: carol\n      password: pass3\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n      - guac user 2\n      - guac user 3\n  - name: conn4\n    protocol: kubernetes",
 
         "INFO_CONNECTIONS_IMPORTED_SUCCESS" : "{NUMBER} {NUMBER, plural, one{connection} other{connections}} imported successfully.",
         

From 55d874bcaa897bbec06e6caec0fca1180d9a6b0c Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 8 May 2023 22:48:14 +0000
Subject: [PATCH 196/289] GUACAMOLE-926: Ensure that parameters and attributes
 are cast to strings.

---
 .../import/services/connectionParseService.js | 26 ++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index b7c2923ec..b7135ec22 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -477,9 +477,17 @@ angular.module('import').factory('connectionParseService',
 
             _.forEach(connection.parameters, (value, name) => {
 
+                // An explicit null value for a parameter is valid - do not
+                // process it further
+                if (value === null)
+                    return;
+
+                // All non-null connection parameters must be strings.
+                const stringValue = String(value);
+
                 // Convert the provided value to the format that would match
                 // the lookup object format
-                const comparisonValue = value.toLowerCase().trim();
+                const comparisonValue = stringValue.toLowerCase().trim();
 
                 // The validated / corrected option value for this connection
                 // parameter, if any
@@ -491,6 +499,22 @@ angular.module('import').factory('connectionParseService',
                 if (validOptionValue)
                     connection.parameters[name] = validOptionValue;
 
+                // Even if no option is found, the value must be a string
+                else
+                    connection.parameters[name] = stringValue;
+
+            });
+
+            _.forEach(connection.attributes, (value, name) => {
+
+                // An explicit null value for an attribute is valid - do not
+                // process it further
+                if (value === null)
+                    return;
+
+                // All non-null connection attributes must be strings
+                connection.attributes[name] = String(value);
+
             });
 
             return connection;

From 8efb93c3b7c4cceb27d40135c9ebcc10e514b526 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 8 May 2023 22:52:16 +0000
Subject: [PATCH 197/289] GUACAMOLE-926: Add REGEX backup for type sniffing in
 batch import.

---
 .../importConnectionsController.js            | 74 +++++++++++++++++--
 1 file changed, 67 insertions(+), 7 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index cc99e9653..fad7af826 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -26,6 +26,15 @@
  */
 const CSV_MIME_TYPE = 'text/csv';
 
+/**
+ * A fallback regular expression for CSV filenames, if no MIME type is provided
+ * by the browser. Any file that matches this regex will be considered to be a
+ * CSV file.
+ *
+ * @type RegExp
+ */
+const CSV_FILENAME_REGEX = /\.csv$/i;
+
 /**
  * The allowed MIME type for JSON files.
  *
@@ -33,6 +42,15 @@ const CSV_MIME_TYPE = 'text/csv';
  */
 const JSON_MIME_TYPE = 'application/json';
 
+/**
+ * A fallback regular expression for JSON filenames, if no MIME type is provided
+ * by the browser. Any file that matches this regex will be considered to be a
+ * JSON file.
+ *
+ * @type RegExp
+ */
+const JSON_FILENAME_REGEX = /\.json$/i;
+
 /**
  * The allowed MIME types for YAML files.
  * NOTE: There is no registered MIME type for YAML files. This may result in a
@@ -50,6 +68,15 @@ const YAML_MIME_TYPES = [
     'application/yml'
 ];
 
+/**
+ * A fallback regular expression for YAML filenames, if no MIME type is provided
+ * by the browser. Any file that matches this regex will be considered to be a
+ * YAML file.
+ *
+ * @type RegExp
+ */
+const YAML_FILENAME_REGEX = /\.ya?ml$/i;
+
 /**
  * Possible signatures for zip files (which include most modern Microsoft office
  * documents - most notable excel). If any file, regardless of extension, has
@@ -564,12 +591,46 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         // There should only ever be a single file in the array
         const file = files[0];
 
-        // The MIME type of the provided file
-        const mimeType = file.type;
+        // The name and MIME type of the file as provided by the browser
+        let fileName = file.name;
+        let mimeType = file.type;
+
+        // If no MIME type was provided by the browser at all, use REGEXes as a
+        // fallback to try to determine the file type. NOTE: Windows 10/11 are
+        // known to do this with YAML files.
+        if (!_.trim(mimeType).length) {
+
+            // If the file name matches what we'd expect for a CSV file, set the
+            // CSV MIME type and move on
+            if (CSV_FILENAME_REGEX.test(fileName))
+                mimeType = CSV_MIME_TYPE;
+
+            // If the file name matches what we'd expect for a JSON file, set
+            // the JSON MIME type and move on
+            else if (JSON_FILENAME_REGEX.test(fileName))
+                mimeType = JSON_MIME_TYPE;
+
+            // If the file name matches what we'd expect for a JSON file, set
+            // one of the allowed YAML MIME types and move on
+            else if (YAML_FILENAME_REGEX.test(fileName))
+                mimeType = YAML_MIME_TYPES[0];
+
+            else {
+
+                // If none of the REGEXes pass, there's nothing more to be tried
+                handleError(new ParseError({
+                    message: "Unknown type for file: " + fileName,
+                    key: 'IMPORT.ERROR_DETECTED_INVALID_TYPE'
+                }));
+                return;
+                
+            }
+
+        }
 
         // Check if the mimetype is one of the supported types,
         // e.g. "application/json" or "text/csv"
-        if (LEGAL_MIME_TYPES.indexOf(mimeType) < 0) {
+        else if (LEGAL_MIME_TYPES.indexOf(mimeType) < 0) {
 
             // If the provided file is not one of the supported types,
             // display an error and abort processing
@@ -582,7 +643,9 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
             
         }
 
-        $scope.fileName = file.name;
+        // Save the name and type to the scope
+        $scope.fileName = fileName;
+        $scope.mimeType = mimeType;
 
         // Initialize upload state
         $scope.aborted = false;
@@ -590,9 +653,6 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         $scope.processing = false;
         $scope.uploadStarted = true;
 
-        // Save the MIME type to the scope
-        $scope.mimeType = file.type;
-
         // Save the file to the scope when ready
         $scope.fileReader = new FileReader();
         $scope.fileReader.onloadend = (e => {

From 6c1ac0b008e9b0b530c9bf6ece7c2cd2993f9912 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 10 May 2023 22:06:27 +0000
Subject: [PATCH 198/289] GUACAMOLE-926: Trim spaces from user and user group
 names before importing.

---
 .../import/services/connectionParseService.js | 38 +++++++++++++------
 1 file changed, 27 insertions(+), 11 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
index b7135ec22..59717001f 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionParseService.js
@@ -456,20 +456,36 @@ angular.module('import').factory('connectionParseService',
 
             // Ensure that the specified user list, if any, is an array
             const users = connection.users;
-            if (users && !Array.isArray(users))
-                connection.errors.push(new ParseError({
-                    message: 'Invalid users list - must be an array',
-                    key: 'IMPORT.ERROR_INVALID_USERS_TYPE'
-                }));
+            if (users) {
 
-            // Ensure that the specified user list, if any, is an array
+                // Ensure all users in the array are trimmed strings
+                if (Array.isArray(users))
+                    connection.users = users.map(user => String(user).trim());
+
+                else
+                    connection.errors.push(new ParseError({
+                        message: 'Invalid users list - must be an array',
+                        key: 'IMPORT.ERROR_INVALID_USERS_TYPE'
+                    }));
+
+            }
+
+            // Ensure that the specified user group list, if any, is an array
             const groups = connection.groups;
-            if (groups && !Array.isArray(groups))
-                connection.errors.push(new ParseError({
-                    message: 'Invalid groups list - must be an array',
-                    key: 'IMPORT.ERROR_INVALID_USER_GROUPS_TYPE'
-                }));
+            if (groups) {
 
+                // Ensure all groups in the array are trimmed strings
+                if (Array.isArray(groups))
+                    connection.groups = groups.map(group => String(group).trim());
+
+                else
+                    connection.errors.push(new ParseError({
+                        message: 'Invalid groups list - must be an array',
+                        key: 'IMPORT.ERROR_INVALID_USER_GROUPS_TYPE'
+                    }));
+                
+            }
+            
             // If the protocol is not valid, there's no point in trying to check
             // parameter case sensitivity
             if (!protocols[protocol])

From e91d5a99ee8d460152bfdae4607ec62f8bc80370 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 10 May 2023 23:26:05 +0000
Subject: [PATCH 199/289] GUACAMOLE-926: Add configuration option for enabling
 self-signed SQL Server certs for local testing.

---
 .../SQLServerAuthenticationProviderModule.java  |  4 ++++
 .../sqlserver/conf/SQLServerEnvironment.java    | 17 +++++++++++++++++
 .../conf/SQLServerGuacamoleProperties.java      | 13 +++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/SQLServerAuthenticationProviderModule.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/SQLServerAuthenticationProviderModule.java
index 74d3c950f..5a3d4002b 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/SQLServerAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/SQLServerAuthenticationProviderModule.java
@@ -76,6 +76,10 @@ public class SQLServerAuthenticationProviderModule implements Module {
 
         // Use UTF-8 in database
         driverProperties.setProperty("characterEncoding", "UTF-8");
+
+        // Trust unknown server certificates if configured to do so
+        if (environment.trustAllServerCertificates())
+            driverProperties.setProperty("trustServerCertificate", "true");
         
         // Retrieve instance name and set it
         String instance = environment.getSQLServerInstance();
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
index 5aedec784..612fa16d8 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
@@ -295,4 +295,21 @@ public class SQLServerEnvironment extends JDBCEnvironment {
                 true);
     }
 
+    /**
+     * Returns true if all server certificates should be trusted, including
+     * those signed by an unknown certificate authority, such as self-signed
+     * certificates, or false otherwise.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while retrieving the property value, or if the
+     *     value was not set, as this property is required.
+     */
+    public boolean trustAllServerCertificates() throws GuacamoleException {
+
+        // Do not trust unknown certificates unless explicitly enabled
+        return getProperty(
+                SQLServerGuacamoleProperties.SQLSERVER_TRUST_ALL_SERVER_CERTIFICATES,
+                false);
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
index 721b3345a..c4df81381 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
@@ -245,4 +245,17 @@ public class SQLServerGuacamoleProperties {
 
     };
 
+    /**
+     * Whether or not all server certificates should be trusted, including those
+     * signed by an unknown certificate authority, such as self-signed
+     * certificates.
+     */
+    public static final BooleanGuacamoleProperty SQLSERVER_TRUST_ALL_SERVER_CERTIFICATES =
+            new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "sqlserver-trust-all-server-certificates"; }
+
+    };
+
 }

From c4e6b046aeff38cec847a480bef2a47c61ee1b8b Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 11 May 2023 00:12:43 +0000
Subject: [PATCH 200/289] GUACAMOLE-926: Disable batch executor for SQL Server
 JDBC extension - it doesn't work.

---
 .../jdbc/JDBCAuthenticationProviderModule.java |  9 +++++----
 .../guacamole/auth/jdbc/JDBCEnvironment.java   | 18 ++++++++++++++++++
 .../sqlserver/conf/SQLServerEnvironment.java   | 15 +++++++++++++++
 3 files changed, 38 insertions(+), 4 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
index 7b735bdf4..1b361e561 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCAuthenticationProviderModule.java
@@ -127,10 +127,11 @@ public class JDBCAuthenticationProviderModule extends MyBatisModule {
         // Transaction factory
         bindTransactionFactoryType(JdbcTransactionFactory.class);
         
-        // Set the JDBC Auth provider to use batch execution when possible
-        bindConfigurationSetting(configuration -> {
-            configuration.setDefaultExecutorType(ExecutorType.BATCH);
-        });
+        // Set the JDBC Auth provider to use batch execution if enabled
+        if (environment.shouldUseBatchExecutor())
+            bindConfigurationSetting(configuration -> {
+                configuration.setDefaultExecutorType(ExecutorType.BATCH);
+            });
 
         // Add MyBatis mappers
         addMapperClass(ConnectionMapper.class);
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
index f7a890e49..27f3d0563 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java
@@ -254,4 +254,22 @@ public abstract class JDBCEnvironment extends DelegatingEnvironment {
      */
     public abstract boolean enforceAccessWindowsForActiveSessions() throws GuacamoleException;
 
+    /**
+     * Returns true if the JDBC batch executor should be used by default, false
+     * otherwise. The batch executor allows repeated updates to be batched
+     * together for improved performance. 
+     * See https://mybatis.org/mybatis-3/java-api.html#sqlSessions
+     *
+     * @return
+     *     true if the batch executor should be used by default, false otherwise.
+     */
+    public boolean shouldUseBatchExecutor() {
+
+        // Unless otherwise overwritten due to implementation-specific problems,
+        // all JDBC extensions should use the batch executor if possible to
+        // ensure the best performance for repetitive queries
+        return true;
+
+    }
+
 }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
index 612fa16d8..3f3133743 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerEnvironment.java
@@ -295,6 +295,21 @@ public class SQLServerEnvironment extends JDBCEnvironment {
                 true);
     }
 
+    @Override
+    public boolean shouldUseBatchExecutor() {
+
+        // The SQL Server driver does not work when batch execution is enabled.
+        // Specifically, inserts fail with com.microsoft.sqlserver.jdbc.SQLServerException:
+        // The statement must be executed before any results can be obtained.
+        // See https://github.com/microsoft/mssql-jdbc/issues/358 for more.
+        logger.warn(
+                "JDBC batch executor is disabled for SQL Server Connections. "
+                + "Large batched updates may run slower."
+        );
+        return false;
+        
+    }
+
     /**
      * Returns true if all server certificates should be trusted, including
      * those signed by an unknown certificate authority, such as self-signed

From 43df5897c62ac00a49801ce82b38b84187ec81f3 Mon Sep 17 00:00:00 2001
From: Mike Jumper <mjumper@apache.org>
Date: Mon, 15 May 2023 15:17:19 -0700
Subject: [PATCH 201/289] GUACAMOLE-1789: Remove duplicate definition of
 SQLSERVER_BATCH_SIZE.

---
 .../sqlserver/conf/SQLServerGuacamoleProperties.java | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
index 1cbceb87b..c4df81381 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-sqlserver/src/main/java/org/apache/guacamole/auth/sqlserver/conf/SQLServerGuacamoleProperties.java
@@ -257,17 +257,5 @@ public class SQLServerGuacamoleProperties {
         public String getName() { return "sqlserver-trust-all-server-certificates"; }
 
     };
-    
-    /**
-     * The maximum number of identifiers/parameters to be included in a single batch when
-     * executing SQL statements.
-     */
-    public static final IntegerGuacamoleProperty SQLSERVER_BATCH_SIZE =
-            new IntegerGuacamoleProperty() {
-
-        @Override
-        public String getName() { return "sqlserver-batch-size"; }
-
-    };
 
 }

From 54cea4e80b469e0b69bd400182aa0d93f0df394f Mon Sep 17 00:00:00 2001
From: Mike Jumper <mjumper@apache.org>
Date: Wed, 17 May 2023 17:00:46 -0700
Subject: [PATCH 202/289] GUACAMOLE-1790: Bump version numbers of components
 not within 1.5.2.

---
 extensions/guacamole-auth-ban/pom.xml                       | 6 +++---
 .../src/main/resources/guac-manifest.json                   | 2 +-
 .../modules/guacamole-auth-sso-dist/pom.xml                 | 2 +-
 .../modules/guacamole-auth-sso-ssl/pom.xml                  | 4 ++--
 .../src/main/resources/guac-manifest.json                   | 2 +-
 extensions/guacamole-display-statistics/pom.xml             | 4 ++--
 .../src/main/resources/guac-manifest.json                   | 2 +-
 7 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/extensions/guacamole-auth-ban/pom.xml b/extensions/guacamole-auth-ban/pom.xml
index 0c1cc1c3d..d42ec347a 100644
--- a/extensions/guacamole-auth-ban/pom.xml
+++ b/extensions/guacamole-auth-ban/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-auth-ban</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.1</version>
+    <version>1.5.2</version>
     <name>guacamole-auth-ban</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.5.1</version>
+        <version>1.5.2</version>
         <relativePath>../</relativePath>
     </parent>
 
@@ -51,7 +51,7 @@
         <dependency>
             <groupId>org.apache.guacamole</groupId>
             <artifactId>guacamole-ext</artifactId>
-            <version>1.5.1</version>
+            <version>1.5.2</version>
             <scope>provided</scope>
 
             <!-- Exclude transitive dependencies that will be overridden by
diff --git a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
index 57b3f739a..d61454f13 100644
--- a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.1",
+    "guacamoleVersion" : "1.5.2",
 
     "name"      : "Brute-force Authentication Detection/Prevention",
     "namespace" : "ban",
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
index e042bb296..be3b4af6e 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
@@ -63,7 +63,7 @@
         <dependency>
             <groupId>org.apache.guacamole</groupId>
             <artifactId>guacamole-auth-sso-ssl</artifactId>
-            <version>1.5.1</version>
+            <version>1.5.2</version>
         </dependency>
 
     </dependencies>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
index d0636b9a9..2255d37ea 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-auth-sso-ssl</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.1</version>
+    <version>1.5.2</version>
     <name>guacamole-auth-sso-ssl</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>guacamole-auth-sso</artifactId>
-        <version>1.5.1</version>
+        <version>1.5.2</version>
         <relativePath>../../</relativePath>
     </parent>
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
index 9ed99833f..032db7af8 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.1",
+    "guacamoleVersion" : "1.5.2",
 
     "name"      : "SSL Authentication Extension",
     "namespace" : "ssl",
diff --git a/extensions/guacamole-display-statistics/pom.xml b/extensions/guacamole-display-statistics/pom.xml
index e726a941d..68aea4592 100644
--- a/extensions/guacamole-display-statistics/pom.xml
+++ b/extensions/guacamole-display-statistics/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-display-statistics</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.1</version>
+    <version>1.5.2</version>
     <name>guacamole-display-statistics</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.5.1</version>
+        <version>1.5.2</version>
         <relativePath>../</relativePath>
     </parent>
 
diff --git a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
index cd10ea49c..3766d0673 100644
--- a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.1",
+    "guacamoleVersion" : "1.5.2",
 
     "name"      : "Display Statistic Toolbar",
     "namespace" : "display-stats",

From 0c033feea72c671edf88acc1e7924878cb2920de Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 19 May 2023 22:09:03 +0000
Subject: [PATCH 203/289] GUACAMOLE-926: Fix UTF-8 handling in batch import
 files.

---
 .../src/app/import/controllers/importConnectionsController.js   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
index fad7af826..b4688203f 100644
--- a/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
+++ b/guacamole/src/main/frontend/src/app/import/controllers/importConnectionsController.js
@@ -693,7 +693,7 @@ angular.module('import').controller('importConnectionsController', ['$scope', '$
         });
 
         // Read all the data into memory
-        $scope.fileReader.readAsBinaryString(file);
+        $scope.fileReader.readAsText(file);
     };
     
 }]);

From 11e6c5ac262cf4fc0897dddd8132354a8caeaaa2 Mon Sep 17 00:00:00 2001
From: Mike Jumper <mjumper@apache.org>
Date: Sun, 21 May 2023 12:32:22 -0700
Subject: [PATCH 204/289] GUACAMOLE-1754: Generate JSDoc for
 guacamole-common-js as part of build.

---
 guacamole-common-js/package-lock.json | 433 ++++++++++++++++++++++++++
 guacamole-common-js/package.json      |   3 +-
 guacamole-common-js/pom.xml           |  26 +-
 3 files changed, 454 insertions(+), 8 deletions(-)

diff --git a/guacamole-common-js/package-lock.json b/guacamole-common-js/package-lock.json
index 5c08e1727..41d55e05d 100644
--- a/guacamole-common-js/package-lock.json
+++ b/guacamole-common-js/package-lock.json
@@ -5,11 +5,24 @@
   "packages": {
     "": {
       "devDependencies": {
+        "jsdoc": "^4.0.2",
         "karma": "^6.4.1",
         "karma-firefox-launcher": "^2.1.2",
         "karma-jasmine": "^5.1.0"
       }
     },
+    "node_modules/@babel/parser": {
+      "version": "7.21.8",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.21.8.tgz",
+      "integrity": "sha512-6zavDGdzG3gUqAdWvlLFfk+36RilI+Pwyuuh7HItyeScCWP3k6i8vKclAQ0bM/0y/Kz/xiwvxhMv9MgTJP5gmA==",
+      "dev": true,
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
     "node_modules/@colors/colors": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/@colors/colors/-/colors-1.5.0.tgz",
@@ -19,6 +32,18 @@
         "node": ">=0.1.90"
       }
     },
+    "node_modules/@jsdoc/salty": {
+      "version": "0.2.5",
+      "resolved": "https://registry.npmjs.org/@jsdoc/salty/-/salty-0.2.5.tgz",
+      "integrity": "sha512-TfRP53RqunNe2HBobVBJ0VLhK1HbfvBYeTC1ahnN64PWvyYyGebmMiPkuwvD9fpw2ZbkoPb8Q7mwy0aR8Z9rvw==",
+      "dev": true,
+      "dependencies": {
+        "lodash": "^4.17.21"
+      },
+      "engines": {
+        "node": ">=v12.0.0"
+      }
+    },
     "node_modules/@socket.io/component-emitter": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/@socket.io/component-emitter/-/component-emitter-3.1.0.tgz",
@@ -40,6 +65,28 @@
         "@types/node": "*"
       }
     },
+    "node_modules/@types/linkify-it": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/linkify-it/-/linkify-it-3.0.2.tgz",
+      "integrity": "sha512-HZQYqbiFVWufzCwexrvh694SOim8z2d+xJl5UNamcvQFejLY/2YUtzXHYi3cHdI7PMlS8ejH2slRAOJQ32aNbA==",
+      "dev": true
+    },
+    "node_modules/@types/markdown-it": {
+      "version": "12.2.3",
+      "resolved": "https://registry.npmjs.org/@types/markdown-it/-/markdown-it-12.2.3.tgz",
+      "integrity": "sha512-GKMHFfv3458yYy+v/N8gjufHO6MSZKCOXpZc5GXIWWy8uldwfmPn98vp81gZ5f9SVw8YYBctgfJ22a2d7AOMeQ==",
+      "dev": true,
+      "dependencies": {
+        "@types/linkify-it": "*",
+        "@types/mdurl": "*"
+      }
+    },
+    "node_modules/@types/mdurl": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@types/mdurl/-/mdurl-1.0.2.tgz",
+      "integrity": "sha512-eC4U9MlIcu2q0KQmXszyn5Akca/0jrQmwDRgpAMJai7qBWq4amIQhZyNau4VYGtCeALvW1/NtjzJJ567aZxfKA==",
+      "dev": true
+    },
     "node_modules/@types/node": {
       "version": "18.15.11",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-18.15.11.tgz",
@@ -96,6 +143,12 @@
         "node": ">= 8"
       }
     },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true
+    },
     "node_modules/balanced-match": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -120,6 +173,12 @@
         "node": ">=8"
       }
     },
+    "node_modules/bluebird": {
+      "version": "3.7.2",
+      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
+      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==",
+      "dev": true
+    },
     "node_modules/body-parser": {
       "version": "1.20.2",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz",
@@ -188,6 +247,18 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/catharsis": {
+      "version": "0.9.0",
+      "resolved": "https://registry.npmjs.org/catharsis/-/catharsis-0.9.0.tgz",
+      "integrity": "sha512-prMTQVpcns/tzFgFVkVp6ak6RykZyWb3gu8ckUpd6YkTlacOd3DXGJjIpD4Q6zJirizvaiAjSSHlOsA+6sNh2A==",
+      "dev": true,
+      "dependencies": {
+        "lodash": "^4.17.15"
+      },
+      "engines": {
+        "node": ">= 10"
+      }
+    },
     "node_modules/chokidar": {
       "version": "3.5.3",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.3.tgz",
@@ -437,6 +508,15 @@
       "integrity": "sha512-GHrMyVZQWvTIdDtpiEXdHZnFQKzeO09apj8Cbl4pKWy4i0Oprcq17usfDt5aO63swf0JOeMWjWQE/LzgSRuWpA==",
       "dev": true
     },
+    "node_modules/entities": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-2.1.0.tgz",
+      "integrity": "sha512-hCx1oky9PFrJ611mf0ifBLBRW8lUUVRlFolb5gWRfIELabBlbp9xZvrqZLZAs+NxFnbfQoeGd8wDkygjg7U85w==",
+      "dev": true,
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
     "node_modules/escalade": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
@@ -452,6 +532,15 @@
       "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
       "dev": true
     },
+    "node_modules/escape-string-regexp": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
+      "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/eventemitter3": {
       "version": "4.0.7",
       "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz",
@@ -812,6 +901,56 @@
       "integrity": "sha512-O236+gd0ZXS8YAjFx8xKaJ94/erqUliEkJTDedyE7iHvv4ZVqi+q+8acJxu05/WJDKm512EUNn809In37nWlAQ==",
       "dev": true
     },
+    "node_modules/js2xmlparser": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/js2xmlparser/-/js2xmlparser-4.0.2.tgz",
+      "integrity": "sha512-6n4D8gLlLf1n5mNLQPRfViYzu9RATblzPEtm1SthMX1Pjao0r9YI9nw7ZIfRxQMERS87mcswrg+r/OYrPRX6jA==",
+      "dev": true,
+      "dependencies": {
+        "xmlcreate": "^2.0.4"
+      }
+    },
+    "node_modules/jsdoc": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/jsdoc/-/jsdoc-4.0.2.tgz",
+      "integrity": "sha512-e8cIg2z62InH7azBBi3EsSEqrKx+nUtAS5bBcYTSpZFA+vhNPyhv8PTFZ0WsjOPDj04/dOLlm08EDcQJDqaGQg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/parser": "^7.20.15",
+        "@jsdoc/salty": "^0.2.1",
+        "@types/markdown-it": "^12.2.3",
+        "bluebird": "^3.7.2",
+        "catharsis": "^0.9.0",
+        "escape-string-regexp": "^2.0.0",
+        "js2xmlparser": "^4.0.2",
+        "klaw": "^3.0.0",
+        "markdown-it": "^12.3.2",
+        "markdown-it-anchor": "^8.4.1",
+        "marked": "^4.0.10",
+        "mkdirp": "^1.0.4",
+        "requizzle": "^0.2.3",
+        "strip-json-comments": "^3.1.0",
+        "underscore": "~1.13.2"
+      },
+      "bin": {
+        "jsdoc": "jsdoc.js"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/jsdoc/node_modules/mkdirp": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
+      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
+      "dev": true,
+      "bin": {
+        "mkdirp": "bin/cmd.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/jsonfile": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-4.0.0.tgz",
@@ -884,6 +1023,24 @@
         "karma": "^6.0.0"
       }
     },
+    "node_modules/klaw": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/klaw/-/klaw-3.0.0.tgz",
+      "integrity": "sha512-0Fo5oir+O9jnXu5EefYbVK+mHMBeEVEy2cmctR1O1NECcCkPRreJKrS6Qt/j3KC2C148Dfo9i3pCmCMsdqGr0g==",
+      "dev": true,
+      "dependencies": {
+        "graceful-fs": "^4.1.9"
+      }
+    },
+    "node_modules/linkify-it": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-3.0.3.tgz",
+      "integrity": "sha512-ynTsyrFSdE5oZ/O9GEf00kPngmOfVwazR5GKDq6EYfhlpFug3J2zybX56a2PRRpc9P+FuSoGNAwjlbDs9jJBPQ==",
+      "dev": true,
+      "dependencies": {
+        "uc.micro": "^1.0.1"
+      }
+    },
     "node_modules/lodash": {
       "version": "4.17.21",
       "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
@@ -929,6 +1086,50 @@
       "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
       "dev": true
     },
+    "node_modules/markdown-it": {
+      "version": "12.3.2",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-12.3.2.tgz",
+      "integrity": "sha512-TchMembfxfNVpHkbtriWltGWc+m3xszaRD0CZup7GFFhzIgQqxIfn3eGj1yZpfuflzPvfkt611B2Q/Bsk1YnGg==",
+      "dev": true,
+      "dependencies": {
+        "argparse": "^2.0.1",
+        "entities": "~2.1.0",
+        "linkify-it": "^3.0.1",
+        "mdurl": "^1.0.1",
+        "uc.micro": "^1.0.5"
+      },
+      "bin": {
+        "markdown-it": "bin/markdown-it.js"
+      }
+    },
+    "node_modules/markdown-it-anchor": {
+      "version": "8.6.7",
+      "resolved": "https://registry.npmjs.org/markdown-it-anchor/-/markdown-it-anchor-8.6.7.tgz",
+      "integrity": "sha512-FlCHFwNnutLgVTflOYHPW2pPcl2AACqVzExlkGQNsi4CJgqOHN7YTgDd4LuhgN1BFO3TS0vLAruV1Td6dwWPJA==",
+      "dev": true,
+      "peerDependencies": {
+        "@types/markdown-it": "*",
+        "markdown-it": "*"
+      }
+    },
+    "node_modules/marked": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-4.3.0.tgz",
+      "integrity": "sha512-PRsaiG84bK+AMvxziE/lCFss8juXjNaWzVbN5tXAm4XjeaS9NAHhop+PjQxz2A9h8Q4M/xGmzP8vqNwy6JeK0A==",
+      "dev": true,
+      "bin": {
+        "marked": "bin/marked.js"
+      },
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/mdurl": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-1.0.1.tgz",
+      "integrity": "sha512-/sKlQJCBYVY9Ers9hqzKou4H6V5UWc/M59TH2dvkt+84itfnq7uFOMLpOiOS4ujvHP4etln18fmIxA5R5fll0g==",
+      "dev": true
+    },
     "node_modules/media-typer": {
       "version": "0.3.0",
       "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
@@ -1172,6 +1373,15 @@
       "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==",
       "dev": true
     },
+    "node_modules/requizzle": {
+      "version": "0.2.4",
+      "resolved": "https://registry.npmjs.org/requizzle/-/requizzle-0.2.4.tgz",
+      "integrity": "sha512-JRrFk1D4OQ4SqovXOgdav+K8EAhSB/LJZqCz8tbX0KObcdeM15Ss59ozWMBWmmINMagCwmqn4ZNryUGpBsl6Jw==",
+      "dev": true,
+      "dependencies": {
+        "lodash": "^4.17.21"
+      }
+    },
     "node_modules/rfdc": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.3.0.tgz",
@@ -1385,6 +1595,18 @@
         "node": ">=8"
       }
     },
+    "node_modules/strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/tmp": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.1.tgz",
@@ -1450,6 +1672,18 @@
         "node": "*"
       }
     },
+    "node_modules/uc.micro": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-1.0.6.tgz",
+      "integrity": "sha512-8Y75pvTYkLJW2hWQHXxoqRgV7qb9B+9vFEtidML+7koHUFapnVJAZ6cKs+Qjz5Aw3aZWHMC6u0wJE3At+nSGwA==",
+      "dev": true
+    },
+    "node_modules/underscore": {
+      "version": "1.13.6",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.6.tgz",
+      "integrity": "sha512-+A5Sja4HP1M08MaXya7p5LvjuM7K6q/2EaC0+iovj/wOcMsTzMvDFbasi/oSapiwOlt252IqsKqPjCl7huKS0A==",
+      "dev": true
+    },
     "node_modules/universalify": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.1.2.tgz",
@@ -1554,6 +1788,12 @@
         }
       }
     },
+    "node_modules/xmlcreate": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/xmlcreate/-/xmlcreate-2.0.4.tgz",
+      "integrity": "sha512-nquOebG4sngPmGPICTS5EnxqhKbCmz5Ox5hsszI2T6U5qdrJizBc+0ilYSEjTSzU0yZcmvppztXe/5Al5fUwdg==",
+      "dev": true
+    },
     "node_modules/y18n": {
       "version": "5.0.8",
       "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
@@ -1592,12 +1832,27 @@
     }
   },
   "dependencies": {
+    "@babel/parser": {
+      "version": "7.21.8",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.21.8.tgz",
+      "integrity": "sha512-6zavDGdzG3gUqAdWvlLFfk+36RilI+Pwyuuh7HItyeScCWP3k6i8vKclAQ0bM/0y/Kz/xiwvxhMv9MgTJP5gmA==",
+      "dev": true
+    },
     "@colors/colors": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/@colors/colors/-/colors-1.5.0.tgz",
       "integrity": "sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==",
       "dev": true
     },
+    "@jsdoc/salty": {
+      "version": "0.2.5",
+      "resolved": "https://registry.npmjs.org/@jsdoc/salty/-/salty-0.2.5.tgz",
+      "integrity": "sha512-TfRP53RqunNe2HBobVBJ0VLhK1HbfvBYeTC1ahnN64PWvyYyGebmMiPkuwvD9fpw2ZbkoPb8Q7mwy0aR8Z9rvw==",
+      "dev": true,
+      "requires": {
+        "lodash": "^4.17.21"
+      }
+    },
     "@socket.io/component-emitter": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/@socket.io/component-emitter/-/component-emitter-3.1.0.tgz",
@@ -1619,6 +1874,28 @@
         "@types/node": "*"
       }
     },
+    "@types/linkify-it": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/linkify-it/-/linkify-it-3.0.2.tgz",
+      "integrity": "sha512-HZQYqbiFVWufzCwexrvh694SOim8z2d+xJl5UNamcvQFejLY/2YUtzXHYi3cHdI7PMlS8ejH2slRAOJQ32aNbA==",
+      "dev": true
+    },
+    "@types/markdown-it": {
+      "version": "12.2.3",
+      "resolved": "https://registry.npmjs.org/@types/markdown-it/-/markdown-it-12.2.3.tgz",
+      "integrity": "sha512-GKMHFfv3458yYy+v/N8gjufHO6MSZKCOXpZc5GXIWWy8uldwfmPn98vp81gZ5f9SVw8YYBctgfJ22a2d7AOMeQ==",
+      "dev": true,
+      "requires": {
+        "@types/linkify-it": "*",
+        "@types/mdurl": "*"
+      }
+    },
+    "@types/mdurl": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@types/mdurl/-/mdurl-1.0.2.tgz",
+      "integrity": "sha512-eC4U9MlIcu2q0KQmXszyn5Akca/0jrQmwDRgpAMJai7qBWq4amIQhZyNau4VYGtCeALvW1/NtjzJJ567aZxfKA==",
+      "dev": true
+    },
     "@types/node": {
       "version": "18.15.11",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-18.15.11.tgz",
@@ -1660,6 +1937,12 @@
         "picomatch": "^2.0.4"
       }
     },
+    "argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true
+    },
     "balanced-match": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -1678,6 +1961,12 @@
       "integrity": "sha512-jDctJ/IVQbZoJykoeHbhXpOlNBqGNcwXJKJog42E5HDPUwQTSdjCHdihjj0DlnheQ7blbT6dHOafNAiS8ooQKA==",
       "dev": true
     },
+    "bluebird": {
+      "version": "3.7.2",
+      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
+      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==",
+      "dev": true
+    },
     "body-parser": {
       "version": "1.20.2",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz",
@@ -1733,6 +2022,15 @@
         "get-intrinsic": "^1.0.2"
       }
     },
+    "catharsis": {
+      "version": "0.9.0",
+      "resolved": "https://registry.npmjs.org/catharsis/-/catharsis-0.9.0.tgz",
+      "integrity": "sha512-prMTQVpcns/tzFgFVkVp6ak6RykZyWb3gu8ckUpd6YkTlacOd3DXGJjIpD4Q6zJirizvaiAjSSHlOsA+6sNh2A==",
+      "dev": true,
+      "requires": {
+        "lodash": "^4.17.15"
+      }
+    },
     "chokidar": {
       "version": "3.5.3",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.3.tgz",
@@ -1931,6 +2229,12 @@
       "integrity": "sha512-GHrMyVZQWvTIdDtpiEXdHZnFQKzeO09apj8Cbl4pKWy4i0Oprcq17usfDt5aO63swf0JOeMWjWQE/LzgSRuWpA==",
       "dev": true
     },
+    "entities": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-2.1.0.tgz",
+      "integrity": "sha512-hCx1oky9PFrJ611mf0ifBLBRW8lUUVRlFolb5gWRfIELabBlbp9xZvrqZLZAs+NxFnbfQoeGd8wDkygjg7U85w==",
+      "dev": true
+    },
     "escalade": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
@@ -1943,6 +2247,12 @@
       "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
       "dev": true
     },
+    "escape-string-regexp": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
+      "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
+      "dev": true
+    },
     "eventemitter3": {
       "version": "4.0.7",
       "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz",
@@ -2212,6 +2522,46 @@
       "integrity": "sha512-O236+gd0ZXS8YAjFx8xKaJ94/erqUliEkJTDedyE7iHvv4ZVqi+q+8acJxu05/WJDKm512EUNn809In37nWlAQ==",
       "dev": true
     },
+    "js2xmlparser": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/js2xmlparser/-/js2xmlparser-4.0.2.tgz",
+      "integrity": "sha512-6n4D8gLlLf1n5mNLQPRfViYzu9RATblzPEtm1SthMX1Pjao0r9YI9nw7ZIfRxQMERS87mcswrg+r/OYrPRX6jA==",
+      "dev": true,
+      "requires": {
+        "xmlcreate": "^2.0.4"
+      }
+    },
+    "jsdoc": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/jsdoc/-/jsdoc-4.0.2.tgz",
+      "integrity": "sha512-e8cIg2z62InH7azBBi3EsSEqrKx+nUtAS5bBcYTSpZFA+vhNPyhv8PTFZ0WsjOPDj04/dOLlm08EDcQJDqaGQg==",
+      "dev": true,
+      "requires": {
+        "@babel/parser": "^7.20.15",
+        "@jsdoc/salty": "^0.2.1",
+        "@types/markdown-it": "^12.2.3",
+        "bluebird": "^3.7.2",
+        "catharsis": "^0.9.0",
+        "escape-string-regexp": "^2.0.0",
+        "js2xmlparser": "^4.0.2",
+        "klaw": "^3.0.0",
+        "markdown-it": "^12.3.2",
+        "markdown-it-anchor": "^8.4.1",
+        "marked": "^4.0.10",
+        "mkdirp": "^1.0.4",
+        "requizzle": "^0.2.3",
+        "strip-json-comments": "^3.1.0",
+        "underscore": "~1.13.2"
+      },
+      "dependencies": {
+        "mkdirp": {
+          "version": "1.0.4",
+          "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
+          "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
+          "dev": true
+        }
+      }
+    },
     "jsonfile": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-4.0.0.tgz",
@@ -2272,6 +2622,24 @@
         "jasmine-core": "^4.1.0"
       }
     },
+    "klaw": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/klaw/-/klaw-3.0.0.tgz",
+      "integrity": "sha512-0Fo5oir+O9jnXu5EefYbVK+mHMBeEVEy2cmctR1O1NECcCkPRreJKrS6Qt/j3KC2C148Dfo9i3pCmCMsdqGr0g==",
+      "dev": true,
+      "requires": {
+        "graceful-fs": "^4.1.9"
+      }
+    },
+    "linkify-it": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-3.0.3.tgz",
+      "integrity": "sha512-ynTsyrFSdE5oZ/O9GEf00kPngmOfVwazR5GKDq6EYfhlpFug3J2zybX56a2PRRpc9P+FuSoGNAwjlbDs9jJBPQ==",
+      "dev": true,
+      "requires": {
+        "uc.micro": "^1.0.1"
+      }
+    },
     "lodash": {
       "version": "4.17.21",
       "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
@@ -2308,6 +2676,38 @@
         }
       }
     },
+    "markdown-it": {
+      "version": "12.3.2",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-12.3.2.tgz",
+      "integrity": "sha512-TchMembfxfNVpHkbtriWltGWc+m3xszaRD0CZup7GFFhzIgQqxIfn3eGj1yZpfuflzPvfkt611B2Q/Bsk1YnGg==",
+      "dev": true,
+      "requires": {
+        "argparse": "^2.0.1",
+        "entities": "~2.1.0",
+        "linkify-it": "^3.0.1",
+        "mdurl": "^1.0.1",
+        "uc.micro": "^1.0.5"
+      }
+    },
+    "markdown-it-anchor": {
+      "version": "8.6.7",
+      "resolved": "https://registry.npmjs.org/markdown-it-anchor/-/markdown-it-anchor-8.6.7.tgz",
+      "integrity": "sha512-FlCHFwNnutLgVTflOYHPW2pPcl2AACqVzExlkGQNsi4CJgqOHN7YTgDd4LuhgN1BFO3TS0vLAruV1Td6dwWPJA==",
+      "dev": true,
+      "requires": {}
+    },
+    "marked": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-4.3.0.tgz",
+      "integrity": "sha512-PRsaiG84bK+AMvxziE/lCFss8juXjNaWzVbN5tXAm4XjeaS9NAHhop+PjQxz2A9h8Q4M/xGmzP8vqNwy6JeK0A==",
+      "dev": true
+    },
+    "mdurl": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-1.0.1.tgz",
+      "integrity": "sha512-/sKlQJCBYVY9Ers9hqzKou4H6V5UWc/M59TH2dvkt+84itfnq7uFOMLpOiOS4ujvHP4etln18fmIxA5R5fll0g==",
+      "dev": true
+    },
     "media-typer": {
       "version": "0.3.0",
       "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
@@ -2479,6 +2879,15 @@
       "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==",
       "dev": true
     },
+    "requizzle": {
+      "version": "0.2.4",
+      "resolved": "https://registry.npmjs.org/requizzle/-/requizzle-0.2.4.tgz",
+      "integrity": "sha512-JRrFk1D4OQ4SqovXOgdav+K8EAhSB/LJZqCz8tbX0KObcdeM15Ss59ozWMBWmmINMagCwmqn4ZNryUGpBsl6Jw==",
+      "dev": true,
+      "requires": {
+        "lodash": "^4.17.21"
+      }
+    },
     "rfdc": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.3.0.tgz",
@@ -2644,6 +3053,12 @@
         "ansi-regex": "^5.0.1"
       }
     },
+    "strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true
+    },
     "tmp": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.1.tgz",
@@ -2684,6 +3099,18 @@
       "integrity": "sha512-veRf7dawaj9xaWEu9HoTVn5Pggtc/qj+kqTOFvNiN1l0YdxwC1kvel57UCjThjGa3BHBihE8/UJAHI+uQHmd/g==",
       "dev": true
     },
+    "uc.micro": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-1.0.6.tgz",
+      "integrity": "sha512-8Y75pvTYkLJW2hWQHXxoqRgV7qb9B+9vFEtidML+7koHUFapnVJAZ6cKs+Qjz5Aw3aZWHMC6u0wJE3At+nSGwA==",
+      "dev": true
+    },
+    "underscore": {
+      "version": "1.13.6",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.6.tgz",
+      "integrity": "sha512-+A5Sja4HP1M08MaXya7p5LvjuM7K6q/2EaC0+iovj/wOcMsTzMvDFbasi/oSapiwOlt252IqsKqPjCl7huKS0A==",
+      "dev": true
+    },
     "universalify": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.1.2.tgz",
@@ -2747,6 +3174,12 @@
       "dev": true,
       "requires": {}
     },
+    "xmlcreate": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/xmlcreate/-/xmlcreate-2.0.4.tgz",
+      "integrity": "sha512-nquOebG4sngPmGPICTS5EnxqhKbCmz5Ox5hsszI2T6U5qdrJizBc+0ilYSEjTSzU0yZcmvppztXe/5Al5fUwdg==",
+      "dev": true
+    },
     "y18n": {
       "version": "5.0.8",
       "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
diff --git a/guacamole-common-js/package.json b/guacamole-common-js/package.json
index f986f8038..4cc745cc8 100644
--- a/guacamole-common-js/package.json
+++ b/guacamole-common-js/package.json
@@ -1,6 +1,7 @@
 {
-  "description": "Dependencies to be installed by maven for running JS tests",
+  "description": "Dependencies to be installed by Maven for running unit tests and generating documentation",
   "devDependencies": {
+    "jsdoc": "^4.0.2",
     "karma": "^6.4.1",
     "karma-firefox-launcher": "^2.1.2",
     "karma-jasmine": "^5.1.0"
diff --git a/guacamole-common-js/pom.xml b/guacamole-common-js/pom.xml
index a1d6b4f44..d721c448e 100644
--- a/guacamole-common-js/pom.xml
+++ b/guacamole-common-js/pom.xml
@@ -188,18 +188,30 @@
 
                 <executions>
 
-                    <!-- Install node.js and NPM before running tests -->
+                    <!-- Install node.js and NPM before running tests or generating documentation -->
                     <execution>
-                        <id>install node and npm</id>
-                        <phase>test</phase>
+                        <id>install-node-and-npm</id>
+                        <phase>process-sources</phase>
                         <goals>
                             <goal>install-node-and-npm</goal>
                         </goals>
                     </execution>
 
-                    <!-- Install test dependencies -->
+                    <!-- Generate documentation using JSDoc -->
                     <execution>
-                        <id>npm install</id>
+                        <id>generate-docs</id>
+                        <goals>
+                            <goal>npx</goal>
+                        </goals>
+                        <phase>package</phase>
+                        <configuration>
+                            <arguments>jsdoc -c jsdoc-conf.json</arguments>
+                        </configuration>
+                    </execution>
+
+                    <!-- Install test and documentation dependencies -->
+                    <execution>
+                        <id>npm-install</id>
                         <phase>test</phase>
                         <goals>
                             <goal>npm</goal>
@@ -208,13 +220,13 @@
 
                     <!-- Run all tests non-interactively -->
                     <execution>
-                        <id>run tests</id>
+                        <id>run-tests</id>
                         <phase>test</phase>
                         <goals>
                             <goal>karma</goal>
                         </goals>
                     </execution>
-                    
+
                 </executions>
                 
             </plugin>

From 70592ef7c3a346e3deb4d3581add1c1fccb8647d Mon Sep 17 00:00:00 2001
From: Mike Jumper <mjumper@apache.org>
Date: Sun, 21 May 2023 12:33:48 -0700
Subject: [PATCH 205/289] GUACAMOLE-1754: Use same "apidocs" directory for
 JSDoc as used by JavaDoc.

---
 guacamole-common-js/jsdoc-conf.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole-common-js/jsdoc-conf.json b/guacamole-common-js/jsdoc-conf.json
index ebc5a64a7..4b43bfb00 100644
--- a/guacamole-common-js/jsdoc-conf.json
+++ b/guacamole-common-js/jsdoc-conf.json
@@ -4,7 +4,7 @@
     },
     "opts" : {
         "recurse" : true,
-        "destination" : "target/site/jsdoc"
+        "destination" : "target/apidocs"
     },
     "templates" : {
         "default" : {

From 49b7218097b120a5ea762db8d534a3c27c9e7ca6 Mon Sep 17 00:00:00 2001
From: Victor Cleaner <Vict0rC@users.noreply.github.com>
Date: Mon, 22 May 2023 20:08:42 +0200
Subject: [PATCH 206/289] GUACAMOLE-1792: Updated czech translation

Correction of some inaccurately translated words in the previous translation. Completion of the translation of the "import" section according to the English original.
---
 .../main/frontend/src/translations/cs.json    | 90 +++++++++++++++++--
 1 file changed, 85 insertions(+), 5 deletions(-)

diff --git a/guacamole/src/main/frontend/src/translations/cs.json b/guacamole/src/main/frontend/src/translations/cs.json
index 53ba7f543..6e56426b8 100644
--- a/guacamole/src/main/frontend/src/translations/cs.json
+++ b/guacamole/src/main/frontend/src/translations/cs.json
@@ -7,11 +7,13 @@
 
         "ACTION_ACKNOWLEDGE"        : "OK",
         "ACTION_CANCEL"             : "Zrušit",
+        "ACTION_CLEAR"              : "Vyčistit",
         "ACTION_CLONE"              : "Klonovat",
         "ACTION_CONTINUE"           : "Pokračovat",
         "ACTION_DELETE"             : "Smazat",
         "ACTION_DELETE_SESSIONS"    : "Ukončit sezení",
         "ACTION_DOWNLOAD"           : "Stáhnout",
+        "ACTION_IMPORT"             : "Importovat",
         "ACTION_LOGIN"              : "Přihlásit",
         "ACTION_LOGIN_AGAIN"        : "Znovu přihlásit",
         "ACTION_LOGOUT"             : "Odhlásit",
@@ -37,6 +39,7 @@
         "ERROR_PAGE_UNAVAILABLE"  : "Došlo k chybě a tuto akci nelze dokončit. Pokud problém přetrvává, informujte prosím správce systému nebo zkontrolujte systémové protokoly.",
         "ERROR_PASSWORD_BLANK"    : "Heslo nesmí být prázdné.",
         "ERROR_PASSWORD_MISMATCH" : "Hesla nesouhlasí.",
+        "ERROR_SINGLE_FILE_ONLY"  : "Nahrajte prosím vždy pouze jeden soubor",
         
         "FIELD_HEADER_PASSWORD"       : "Heslo:",
         "FIELD_HEADER_PASSWORD_AGAIN" : "Heslo znovu:",
@@ -48,7 +51,7 @@
         "INFO_ACTIVE_USER_COUNT" : "V současné době používá {USERS} {USERS, plural, one{uživatel} other{uživatelů}}.",
         "INFO_LOGGED_OUT"        : "Byli jste odhlášeni.",
 
-        "TEXT_ANONYMOUS_USER"   : "Neznámý uživatel",
+        "TEXT_ANONYMOUS_USER"   : "Anonymní uživatel",
         "TEXT_HISTORY_DURATION" : "{VALUE} {UNIT, select, second{{VALUE, plural, one{sekundu} other{sekund}}} minute{{VALUE, plural, one{minutu} other{minut}}} hour{{VALUE, plural, one{hodinu} other{hodin}}} day{{VALUE, plural, one{den} other{dnů}}} other{}}",
         "TEXT_UNTRANSLATED" : "{MESSAGE}"
 
@@ -127,9 +130,10 @@
         "INFO_ANONYMOUS_USER_COUNT" : "Anonymní{COUNT, plural, one{} other{ (#)}}",
         "INFO_CONNECTION_SHARED"    : "Toto připojení je nyní sdíleno.",
         "INFO_NO_FILE_TRANSFERS"    : "Žádné přenosy souborů.",
+        "INFO_USER_COUNT"           : "{USERNAME}{COUNT, plural, one{} other{ (#)}}",
 
         "NAME_INPUT_METHOD_NONE"   : "Žádné",
-        "NAME_INPUT_METHOD_OSK"    : "Na obrazovce, klávesnice",
+        "NAME_INPUT_METHOD_OSK"    : "Klávesnice na obrazovce",
         "NAME_INPUT_METHOD_TEXT"   : "Textový vstup",
         "NAME_KEY_CTRL"            : "Ctrl",
         "NAME_KEY_ALT"             : "Alt",
@@ -181,6 +185,80 @@
 
     },
 
+    "IMPORT": {
+
+        "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_BROWSE"             : "Vyhledejte soubor",
+        "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
+        "ACTION_CLEAR"              : "@:APP.ACTION_CLEAR",
+        "ACTION_VIEW_FORMAT_HELP"   : "Zobrazit tipy formátů",
+        "ACTION_IMPORT"             : "@:APP.ACTION_IMPORT",
+        "ACTION_IMPORT_CONNECTIONS" : "Importovat připojení",
+
+        "DIALOG_HEADER_ERROR"   : "@:APP.DIALOG_HEADER_ERROR",
+        "DIALOG_HEADER_SUCCESS" : "Úspěch",
+
+        "ERROR_AMBIGUOUS_CSV_HEADER"         : "Nejednoznačné záhlaví CSV \"{HEADER}\", může být buď atribut nebo parametr připojení",
+        "ERROR_AMBIGUOUS_PARENT_GROUP"       : "Skupina a parentIdentifier nesmí být zadány současně",
+        "ERROR_ARRAY_REQUIRED"               : "Zadaný soubor musí obsahovat seznam připojení",
+        "ERROR_DETECTED_INVALID_TYPE"        : "Nepodporovaný typ souboru. Ujistěte se, že je soubor platný CSV, JSON nebo YAML.",
+        "ERROR_DUPLICATE_CONNECTION_IN_FILE" : "Duplicitní připojení \"{NAME}\" v \"{PATH}\" v souboru importu",
+        "ERROR_DUPLICATE_CSV_HEADER"         : "Duplicitní záhlaví CSV: {HEADER}",
+        "ERROR_EMPTY_FILE"                   : "Zadaný soubor je prázdný",
+        "ERROR_INVALID_CSV_HEADER"           : "Neplatné záhlaví CSV \"{HEADER}\" není atribut ani parametr",
+        "ERROR_INVALID_MIME_TYPE"            : "Nepodporovaný typ souboru: \"{TYPE}\"",
+        "ERROR_INVALID_GROUP"                : "Nebyla nalezena žádná skupina odpovídající \"{GROUP}\"",
+        "ERROR_INVALID_GROUP_IDENTIFIER"     : "Nebyla nalezena žádná skupina připojení s identifikátorem \"{IDENTIFIER}\"",
+        "ERROR_INVALID_GROUP_TYPE"           : "Neplatná skupina – musí být zadán řetězec.",
+        "ERROR_INVALID_PROTOCOL"             : "Neplatný protokol \"{PROTOCOL}\"",
+        "ERROR_INVALID_USER_GROUPS_TYPE"     : "Neplatné skupiny uživatelů – musí se jednat o pole identifikátorů skupiny uživatelů.",
+        "ERROR_INVALID_USERS_TYPE"           : "Neplatní uživatelé – musí se jednat o pole identifikátorů uživatelů.",
+        "ERROR_NO_FILE_SUPPLIED"             : "Vyberte soubor k importu",
+        "ERROR_PARSE_FAILURE_CSV"            : "Ujistěte se, že je váš soubor platný CSV. Analýza se nezdařila s chybou \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_JSON"           : "Ujistěte se, že váš soubor je platný JSON. Analýza se nezdařila s chybou \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_YAML"           : "Ujistěte se, že váš soubor je platný YAML. Analýza se nezdařila s chybou \"{ERROR}\". ",
+        "ERROR_REJECT_UPDATE_CONNECTION"     : "Připojení \"{NAME}\" již existuje v \"{PATH}\"",
+        "ERROR_REQUIRED_NAME_CONNECTION"     : "Název připojení je povinný parametr",
+        "ERROR_REQUIRED_PROTOCOL_CONNECTION" : "Protokol připojení je povinný parametr",
+        "ERROR_REQUIRED_NAME_FILE"           : "V zadaném souboru nebyl nalezen žádný název připojení",
+        "ERROR_REQUIRED_PROTOCOL_FILE"       : "V zadaném souboru nebyl nalezen žádný protokol připojení",
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "FIELD_HEADER_EXISTING_CONNECTION_MODE" : "Nahradit/aktualizovat stávající připojení",
+        "FIELD_HEADER_EXISTING_PERMISSION_MODE" : "Obnovit oprávnění",
+
+        "HELP_CSV_DESCRIPTION"              : "Soubor CSV pro import připojení má jeden záznam připojení na řádek. Každý sloupec bude specifikovat pole připojení. Minimálně musí být specifikován název připojení a protokol.",
+        "HELP_CSV_EXAMPLE"                  : "name,protocol,username,password,hostname,group,users,groups,guacd-encryption (attribute)\nprip1,vnc,alice,heslo1,prip1.web.com,ROOT,guac uživatel 1;guac uživatel 2,Uživatelé Připojení 1,none\nprip2,rdp,bob,heslo2,prip2.web.com,ROOT/Nadřazená skupina,guac uživatel 1,,ssl\nprip3,ssh,karolina,heslo3,prip3.web.com,ROOT/Nadřazená skupina/Podřízená skupina,guac uživatel 2;guac uživatel 3,,\nprip4,kubernetes,,,,,,,",
+        "HELP_CSV_MORE_DETAILS"             : "V záhlaví CSV každého řádku je uvedeno pole připojení. ID skupiny připojení, do které má být připojení importováno, lze přímo zadat pomocí parametru \"parentIdentifier\" nebo lze cestu k nadřazené skupině zadat pomocí parametru \"group\", jak je uvedeno níže. Ve většině případů by mezi poli neměl být žádný konflikt, ale v případě potřeby lze pro jednoznačnost přidat příponu \" (attribute)\" nebo \" (parameter)\". Seznamy identifikátorů uživatelů nebo skupin uživatelů musí být odděleny středníkem.¹",
+        "HELP_FILE_TYPE_DESCRIPTION"        : "Pro import připojení jsou podporovány tři typy souborů: CSV, JSON a YAML. Pro každý typ souboru mohou být zadána stejná data. Musí obsahovat název připojení a protokol. Volitelně lze také zadat umístění skupiny připojení, seznam uživatelů a/nebo skupiny uživatelů pro udělení přístupu, parametry připojení nebo protokoly připojení. Všichni uživatelé nebo skupiny uživatelů, kteří v aktuálním zdroji dat neexistují, budou automaticky vytvořeni. Upozorňujeme, že žádná existující oprávnění připojení nebudou odebrána pro aktualizovaná připojení, pokud není zaškrtnuto políčko \"Obnovit oprávnění\".",
+        "HELP_FILE_TYPE_HEADER"             : "Typy souborů",
+        "HELP_JSON_DESCRIPTION"             : "Soubor JSON pro import připojení je seznam objektů připojení. V každém objektu připojení musí být uvedeno minimálně jméno připojení a protokol.",
+        "HELP_JSON_EXAMPLE"                 : "[\n  \\{\n    \"name\": \"prip1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"username\": \"alice\", \"password\": \"heslo1\", \"hostname\": \"prip1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac uživatel 1\", \"guac uživatel 2\" ],\n    \"groups\": [ \"Uživatelé Připojení 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"prip2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"username\": \"bob\", \"password\": \"heslo2\", \"hostname\": \"prip2.web.com\" \\},\n    \"group\": \"ROOT/Nadřazená skupina\",\n    \"users\": [ \"guac uživatel 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"prip3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"username\": \"karolina\", \"password\": \"heslo3\", \"hostname\": \"prip3.web.com\" \\},\n    \"group\": \"ROOT/Nadřazená skupina/Podřízená skupina\",\n    \"users\": [ \"guac uživatel 2\", \"guac uživatel 3\" ]\n  \\},\n  \\{\n    \"name\": \"prip4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
+        "HELP_JSON_MORE_DETAILS"            : "ID skupiny připojení, do které má být připojení importováno, lze přímo zadat pomocí pole \"parentIdentifier\" nebo lze cestu k nadřazené skupině zadat pomocí pole \"group\", jak je uvedeno níže. Pro každé připojení lze zadat pole identifikátorů uživatelů a skupin uživatelů, kterým chcete udělit přístup.",
+        "HELP_EXISTING_CONNECTION_MODE"     : "Zcela nahradit/aktualizovat existující připojení, pokud jejich názvy a nadřazené skupiny připojení odpovídají hodnotám v poskytnutém souboru. Pokud není zaškrtnuto, pokus o import připojení se stejným názvem a nadřazenou skupinou připojení jako existující připojení bude považován za chybu.",
+        "HELP_EXISTING_PERMISSION_MODE"     : "Úplně resetujte oprávnění udělená pro všechna připojení v poskytnutém souboru za oprávnění určená v tomto souboru. Pokud nejsou zadána žádná oprávnění, všechna příslušná oprávnění k připojení budou odvolána. Pokud není zaškrtnuto, stávající oprávnění zůstanou zachována a všechna oprávnění uvedená v souboru budou přidána.",
+        "HELP_SEMICOLON_FOOTNOTE"           : "Pokud jsou přítomny středníky, mohou být escapovány zpětným lomítkem, např. \"první\\\\;poslední\"",
+        "HELP_UPLOAD_DROP_TITLE"            : "Sem přetáhněte soubor",
+        "HELP_UPLOAD_FILE_TYPES"            : "CSV, JSON, nebo YAML",
+        "HELP_YAML_DESCRIPTION"             : "Soubor YAML pro import připojení je seznam objektů připojení se zcela stejnou strukturou jako formát JSON.",
+        "HELP_YAML_EXAMPLE"                 : "---\n  - name: prip1\n    protocol: vnc\n    parameters:\n      username: alice\n      password: heslo1\n      hostname: prip1.web.com\n    group: ROOT\n    users:\n      - guac uživatel 1\n      - guac uživatel 2\n    groups:\n    - Uživatelé Připojení 1\n    attributes:\n      guacd-encryption: none\n  - name: prip2\n    protocol: rdp\n    parameters:\n      username: bob\n      password: heslo2\n      hostname: prip2.web.com\n    group: ROOT/Nadřazená skupina\n    users:\n      - guac uživatel 1\n    attributes:\n      guacd-encryption: none\n  - name: prip3\n    protocol: ssh\n    parameters:\n      username: karolina\n      password: heslo3\n      hostname: prip3.web.com\n    group: ROOT/Nadřazená skupina/Podřízená skupina\n    users:\n      - guac uživatel 2\n      - guac uživatel 3\n  - name: prip4\n    protocol: kubernetes",
+
+        "INFO_CONNECTIONS_IMPORTED_SUCCESS" : "{NUMBER} {NUMBER, plural, one{připojení} other{připojení}} úspěšně importováno.",
+        
+        "SECTION_HEADER_CONNECTION_IMPORT"           : "Import připojení",
+        "SECTION_HEADER_HELP_CONNECTION_IMPORT_FILE" : "Formát souboru importu připojení",
+        "SECTION_HEADER_CSV"                         : "Formát CSV",
+        "SECTION_HEADER_JSON"                        : "Formát JSON",
+        "SECTION_HEADER_YAML"                        : "Formát YAML",
+
+        "TABLE_HEADER_ERRORS"     : "Chyby",
+        "TABLE_HEADER_GROUP"      : "Skupina",
+        "TABLE_HEADER_NAME"       : "Jméno",
+        "TABLE_HEADER_PROTOCOL"   : "Protokol",
+        "TABLE_HEADER_ROW_NUMBER" : "Řádek #"
+    },
+
     "DATA_SOURCE_DEFAULT" : {
         "NAME" : "Výchozí (XML)"
     },
@@ -212,7 +290,7 @@
 
     "LIST" : {
 
-        "TEXT_ANONYMOUS_USER" : "Neznámý uživatel"
+        "TEXT_ANONYMOUS_USER" : "Anonymní uživatel"
 
     },
 
@@ -597,9 +675,10 @@
         "FIELD_OPTION_SERVER_LAYOUT_IT_IT_QWERTY" : "Italština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japonština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_NO_NO_QWERTY" : "Norština (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polské (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portugalská Brazilština (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugalská (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugalština (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY" : "Rumunština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Švédština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dánština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turečtina (Qwerty)",
@@ -904,6 +983,7 @@
     "SETTINGS_CONNECTIONS" : {
 
         "ACTION_ACKNOWLEDGE"          : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_IMPORT"               : "@:APP.ACTION_IMPORT",
         "ACTION_NEW_CONNECTION"       : "Nové připojení",
         "ACTION_NEW_CONNECTION_GROUP" : "Nový skupina",
         "ACTION_NEW_SHARING_PROFILE"  : "Nový sdílený profil",

From a1c6ca745a1d2b4d25b3da8a68668f5f382c71f5 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 24 May 2023 22:13:42 +0000
Subject: [PATCH 207/289] GUACAMOLE-1795: Support new private key field name
 for KSM Pam User.

---
 .../vault/ksm/secret/KsmRecordService.java    | 34 ++++++++++++++-----
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java
index da53487a8..8e363f3b9 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java
@@ -87,9 +87,16 @@ public class KsmRecordService {
      * Regular expression which matches the labels of custom fields containing
      * private keys.
      */
-    private static final Pattern PRIVATE_KEY_LABEL_PATTERN =
+    private static final Pattern PRIVATE_KEY_CUSTOM_LABEL_PATTERN =
             Pattern.compile("private\\s*key", Pattern.CASE_INSENSITIVE);
 
+    /**
+     * Regular expression which matches the labels of standard fields containing
+     * private keys.
+     */
+    private static final Pattern PRIVATE_KEY_STANDARD_LABEL_PATTERN =
+            Pattern.compile("private\\s*pem\\s*key", Pattern.CASE_INSENSITIVE);
+
     /**
      * Regular expression which matches the filenames of private keys attached
      * to Keeper records.
@@ -523,9 +530,11 @@ public class KsmRecordService {
      * has no associated private key, or multiple private keys, null is
      * returned. Private keys are retrieved from "KeyPairs" fields.
      * Alternatively, private keys are retrieved from PEM-type attachments or
-     * custom fields with the label "private key" (case-insensitive, space
-     * optional) if they are "KeyPairs", "Password", or "Hidden" fields. If
-     * file downloads are required, they will be performed asynchronously.
+     * standard "Hidden" fields with the label "private pem key", or custom
+     * fields with the label "private key" if they are "KeyPairs", "Password",
+     * or "Hidden" fields. All label matching is case-insensitive, with spaces
+     * between words being optional. If file downloads are required, they will
+     * be performed asynchronously.
      *
      * @param record
      *     The record to retrieve the private key from.
@@ -538,7 +547,8 @@ public class KsmRecordService {
     public Future<String> getPrivateKey(KeeperRecord record) {
 
         // Attempt to find single matching keypair field
-        KeyPairs keyPairsField = getField(record, KeyPairs.class, PRIVATE_KEY_LABEL_PATTERN);
+        KeyPairs keyPairsField = getField(
+                record, KeyPairs.class, PRIVATE_KEY_CUSTOM_LABEL_PATTERN);
         if (keyPairsField != null) {
             String privateKey = getSingleStringValue(keyPairsField.getValue(), KeyPair::getPrivateKey);
             if (privateKey != null && !privateKey.isEmpty())
@@ -553,13 +563,21 @@ public class KsmRecordService {
         KeeperRecordData data = record.getData();
         List<KeeperRecordField> custom = data.getCustom();
 
-        // Use password "private key" custom field as fallback ...
-        Password passwordField = getField(custom, Password.class, PRIVATE_KEY_LABEL_PATTERN);
+        // Use a hidden "private pem key" standard field as fallback ...
+        HiddenField hiddenField = getField(
+                data.getFields(), HiddenField.class, PRIVATE_KEY_STANDARD_LABEL_PATTERN);
+        if (hiddenField != null)
+            return CompletableFuture.completedFuture(getSingleStringValue(hiddenField.getValue()));
+
+        // ... or password "private key" custom field ...
+        Password passwordField = getField(
+                custom, Password.class, PRIVATE_KEY_CUSTOM_LABEL_PATTERN);
         if (passwordField != null)
             return CompletableFuture.completedFuture(getSingleStringValue(passwordField.getValue()));
 
         // ... or hidden "private key" custom field
-        HiddenField hiddenField = getField(custom, HiddenField.class, PRIVATE_KEY_LABEL_PATTERN);
+        hiddenField = getField(
+                custom, HiddenField.class, PRIVATE_KEY_CUSTOM_LABEL_PATTERN);
         if (hiddenField != null)
             return CompletableFuture.completedFuture(getSingleStringValue(hiddenField.getValue()));
 

From fac646b8e08fd3158e5c7181c474c5e0ab86b5ca Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 12 Jun 2023 18:26:10 +0000
Subject: [PATCH 208/289] GUACAMOLE-1810: Fix meta handling on Mac firefox.

---
 .../src/main/webapp/modules/Keyboard.js       | 43 ++++++++++++-------
 1 file changed, 27 insertions(+), 16 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/Keyboard.js b/guacamole-common-js/src/main/webapp/modules/Keyboard.js
index 748cab3cc..0d7155a3c 100644
--- a/guacamole-common-js/src/main/webapp/modules/Keyboard.js
+++ b/guacamole-common-js/src/main/webapp/modules/Keyboard.js
@@ -1314,9 +1314,10 @@ Guacamole.Keyboard = function Keyboard(element) {
 
             var keydownEvent = new KeydownEvent(e);
 
-            // Ignore (but do not prevent) the "composition" keycode sent by some
-            // browsers when an IME is in use (see: http://lists.w3.org/Archives/Public/www-dom/2010JulSep/att-0182/keyCode-spec.html)
-            if (keydownEvent.keyCode === 229)
+            // Ignore (but do not prevent) the event if explicitly marked as composing,
+            // or when the "composition" keycode sent by some browsers when an IME is in use
+            // (see: http://lists.w3.org/Archives/Public/www-dom/2010JulSep/att-0182/keyCode-spec.html)
+            if (e.isComposing || keydownEvent.keyCode === 229)
                 return;
 
             // Log event
@@ -1365,8 +1366,6 @@ Guacamole.Keyboard = function Keyboard(element) {
 
         /**
          * Handles the given "input" event, typing the data within the input text.
-         * If the event is complete (text is provided), handling of "compositionend"
-         * events is suspended, as such events may conflict with input events.
          *
          * @private
          * @param {!InputEvent} e
@@ -1381,24 +1380,37 @@ Guacamole.Keyboard = function Keyboard(element) {
             if (!markEvent(e)) return;
 
             // Type all content written
-            if (e.data && !e.isComposing) {
-                element.removeEventListener("compositionend", handleComposition, false);
+            if (e.data && !e.isComposing)
                 guac_keyboard.type(e.data);
-            }
+
+        };
+
+        /**
+         * Handles the given "compositionstart" event, automatically removing
+         * the "input" event handler, as "input" events should only be handled
+         * if composition events are not provided by the browser.
+         *
+         * @private
+         * @param {!CompositionEvent} e
+         *     The "compositionstart" event to handle.
+         */
+        var handleCompositionStart = function handleCompositionStart(e) {
+
+            // Remove the "input" event handler now that the browser is known
+            // to send composition events
+            element.removeEventListener("input", handleInput, false);
 
         };
 
         /**
          * Handles the given "compositionend" event, typing the data within the
-         * composed text. If the event is complete (composed text is provided),
-         * handling of "input" events is suspended, as such events may conflict
-         * with composition events.
+         * composed text.
          *
          * @private
          * @param {!CompositionEvent} e
          *     The "compositionend" event to handle.
          */
-        var handleComposition = function handleComposition(e) {
+        var handleCompositionEnd = function handleCompositionEnd(e) {
 
             // Only intercept if handler set
             if (!guac_keyboard.onkeydown && !guac_keyboard.onkeyup) return;
@@ -1407,16 +1419,15 @@ Guacamole.Keyboard = function Keyboard(element) {
             if (!markEvent(e)) return;
 
             // Type all content written
-            if (e.data) {
-                element.removeEventListener("input", handleInput, false);
+            if (e.data)
                 guac_keyboard.type(e.data);
-            }
 
         };
 
         // Automatically type text entered into the wrapped field
         element.addEventListener("input", handleInput, false);
-        element.addEventListener("compositionend", handleComposition, false);
+        element.addEventListener("compositionend", handleCompositionEnd, false);
+        element.addEventListener("compositionstart", handleCompositionStart, false);
 
     };
 

From 9e938be878bd9145f452d865798c1b99ed77f36f Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 14 Jun 2023 21:27:49 +0000
Subject: [PATCH 209/289] GUACAMOLE-1113: Restore right alt in keyboard
 handler.

---
 guacamole-common-js/src/main/webapp/modules/Keyboard.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/Keyboard.js b/guacamole-common-js/src/main/webapp/modules/Keyboard.js
index 0d7155a3c..a5792a005 100644
--- a/guacamole-common-js/src/main/webapp/modules/Keyboard.js
+++ b/guacamole-common-js/src/main/webapp/modules/Keyboard.js
@@ -395,7 +395,7 @@ Guacamole.Keyboard = function Keyboard(element) {
         13:  [0xFF0D], // enter
         16:  [0xFFE1, 0xFFE1, 0xFFE2], // shift
         17:  [0xFFE3, 0xFFE3, 0xFFE4], // ctrl
-        18:  [0xFFE9, 0xFFE9, 0xFE03], // alt
+        18:  [0xFFE9, 0xFFE9, 0xFFEA], // alt
         19:  [0xFF13], // pause/break
         20:  [0xFFE5], // caps lock
         27:  [0xFF1B], // escape
@@ -456,7 +456,7 @@ Guacamole.Keyboard = function Keyboard(element) {
         "Again": [0xFF66],
         "AllCandidates": [0xFF3D],
         "Alphanumeric": [0xFF30],
-        "Alt": [0xFFE9, 0xFFE9, 0xFE03],
+        "Alt": [0xFFE9, 0xFFE9, 0xFFEA],
         "Attn": [0xFD0E],
         "AltGraph": [0xFE03],
         "ArrowDown": [0xFF54],

From 1f8183357cb1e628a368184c910ba4116275d6bb Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 14 Jun 2023 23:19:44 +0000
Subject: [PATCH 210/289] GUACAMOLE-1113: Always treat alt as AltGr on Mac.

---
 guacamole-common-js/src/main/webapp/modules/Keyboard.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/guacamole-common-js/src/main/webapp/modules/Keyboard.js b/guacamole-common-js/src/main/webapp/modules/Keyboard.js
index a5792a005..62d709cb9 100644
--- a/guacamole-common-js/src/main/webapp/modules/Keyboard.js
+++ b/guacamole-common-js/src/main/webapp/modules/Keyboard.js
@@ -295,6 +295,10 @@ Guacamole.Keyboard = function Keyboard(element) {
         // Determine whether default action for Alt+combinations must be prevented
         var prevent_alt = !this.modifiers.ctrl && !quirks.altIsTypableOnly;
 
+        // If alt is typeable only, and this is actually an alt key event, treat as AltGr instead
+        if (quirks.altIsTypableOnly && (this.keysym === 0xFFE9 || this.keysym === 0xFFEA))
+            this.keysym = 0xFE03;
+
         // Determine whether default action for Ctrl+combinations must be prevented
         var prevent_ctrl = !this.modifiers.alt;
 

From b8de8ebb902d7601f0a991414d884ee0025e090f Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 2 Jun 2023 23:12:05 +0000
Subject: [PATCH 211/289] GUACAMOLE-1803: Update session recording playback at
 least once per second and allow arbitrary seeking.

---
 .../main/webapp/modules/SessionRecording.js   | 185 ++++++++++++++----
 .../src/app/player/directives/player.js       |  11 +-
 2 files changed, 156 insertions(+), 40 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
index ce8968f2b..37270a5fb 100644
--- a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
+++ b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
@@ -32,8 +32,13 @@ var Guacamole = Guacamole || {};
  * @param {!Blob|Guacamole.Tunnel} source
  *     The Blob from which the instructions of the recording should
  *     be read.
+ * @param {number} [refreshInterval=1000]
+ *     The minimum number of milliseconds between updates to the recording
+ *     position through the provided onseek() callback. If non-positive, this
+ *     parameter will be ignored, and the recording position will only be
+ *     updated when seek requests are made, or when new frames are rendered.
  */
-Guacamole.SessionRecording = function SessionRecording(source) {
+Guacamole.SessionRecording = function SessionRecording(source, refreshInterval) {
 
     /**
      * Reference to this Guacamole.SessionRecording.
@@ -139,22 +144,20 @@ Guacamole.SessionRecording = function SessionRecording(source) {
     var currentFrame = -1;
 
     /**
-     * The timestamp of the frame when playback began, in milliseconds. If
-     * playback is not in progress, this will be null.
+     * True if the player is currently playing, or false otherwise.
      *
      * @private
-     * @type {number}
+     * @type {boolean}
      */
-    var startVideoTimestamp = null;
+    var currentlyPlaying = null;
 
     /**
-     * The real-world timestamp when playback began, in milliseconds. If
-     * playback is not in progress, this will be null.
+     * The current position within the recording, in milliseconds.
      *
      * @private
-     * @type {number}
+     * @type {!number}
      */
-    var startRealTimestamp = null;
+    var currentPosition = 0;
 
     /**
      * An object containing a single "aborted" property which is set to
@@ -211,6 +214,25 @@ Guacamole.SessionRecording = function SessionRecording(source) {
      */
     var seekCallback = null;
 
+    /**
+     * Any current timeout associated with scheduling frame replay, or updating
+     * the current position, or null if no frame position increment is currently
+     * scheduled.
+     *
+     * @private
+     * @type {number}
+     */
+    var updateTimeout = null;
+
+    /**
+     * The browser timestamp of the last time that currentPosition was updated
+     * while playing, or null if the recording is not currently playing.
+     *
+     * @private
+     * @type {number}
+     */
+    var lastUpdateTimestamp = null;
+
     /**
      * Parses all Guacamole instructions within the given blob, invoking
      * the provided instruction callback for each such instruction. Once
@@ -482,8 +504,9 @@ Guacamole.SessionRecording = function SessionRecording(source) {
     };
 
     /**
-     * Searches through the given region of frames for the frame having a
-     * relative timestamp closest to the timestamp given.
+     * Searches through the given region of frames for the closest frame
+     * having a relative timestamp less than or equal to the to the given
+     * relative timestamp.
      *
      * @private
      * @param {!number} minIndex
@@ -504,9 +527,22 @@ Guacamole.SessionRecording = function SessionRecording(source) {
      */
     var findFrame = function findFrame(minIndex, maxIndex, timestamp) {
 
-        // Do not search if the region contains only one element
-        if (minIndex === maxIndex)
-            return minIndex;
+        // The region has only one frame - determine if it is before or after
+        // the requested timestamp
+        if (minIndex === maxIndex) {
+
+            // Skip checking if this is the very first frame - no frame could
+            // possibly be earlier
+            if (minIndex === 0)
+                return minIndex;
+
+            // If the closest frame occured after the requested timestamp,
+            // return the previous frame, which will be the closest with a
+            // timestamp before the requested timestamp
+            if (toRelativeTimestamp(frames[minIndex].timestamp) > timestamp)
+                return minIndex - 1;
+
+        }
 
         // Split search region into two halves
         var midIndex = Math.floor((minIndex + maxIndex) / 2);
@@ -599,10 +635,11 @@ Guacamole.SessionRecording = function SessionRecording(source) {
         // Replay any applicable incremental frames
         var continueReplay = function continueReplay() {
 
-            // Notify of changes in position
+            // Set the current position and notify changes
             if (recording.onseek && currentFrame > startIndex) {
-                recording.onseek(toRelativeTimestamp(frames[currentFrame].timestamp),
-                    currentFrame - startIndex, index - startIndex);
+                currentPosition = toRelativeTimestamp(frames[currentFrame].timestamp);
+                recording.onseek(currentPosition, currentFrame - startIndex,
+                        index - startIndex);
             }
 
             // Cancel seek if aborted
@@ -623,8 +660,18 @@ Guacamole.SessionRecording = function SessionRecording(source) {
         // immediately if no delay was requested
         var continueAfterRequiredDelay = function continueAfterRequiredDelay() {
             var delay = nextRealTimestamp ? Math.max(nextRealTimestamp - new Date().getTime(), 0) : 0;
-            if (delay)
-                window.setTimeout(continueReplay, delay);
+            if (delay) {
+
+                // Clear any already-scheduled update before scheduling again
+                // to avoid multiple updates in flight at the same time
+                updateTimeout && clearTimeout(updateTimeout);
+
+                // Schedule with the appropriate delay
+                updateTimeout = window.setTimeout(function timeoutComplete() {
+                    updateTimeout = null;
+                    continueReplay();
+                }, delay);
+            }
             else
                 continueReplay();
         };
@@ -653,7 +700,7 @@ Guacamole.SessionRecording = function SessionRecording(source) {
         }
 
         continueAfterRequiredDelay();
-        
+
     };
 
     /**
@@ -678,20 +725,62 @@ Guacamole.SessionRecording = function SessionRecording(source) {
      */
     var continuePlayback = function continuePlayback() {
 
+        // Do not continue playback if the recording is paused
+        if (!recording.isPlaying())
+            return;
+
         // If frames remain after advancing, schedule next frame
         if (currentFrame + 1 < frames.length) {
 
             // Pull the upcoming frame
             var next = frames[currentFrame + 1];
 
-            // Calculate the real timestamp corresponding to when the next
-            // frame begins
-            var nextRealTimestamp = next.timestamp - startVideoTimestamp + startRealTimestamp;
+            // The position at which the next frame should be rendered
+            var nextFramePosition = toRelativeTimestamp(next.timestamp);
 
-            // Advance to next frame after enough time has elapsed
-            seekToFrame(currentFrame + 1, function frameDelayElapsed() {
-                continuePlayback();
-            }, nextRealTimestamp);
+            // The position at which the refresh interval would induce an
+            // update to the current recording position, rounded to the nearest
+            // whole multiple of refreshInterval to ensure consistent timing
+            // for refresh intervals even with inconsistent frame timing
+            var nextRefreshPosition = refreshInterval > 0 ? refreshInterval * (
+                Math.floor((currentPosition + refreshInterval) / refreshInterval)
+            ) : nextFramePosition;
+
+            // If the next frame will occur before the next refresh interval,
+            // advance to the frame after the appropriate delay
+            if (nextFramePosition <= nextRefreshPosition)
+
+                seekToFrame(currentFrame + 1, function frameDelayElapsed() {
+
+                    // Record when the timestamp was updated and continue on
+                    lastUpdateTimestamp = Date.now();
+                    continuePlayback();
+
+                }, Date.now() + (nextFramePosition - currentPosition));
+
+            // The position needs to be incremented before the next frame
+            else {
+
+                // Clear any existing update timeout
+                updateTimeout && window.clearTimeout(updateTimeout);
+
+                updateTimeout = window.setTimeout(function incrementPosition() {
+
+                    updateTimeout = null;
+
+                    // Update the position
+                    currentPosition = nextRefreshPosition;
+
+                    // Notifiy the new position using the onseek handler
+                    if (recording.onseek)
+                        recording.onseek(currentPosition);
+
+                    // Record when the timestamp was updated and continue on
+                    lastUpdateTimestamp = Date.now();
+                    continuePlayback();
+
+                }, nextRefreshPosition - currentPosition);
+            }
 
         }
 
@@ -839,7 +928,7 @@ Guacamole.SessionRecording = function SessionRecording(source) {
      *     true if playback is currently in progress, false otherwise.
      */
     this.isPlaying = function isPlaying() {
-        return !!startVideoTimestamp;
+        return !!currentlyPlaying;
     };
 
     /**
@@ -899,13 +988,9 @@ Guacamole.SessionRecording = function SessionRecording(source) {
             if (recording.onplay)
                 recording.onplay();
 
-            // Store timestamp of playback start for relative scheduling of
-            // future frames
-            var next = frames[currentFrame + 1];
-            startVideoTimestamp = next.timestamp;
-            startRealTimestamp = new Date().getTime();
-
             // Begin playback of video
+            currentlyPlaying = true;
+            lastUpdateTimestamp = Date.now();
             continuePlayback();
 
         }
@@ -957,8 +1042,23 @@ Guacamole.SessionRecording = function SessionRecording(source) {
 
         };
 
-        // Perform seek
-        seekToFrame(findFrame(0, frames.length - 1, position), seekCallback);
+        // Find the index of the closest frame at or before the requested position
+        var closestFrame = findFrame(0, frames.length - 1, position);
+
+        // Seek to the closest frame before or at the requested position
+        seekToFrame(closestFrame, function seekComplete() {
+
+            // Update the current position to the requested position
+            // and invoke the the onseek callback. Note that this is the
+            // position provided to this function, NOT the position of the
+            // frame that was just seeked
+            currentPosition = position;
+            if (recording.onseek)
+                recording.onseek(position);
+
+            seekCallback();
+
+        });
 
     };
 
@@ -988,6 +1088,14 @@ Guacamole.SessionRecording = function SessionRecording(source) {
         // Abort any in-progress seek / playback
         abortSeek();
 
+        // Cancel any currently-scheduled updates
+        updateTimeout && clearTimeout(updateTimeout);
+
+        // Increment the current position by the amount of time passed since the
+        // the last time it was updated
+        currentPosition += Date.now() - lastUpdateTimestamp;
+        lastUpdateTimestamp = null;
+
         // Stop playback only if playback is in progress
         if (recording.isPlaying()) {
 
@@ -996,8 +1104,7 @@ Guacamole.SessionRecording = function SessionRecording(source) {
                 recording.onpause();
 
             // Playback is stopped
-            startVideoTimestamp = null;
-            startRealTimestamp = null;
+            currentlyPlaying = false;
 
         }
 
@@ -1124,4 +1231,4 @@ Guacamole.SessionRecording._PlaybackTunnel = function _PlaybackTunnel() {
             tunnel.oninstruction(opcode, args);
     };
 
-};
\ No newline at end of file
+};
diff --git a/guacamole/src/main/frontend/src/app/player/directives/player.js b/guacamole/src/main/frontend/src/app/player/directives/player.js
index 7b3e08792..f2a008fee 100644
--- a/guacamole/src/main/frontend/src/app/player/directives/player.js
+++ b/guacamole/src/main/frontend/src/app/player/directives/player.js
@@ -96,6 +96,14 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
     config.controller = ['$scope', '$element', '$injector',
         function guacPlayerController($scope) {
 
+        /**
+         * The minimum number of milliseconds that should occur between updates
+         * to the progress indicator.
+         *
+         * @type {number}
+         */
+        const PROGRESS_REFRESH_INTERVAL = 1000;
+
         /**
          * Guacamole.SessionRecording instance to be used to playback the
          * session recording given via $scope.src. If the recording has not
@@ -303,7 +311,8 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
             // Otherwise, begin loading the provided recording
             else {
 
-                $scope.recording = new Guacamole.SessionRecording(src);
+                $scope.recording = new Guacamole.SessionRecording(
+                        src, PROGRESS_REFRESH_INTERVAL);
 
                 // Begin downloading the recording
                 $scope.recording.connect();

From 55eabaee558fde0e5acd739f3faeb67fd0df717c Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 13 Jun 2023 18:00:05 +0000
Subject: [PATCH 212/289] GUACAMOLE-1803: Fix potential sulf-suppression error.

---
 .../connection/HistoryConnectionRecord.java   | 22 ++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/extensions/guacamole-history-recording-storage/src/main/java/org/apache/guacamole/history/connection/HistoryConnectionRecord.java b/extensions/guacamole-history-recording-storage/src/main/java/org/apache/guacamole/history/connection/HistoryConnectionRecord.java
index fbc7bdf08..f1c53ff87 100644
--- a/extensions/guacamole-history-recording-storage/src/main/java/org/apache/guacamole/history/connection/HistoryConnectionRecord.java
+++ b/extensions/guacamole-history-recording-storage/src/main/java/org/apache/guacamole/history/connection/HistoryConnectionRecord.java
@@ -131,7 +131,9 @@ public class HistoryConnectionRecord extends DelegatingConnectionRecord {
      */
     private boolean isSessionRecording(File file) {
 
-        try (Reader reader = new InputStreamReader(new FileInputStream(file), StandardCharsets.UTF_8)) {
+        Reader reader = null;
+        try {
+            reader = new InputStreamReader(new FileInputStream(file), StandardCharsets.UTF_8);
 
             GuacamoleReader guacReader = new ReaderGuacamoleReader(reader);
             if (guacReader.readInstruction() != null)
@@ -148,6 +150,24 @@ public class HistoryConnectionRecord extends DelegatingConnectionRecord {
                     + "identified as it cannot be read: {}", file, e.getMessage());
             logger.debug("Possible session recording \"{}\" could not be read.", file, e);
         }
+        finally {
+
+            // If the reader was successfully constructed, close it
+            if (reader != null) {
+
+                try {
+                    reader.close();
+                }
+
+                catch (IOException e) {
+                    logger.warn("Unexpected error closing recording file \"{}\": {}",
+                            file, e.getMessage());
+                    logger.debug("Session recording file \"{}\" could not be closed.",
+                            file, e);
+                }
+
+            }
+        }
 
         return false;
 

From e4d6fe10124ca6e4a9cebb86992b78bcbccdbf31 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 13 Jun 2023 19:58:10 +0000
Subject: [PATCH 213/289] GUACAMOLE-1803: Default to 1000 millisecond refresh
 interval.

---
 .../src/main/webapp/modules/SessionRecording.js       |  5 +++++
 .../main/frontend/src/app/player/directives/player.js | 11 +----------
 2 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
index 37270a5fb..02a083bba 100644
--- a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
+++ b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
@@ -37,9 +37,14 @@ var Guacamole = Guacamole || {};
  *     position through the provided onseek() callback. If non-positive, this
  *     parameter will be ignored, and the recording position will only be
  *     updated when seek requests are made, or when new frames are rendered.
+ *     If not specified, refreshInterval will default to 1000 milliseconds.
  */
 Guacamole.SessionRecording = function SessionRecording(source, refreshInterval) {
 
+    // Default the refresh interval to 1 second if not specified otherwise
+    if (refreshInterval === undefined)
+        refreshInterval = 1000;
+
     /**
      * Reference to this Guacamole.SessionRecording.
      *
diff --git a/guacamole/src/main/frontend/src/app/player/directives/player.js b/guacamole/src/main/frontend/src/app/player/directives/player.js
index f2a008fee..7b3e08792 100644
--- a/guacamole/src/main/frontend/src/app/player/directives/player.js
+++ b/guacamole/src/main/frontend/src/app/player/directives/player.js
@@ -96,14 +96,6 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
     config.controller = ['$scope', '$element', '$injector',
         function guacPlayerController($scope) {
 
-        /**
-         * The minimum number of milliseconds that should occur between updates
-         * to the progress indicator.
-         *
-         * @type {number}
-         */
-        const PROGRESS_REFRESH_INTERVAL = 1000;
-
         /**
          * Guacamole.SessionRecording instance to be used to playback the
          * session recording given via $scope.src. If the recording has not
@@ -311,8 +303,7 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
             // Otherwise, begin loading the provided recording
             else {
 
-                $scope.recording = new Guacamole.SessionRecording(
-                        src, PROGRESS_REFRESH_INTERVAL);
+                $scope.recording = new Guacamole.SessionRecording(src);
 
                 // Begin downloading the recording
                 $scope.recording.connect();

From 7176ccce682202fcc0f804d52e9fba5efeee5a83 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 15 Jun 2023 17:51:54 +0000
Subject: [PATCH 214/289] GUACAMOLE-1803: Restore logic to account for frame
 rendering delays.

---
 .../main/webapp/modules/SessionRecording.js   | 35 ++++++++++++++-----
 1 file changed, 26 insertions(+), 9 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
index 02a083bba..17b4ea7cb 100644
--- a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
+++ b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
@@ -149,12 +149,22 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
     var currentFrame = -1;
 
     /**
-     * True if the player is currently playing, or false otherwise.
+     * The timestamp of the frame when playback began, in milliseconds. If
+     * playback is not in progress, this will be null.
      *
      * @private
-     * @type {boolean}
+     * @type {number}
      */
-    var currentlyPlaying = null;
+    var startVideoTimestamp = null;
+
+    /**
+     * The real-world timestamp when playback began, in milliseconds. If
+     * playback is not in progress, this will be null.
+     *
+     * @private
+     * @type {number}
+     */
+    var startRealTimestamp = null;
 
     /**
      * The current position within the recording, in milliseconds.
@@ -740,8 +750,9 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
             // Pull the upcoming frame
             var next = frames[currentFrame + 1];
 
-            // The position at which the next frame should be rendered
-            var nextFramePosition = toRelativeTimestamp(next.timestamp);
+            // The position at which the next frame should be rendered, taking
+            // into account any accumulated delays from rendering frames so far
+            var nextFramePosition = next.timestamp - startVideoTimestamp + startRealTimestamp;
 
             // The position at which the refresh interval would induce an
             // update to the current recording position, rounded to the nearest
@@ -933,7 +944,7 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
      *     true if playback is currently in progress, false otherwise.
      */
     this.isPlaying = function isPlaying() {
-        return !!currentlyPlaying;
+        return !!startVideoTimestamp;
     };
 
     /**
@@ -993,8 +1004,13 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
             if (recording.onplay)
                 recording.onplay();
 
+            // Store timestamp of playback start for relative scheduling of
+            // future frames
+            var next = frames[currentFrame + 1];
+            startVideoTimestamp = next.timestamp;
+            startRealTimestamp = Date.now();
+
             // Begin playback of video
-            currentlyPlaying = true;
             lastUpdateTimestamp = Date.now();
             continuePlayback();
 
@@ -1099,7 +1115,6 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
         // Increment the current position by the amount of time passed since the
         // the last time it was updated
         currentPosition += Date.now() - lastUpdateTimestamp;
-        lastUpdateTimestamp = null;
 
         // Stop playback only if playback is in progress
         if (recording.isPlaying()) {
@@ -1109,7 +1124,9 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
                 recording.onpause();
 
             // Playback is stopped
-            currentlyPlaying = false;
+            lastUpdateTimestamp = null;
+            startVideoTimestamp = null;
+            startRealTimestamp = null;
 
         }
 

From 8497878cb2458069f65b3f1fcabe2b193c58f8e0 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 20 Jun 2023 19:11:16 +0000
Subject: [PATCH 215/289] GUACAMOLE-1803: Fix frame scheduling logic in
 recording playback.

---
 .../main/webapp/modules/SessionRecording.js   | 57 ++++++++++---------
 1 file changed, 30 insertions(+), 27 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
index 17b4ea7cb..3a0dae131 100644
--- a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
+++ b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
@@ -149,13 +149,13 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
     var currentFrame = -1;
 
     /**
-     * The timestamp of the frame when playback began, in milliseconds. If
+     * The position of the recording when playback began, in milliseconds. If
      * playback is not in progress, this will be null.
      *
      * @private
      * @type {number}
      */
-    var startVideoTimestamp = null;
+    var startVideoPosition = null;
 
     /**
      * The real-world timestamp when playback began, in milliseconds. If
@@ -750,21 +750,31 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
             // Pull the upcoming frame
             var next = frames[currentFrame + 1];
 
-            // The position at which the next frame should be rendered, taking
-            // into account any accumulated delays from rendering frames so far
-            var nextFramePosition = next.timestamp - startVideoTimestamp + startRealTimestamp;
+            // The number of elapsed milliseconds on the clock since playback began
+            var realLifePlayTime = Date.now() - startRealTimestamp;
 
-            // The position at which the refresh interval would induce an
-            // update to the current recording position, rounded to the nearest
-            // whole multiple of refreshInterval to ensure consistent timing
-            // for refresh intervals even with inconsistent frame timing
-            var nextRefreshPosition = refreshInterval > 0 ? refreshInterval * (
-                Math.floor((currentPosition + refreshInterval) / refreshInterval)
-            ) : nextFramePosition;
+            // The number of milliseconds between the recording position when
+            // playback started and the position of the next frame
+            var timestampOffset = (
+                    toRelativeTimestamp(next.timestamp) - startVideoPosition);
+
+            // The delay until the next frame should be rendered, taking into
+            // account any accumulated delays from rendering frames so far
+            var nextFrameDelay = timestampOffset - realLifePlayTime;
+
+            // The delay until the refresh interval would induce an update to
+            // the current recording position, rounded to the nearest whole
+            // multiple of refreshInterval to ensure consistent timing for
+            // refresh intervals even with inconsistent frame timing
+            var nextRefreshDelay = refreshInterval >= 0
+                    ? (refreshInterval * (Math.floor(
+                        (currentPosition + refreshInterval) / refreshInterval))
+                    ) - currentPosition
+                    : nextFrameDelay;
 
             // If the next frame will occur before the next refresh interval,
             // advance to the frame after the appropriate delay
-            if (nextFramePosition <= nextRefreshPosition)
+            if (nextFrameDelay <= nextRefreshDelay)
 
                 seekToFrame(currentFrame + 1, function frameDelayElapsed() {
 
@@ -772,7 +782,7 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
                     lastUpdateTimestamp = Date.now();
                     continuePlayback();
 
-                }, Date.now() + (nextFramePosition - currentPosition));
+                }, Date.now() + nextFrameDelay);
 
             // The position needs to be incremented before the next frame
             else {
@@ -785,7 +795,7 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
                     updateTimeout = null;
 
                     // Update the position
-                    currentPosition = nextRefreshPosition;
+                    currentPosition += nextRefreshDelay;
 
                     // Notifiy the new position using the onseek handler
                     if (recording.onseek)
@@ -795,7 +805,7 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
                     lastUpdateTimestamp = Date.now();
                     continuePlayback();
 
-                }, nextRefreshPosition - currentPosition);
+                }, nextRefreshDelay);
             }
 
         }
@@ -944,7 +954,7 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
      *     true if playback is currently in progress, false otherwise.
      */
     this.isPlaying = function isPlaying() {
-        return !!startVideoTimestamp;
+        return !!startRealTimestamp;
     };
 
     /**
@@ -956,13 +966,7 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
      */
     this.getPosition = function getPosition() {
 
-        // Position is simply zero if playback has not started at all
-        if (currentFrame === -1)
-            return 0;
-
-        // Return current position as a millisecond timestamp relative to the
-        // start of the recording
-        return toRelativeTimestamp(frames[currentFrame].timestamp);
+        return currentPosition;
 
     };
 
@@ -1006,8 +1010,7 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
 
             // Store timestamp of playback start for relative scheduling of
             // future frames
-            var next = frames[currentFrame + 1];
-            startVideoTimestamp = next.timestamp;
+            startVideoPosition = currentPosition;
             startRealTimestamp = Date.now();
 
             // Begin playback of video
@@ -1125,7 +1128,7 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
 
             // Playback is stopped
             lastUpdateTimestamp = null;
-            startVideoTimestamp = null;
+            startVideoPosition = null;
             startRealTimestamp = null;
 
         }

From 0de694c9123c7552f17c04572998fede0a5e55fc Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 5 Apr 2023 17:13:55 +0000
Subject: [PATCH 216/289] GUACAMOLE-1780: Allow SAML, SSL sessions to be
 resumed after another auth provider vetoes the auth attempt.

---
 .../sso/AuthenticationSessionManager.java     | 71 +++++++++++++++++-
 .../saml/AuthenticationEventListener.java     | 70 ++++++++++++++++++
 .../saml/AuthenticationProviderService.java   | 24 +++++-
 .../SAMLAuthenticationProviderModule.java     |  2 +
 .../src/main/resources/guac-manifest.json     |  4 +
 .../auth/ssl/AuthenticationEventListener.java | 74 +++++++++++++++++++
 .../ssl/AuthenticationProviderService.java    | 38 +++++++---
 .../ssl/SSLAuthenticationProviderModule.java  |  2 +
 .../src/main/resources/guac-manifest.json     |  4 +
 .../src/app/login/directives/login.js         | 20 ++++-
 10 files changed, 293 insertions(+), 16 deletions(-)
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationEventListener.java
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationEventListener.java

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
index 3261228b8..6e13144c2 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
@@ -21,6 +21,7 @@ package org.apache.guacamole.auth.sso;
 
 import com.google.common.base.Predicates;
 import com.google.inject.Inject;
+import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.Executors;
@@ -51,6 +52,16 @@ public class AuthenticationSessionManager<T extends AuthenticationSession> {
      */
     private final ConcurrentMap<String, T> sessions = new ConcurrentHashMap<>();
 
+    /**
+     * Set of identifiers of all sessions that are in a pending state, meaning
+     * that the session was successfully created, but the overall auth result
+     * has not yet been determined.
+     *
+     * Exposed as a ConcurrentMap instead of a Set because there is no
+     * ConcurrentSet class offering the required atomic operations.
+     */
+    private final ConcurrentMap<String, Boolean> pendingSessions = new ConcurrentHashMap<>();
+
     /**
      * Executor service which runs the periodic cleanup task
      */
@@ -64,7 +75,13 @@ public class AuthenticationSessionManager<T extends AuthenticationSession> {
      */
     public AuthenticationSessionManager() {
         executor.scheduleAtFixedRate(() -> {
-            sessions.values().removeIf(Predicates.not(AuthenticationSession::isValid));
+
+            // Invalidate any stale sessions
+            for (Map.Entry<String, T> entry : sessions.entrySet()) {
+                if (!entry.getValue().isValid()) 
+                    invalidateSession(entry.getKey());
+            }
+
         }, 1, 1, TimeUnit.MINUTES);
     }
 
@@ -82,6 +99,43 @@ public class AuthenticationSessionManager<T extends AuthenticationSession> {
         return idGenerator.generateIdentifier();
     }
 
+    /**
+     * Remove the session associated with the given identifier, if any, from the
+     * map of sessions, and the set of pending sessions.
+     *
+     * @param identifier
+     *     The identifier of the session to remove, if one exists.
+     */
+    public void invalidateSession(String identifier) {
+
+        // Do not attempt to remove a null identifier
+        if (identifier == null)
+            return;
+
+        // Remove from the overall list of sessions
+        sessions.remove(identifier);
+
+        // Remove from the set of pending sessions
+        pendingSessions.remove(identifier);
+
+    }
+
+    /**
+     * Reactivate (remove from pending) the session associated with the given
+     * session identifier, if any. After calling this method, any session with
+     * the given identifier will be ready to be resumed again.
+     * 
+     * @param identifier
+     *     The identifier of the session to reactivate, if one exists.
+     */
+    public void reactivateSession(String identifier) {
+
+        // Remove from the set of pending sessions to reactivate
+        if (identifier != null)
+            pendingSessions.remove(identifier);
+
+    }
+
     /**
      * Resumes the Guacamole side of the authentication process that was
      * previously deferred through a call to defer(). Once invoked, the
@@ -97,9 +151,20 @@ public class AuthenticationSessionManager<T extends AuthenticationSession> {
      *     value was returned by defer().
      */
     public T resume(String identifier) {
-
         if (identifier != null) {
-            T session = sessions.remove(identifier);
+             T session = sessions.get(identifier);
+
+            // Mark the session as pending. NOTE: Unless explicitly removed
+            // from pending status via a call to reactivateSession(),
+            // the next attempt to resume this session will fail
+            if (pendingSessions.putIfAbsent(identifier, true) != null) {
+
+                // If the session was already marked as pending, invalidate it
+                invalidateSession(identifier);
+                return null;
+
+            }
+
             if (session != null && session.isValid())
                 return session;
         }
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationEventListener.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationEventListener.java
new file mode 100644
index 000000000..bde671ba1
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationEventListener.java
@@ -0,0 +1,70 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.saml;
+
+import com.google.inject.Inject;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.saml.acs.SAMLAuthenticationSessionManager;
+import org.apache.guacamole.net.event.AuthenticationFailureEvent;
+import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
+import org.apache.guacamole.net.event.listener.Listener;
+
+/**
+ * A Listener that will reactivate or invalidate SAML auth sessions depending on
+ * overall auth success or failure.
+ */
+public class AuthenticationEventListener implements Listener {
+
+    /**
+     * Manager of active SAML authentication attempts.
+     *
+     * Requires static injection due to the fact that the webapp just calls the
+     * constructor directly when creating new Listeners. The instances will not
+     * be constructed by guice.
+     */
+    @Inject
+    private static SAMLAuthenticationSessionManager sessionManager;
+
+    @Override
+    public void handleEvent(Object event) throws GuacamoleException {
+
+        if (event instanceof AuthenticationSuccessEvent)
+
+            // After an auth attempt has fully succeeded, invalidate the session
+            // associated with the successful login event so it can't be reused
+            sessionManager.invalidateSession(
+                AuthenticationProviderService.getSessionIdentifier(
+                    ((AuthenticationSuccessEvent) event).getCredentials()));
+
+        else if (event instanceof AuthenticationFailureEvent)
+
+            // If the SSL auth succeeded, but other auth providers failed to
+            // authenticate the user associated with the credentials in this
+            // failure event, they may wish to make another login attempt. To 
+            // avoid an infinite login attempt loop, re-enable the session
+            // associated with these credentials, allowing the auth attempt to be
+            // resumed without requiring another round trip to the SAML provider.
+            sessionManager.reactivateSession(
+                AuthenticationProviderService.getSessionIdentifier(
+                    ((AuthenticationFailureEvent) event).getCredentials()));
+        
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java
index 982028f16..b22a25972 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java
@@ -69,6 +69,26 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
     @Inject
     private SAMLService saml;
 
+    /**
+     * Return the value of the session identifier associated with the given
+     * credentials, or null if no session identifier is found in the
+     * credentials.
+     *
+     * @param credentials The credentials from which to extract the session
+     * identifier.
+     *
+     * @return The session identifier associated with the given credentials, or
+     * null if no identifier is found.
+     */
+    public static String getSessionIdentifier(Credentials credentials) {
+
+        // Return the session identifier from the request params, if set, or
+        // null otherwise
+        return credentials != null && credentials.getRequest() != null
+                ? credentials.getRequest().getParameter(AUTH_SESSION_QUERY_PARAM)
+                : null;
+    }
+
     @Override
     public SAMLAuthenticatedUser authenticateUser(Credentials credentials)
             throws GuacamoleException {
@@ -80,7 +100,9 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
             return null;
 
         // Use established SAML identity if already provided by the SAML IdP
-        AssertedIdentity identity = sessionManager.getIdentity(request.getParameter(AUTH_SESSION_QUERY_PARAM));
+        AssertedIdentity identity = sessionManager.getIdentity(
+                getSessionIdentifier(credentials));
+
         if (identity != null) {
 
             // Back-port the username to the credentials
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java
index 7c7dd49ed..1e193dd51 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java
@@ -36,6 +36,8 @@ public class SAMLAuthenticationProviderModule extends AbstractModule {
         bind(ConfigurationService.class);
         bind(SAMLAuthenticationSessionManager.class);
         bind(SAMLService.class);
+        
+        requestStaticInjection(AuthenticationEventListener.class);
     }
 
 }
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json
index d86753789..9319d4983 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json
@@ -9,6 +9,10 @@
         "org.apache.guacamole.auth.saml.SAMLAuthenticationProvider"
     ],
 
+    "listeners" : [
+        "org.apache.guacamole.auth.saml.AuthenticationEventListener"
+    ],
+
     "css" : [
         "styles/sso-providers.css"
     ],
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationEventListener.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationEventListener.java
new file mode 100644
index 000000000..3ea7bd0c5
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationEventListener.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ssl;
+
+import com.google.inject.Inject;
+import com.google.inject.Singleton;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.ssl.SSLAuthenticationSessionManager;
+import org.apache.guacamole.net.event.AuthenticationFailureEvent;
+import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
+import org.apache.guacamole.net.event.listener.Listener;
+
+/**
+ * A Listener that will reactivate or invalidate SSL auth sessions depending on
+ * overall auth success or failure.
+ */
+@Singleton
+public class AuthenticationEventListener implements Listener {
+
+    /**
+     * Session manager for generating and maintaining unique tokens to
+     * represent the authentication flow of a user who has only partially
+     * authenticated.
+     *
+     * Requires static injection due to the fact that the webapp just calls the
+     * constructor directly when creating new Listeners. The instances will not
+     * be constructed by guice.
+     */
+    @Inject
+    private static SSLAuthenticationSessionManager sessionManager;
+
+    @Override
+    public void handleEvent(Object event) throws GuacamoleException {
+
+        if (event instanceof AuthenticationSuccessEvent)
+
+            // After an auth attempt has fully succeeded, invalidate the session
+            // associated with the successful login event so it can't be reused
+            sessionManager.invalidateSession(
+                AuthenticationProviderService.getSessionIdentifier(
+                    ((AuthenticationSuccessEvent) event).getCredentials()));
+
+        else if (event instanceof AuthenticationFailureEvent)
+
+            // If the SSL auth succeeded, but other auth providers failed to
+            // authenticate the user associated with the credentials in this
+            // failure event, they may wish to make another login attempt. To
+            // avoid an infinite login attempt loop, re-enable the session
+            // associated with these credentials, allowing the auth attempt to be 
+            // resumed without requiring another round trip to the SSL service.
+            sessionManager.reactivateSession(
+                AuthenticationProviderService.getSessionIdentifier(
+                    ((AuthenticationFailureEvent) event).getCredentials()));
+
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
index 807df0cae..49d8daaff 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java
@@ -75,22 +75,42 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
     private static final String AUTH_SESSION_PARAMETER_NAME = "state";
 
     /**
-     * Processes the given HTTP request, returning the identity represented by
-     * the auth session token present in that request. If no such token is
-     * present, or the token does not represent a valid identity, null is
-     * returned.
+     * Return the value of the session identifier associated with the given
+     * credentials, or null if no session identifier is found in the credentials.
      *
-     * @param request
-     *     The HTTP request to process.
+     * @param credentials
+     *      The credentials from which to extract the session identifier.
+     *
+     * @return
+     *      The session identifier associated with the given credentials, or
+     *      null if no identifier is found.
+     */
+    public static String getSessionIdentifier(Credentials credentials) {
+
+        // Return the session identifier from the request params, if set, or
+        // null otherwise
+        return credentials != null && credentials.getRequest() != null
+                ? credentials.getRequest().getParameter(AUTH_SESSION_PARAMETER_NAME)
+                : null;
+    }
+
+    /**
+     * Processes the given credentials, returning the identity represented by
+     * the auth session token present in that request associated with the 
+     * credentials. If no such token is present, or the token does not represent
+     * a valid identity, null is returned.
+     *
+     * @param credentials
+     *     The credentials to extract the auth session token from.
      *
      * @return
      *     The identity represented by the auth session token in the request,
      *     or null if there is no such token or the token does not represent a
      *     valid identity.
      */
-    private SSOAuthenticatedUser processIdentity(Credentials credentials, HttpServletRequest request) {
+    private SSOAuthenticatedUser processIdentity(Credentials credentials) {
 
-        String state = request.getParameter(AUTH_SESSION_PARAMETER_NAME);
+        String state = getSessionIdentifier(credentials);
         String username = sessionManager.getIdentity(state);
         if (username == null)
             return null;
@@ -153,7 +173,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
         //
 
         if (confService.isPrimaryHostname(host))
-            return processIdentity(credentials, request);
+            return processIdentity(credentials);
 
         // All other requests are not allowed - redirect to proper hostname
         throw new GuacamoleInvalidCredentialsException("Authentication is "
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
index 46eeaa94f..36429b0b8 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
@@ -35,6 +35,8 @@ public class SSLAuthenticationProviderModule extends AbstractModule {
         bind(ConfigurationService.class);
         bind(NonceService.class).in(Scopes.SINGLETON);
         bind(SSLAuthenticationSessionManager.class);
+
+        requestStaticInjection(AuthenticationEventListener.class);
     }
 
 }
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
index 032db7af8..4dc047a90 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
@@ -9,6 +9,10 @@
         "org.apache.guacamole.auth.ssl.SSLAuthenticationProvider"
     ],
 
+    "listeners" : [
+        "org.apache.guacamole.auth.ssl.AuthenticationEventListener"
+    ],
+
     "css" : [
         "styles/sso-providers.css"
     ],
diff --git a/guacamole/src/main/frontend/src/app/login/directives/login.js b/guacamole/src/main/frontend/src/app/login/directives/login.js
index 80ce00fe4..60272086a 100644
--- a/guacamole/src/main/frontend/src/app/login/directives/login.js
+++ b/guacamole/src/main/frontend/src/app/login/directives/login.js
@@ -66,6 +66,7 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
         var Field = $injector.get('Field');
 
         // Required services
+        var $location             = $injector.get('$location');
         var $rootScope            = $injector.get('$rootScope');
         var $route                = $injector.get('$route');
         var authenticationService = $injector.get('authenticationService');
@@ -173,11 +174,24 @@ angular.module('login').directive('guacLogin', [function guacLogin() {
         });
 
         /**
-         * Submits the currently-specified username and password to the
-         * authentication service, redirecting to the main view if successful.
+         * Submits the currently-specified fields to the authentication service,
+         * as well as any URL parameters set for the current page, preferring
+         * the values from the fields, and redirecting to the main view if
+         * successful.
          */
         $scope.login = function login() {
-            authenticationService.authenticate($scope.enteredValues)['catch'](requestService.IGNORE);
+
+            // Any values from URL paramters
+            const urlValues = $location.search();
+
+            // Values from the fields
+            const fieldValues = $scope.enteredValues;
+
+            // All the values to be submitted in the auth attempt, preferring
+            // any values from fields over those in the URL
+            const authParams = {...urlValues, ...fieldValues};
+
+            authenticationService.authenticate(authParams)['catch'](requestService.IGNORE);
         };
 
         /**

From 97f93fa5c5909b9aab83a6402aca73189bdc896f Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 27 Jun 2023 20:35:15 +0000
Subject: [PATCH 217/289] GUACAMOLE-1780: Unify session
 reactivation/invalidation behavior.

---
 .../sso/AuthenticationSessionManager.java     |   7 +-
 .../sso/SSOAuthenticationEventListener.java   | 115 ++++++++++++++++++
 .../saml/AuthenticationEventListener.java     |  70 -----------
 .../saml/AuthenticationProviderService.java   |   9 +-
 .../saml/SAMLAuthenticationEventListener.java |  66 ++++++++++
 .../SAMLAuthenticationProviderModule.java     |   2 +-
 .../src/main/resources/guac-manifest.json     |   2 +-
 ...va => SSLAuthenticationEventListener.java} |  37 +++---
 .../ssl/SSLAuthenticationProviderModule.java  |   2 +-
 .../src/main/resources/guac-manifest.json     |   2 +-
 10 files changed, 209 insertions(+), 103 deletions(-)
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/SSOAuthenticationEventListener.java
 delete mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationEventListener.java
 create mode 100644 extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationEventListener.java
 rename extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/{AuthenticationEventListener.java => SSLAuthenticationEventListener.java} (56%)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
index 6e13144c2..11ef307e2 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
@@ -19,8 +19,9 @@
 
 package org.apache.guacamole.auth.sso;
 
-import com.google.common.base.Predicates;
 import com.google.inject.Inject;
+import com.google.inject.Singleton;
+
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
@@ -38,6 +39,7 @@ import java.util.concurrent.TimeUnit;
  * @param <T>
  *     The type of sessions managed by this session manager.
  */
+@Singleton
 public class AuthenticationSessionManager<T extends AuthenticationSession> {
 
     /**
@@ -152,7 +154,8 @@ public class AuthenticationSessionManager<T extends AuthenticationSession> {
      */
     public T resume(String identifier) {
         if (identifier != null) {
-             T session = sessions.get(identifier);
+
+            T session = sessions.get(identifier);
 
             // Mark the session as pending. NOTE: Unless explicitly removed
             // from pending status via a call to reactivateSession(),
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/SSOAuthenticationEventListener.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/SSOAuthenticationEventListener.java
new file mode 100644
index 000000000..46df4fd49
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/SSOAuthenticationEventListener.java
@@ -0,0 +1,115 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.sso;
+
+import org.apache.guacamole.GuacamoleClientException;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleSecurityException;
+import org.apache.guacamole.net.auth.Credentials;
+import org.apache.guacamole.net.auth.credentials.GuacamoleInsufficientCredentialsException;
+import org.apache.guacamole.net.event.AuthenticationFailureEvent;
+import org.apache.guacamole.net.event.AuthenticationRequestReceivedEvent;
+import org.apache.guacamole.net.event.CredentialEvent;
+import org.apache.guacamole.net.event.listener.Listener;
+
+/**
+ * A Listener that will reactivate or invalidate SSO auth sessions depending on
+ * overall auth success or failure.
+ */
+public abstract class SSOAuthenticationEventListener implements Listener {
+
+    @Override
+    public void handleEvent(Object event) throws GuacamoleException {
+
+        // If the authentication attempt is incomplete or credentials cannot be
+        // extracted, there's nothing to do
+        if (event instanceof AuthenticationRequestReceivedEvent
+                || !(event instanceof CredentialEvent))
+            return;
+
+        // Look for a session identifier associated with these credentials
+        String sessionIdentifier = getSessionIdentifier(
+                ((CredentialEvent) event).getCredentials());
+
+        // If no session is associated with these credentials, there's
+        // nothing to do
+        if (sessionIdentifier == null)
+            return;
+
+        // If the SSO auth succeeded, but other auth providers failed to
+        // authenticate the user associated with the credentials in this
+        // failure event, they may wish to make another login attempt. To
+        // avoid an infinite login attempt loop, re-enable the session
+        // associated with these credentials, allowing the auth attempt to be
+        // resumed without requiring another round trip to the SSO service.
+        if (event instanceof AuthenticationFailureEvent) {
+            Throwable failure = ((AuthenticationFailureEvent) event).getFailure();
+
+            // If and only if the failure was associated with missing or
+            // credentials, or a non-security related request issue,
+            // reactivate the session
+            if (failure instanceof GuacamoleInsufficientCredentialsException
+                    || ((failure instanceof GuacamoleClientException)
+                    && !(failure instanceof GuacamoleSecurityException))) {
+
+                reactivateSession(sessionIdentifier);
+                return;
+
+            }
+
+        }
+
+        // Invalidate the session in all other cases
+        invalidateSession(sessionIdentifier);
+
+    }
+
+    /**
+     * Get the session identifier associated with the provided credentials,
+     * if any. If no session is associated with the credentials, null will
+     * be returned.
+     *
+     * @param credentials
+     *     The credentials assoociated with the deferred SSO authentication
+     *     session to reactivate.
+     *
+     * @return
+     *     The session identifier associated with the provided credentials,
+     *     or null if no session is found.
+     */
+    protected abstract String getSessionIdentifier(Credentials credentials);
+
+    /**
+     * Reactivate the session identified by the provided identifier, if any.
+     *
+     * @param sessionIdentifier
+     *     The identifier of the session to reactivate.
+     */
+    protected abstract void reactivateSession(String sessionIdentifier);
+
+    /**
+     * Invalidate the session identified by the provided identifier, if any.
+     *
+     * @param sessionIdentifier
+     *     The identifier of the session to invalidate.
+     */
+    protected abstract void invalidateSession(String sessionIdentifier);
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationEventListener.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationEventListener.java
deleted file mode 100644
index bde671ba1..000000000
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationEventListener.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.saml;
-
-import com.google.inject.Inject;
-import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.saml.acs.SAMLAuthenticationSessionManager;
-import org.apache.guacamole.net.event.AuthenticationFailureEvent;
-import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
-import org.apache.guacamole.net.event.listener.Listener;
-
-/**
- * A Listener that will reactivate or invalidate SAML auth sessions depending on
- * overall auth success or failure.
- */
-public class AuthenticationEventListener implements Listener {
-
-    /**
-     * Manager of active SAML authentication attempts.
-     *
-     * Requires static injection due to the fact that the webapp just calls the
-     * constructor directly when creating new Listeners. The instances will not
-     * be constructed by guice.
-     */
-    @Inject
-    private static SAMLAuthenticationSessionManager sessionManager;
-
-    @Override
-    public void handleEvent(Object event) throws GuacamoleException {
-
-        if (event instanceof AuthenticationSuccessEvent)
-
-            // After an auth attempt has fully succeeded, invalidate the session
-            // associated with the successful login event so it can't be reused
-            sessionManager.invalidateSession(
-                AuthenticationProviderService.getSessionIdentifier(
-                    ((AuthenticationSuccessEvent) event).getCredentials()));
-
-        else if (event instanceof AuthenticationFailureEvent)
-
-            // If the SSL auth succeeded, but other auth providers failed to
-            // authenticate the user associated with the credentials in this
-            // failure event, they may wish to make another login attempt. To 
-            // avoid an infinite login attempt loop, re-enable the session
-            // associated with these credentials, allowing the auth attempt to be
-            // resumed without requiring another round trip to the SAML provider.
-            sessionManager.reactivateSession(
-                AuthenticationProviderService.getSessionIdentifier(
-                    ((AuthenticationFailureEvent) event).getCredentials()));
-        
-    }
-
-}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java
index b22a25972..2c7990c4f 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java
@@ -74,11 +74,12 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
      * credentials, or null if no session identifier is found in the
      * credentials.
      *
-     * @param credentials The credentials from which to extract the session
-     * identifier.
+     * @param credentials
+     *     The credentials from which to extract the session identifier.
      *
-     * @return The session identifier associated with the given credentials, or
-     * null if no identifier is found.
+     * @return
+     *     The session identifier associated with the given credentials, or
+     *     null if no identifier is found.
      */
     public static String getSessionIdentifier(Credentials credentials) {
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationEventListener.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationEventListener.java
new file mode 100644
index 000000000..f6bb3b06c
--- /dev/null
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationEventListener.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.saml;
+
+import org.apache.guacamole.auth.saml.acs.SAMLAuthenticationSessionManager;
+import org.apache.guacamole.auth.sso.SSOAuthenticationEventListener;
+import org.apache.guacamole.net.auth.Credentials;
+
+import com.google.inject.Inject;
+
+/**
+ * A Listener that will reactivate or invalidate SAML auth sessions depending on
+ * overall auth success or failure.
+ */
+public class SAMLAuthenticationEventListener extends SSOAuthenticationEventListener {
+
+    /**
+     * Session manager for generating and maintaining unique tokens to
+     * represent the authentication flow of a user who has only partially
+     * authenticated.
+     *
+     * Requires static injection due to the fact that the webapp just calls the
+     * constructor directly when creating new Listeners. The instances will not
+     * be constructed by guice.
+     *
+     * Note that is possible to instead inject an AuthenticationSessionManager
+     * instance directly into the base class, but this results in different
+     * instances of the session manager injected here and in the rest of the
+     * extension, regardless of singleton configuration for the service.
+     */
+    @Inject
+    protected static SAMLAuthenticationSessionManager sessionManager;
+
+    @Override
+    protected String getSessionIdentifier(Credentials credentials) {
+        return AuthenticationProviderService.getSessionIdentifier(credentials);
+    }
+
+    @Override
+    protected void reactivateSession(String sessionIdentifier) {
+        sessionManager.reactivateSession(sessionIdentifier);
+    }
+
+    @Override
+    protected void invalidateSession(String sessionIdentifier) {
+        sessionManager.invalidateSession(sessionIdentifier);
+    }
+
+}
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java
index 1e193dd51..e01880a62 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/SAMLAuthenticationProviderModule.java
@@ -37,7 +37,7 @@ public class SAMLAuthenticationProviderModule extends AbstractModule {
         bind(SAMLAuthenticationSessionManager.class);
         bind(SAMLService.class);
         
-        requestStaticInjection(AuthenticationEventListener.class);
+        requestStaticInjection(SAMLAuthenticationEventListener.class);
     }
 
 }
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json
index 9319d4983..00cb8c23d 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/resources/guac-manifest.json
@@ -10,7 +10,7 @@
     ],
 
     "listeners" : [
-        "org.apache.guacamole.auth.saml.AuthenticationEventListener"
+        "org.apache.guacamole.auth.saml.SAMLAuthenticationEventListener"
     ],
 
     "css" : [
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationEventListener.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationEventListener.java
similarity index 56%
rename from extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationEventListener.java
rename to extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationEventListener.java
index 3ea7bd0c5..26769ced9 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationEventListener.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationEventListener.java
@@ -23,6 +23,8 @@ import com.google.inject.Inject;
 import com.google.inject.Singleton;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.auth.ssl.SSLAuthenticationSessionManager;
+import org.apache.guacamole.auth.sso.SSOAuthenticationEventListener;
+import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.event.AuthenticationFailureEvent;
 import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
 import org.apache.guacamole.net.event.listener.Listener;
@@ -31,8 +33,7 @@ import org.apache.guacamole.net.event.listener.Listener;
  * A Listener that will reactivate or invalidate SSL auth sessions depending on
  * overall auth success or failure.
  */
-@Singleton
-public class AuthenticationEventListener implements Listener {
+public class SSLAuthenticationEventListener extends SSOAuthenticationEventListener {
 
     /**
      * Session manager for generating and maintaining unique tokens to
@@ -44,31 +45,21 @@ public class AuthenticationEventListener implements Listener {
      * be constructed by guice.
      */
     @Inject
-    private static SSLAuthenticationSessionManager sessionManager;
+    protected static SSLAuthenticationSessionManager sessionManager;
 
     @Override
-    public void handleEvent(Object event) throws GuacamoleException {
+    protected String getSessionIdentifier(Credentials credentials) {
+        return AuthenticationProviderService.getSessionIdentifier(credentials);
+    }
 
-        if (event instanceof AuthenticationSuccessEvent)
-
-            // After an auth attempt has fully succeeded, invalidate the session
-            // associated with the successful login event so it can't be reused
-            sessionManager.invalidateSession(
-                AuthenticationProviderService.getSessionIdentifier(
-                    ((AuthenticationSuccessEvent) event).getCredentials()));
-
-        else if (event instanceof AuthenticationFailureEvent)
-
-            // If the SSL auth succeeded, but other auth providers failed to
-            // authenticate the user associated with the credentials in this
-            // failure event, they may wish to make another login attempt. To
-            // avoid an infinite login attempt loop, re-enable the session
-            // associated with these credentials, allowing the auth attempt to be 
-            // resumed without requiring another round trip to the SSL service.
-            sessionManager.reactivateSession(
-                AuthenticationProviderService.getSessionIdentifier(
-                    ((AuthenticationFailureEvent) event).getCredentials()));
+    @Override
+    protected void reactivateSession(String sessionIdentifier) {
+        sessionManager.reactivateSession(sessionIdentifier);
+    }
 
+    @Override
+    protected void invalidateSession(String sessionIdentifier) {
+        sessionManager.invalidateSession(sessionIdentifier);
     }
 
 }
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
index 36429b0b8..9f7b15aff 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationProviderModule.java
@@ -36,7 +36,7 @@ public class SSLAuthenticationProviderModule extends AbstractModule {
         bind(NonceService.class).in(Scopes.SINGLETON);
         bind(SSLAuthenticationSessionManager.class);
 
-        requestStaticInjection(AuthenticationEventListener.class);
+        requestStaticInjection(SSLAuthenticationEventListener.class);
     }
 
 }
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
index 4dc047a90..d5422bf93 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
@@ -10,7 +10,7 @@
     ],
 
     "listeners" : [
-        "org.apache.guacamole.auth.ssl.AuthenticationEventListener"
+        "org.apache.guacamole.auth.ssl.SSLAuthenticationEventListener"
     ],
 
     "css" : [

From e804e8f95dccaa6f66aeccf8e0d2760138dc3a06 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 5 Jul 2023 23:13:48 +0000
Subject: [PATCH 218/289] GUACAMOLE-1829: Correct versions of dependencies for
 remaining 1.5.2 versioned extensions.

---
 extensions/guacamole-auth-ban/pom.xml                       | 6 +++---
 .../src/main/resources/guac-manifest.json                   | 2 +-
 .../modules/guacamole-auth-sso-dist/pom.xml                 | 2 +-
 .../modules/guacamole-auth-sso-ssl/pom.xml                  | 4 ++--
 .../src/main/resources/guac-manifest.json                   | 2 +-
 extensions/guacamole-display-statistics/pom.xml             | 4 ++--
 .../src/main/resources/guac-manifest.json                   | 2 +-
 7 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/extensions/guacamole-auth-ban/pom.xml b/extensions/guacamole-auth-ban/pom.xml
index d42ec347a..6f39a4513 100644
--- a/extensions/guacamole-auth-ban/pom.xml
+++ b/extensions/guacamole-auth-ban/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-auth-ban</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.2</version>
+    <version>1.5.3</version>
     <name>guacamole-auth-ban</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.5.2</version>
+        <version>1.5.3</version>
         <relativePath>../</relativePath>
     </parent>
 
@@ -51,7 +51,7 @@
         <dependency>
             <groupId>org.apache.guacamole</groupId>
             <artifactId>guacamole-ext</artifactId>
-            <version>1.5.2</version>
+            <version>1.5.3</version>
             <scope>provided</scope>
 
             <!-- Exclude transitive dependencies that will be overridden by
diff --git a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
index d61454f13..75b09bc27 100644
--- a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.2",
+    "guacamoleVersion" : "1.5.3",
 
     "name"      : "Brute-force Authentication Detection/Prevention",
     "namespace" : "ban",
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
index 70c2f13ed..fc2abd8f4 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
@@ -63,7 +63,7 @@
         <dependency>
             <groupId>org.apache.guacamole</groupId>
             <artifactId>guacamole-auth-sso-ssl</artifactId>
-            <version>1.5.2</version>
+            <version>1.5.3</version>
         </dependency>
 
     </dependencies>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
index 2255d37ea..2f705eae7 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-auth-sso-ssl</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.2</version>
+    <version>1.5.3</version>
     <name>guacamole-auth-sso-ssl</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>guacamole-auth-sso</artifactId>
-        <version>1.5.2</version>
+        <version>1.5.3</version>
         <relativePath>../../</relativePath>
     </parent>
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
index 032db7af8..d2d21741b 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.2",
+    "guacamoleVersion" : "1.5.3",
 
     "name"      : "SSL Authentication Extension",
     "namespace" : "ssl",
diff --git a/extensions/guacamole-display-statistics/pom.xml b/extensions/guacamole-display-statistics/pom.xml
index 68aea4592..fb96bd99d 100644
--- a/extensions/guacamole-display-statistics/pom.xml
+++ b/extensions/guacamole-display-statistics/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-display-statistics</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.2</version>
+    <version>1.5.3</version>
     <name>guacamole-display-statistics</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.5.2</version>
+        <version>1.5.3</version>
         <relativePath>../</relativePath>
     </parent>
 
diff --git a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
index 3766d0673..8e528b745 100644
--- a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.2",
+    "guacamoleVersion" : "1.5.3",
 
     "name"      : "Display Statistic Toolbar",
     "namespace" : "display-stats",

From 2a2cef918945408da39372d8e3f2499e51528017 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 15 May 2023 23:29:58 +0000
Subject: [PATCH 219/289] GUACAMOLE-1820: Create UI for viewing, searching, and
 navigating to key events in session recording player.

---
 doc/licenses/fuzzysort-2.0.4/LICENSE          |  21 +
 doc/licenses/fuzzysort-2.0.4/README           |   8 +
 .../fuzzysort-2.0.4/dep-coordinates.txt       |   1 +
 .../webapp/modules/KeyEventInterpreter.js     | 487 ++++++++++++++++++
 .../main/webapp/modules/SessionRecording.js   |  52 ++
 guacamole/src/main/frontend/package-lock.json |  11 +
 guacamole/src/main/frontend/package.json      |   1 +
 .../src/app/player/directives/player.js       | 145 +++---
 .../src/app/player/directives/textView.js     | 137 +++++
 .../app/player/services/playerTimeService.js  |  82 +++
 .../frontend/src/app/player/styles/player.css |  61 ++-
 .../src/app/player/styles/textView.css        | 115 +++++
 .../src/app/player/templates/player.html      |  63 ++-
 .../src/app/player/templates/textView.html    |  23 +
 .../src/app/player/types/TextBatch.js         |  57 ++
 .../app/settings/styles/history-player.css    |   6 +-
 .../settingsConnectionHistoryPlayer.html      |   9 +-
 .../main/frontend/src/images/fullscreen.svg   |   1 +
 .../main/frontend/src/translations/en.json    |  13 +-
 19 files changed, 1197 insertions(+), 96 deletions(-)
 create mode 100644 doc/licenses/fuzzysort-2.0.4/LICENSE
 create mode 100644 doc/licenses/fuzzysort-2.0.4/README
 create mode 100644 doc/licenses/fuzzysort-2.0.4/dep-coordinates.txt
 create mode 100644 guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
 create mode 100644 guacamole/src/main/frontend/src/app/player/directives/textView.js
 create mode 100644 guacamole/src/main/frontend/src/app/player/services/playerTimeService.js
 create mode 100644 guacamole/src/main/frontend/src/app/player/styles/textView.css
 create mode 100644 guacamole/src/main/frontend/src/app/player/templates/textView.html
 create mode 100644 guacamole/src/main/frontend/src/app/player/types/TextBatch.js
 create mode 100644 guacamole/src/main/frontend/src/images/fullscreen.svg

diff --git a/doc/licenses/fuzzysort-2.0.4/LICENSE b/doc/licenses/fuzzysort-2.0.4/LICENSE
new file mode 100644
index 000000000..a3b9d9d79
--- /dev/null
+++ b/doc/licenses/fuzzysort-2.0.4/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018 Stephen Kamenar
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/doc/licenses/fuzzysort-2.0.4/README b/doc/licenses/fuzzysort-2.0.4/README
new file mode 100644
index 000000000..add7ed142
--- /dev/null
+++ b/doc/licenses/fuzzysort-2.0.4/README
@@ -0,0 +1,8 @@
+fuzzysort (https://github.com/farzher/fuzzysort/tree/master)
+---------------------------------------------
+
+    Version: 2.0.4
+    From: 'Stephen Kamenar' (https://github.com/farzher)
+    License(s):
+        MIT (bundled/fuzzysort-2.0.4/LICENSE)
+
diff --git a/doc/licenses/fuzzysort-2.0.4/dep-coordinates.txt b/doc/licenses/fuzzysort-2.0.4/dep-coordinates.txt
new file mode 100644
index 000000000..24be4c241
--- /dev/null
+++ b/doc/licenses/fuzzysort-2.0.4/dep-coordinates.txt
@@ -0,0 +1 @@
+fuzzysort:2.0.4
diff --git a/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js b/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
new file mode 100644
index 000000000..957a90c6b
--- /dev/null
+++ b/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
@@ -0,0 +1,487 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+var Guacamole = Guacamole || {};
+
+/**
+ * An object that will accept raw key events and produce human readable text
+ * batches, seperated by at least `batchSeperation` milliseconds, which can be
+ * retrieved through the onBatch callback or by calling getCurrentBatch().
+ *
+ * NOTE: The event processing logic and output format is based on the `guaclog`
+ * tool, with the addition of batching support.
+ *
+ * @constructor
+ * @param {number} [batchSeperation=5000]
+ *     The minimum number of milliseconds that must elapse between subsequent
+ *     batches of key-event-generated text. If 0 or negative, no splitting will
+ *     occur, resulting in a single batch for all provided key events.
+ */
+Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
+
+    /**
+     * Reference to this Guacamole.KeyEventInterpreter.
+     *
+     * @private
+     * @type {!Guacamole.SessionRecording}
+     */
+    var interpreter = this;
+
+    // Default to 5 seconds if the batch seperation was not provided
+    if (batchSeperation === undefined || batchSeperation === null)
+        batchSeperation = 5000;
+
+    /**
+     * A definition for a known key.
+     *
+     * @constructor
+     * @private
+     * @param {KEY_DEFINITION|object} [template={}]
+     *     The object whose properties should be copied within the new
+     *     KEY_DEFINITION.
+     */
+    var KeyDefinition = function KeyDefinition(template) {
+
+        /**
+         * The X11 keysym of the key.
+         * @type {!number}
+         */
+        this.keysym = parseInt(template.keysym);
+
+        /**
+         * A human-readable name for the key.
+         * @type {!String}
+         */
+        this.name = template.name;
+
+        /**
+         * The value which would be typed in a typical text editor, if any. If the
+         * key is not associated with any typable value, or if the typable value is
+         * not generally useful in an auditing context, this will be undefined.
+         * @type {String}
+         */
+        this.value = template.value;
+
+        /**
+         * Whether this key is a modifier which may affect the interpretation of
+         * other keys, and thus should be tracked as it is held down.
+         * @type {!boolean}
+         * @default false
+         */
+        this.modifier = template.modifier || false;
+
+    };
+
+    /**
+     * A precursor array to the KNOWN_KEYS map. The objects contained within
+     * will be constructed into full KeyDefinition objects.
+     *
+     * @constant
+     * @private
+     * @type {Object[]}
+     */
+    var _KNOWN_KEYS = [
+        {keysym: 0xFE03, name: 'AltGr', value: "", modifier: true },
+        {keysym: 0xFF08, name: 'Backspace' },
+        {keysym: 0xFF09, name: 'Tab' },
+        {keysym: 0xFF0B, name: 'Clear' },
+        {keysym: 0xFF0D, name: 'Return', value: "\n" },
+        {keysym: 0xFF13, name: 'Pause' },
+        {keysym: 0xFF14, name: 'Scroll' },
+        {keysym: 0xFF15, name: 'SysReq' },
+        {keysym: 0xFF1B, name: 'Escape' },
+        {keysym: 0xFF50, name: 'Home' },
+        {keysym: 0xFF51, name: 'Left' },
+        {keysym: 0xFF52, name: 'Up' },
+        {keysym: 0xFF53, name: 'Right' },
+        {keysym: 0xFF54, name: 'Down' },
+        {keysym: 0xFF55, name: 'Page Up' },
+        {keysym: 0xFF56, name: 'Page Down' },
+        {keysym: 0xFF57, name: 'End' },
+        {keysym: 0xFF63, name: 'Insert' },
+        {keysym: 0xFF65, name: 'Undo' },
+        {keysym: 0xFF6A, name: 'Help' },
+        {keysym: 0xFF7F, name: 'Num' },
+        {keysym: 0xFF80, name: 'Space', value: " " },
+        {keysym: 0xFF8D, name: 'Enter', value: "\n" },
+        {keysym: 0xFF95, name: 'Home' },
+        {keysym: 0xFF96, name: 'Left' },
+        {keysym: 0xFF97, name: 'Up' },
+        {keysym: 0xFF98, name: 'Right' },
+        {keysym: 0xFF99, name: 'Down' },
+        {keysym: 0xFF9A, name: 'Page Up' },
+        {keysym: 0xFF9B, name: 'Page Down' },
+        {keysym: 0xFF9C, name: 'End' },
+        {keysym: 0xFF9E, name: 'Insert' },
+        {keysym: 0xFFAA, name: '*', value: "*" },
+        {keysym: 0xFFAB, name: '+', value: "+" },
+        {keysym: 0xFFAD, name: '-', value: "-" },
+        {keysym: 0xFFAE, name: '.', value: "." },
+        {keysym: 0xFFAF, name: '/', value: "/" },
+        {keysym: 0xFFB0, name: '0', value: "0" },
+        {keysym: 0xFFB1, name: '1', value: "1" },
+        {keysym: 0xFFB2, name: '2', value: "2" },
+        {keysym: 0xFFB3, name: '3', value: "3" },
+        {keysym: 0xFFB4, name: '4', value: "4" },
+        {keysym: 0xFFB5, name: '5', value: "5" },
+        {keysym: 0xFFB6, name: '6', value: "6" },
+        {keysym: 0xFFB7, name: '7', value: "7" },
+        {keysym: 0xFFB8, name: '8', value: "8" },
+        {keysym: 0xFFB9, name: '9', value: "9" },
+        {keysym: 0xFFBE, name: 'F1' },
+        {keysym: 0xFFBF, name: 'F2' },
+        {keysym: 0xFFC0, name: 'F3' },
+        {keysym: 0xFFC1, name: 'F4' },
+        {keysym: 0xFFC2, name: 'F5' },
+        {keysym: 0xFFC3, name: 'F6' },
+        {keysym: 0xFFC4, name: 'F7' },
+        {keysym: 0xFFC5, name: 'F8' },
+        {keysym: 0xFFC6, name: 'F9' },
+        {keysym: 0xFFC7, name: 'F10' },
+        {keysym: 0xFFC8, name: 'F11' },
+        {keysym: 0xFFC9, name: 'F12' },
+        {keysym: 0xFFCA, name: 'F13' },
+        {keysym: 0xFFCB, name: 'F14' },
+        {keysym: 0xFFCC, name: 'F15' },
+        {keysym: 0xFFCD, name: 'F16' },
+        {keysym: 0xFFCE, name: 'F17' },
+        {keysym: 0xFFCF, name: 'F18' },
+        {keysym: 0xFFD0, name: 'F19' },
+        {keysym: 0xFFD1, name: 'F20' },
+        {keysym: 0xFFD2, name: 'F21' },
+        {keysym: 0xFFD3, name: 'F22' },
+        {keysym: 0xFFD4, name: 'F23' },
+        {keysym: 0xFFD5, name: 'F24' },
+        {keysym: 0xFFE1, name: 'Shift', value: "", modifier: true },
+        {keysym: 0xFFE2, name: 'Shift', value: "", modifier: true },
+        {keysym: 0xFFE3, name: 'Ctrl', value: null, modifier: true },
+        {keysym: 0xFFE4, name: 'Ctrl', value: null, modifier: true },
+        {keysym: 0xFFE5, name: 'Caps' },
+        {keysym: 0xFFE7, name: 'Meta', value: null, modifier: true },
+        {keysym: 0xFFE8, name: 'Meta', value: null, modifier: true },
+        {keysym: 0xFFE9, name: 'Alt', value: null, modifier: true },
+        {keysym: 0xFFEA, name: 'Alt', value: null, modifier: true },
+        {keysym: 0xFFEB, name: 'Super', value: null, modifier: true },
+        {keysym: 0xFFEC, name: 'Super', value: null, modifier: true },
+        {keysym: 0xFFED, name: 'Hyper', value: null, modifier: true },
+        {keysym: 0xFFEE, name: 'Hyper', value: null, modifier: true },
+        {keysym: 0xFFFF, name: 'Delete' }
+    ];
+
+    /**
+     * All known keys, as a map of X11 keysym to KeyDefinition.
+     *
+     * @constant
+     * @private
+     * @type {Object.<String, KeyDefinition>}
+     */
+    var KNOWN_KEYS = {};
+    _KNOWN_KEYS.forEach(function createKeyDefinitionMap(keyDefinition) {
+
+        // Construct a map of keysym to KeyDefinition object
+        KNOWN_KEYS[keyDefinition.keysym] = new KeyDefinition(keyDefinition)
+
+    });
+
+    /**
+     * A map of X11 keysyms to a KeyDefinition object, if the corresponding
+     * key is currently pressed. If a keysym has no entry in this map at all,
+     * it means that the key is not being pressed. Note that not all keysyms
+     * are necessarily tracked within this map - only those that are explicitly
+     * tracked.
+     *
+     * @private
+     * @type {Object.<String,KeyDefinition> }
+     */
+    var pressedKeys = {};
+
+    /**
+     * A human-readable representation of all keys pressed since the last keyframe.
+     *
+     * @private
+     * @type {String}
+     */
+    var currentTypedValue = '';
+
+    /**
+     * The timestamp of the key event that started the most recent batch of
+     * text content. If 0, no key events have been processed yet.
+     *
+     * @private
+     * @type {Number}
+     */
+    var lastTextTimestamp = 0;
+
+    /**
+     * The timestamp of the most recent key event processed.
+     *
+     * @private
+     * @type {Number}
+     */
+    var lastKeyEvent = 0;
+
+    /**
+     * Returns true if the currently-pressed keys are part of a shortcut, or
+     * false otherwise.
+     *
+     * @private
+     * @returns {!boolean}
+     *     True if the currently-pressed keys are part of a shortcut, or false
+     *     otherwise.
+     */
+    function isShortcut() {
+
+        // If one of the currently-pressed keys is non-printable, a shortcut
+        // is being typed
+        for (var keysym in pressedKeys) {
+            if (pressedKeys[keysym].value === null)
+                return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * If the provided keysym corresponds to a valid UTF-8 character, return
+     * a KeyDefinition for that keysym. Otherwise, return null.
+     *
+     * @private
+     * @param {Number} keysym
+     *     The keysym to produce a UTF-8 KeyDefinition for, if valid.
+     *
+     * @returns
+     *     Return a KeyDefinition for the provided keysym, if it it's a valid
+     *     UTF-8 keysym, or null otherwise.
+     */
+    function getUnicodeKeyDefinition(keysym) {
+
+        // Translate only if keysym maps to Unicode
+        if (keysym < 0x00 || (keysym > 0xFF && (keysym | 0xFFFF) != 0x0100FFFF))
+            return null;
+
+        var codepoint = keysym & 0xFFFF;
+        var mask;
+        var bytes;
+
+        /* Determine size and initial byte mask */
+        if (codepoint <= 0x007F) {
+            mask  = 0x00;
+            bytes = 1;
+        }
+        else if (codepoint <= 0x7FF) {
+            mask  = 0xC0;
+            bytes = 2;
+        }
+        else {
+            mask  = 0xE0;
+            bytes = 3;
+        }
+
+        var byteArray = new ArrayBuffer(bytes);
+        var byteView = new Int8Array(byteArray);
+
+        // Add trailing bytes, if any
+        for (var i = 1; i < bytes; i++) {
+            byteView[bytes - i] = 0x80 | (codepoint & 0x3F);
+            codepoint >>= 6;
+        }
+
+        // Set initial byte
+        byteView[0] = mask | codepoint;
+
+        // Convert to UTF8 string
+        var name = new TextDecoder("utf-8").decode(byteArray);
+
+        // Create and return the definition
+        return new KeyDefinition({keysym: keysym.toString(), name: name, value: name, modifier: false});
+
+    }
+
+    /**
+     * Return a KeyDefinition corresponding to the provided keysym.
+     *
+     * @private
+     * @param {Number} keysym
+     *     The keysym to return a KeyDefinition for.
+     *
+     * @returns
+     *     A KeyDefinition corresponding to the provided keysym.
+     */
+    function getKeyDefinitionByKeysym(keysym) {
+
+        // If it's a known type, return the existing definition
+        if (keysym in KNOWN_KEYS)
+            return KNOWN_KEYS[keysym];
+
+        // Return a UTF-8 KeyDefinition, if valid
+        var definition = getUnicodeKeyDefinition(keysym);
+        if (definition != null)
+            return definition;
+
+        // If it's not UTF-8, return an unknown definition, with the name
+        // just set to the hex value of the keysym
+        return new KeyDefinition({
+            keysym: keysym,
+            name: '0x' + String(keysym.toString(16))
+        })
+
+    }
+
+    /**
+     * Fired whenever a new batch of typed text extracted from key events
+     * is available. A new batch will be provided every time a new key event
+     * is processed after more than batchSeperation milliseconds after the
+     * previous key event.
+     *
+     * @event
+     * @param {!String} text
+     *     The typed text associated with the batch of text.
+     *
+     * @param {!number} timestamp
+     *     The raw recording timestamp associated with the first key event
+     *     that started this batch of text.
+     */
+    interpreter.onBatch = null;
+
+    /**
+     * Handles a raw key event, potentially appending typed text to the
+     * current batch, and calling onBatch with the current batch, if the
+     * callback is set and a new batch is about to be started.
+     *
+     * @param {!string[]} args
+     *     The arguments of the key event.
+     */
+    interpreter.handleKeyEvent = function handleKeyEvent(args) {
+
+        // The X11 keysym
+        var keysym = parseInt(args[0]);
+
+        // Either 1 or 0 for pressed or released, respectively
+        var pressed = parseInt(args[1]);
+
+        // The timestamp when this key event occured
+        var timestamp = parseInt(args[2]);
+
+        // If no current batch exists, start a new one now
+        if (!lastTextTimestamp) {
+            lastTextTimestamp = timestamp;
+            lastKeyEvent = timestamp;
+        }
+
+        // Only switch to a new batch of text if sufficient time has passed
+        // since the last key event
+        var newBatch = (batchSeperation >= 0
+                && (timestamp - lastKeyEvent) >= batchSeperation);
+        lastKeyEvent = timestamp;
+
+        if (newBatch) {
+
+            // Call the handler with the current batch of text and the timestamp
+            // at which the current batch started
+            if (currentTypedValue && interpreter.onBatch)
+                interpreter.onBatch(currentTypedValue, lastTextTimestamp);
+
+            // Move on to the next batch of text
+            currentTypedValue = '';
+            lastTextTimestamp = 0;
+
+        }
+
+        var keyDefinition = getKeyDefinitionByKeysym(keysym);
+
+        // Mark down whether the key was pressed or released
+        if (keyDefinition.modifier) {
+            if (pressed)
+                pressedKeys[keysym] = keyDefinition;
+            else
+                delete pressedKeys[keysym];
+        }
+
+        // Append to the current typed value when a printable
+        // (non-modifier) key is pressed
+        else if (pressed) {
+
+            if (isShortcut()) {
+
+                currentTypedValue += '<';
+
+                var firstKey = true;
+
+                // Compose entry by inspecting the state of each tracked key.
+                // At least one key must be pressed when in a shortcut.
+                for (var keysym in pressedKeys) {
+
+                    var pressedKeyDefinition = pressedKeys[keysym];
+
+                    // Print name of key
+                    if (firstKey) {
+                        currentTypedValue += pressedKeyDefinition.name;
+                        firstKey = false;
+                    }
+
+                    else
+                        currentTypedValue += ('+' + pressedKeyDefinition.name);
+
+                }
+
+                // Finally, append the printable key to close the shortcut
+                currentTypedValue += ('+' + keyDefinition.name + '>')
+
+            }
+
+            // Print the key itself
+            else {
+
+                // Print the value if explicitly defined
+                if (keyDefinition.value != null)
+                    currentTypedValue += keyDefinition.value;
+
+                // Otherwise print the name
+                else
+                    currentTypedValue += ('<' + keyDefinition.name + '>');
+            }
+
+        }
+
+    }
+
+    /**
+     * Return the current batch of typed text. Note that the batch may be
+     * incomplete, as more key events might be processed before the next
+     * batch starts.
+     *
+     * @returns
+     *     The current batch of text.
+     */
+    interpreter.getCurrentText = function getCurrentText() {
+        return currentTypedValue;
+    }
+
+    /**
+     * Return the recording timestamp associated with the start of the
+     * current batch of typed text.
+     *
+     * @returns
+     *     The recording timestamp at which the current batch started.
+     */
+    interpreter.getCurrentTimestamp = function getCurrentTimestamp() {
+        return lastTextTimestamp;
+    }
+
+}
diff --git a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
index 3a0dae131..18db916d4 100644
--- a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
+++ b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
@@ -104,6 +104,16 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
      */
     var KEYFRAME_TIME_INTERVAL = 5000;
 
+    /**
+     * The minimum number of milliseconds which must elapse between key events
+     * before text can be split across multiple frames.
+     *
+     * @private
+     * @constant
+     * @type {Number}
+     */
+    var TYPED_TEXT_INTERVAL = 5000;
+
     /**
      * All frames parsed from the provided blob.
      *
@@ -375,6 +385,26 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
     // Hide cursor unless mouse position is received
     playbackClient.getDisplay().showCursor(false);
 
+    /**
+     * A key event interpreter to split all key events in this recording into
+     * human-readable batches of text.
+     *
+     * @type {!Guacamole.KeyEventInterpreter}
+     */
+    var keyEventInterpreter = new Guacamole.KeyEventInterpreter();
+
+    // Pass through any received batches to the recording ontext handler
+    keyEventInterpreter.onBatch = function onBatch(text, timestamp) {
+
+        // Don't call the callback if it was never set
+        if (!recording.ontext)
+            return;
+
+        // Convert to a recording-relative timestamp and pass through
+        recording.ontext(text, toRelativeTimestamp(timestamp));
+
+    };
+
     /**
      * Handles a newly-received instruction, whether from the main Blob or a
      * tunnel, adding new frames and keyframes as necessary. Load progress is
@@ -421,6 +451,8 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
 
         }
 
+        else if (opcode === 'key')
+            keyEventInterpreter.handleKeyEvent(args);
     };
 
     /**
@@ -487,6 +519,13 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
                     instructionBuffer = '';
                 }
 
+                // If there's any typed text that's yet to be sent to the ontext
+                // handler, send it now
+                var text = keyEventInterpreter.getCurrentText();
+                var timestamp = keyEventInterpreter.getCurrentTimestamp();
+                if (text && recording.ontext)
+                    recording.ontext(text, toRelativeTimestamp(timestamp));
+
                 // Consider recording loaded if tunnel has closed without errors
                 if (!errorEncountered)
                     notifyLoaded();
@@ -872,6 +911,19 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
      */
     this.onpause = null;
 
+    /**
+     * Fired whenever a new batch of typed text extracted from key events
+     * is available.
+     *
+     * @event
+     * @param {!String} text
+     *     The typed text associated with the batch of text.
+     *
+     * @param {!number} timestamp
+     *     The relative timestamp associated with the batch of text.
+     */
+    this.ontext = null;
+
     /**
      * Fired whenever the playback position within the recording changes.
      *
diff --git a/guacamole/src/main/frontend/package-lock.json b/guacamole/src/main/frontend/package-lock.json
index 9ad15bdce..c9f001355 100644
--- a/guacamole/src/main/frontend/package-lock.json
+++ b/guacamole/src/main/frontend/package-lock.json
@@ -16,6 +16,7 @@
                 "csv": "^6.2.5",
                 "datalist-polyfill": "^1.25.1",
                 "file-saver": "^2.0.5",
+                "fuzzysort": "^2.0.4",
                 "jquery": "^3.6.4",
                 "jstz": "^2.1.1",
                 "lodash": "^4.17.21",
@@ -5632,6 +5633,11 @@
                 "url": "https://github.com/sponsors/ljharb"
             }
         },
+        "node_modules/fuzzysort": {
+            "version": "2.0.4",
+            "resolved": "https://registry.npmjs.org/fuzzysort/-/fuzzysort-2.0.4.tgz",
+            "integrity": "sha512-Api1mJL+Ad7W7vnDZnWq5pGaXJjyencT+iKGia2PlHUcSsSzWwIQ3S1isiMpwpavjYtGd2FzhUIhnnhOULZgDw=="
+        },
         "node_modules/gensync": {
             "version": "1.0.0-beta.2",
             "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
@@ -15703,6 +15709,11 @@
             "integrity": "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==",
             "dev": true
         },
+        "fuzzysort": {
+            "version": "2.0.4",
+            "resolved": "https://registry.npmjs.org/fuzzysort/-/fuzzysort-2.0.4.tgz",
+            "integrity": "sha512-Api1mJL+Ad7W7vnDZnWq5pGaXJjyencT+iKGia2PlHUcSsSzWwIQ3S1isiMpwpavjYtGd2FzhUIhnnhOULZgDw=="
+        },
         "gensync": {
             "version": "1.0.0-beta.2",
             "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
diff --git a/guacamole/src/main/frontend/package.json b/guacamole/src/main/frontend/package.json
index 4b7f98630..773d5f80d 100644
--- a/guacamole/src/main/frontend/package.json
+++ b/guacamole/src/main/frontend/package.json
@@ -15,6 +15,7 @@
         "csv": "^6.2.5",
         "datalist-polyfill": "^1.25.1",
         "file-saver": "^2.0.5",
+        "fuzzysort": "^2.0.4",
         "jquery": "^3.6.4",
         "jstz": "^2.1.1",
         "lodash": "^4.17.21",
diff --git a/guacamole/src/main/frontend/src/app/player/directives/player.js b/guacamole/src/main/frontend/src/app/player/directives/player.js
index 7b3e08792..43b1c8ec2 100644
--- a/guacamole/src/main/frontend/src/app/player/directives/player.js
+++ b/guacamole/src/main/frontend/src/app/player/directives/player.js
@@ -77,6 +77,12 @@
  */
 angular.module('player').directive('guacPlayer', ['$injector', function guacPlayer($injector) {
 
+    // Required types
+    const TextBatch = $injector.get('TextBatch');
+
+    // Required services
+    const playerTimeService = $injector.get('playerTimeService');
+
     const config = {
         restrict : 'E',
         templateUrl : 'app/player/templates/player.html'
@@ -142,6 +148,21 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
          */
         $scope.seekPosition = null;
 
+        /**
+         * Any batches of text typed during the recording.
+         *
+         * @type {TextBatch[]}
+         */
+        $scope.textBatches = [];
+
+        /**
+         * Whether or not the key log viewer should be displayed. False by
+         * default unless explicitly enabled by user interaction.
+         *
+         * @type {boolean}
+         */
+        $scope.showKeyLog = false;
+
         /**
          * Whether a seek request is currently in progress. A seek request is
          * in progress if the user is attempting to change the current playback
@@ -161,57 +182,29 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
         var resumeAfterSeekRequest = false;
 
         /**
-         * Formats the given number as a decimal string, adding leading zeroes
-         * such that the string contains at least two digits. The given number
-         * MUST NOT be negative.
+         * Return true if any batches of key event logs are available for this
+         * recording, or false otherwise.
          *
-         * @param {!number} value
-         *     The number to format.
-         *
-         * @returns {!string}
-         *     The decimal string representation of the given value, padded
-         *     with leading zeroes up to a minimum length of two digits.
+         * @return
+         *     True if any batches of key event logs are avaiable for this
+         *     recording, or false otherwise.
          */
-        const zeroPad = function zeroPad(value) {
-            return value > 9 ? value : '0' + value;
+        $scope.hasTextBatches = function hasTextBatches () {
+            return $scope.textBatches.length >= 0;
         };
 
         /**
-         * Formats the given quantity of milliseconds as days, hours, minutes,
-         * and whole seconds, separated by colons (DD:HH:MM:SS). Hours are
-         * included only if the quantity is at least one hour, and days are
-         * included only if the quantity is at least one day. All included
-         * groups are zero-padded to two digits with the exception of the
-         * left-most group.
-         *
-         * @param {!number} value
-         *     The time to format, in milliseconds.
-         *
-         * @returns {!string}
-         *     The given quantity of milliseconds formatted as "DD:HH:MM:SS".
+         * Toggle the visibility of the text key log viewer.
          */
-        $scope.formatTime = function formatTime(value) {
-
-            // Round provided value down to whole seconds
-            value = Math.floor((value || 0) / 1000);
-
-            // Separate seconds into logical groups of seconds, minutes,
-            // hours, etc.
-            var groups = [ 1, 24, 60, 60 ];
-            for (var i = groups.length - 1; i >= 0; i--) {
-                var placeValue = groups[i];
-                groups[i] = zeroPad(value % placeValue);
-                value = Math.floor(value / placeValue);
-            }
-
-            // Format groups separated by colons, stripping leading zeroes and
-            // groups which are entirely zeroes, leaving at least minutes and
-            // seconds
-            var formatted = groups.join(':');
-            return /^[0:]*([0-9]{1,2}(?::[0-9]{2})+)$/.exec(formatted)[1];
-
+        $scope.toggleKeyLogView = function toggleKeyLogView() {
+            $scope.showKeyLog = !$scope.showKeyLog;
         };
 
+        /**
+         * @borrows playerTimeService.formatTime
+         */
+        $scope.formatTime = playerTimeService.formatTime;
+
         /**
          * Pauses playback and decouples the position slider from current
          * playback position, allowing the user to manipulate the slider
@@ -242,32 +235,53 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
             // If a recording is present and there is an active seek request,
             // restore the playback state at the time that request began and
             // begin seeking to the requested position
-            if ($scope.recording && pendingSeekRequest) {
-
-                $scope.seekPosition = null;
-                $scope.operationMessage = 'PLAYER.INFO_SEEK_IN_PROGRESS';
-                $scope.operationProgress = 0;
-
-                // Cancel seek when requested, updating playback position if
-                // that position changed
-                $scope.cancelOperation = function abortSeek() {
-                    $scope.recording.cancel();
-                    $scope.playbackPosition = $scope.seekPosition || $scope.playbackPosition;
-                };
-
-                resumeAfterSeekRequest && $scope.recording.play();
-                $scope.recording.seek($scope.playbackPosition, function seekComplete() {
-                    $scope.operationMessage = null;
-                    $scope.$evalAsync();
-                });
-
-            }
+            if ($scope.recording && pendingSeekRequest)
+                $scope.seekToPlaybackPosition();
 
             // Flag seek request as completed
             pendingSeekRequest = false;
 
         };
 
+        /**
+         * Seek the recording to the specified position within the recording,
+         * in milliseconds.
+         *
+         * @param {Number} timestamp
+         *      The position to seek to within the current record,
+         *      in milliseconds.
+         */
+        $scope.seekToTimestamp = function seekToTimestamp(timestamp) {
+
+            // Set the timestamp and seek to it
+            $scope.playbackPosition = timestamp;
+            $scope.seekToPlaybackPosition();
+
+        };
+
+        /**
+         * Seek the recording to the current playback position value.
+         */
+        $scope.seekToPlaybackPosition = function seekToPlaybackPosition() {
+
+            $scope.seekPosition = null;
+            $scope.operationMessage = 'PLAYER.INFO_SEEK_IN_PROGRESS';
+            $scope.operationProgress = 0;
+
+            // Cancel seek when requested, updating playback position if
+            // that position changed
+            $scope.cancelOperation = function abortSeek() {
+                $scope.recording.cancel();
+                $scope.playbackPosition = $scope.seekPosition || $scope.playbackPosition;
+            };
+
+            resumeAfterSeekRequest && $scope.recording.play();
+            $scope.recording.seek($scope.playbackPosition, function seekComplete() {
+                $scope.operationMessage = null;
+                $scope.$evalAsync();
+            });
+        };
+
         /**
          * Toggles the current playback state. If playback is currently paused,
          * playback is resumed. If playback is currently active, playback is
@@ -342,6 +356,11 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
                     $scope.$evalAsync();
                 };
 
+                // Append any extracted batches of typed text
+                $scope.recording.ontext = function appendTextBatch(text, timestamp) {
+                    $scope.textBatches.push({text, timestamp});
+                }
+
                 // Notify listeners when current position within the recording
                 // has changed
                 $scope.recording.onseek = function positionChanged(position, current, total) {
diff --git a/guacamole/src/main/frontend/src/app/player/directives/textView.js b/guacamole/src/main/frontend/src/app/player/directives/textView.js
new file mode 100644
index 000000000..2a9fbb303
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/player/directives/textView.js
@@ -0,0 +1,137 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+const fuzzysort = require('fuzzysort')
+
+/**
+ * Directive which plays back session recordings.
+ */
+angular.module('player').directive('guacPlayerTextView',
+        ['$injector', function guacPlayer($injector) {
+
+    // Required types
+    const TextBatch = $injector.get('TextBatch');
+
+    // Required services
+    const playerTimeService = $injector.get('playerTimeService');
+
+    const config = {
+        restrict : 'E',
+        templateUrl : 'app/player/templates/textView.html'
+    };
+
+    config.scope = {
+
+        /**
+         * All the batches of text extracted from this recording.
+         *
+         * @type {!TextBatch[]}
+         */
+        textBatches : '=',
+
+        /**
+         * A callback that accepts a timestamp, and seeks the recording to
+         * that provided timestamp.
+         *
+         * @type {!Function}
+         */
+        seek: '&',
+
+        /**
+         * The current position within the recording.
+         *
+         * @type {!Number}
+         */
+        currentPosition: '='
+
+    };
+
+    config.controller = ['$scope', '$element', '$injector',
+            function guacPlayerController($scope, $element) {
+
+        /**
+         * The phrase to search within the text batches in order to produce the
+         * filtered list for display.
+         *
+         * @type {String}
+         */
+        $scope.searchPhrase = '';
+
+        /**
+         * The text batches that match the current search phrase, or all
+         * batches if no search phrase is set.
+         *
+         * @type {!TextBatch[]}
+         */
+        $scope.filteredBatches = $scope.textBatches;
+
+        /**
+         * Whether or not the key log viewer should be full-screen. False by
+         * default unless explicitly enabled by user interaction.
+         *
+         * @type {boolean}
+         */
+        $scope.fullscreenKeyLog = false;
+
+        /**
+         * Toggle whether the key log viewer should take up the whole screen.
+         */
+        $scope.toggleKeyLogFullscreen = function toggleKeyLogFullscreen() {
+            $element.toggleClass("fullscreen");
+        };
+
+        /**
+         * Filter the provided text batches using the provided search phrase to
+         * generate the list of filtered batches, or set to all provided
+         * batches if no search phrase is provided.
+         *
+         * @param {String} searchPhrase
+         *     The phrase to search the text batches for. If no phrase is
+         *     provided, the list of batches will not be filtered.
+         */
+        const applyFilter = searchPhrase => {
+
+            // If there's search phrase entered, search the text within the
+            // batches for it
+            if (searchPhrase)
+                $scope.filteredBatches = fuzzysort.go(
+                    searchPhrase, $scope.textBatches, {key: 'text'})
+                .map(result => result.obj);
+
+            // Otherwise, do not filter the batches
+            else
+                $scope.filteredBatches = $scope.textBatches;
+
+        };
+
+        // Reapply the filter to the updated text batches
+        $scope.$watch('textBatches', applyFilter);
+
+        // Reapply the filter whenever the search phrase is updated
+        $scope.$watch('searchPhrase', applyFilter);
+
+        /**
+         * @borrows playerTimeService.formatTime
+         */
+        $scope.formatTime = playerTimeService.formatTime;
+
+    }];
+
+    return config;
+}]);
diff --git a/guacamole/src/main/frontend/src/app/player/services/playerTimeService.js b/guacamole/src/main/frontend/src/app/player/services/playerTimeService.js
new file mode 100644
index 000000000..b005cbc20
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/player/services/playerTimeService.js
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * 'License'); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * A service for formatting time, specifically for the recording player.
+ */
+angular.module('player').factory('playerTimeService',
+        ['$injector', function playerTimeService($injector) {
+
+    const service = {};
+
+    /**
+     * Formats the given number as a decimal string, adding leading zeroes
+     * such that the string contains at least two digits. The given number
+     * MUST NOT be negative.
+     *
+     * @param {!number} value
+     *     The number to format.
+     *
+     * @returns {!string}
+     *     The decimal string representation of the given value, padded
+     *     with leading zeroes up to a minimum length of two digits.
+     */
+    const zeroPad = function zeroPad(value) {
+        return value > 9 ? value : '0' + value;
+    };
+
+    /**
+     * Formats the given quantity of milliseconds as days, hours, minutes,
+     * and whole seconds, separated by colons (DD:HH:MM:SS). Hours are
+     * included only if the quantity is at least one hour, and days are
+     * included only if the quantity is at least one day. All included
+     * groups are zero-padded to two digits with the exception of the
+     * left-most group.
+     *
+     * @param {!number} value
+     *     The time to format, in milliseconds.
+     *
+     * @returns {!string}
+     *     The given quantity of milliseconds formatted as "DD:HH:MM:SS".
+     */
+    service.formatTime = function formatTime(value) {
+
+        // Round provided value down to whole seconds
+        value = Math.floor((value || 0) / 1000);
+
+        // Separate seconds into logical groups of seconds, minutes,
+        // hours, etc.
+        var groups = [ 1, 24, 60, 60 ];
+        for (var i = groups.length - 1; i >= 0; i--) {
+            var placeValue = groups[i];
+            groups[i] = zeroPad(value % placeValue);
+            value = Math.floor(value / placeValue);
+        }
+
+        // Format groups separated by colons, stripping leading zeroes and
+        // groups which are entirely zeroes, leaving at least minutes and
+        // seconds
+        var formatted = groups.join(':');
+        return /^[0:]*([0-9]{1,2}(?::[0-9]{2})+)$/.exec(formatted)[1];
+
+    };
+
+    return service;
+
+}]);
diff --git a/guacamole/src/main/frontend/src/app/player/styles/player.css b/guacamole/src/main/frontend/src/app/player/styles/player.css
index 36a783eca..a1566810a 100644
--- a/guacamole/src/main/frontend/src/app/player/styles/player.css
+++ b/guacamole/src/main/frontend/src/app/player/styles/player.css
@@ -50,7 +50,6 @@ guac-player {
 }
 
 guac-player .guac-player-display {
-    position: absolute;
     top: 0;
     left: 0;
     width: 100%;
@@ -60,6 +59,7 @@ guac-player .guac-player-display {
 guac-player .guac-player-controls {
 
     position: absolute;
+    padding-bottom: 0;
     left: 0;
     bottom: 0;
     width: 100%;
@@ -107,6 +107,18 @@ guac-player .guac-player-controls {
     background-image: url('images/action-icons/guac-pause.svg');
 }
 
+.guac-player-controls .guac-player-buttons {
+    display: flex;
+    flex-direction: row;
+    align-items: center;
+}
+
+.guac-player-controls .guac-player-keys {
+    margin-left: auto;
+    padding-right: 0.5em;
+    cursor: pointer;
+}
+
 guac-player .guac-player-status {
 
     position: fixed;
@@ -145,3 +157,50 @@ guac-player .guac-player-status {
     flex-direction: column;
 
 }
+
+.guac-player-container {
+
+    height: 100%;
+
+    display: -webkit-box;
+    display: -webkit-flex;
+    display: -moz-box;
+    display: -ms-flexbox;
+    display: flex;
+
+    -webkit-flex-direction: row;
+    -ms-flex-direction: row;
+    flex-direction: row;
+
+    -ms-flex-pack: space-between;
+    -webkit-box-pack: justify;
+    -webkit-justify-content: space-between;
+    justify-content: space-between;
+
+}
+
+guac-player-display {
+
+    flex-grow: 5;
+
+    /* Required for horizontal resizing to work */
+    min-width: 0;
+
+}
+
+guac-player-text-view {
+
+    min-width: 25em;
+    flex-basis: 0;
+
+    /* Make room for the control bar at the bottom */
+    height: calc(100% - 48px);
+
+}
+
+guac-player-text-view.fullscreen {
+
+    min-width: 100%;
+
+}
+
diff --git a/guacamole/src/main/frontend/src/app/player/styles/textView.css b/guacamole/src/main/frontend/src/app/player/styles/textView.css
new file mode 100644
index 000000000..3a73c940e
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/player/styles/textView.css
@@ -0,0 +1,115 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/*
+ * NOTE: This session recording player implementation is based on the Session
+ * Recording Player for Glyptodon Enterprise which is available at
+ * https://github.com/glyptodon/glyptodon-enterprise-player under the
+ * following license:
+ *
+ * Copyright (C) 2019 Glyptodon, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+.text-batches {
+
+    display: flex;
+    flex-direction: column;
+    overflow-y: scroll;
+
+}
+
+.text-batches .text-batch {
+
+    margin-bottom: 1em;
+    margin-left: 0.5em;
+    cursor: pointer;
+
+}
+
+.text-batches .text-batch .timestamp {
+
+    white-space: pre-wrap;
+    color: blue;
+
+}
+
+.guac-player-text-container {
+
+    height: 100%;
+    display: flex;
+    flex-direction: column;
+    background-color: white;
+    color: black;
+}
+
+.guac-player-text-container .text-controls {
+
+    display: flex;
+    flex-direction: row;
+    align-items: center;
+
+}
+
+.guac-player-text-container .text-controls .filter {
+
+    flex-grow: 5;
+
+}
+
+.guac-player-text-container .text-controls .fullscreen-button {
+
+    background-image: url('images/fullscreen.svg');
+    background-size: contain;
+    cursor: pointer;
+    height: 22px;
+    width: 22px;
+    margin-right: 0.25em;
+
+}
+
+.guac-player-text-container .result-count {
+
+    font-weight: bold;
+    margin: 0.5em;
+
+}
+
+.guac-player-text-container .filter {
+
+    margin: 0.25em;
+
+}
diff --git a/guacamole/src/main/frontend/src/app/player/templates/player.html b/guacamole/src/main/frontend/src/app/player/templates/player.html
index 91594b40e..eeb3744b5 100644
--- a/guacamole/src/main/frontend/src/app/player/templates/player.html
+++ b/guacamole/src/main/frontend/src/app/player/templates/player.html
@@ -1,9 +1,25 @@
-<!-- Actual playback display -->
-<guac-player-display display="recording.getDisplay()"
-                     ng-click="togglePlayback()"></guac-player-display>
+<div class="guac-player-container">
+
+    <!-- Actual playback display -->
+    <guac-player-display display="recording.getDisplay()"
+                        ng-click="togglePlayback()"></guac-player-display>
+
+    <!-- Show the text viewer only if text exists -->
+    <guac-player-text-view ng-show="showKeyLog"
+                        text-batches="textBatches"
+                        seek="seekToTimestamp(timestamp)"
+                        current-position="seekPosition || playbackPosition"
+                        duration="recording.getDuration()"
+    ></guac-player-text-view>
+
+</div>
 
 <!-- Player controls -->
-<div class="guac-player-controls" ng-show="recording">
+<div class="guac-player-controls" ng-show="recording"
+        ng-class="{
+            'paused' : !recording.isPlaying(),
+            'playing' : recording.isPlaying()
+        }">
 
     <!-- Playback position slider -->
     <input class="guac-player-seek" type="range" min="0" step="1"
@@ -12,22 +28,33 @@
            ng-model="playbackPosition"
            ng-on-change="commitSeekRequest()">
 
-    <!-- Play button -->
-    <button class="guac-player-play"
-            ng-attr-title="{{ 'PLAYER.ACTION_PLAY' | translate }}"
-            ng-click="recording.play()"
-            ng-hide="recording.isPlaying()"><span class="play-icon"></span></button>
+    <div class="guac-player-buttons">
 
-    <!-- Pause button -->
-    <button class="guac-player-pause"
-            ng-attr-title="{{ 'PLAYER.ACTION_PAUSE' | translate }}"
-            ng-click="recording.pause()"
-            ng-show="recording.isPlaying()"><span class="pause-icon"></span></button>
+        <!-- Play button -->
+        <button class="guac-player-play"
+                ng-attr-title="{{ 'PLAYER.ACTION_PLAY' | translate }}"
+                ng-click="recording.play()"
+                ng-hide="recording.isPlaying()"><span class="play-icon"></span></button>
 
-    <!-- Playback position and duration -->
-    <span class="guac-player-position">
-        {{ formatTime(playbackPosition) }} / {{ formatTime(recording.getDuration()) }}
-    </span>
+        <!-- Pause button -->
+        <button class="guac-player-pause"
+                ng-attr-title="{{ 'PLAYER.ACTION_PAUSE' | translate }}"
+                ng-click="recording.pause()"
+                ng-show="recording.isPlaying()"><span class="pause-icon"></span></button>
+
+        <!-- Playback position and duration -->
+        <span class="guac-player-position">
+            {{ formatTime(playbackPosition) }} / {{ formatTime(recording.getDuration()) }}
+        </span>
+
+        <span ng-show="hasTextBatches()" class="guac-player-keys" ng-click="toggleKeyLogView()">
+            {{ 'PLAYER.ACTION_SHOW_KEY_LOG' | translate }}
+        </span>
+
+        <span ng-show="!hasTextBatches()" class="guac-player-keys disabled">
+            {{ 'PLAYER.INFO_NO_KEY_LOG' | translate }}
+        </span>
+    </div>
 
 </div>
 
diff --git a/guacamole/src/main/frontend/src/app/player/templates/textView.html b/guacamole/src/main/frontend/src/app/player/templates/textView.html
new file mode 100644
index 000000000..1d30da58f
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/player/templates/textView.html
@@ -0,0 +1,23 @@
+<div class="guac-player-text-container">
+
+    <div class="text-controls">
+        <div class="filter">
+            <input class="search-string"
+                placeholder="{{'PLAYER.FIELD_PLACEHOLDER_TEXT_BATCH_FILTER' | translate}}"
+                type="text" ng-model="searchPhrase">
+        </div>
+        <span class="fullscreen-button" ng-click="toggleKeyLogFullscreen()"></span>
+    </div>
+
+    <div class="result-count"
+            ng-show="searchPhrase.length"
+            translate="PLAYER.INFO_NUMBER_OF_RESULTS"
+            translate-values="{RESULTS: filteredBatches.length}"></div>
+
+    <div class="text-batches">
+        <div ng-repeat="batch in filteredBatches" class="text-batch" ng-click="seek({timestamp: batch.timestamp})">
+            <div class="timestamp">{{ formatTime(batch.timestamp) }}</div>
+            <div class="text">{{ batch.text }}</div>
+        </span>
+    </div>
+</div>
diff --git a/guacamole/src/main/frontend/src/app/player/types/TextBatch.js b/guacamole/src/main/frontend/src/app/player/types/TextBatch.js
new file mode 100644
index 000000000..fbe92c7d2
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/player/types/TextBatch.js
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Service which defines the TextBatch class.
+ */
+angular.module('player').factory('TextBatch', [function defineTextBatch() {
+
+    /**
+     * A batch of text associated with a recording. The batch consists of a
+     * string representation of the text that would be typed based on the key
+     * events in the recording, as well as a timestamp when the batch started.
+     *
+     * @constructor
+     * @param {TextBatch|Object} [template={}]
+     *     The object whose properties should be copied within the new TextBatch.
+     */
+    const TextBatch = function TextBatch(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * The text that was typed in this batch.
+         *
+         * @type String
+         */
+        this.text = template.text;
+
+        /**
+         * The timestamp at which the batch of text was typed.
+         *
+         * @type Number
+         */
+        this.timestamp = template.timestamp;
+
+    };
+
+    return TextBatch;
+
+}]);
diff --git a/guacamole/src/main/frontend/src/app/settings/styles/history-player.css b/guacamole/src/main/frontend/src/app/settings/styles/history-player.css
index 03d562a53..7503cc8c3 100644
--- a/guacamole/src/main/frontend/src/app/settings/styles/history-player.css
+++ b/guacamole/src/main/frontend/src/app/settings/styles/history-player.css
@@ -96,7 +96,7 @@
     background: rgba(0, 0, 0, 0.5);
 }
 
-.settings.connectionHistoryPlayer.playing .guac-player-controls {
+.settings.connectionHistoryPlayer .guac-player-controls.playing {
     opacity: 0;
     -webkit-transition: opacity 0.25s linear 0.25s;
     -moz-transition: opacity 0.25s linear 0.25s;
@@ -104,8 +104,8 @@
     transition: opacity 0.25s linear 0.25s;
 }
 
-.settings.connectionHistoryPlayer.paused .guac-player-controls,
-.settings.connectionHistoryPlayer.playing:hover .guac-player-controls {
+.settings.connectionHistoryPlayer .guac-player-controls.paused,
+.settings.connectionHistoryPlayer .guac-player-controls.playing:hover {
     opacity: 1;
     -webkit-transition-delay: 0s;
     -moz-transition-delay: 0s;
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsConnectionHistoryPlayer.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsConnectionHistoryPlayer.html
index 41d6aa873..d986864d1 100644
--- a/guacamole/src/main/frontend/src/app/settings/templates/settingsConnectionHistoryPlayer.html
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsConnectionHistoryPlayer.html
@@ -1,11 +1,6 @@
-<guac-viewport class="settings view connectionHistoryPlayer"
-     ng-class="{
-         'no-recording' : !selectedRecording,
-         'paused' : !playing,
-         'playing' : playing
-     }">
+<guac-viewport class="settings view connectionHistoryPlayer">
 
     <!-- Player for selected recording -->
     <guac-player src="tunnel"></guac-player>
 
-</guac-viewport>
\ No newline at end of file
+</guac-viewport>
diff --git a/guacamole/src/main/frontend/src/images/fullscreen.svg b/guacamole/src/main/frontend/src/images/fullscreen.svg
new file mode 100644
index 000000000..52e77e7da
--- /dev/null
+++ b/guacamole/src/main/frontend/src/images/fullscreen.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="540" height="540" viewBox="0 0 142.875 142.875"><path d="M0 0v160h40V40h120V0H0zm380 0v40h120v120h40V0H380zM0 380v160h160v-40H40V380H0zm500 0v120H380v40h160V380h-40z" style="fill:#000;stroke-width:.999999" transform="scale(.26458)"/><path d="M84.667 68.792h58.208v148.167H84.667z" style="fill:none;stroke-width:.264583" transform="translate(-42.333 -68.792)"/><path d="M52.917 79.375h121.708v121.708H52.917z" style="fill:none;stroke-width:.264583" transform="translate(-42.333 -68.792)"/></svg>
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 0826f3354..a2df4ff48 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -478,12 +478,17 @@
 
     "PLAYER" : {
 
-        "ACTION_CANCEL" : "@:APP.ACTION_CANCEL",
-        "ACTION_PAUSE"  : "@:APP.ACTION_PAUSE",
-        "ACTION_PLAY"   : "@:APP.ACTION_PLAY",
+        "ACTION_CANCEL"       : "@:APP.ACTION_CANCEL",
+        "ACTION_PAUSE"        : "@:APP.ACTION_PAUSE",
+        "ACTION_PLAY"         : "@:APP.ACTION_PLAY",
+        "ACTION_SHOW_KEY_LOG" : "Keystroke Log",
 
         "INFO_LOADING_RECORDING" : "Your recording is now being loaded. Please wait...",
-        "INFO_SEEK_IN_PROGRESS"  : "Seeking to the requested position. Please wait..."
+        "INFO_NO_KEY_LOG"        : "Keystroke Log Unavailable",
+        "INFO_NUMBER_OF_RESULTS" : "{RESULTS} {RESULTS, plural, one{Match} other{Matches}}",
+        "INFO_SEEK_IN_PROGRESS"  : "Seeking to the requested position. Please wait...",
+
+        "FIELD_PLACEHOLDER_TEXT_BATCH_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER"
 
     },
 

From 55f1fc2aaa31a5e17abe60e883f19e7abcd770af Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 26 Jun 2023 18:22:38 +0000
Subject: [PATCH 220/289] GUACAMOLE-1820: Extract and display richer
 information about key events.

---
 .../webapp/modules/KeyEventInterpreter.js     | 201 +++++++++++++-----
 .../main/webapp/modules/SessionRecording.js   |  62 +++---
 .../src/app/player/directives/player.js       |  10 +-
 .../src/app/player/directives/textView.js     |   9 +-
 .../app/player/services/playerTimeService.js  |  27 +++
 .../src/app/player/styles/textView.css        |  49 ++---
 .../src/app/player/templates/textView.html    |  12 +-
 .../src/app/player/types/TextBatch.js         |  57 -----
 8 files changed, 244 insertions(+), 183 deletions(-)
 delete mode 100644 guacamole/src/main/frontend/src/app/player/types/TextBatch.js

diff --git a/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js b/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
index 957a90c6b..3e37629c1 100644
--- a/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
+++ b/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
@@ -22,18 +22,24 @@ var Guacamole = Guacamole || {};
 /**
  * An object that will accept raw key events and produce human readable text
  * batches, seperated by at least `batchSeperation` milliseconds, which can be
- * retrieved through the onBatch callback or by calling getCurrentBatch().
+ * retrieved through the onbatch callback or by calling getCurrentBatch().
  *
  * NOTE: The event processing logic and output format is based on the `guaclog`
  * tool, with the addition of batching support.
  *
  * @constructor
+ *
  * @param {number} [batchSeperation=5000]
  *     The minimum number of milliseconds that must elapse between subsequent
  *     batches of key-event-generated text. If 0 or negative, no splitting will
  *     occur, resulting in a single batch for all provided key events.
+ *
+ * @param {number} [startTimestamp=0]
+ *     The starting timestamp for the recording being intepreted. If provided,
+ *     the timestamp of each intepreted event will be relative to this timestamp.
+ *     If not provided, the raw recording timestamp will be used.
  */
-Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
+Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, startTimestamp) {
 
     /**
      * Reference to this Guacamole.KeyEventInterpreter.
@@ -47,6 +53,10 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
     if (batchSeperation === undefined || batchSeperation === null)
         batchSeperation = 5000;
 
+    // Default to 0 seconds to keep the raw timestamps
+    if (startTimestamp === undefined || startTimestamp === null)
+        startTimestamp = 0;
+
     /**
      * A definition for a known key.
      *
@@ -212,21 +222,14 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
     var pressedKeys = {};
 
     /**
-     * A human-readable representation of all keys pressed since the last keyframe.
+     * The current key event batch, containing a representation of all key
+     * events processed since the end of the last batch passed to onbatch.
+     * Null if no key events have been processed yet.
      *
      * @private
-     * @type {String}
+     * @type {!KeyEventBatch}
      */
-    var currentTypedValue = '';
-
-    /**
-     * The timestamp of the key event that started the most recent batch of
-     * text content. If 0, no key events have been processed yet.
-     *
-     * @private
-     * @type {Number}
-     */
-    var lastTextTimestamp = 0;
+    var currentBatch = null;
 
     /**
      * The timestamp of the most recent key event processed.
@@ -265,9 +268,9 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
      * @param {Number} keysym
      *     The keysym to produce a UTF-8 KeyDefinition for, if valid.
      *
-     * @returns
-     *     Return a KeyDefinition for the provided keysym, if it it's a valid
-     *     UTF-8 keysym, or null otherwise.
+     * @returns {KeyDefinition}
+     *     A KeyDefinition for the provided keysym, if it's a valid UTF-8
+     *     keysym, or null otherwise.
      */
     function getUnicodeKeyDefinition(keysym) {
 
@@ -279,7 +282,7 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
         var mask;
         var bytes;
 
-        /* Determine size and initial byte mask */
+        // Determine size and initial byte mask
         if (codepoint <= 0x007F) {
             mask  = 0x00;
             bytes = 1;
@@ -309,7 +312,7 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
         var name = new TextDecoder("utf-8").decode(byteArray);
 
         // Create and return the definition
-        return new KeyDefinition({keysym: keysym.toString(), name: name, value: name, modifier: false});
+        return new KeyDefinition({keysym: keysym, name: name, value: name, modifier: false});
 
     }
 
@@ -320,7 +323,7 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
      * @param {Number} keysym
      *     The keysym to return a KeyDefinition for.
      *
-     * @returns
+     * @returns {KeyDefinition}
      *     A KeyDefinition corresponding to the provided keysym.
      */
     function getKeyDefinitionByKeysym(keysym) {
@@ -350,24 +353,19 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
      * previous key event.
      *
      * @event
-     * @param {!String} text
-     *     The typed text associated with the batch of text.
-     *
-     * @param {!number} timestamp
-     *     The raw recording timestamp associated with the first key event
-     *     that started this batch of text.
+     * @param {!Guacamole.KeyEventInterpreter.KeyEventBatch}
      */
-    interpreter.onBatch = null;
+    this.onbatch = null;
 
     /**
      * Handles a raw key event, potentially appending typed text to the
-     * current batch, and calling onBatch with the current batch, if the
+     * current batch, and calling onbatch with the current batch, if the
      * callback is set and a new batch is about to be started.
      *
      * @param {!string[]} args
      *     The arguments of the key event.
      */
-    interpreter.handleKeyEvent = function handleKeyEvent(args) {
+    this.handleKeyEvent = function handleKeyEvent(args) {
 
         // The X11 keysym
         var keysym = parseInt(args[0]);
@@ -379,10 +377,8 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
         var timestamp = parseInt(args[2]);
 
         // If no current batch exists, start a new one now
-        if (!lastTextTimestamp) {
-            lastTextTimestamp = timestamp;
-            lastKeyEvent = timestamp;
-        }
+        if (!currentBatch)
+            currentBatch = new Guacamole.KeyEventInterpreter.KeyEventBatch();
 
         // Only switch to a new batch of text if sufficient time has passed
         // since the last key event
@@ -394,12 +390,11 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
 
             // Call the handler with the current batch of text and the timestamp
             // at which the current batch started
-            if (currentTypedValue && interpreter.onBatch)
-                interpreter.onBatch(currentTypedValue, lastTextTimestamp);
+            if (currentBatch.events.length && interpreter.onbatch)
+                interpreter.onbatch(currentBatch);
 
             // Move on to the next batch of text
-            currentTypedValue = '';
-            lastTextTimestamp = 0;
+            currentBatch = new Guacamole.KeyEventInterpreter.KeyEventBatch();
 
         }
 
@@ -417,9 +412,11 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
         // (non-modifier) key is pressed
         else if (pressed) {
 
+            var relativeTimestap = timestamp - startTimestamp;
+
             if (isShortcut()) {
 
-                currentTypedValue += '<';
+                var shortcutText = '<';
 
                 var firstKey = true;
 
@@ -431,30 +428,56 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
 
                     // Print name of key
                     if (firstKey) {
-                        currentTypedValue += pressedKeyDefinition.name;
+                        shortcutText += pressedKeyDefinition.name;
                         firstKey = false;
                     }
 
                     else
-                        currentTypedValue += ('+' + pressedKeyDefinition.name);
+                        shortcutText += ('+' + pressedKeyDefinition.name);
 
                 }
 
                 // Finally, append the printable key to close the shortcut
-                currentTypedValue += ('+' + keyDefinition.name + '>')
+                shortcutText += ('+' + keyDefinition.name + '>')
+
+                // Add the shortcut to the current batch
+                currentBatch.simpleValue += shortcutText;
+                currentBatch.events.push(new Guacamole.KeyEventInterpreter.KeyEvent(
+                        shortcutText, false, relativeTimestap));
 
             }
 
             // Print the key itself
             else {
 
+                var keyText;
+                var typed;
+
                 // Print the value if explicitly defined
-                if (keyDefinition.value != null)
-                    currentTypedValue += keyDefinition.value;
+                if (keyDefinition.value != null) {
+
+                    keyText = keyDefinition.value;
+                    typed = true;
+
+                }
 
                 // Otherwise print the name
-                else
-                    currentTypedValue += ('<' + keyDefinition.name + '>');
+                else {
+
+                    keyText = ('<' + keyDefinition.name + '>');
+
+                    // While this is a representation for a single character,
+                    // the key text is the name of the key, not the actual
+                    // character itself
+                    typed = false;
+
+                }
+
+                // Add the key to the current batch
+                currentBatch.simpleValue += keyText;
+                currentBatch.events.push(new Guacamole.KeyEventInterpreter.KeyEvent(
+                        keyText, typed, relativeTimestap));
+
             }
 
         }
@@ -466,22 +489,90 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation) {
      * incomplete, as more key events might be processed before the next
      * batch starts.
      *
-     * @returns
+     * @returns {Guacamole.KeyEventInterpreter.KeyEventBatch}
      *     The current batch of text.
      */
-    interpreter.getCurrentText = function getCurrentText() {
-        return currentTypedValue;
+    this.getCurrentBatch = function getCurrentBatch() {
+        return currentBatch;
     }
+}
+
+/**
+ * A granular description of an extracted key event, including a human-readable
+ * text representation of the event, whether the event is directly typed or not,
+ * and the timestamp when the event occured.
+ *
+ * @constructor
+ * @param {!String} text
+ *     A human-readable representation of the event.
+ *
+ * @param {!boolean} typed
+ *     True if this event represents a directly-typed character, or false
+ *     otherwise.
+ *
+ * @param {!Number} timestamp
+ *     The timestamp from the recording when this event occured.
+ */
+Guacamole.KeyEventInterpreter.KeyEvent = function KeyEvent(text, typed, timestamp) {
 
     /**
-     * Return the recording timestamp associated with the start of the
-     * current batch of typed text.
+     * A human-readable representation of the event. If a printable character
+     * was directly typed, this will just be that character. Otherwise it will
+     * be a string describing the event.
      *
-     * @returns
-     *     The recording timestamp at which the current batch started.
+     * @type {!String}
      */
-    interpreter.getCurrentTimestamp = function getCurrentTimestamp() {
-        return lastTextTimestamp;
-    }
+    this.text = text;
 
+    /**
+     * True if this text of this event is exactly a typed character, or false
+     * otherwise.
+     *
+     * @type {!boolean}
+     */
+    this.typed = typed;
+
+    /**
+     * The timestamp from the recording when this event occured. If a
+     * `startTimestamp` value was provided to the interpreter constructor, this
+     * will be relative to start of the recording. If not, it will be the raw
+     * timestamp from the key event.
+     *
+     * @type {!Number}
+     */
+    this.timestamp = timestamp;
+
+};
+
+/**
+ * A series of intepreted key events, seperated by at least the configured
+ * batchSeperation value from any other key events in the recording corresponding
+ * to the interpreted key events. A batch will always consist of at least one key
+ * event, and an associated simplified representation of the event(s).
+ *
+ * @constructor
+ * @param {!Guacamole.KeyEventInterpreter.KeyEvent[]} events
+ *     The interpreted key events for this batch.
+ *
+ * @param {!String} simpleValue
+ *     The simplified, human-readable value representing the key events for
+ *     this batch.
+ */
+Guacamole.KeyEventInterpreter.KeyEventBatch = function KeyEventBatch(events, simpleValue) {
+
+    /**
+     * All key events for this batch.
+     *
+     * @type {!Guacamole.KeyEventInterpreter.KeyEvent[]}
+     */
+    this.events = events || [];
+
+    /**
+     * The simplified, human-readable value representing the key events for
+     * this batch, equivalent to concatenating the `text` field of all key
+     * events in the batch.
+     *
+     * @type {!String}
+     */
+    this.simpleValue = simpleValue || '';
 }
diff --git a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
index 18db916d4..619f78fba 100644
--- a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
+++ b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
@@ -104,16 +104,6 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
      */
     var KEYFRAME_TIME_INTERVAL = 5000;
 
-    /**
-     * The minimum number of milliseconds which must elapse between key events
-     * before text can be split across multiple frames.
-     *
-     * @private
-     * @constant
-     * @type {Number}
-     */
-    var TYPED_TEXT_INTERVAL = 5000;
-
     /**
      * All frames parsed from the provided blob.
      *
@@ -387,23 +377,35 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
 
     /**
      * A key event interpreter to split all key events in this recording into
-     * human-readable batches of text.
+     * human-readable batches of text. Constrcution is deferred until the first
+     * event is processed, to enable recording-relative timestamps.
      *
      * @type {!Guacamole.KeyEventInterpreter}
      */
-    var keyEventInterpreter = new Guacamole.KeyEventInterpreter();
+    var keyEventInterpreter = null;
 
-    // Pass through any received batches to the recording ontext handler
-    keyEventInterpreter.onBatch = function onBatch(text, timestamp) {
+    /**
+     * Initialize the key interpreter. This function should be called only once
+     * with the first timestamp in the recording as an argument.
+     *
+     * @private
+     * @param {!number} startTimestamp
+     *     The timestamp of the first frame in the recording, i.e. the start of
+     *     the recording.
+     */
+    function initializeKeyInterpreter(startTimestamp) {
 
-        // Don't call the callback if it was never set
-        if (!recording.ontext)
-            return;
+        keyEventInterpreter = new Guacamole.KeyEventInterpreter(null, startTimestamp);
 
-        // Convert to a recording-relative timestamp and pass through
-        recording.ontext(text, toRelativeTimestamp(timestamp));
+        // Pass through any received batches to the recording ontext handler
+        keyEventInterpreter.onbatch = function onbatch(batch) {
 
-    };
+            // Pass the batch through if a handler is set
+            if (recording.ontext)
+                recording.ontext(batch);
+
+        };
+    }
 
     /**
      * Handles a newly-received instruction, whether from the main Blob or a
@@ -436,6 +438,11 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
             frames.push(frame);
             frameStart = frameEnd;
 
+            // If this is the first frame, intialize the key event interpreter
+            // with the timestamp of the first frame
+            if (frames.length === 1)
+                initializeKeyInterpreter(timestamp);
+
             // This frame should eventually become a keyframe if enough data
             // has been processed and enough recording time has elapsed, or if
             // this is the absolute first frame
@@ -443,6 +450,7 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
                     && timestamp - frames[lastKeyframe].timestamp >= KEYFRAME_TIME_INTERVAL)) {
                 frame.keyframe = true;
                 lastKeyframe = frames.length - 1;
+
             }
 
             // Notify that additional content is available
@@ -521,10 +529,9 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
 
                 // If there's any typed text that's yet to be sent to the ontext
                 // handler, send it now
-                var text = keyEventInterpreter.getCurrentText();
-                var timestamp = keyEventInterpreter.getCurrentTimestamp();
-                if (text && recording.ontext)
-                    recording.ontext(text, toRelativeTimestamp(timestamp));
+                var batch = keyEventInterpreter.getCurrentBatch();
+                if (batch && recording.ontext)
+                    recording.ontext(batch);
 
                 // Consider recording loaded if tunnel has closed without errors
                 if (!errorEncountered)
@@ -916,11 +923,8 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
      * is available.
      *
      * @event
-     * @param {!String} text
-     *     The typed text associated with the batch of text.
-     *
-     * @param {!number} timestamp
-     *     The relative timestamp associated with the batch of text.
+     * @param {!Guacamole.KeyEventInterpreter.KeyEventBatch} batch
+     *     The batch of extracted text.
      */
     this.ontext = null;
 
diff --git a/guacamole/src/main/frontend/src/app/player/directives/player.js b/guacamole/src/main/frontend/src/app/player/directives/player.js
index 43b1c8ec2..7e50dd7af 100644
--- a/guacamole/src/main/frontend/src/app/player/directives/player.js
+++ b/guacamole/src/main/frontend/src/app/player/directives/player.js
@@ -77,9 +77,6 @@
  */
 angular.module('player').directive('guacPlayer', ['$injector', function guacPlayer($injector) {
 
-    // Required types
-    const TextBatch = $injector.get('TextBatch');
-
     // Required services
     const playerTimeService = $injector.get('playerTimeService');
 
@@ -151,7 +148,7 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
         /**
          * Any batches of text typed during the recording.
          *
-         * @type {TextBatch[]}
+         * @type {Guacamole.KeyEventInterpeter.KeyEventBatch[]}
          */
         $scope.textBatches = [];
 
@@ -277,6 +274,7 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
 
             resumeAfterSeekRequest && $scope.recording.play();
             $scope.recording.seek($scope.playbackPosition, function seekComplete() {
+                $scope.seekPosition = null;
                 $scope.operationMessage = null;
                 $scope.$evalAsync();
             });
@@ -357,8 +355,8 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
                 };
 
                 // Append any extracted batches of typed text
-                $scope.recording.ontext = function appendTextBatch(text, timestamp) {
-                    $scope.textBatches.push({text, timestamp});
+                $scope.recording.ontext = function appendTextBatch(batch) {
+                    $scope.textBatches.push(batch);
                 }
 
                 // Notify listeners when current position within the recording
diff --git a/guacamole/src/main/frontend/src/app/player/directives/textView.js b/guacamole/src/main/frontend/src/app/player/directives/textView.js
index 2a9fbb303..3ff5b1b17 100644
--- a/guacamole/src/main/frontend/src/app/player/directives/textView.js
+++ b/guacamole/src/main/frontend/src/app/player/directives/textView.js
@@ -25,9 +25,6 @@ const fuzzysort = require('fuzzysort')
 angular.module('player').directive('guacPlayerTextView',
         ['$injector', function guacPlayer($injector) {
 
-    // Required types
-    const TextBatch = $injector.get('TextBatch');
-
     // Required services
     const playerTimeService = $injector.get('playerTimeService');
 
@@ -41,7 +38,7 @@ angular.module('player').directive('guacPlayerTextView',
         /**
          * All the batches of text extracted from this recording.
          *
-         * @type {!TextBatch[]}
+         * @type {!Guacamole.KeyEventInterpeter.KeyEventBatch[]}
          */
         textBatches : '=',
 
@@ -77,7 +74,7 @@ angular.module('player').directive('guacPlayerTextView',
          * The text batches that match the current search phrase, or all
          * batches if no search phrase is set.
          *
-         * @type {!TextBatch[]}
+         * @type {!Guacamole.KeyEventInterpeter.KeyEventBatch[]}
          */
         $scope.filteredBatches = $scope.textBatches;
 
@@ -111,7 +108,7 @@ angular.module('player').directive('guacPlayerTextView',
             // batches for it
             if (searchPhrase)
                 $scope.filteredBatches = fuzzysort.go(
-                    searchPhrase, $scope.textBatches, {key: 'text'})
+                    searchPhrase, $scope.textBatches, {key: 'simpleValue'})
                 .map(result => result.obj);
 
             // Otherwise, do not filter the batches
diff --git a/guacamole/src/main/frontend/src/app/player/services/playerTimeService.js b/guacamole/src/main/frontend/src/app/player/services/playerTimeService.js
index b005cbc20..919c4eec9 100644
--- a/guacamole/src/main/frontend/src/app/player/services/playerTimeService.js
+++ b/guacamole/src/main/frontend/src/app/player/services/playerTimeService.js
@@ -17,6 +17,33 @@
  * under the License.
  */
 
+ /*
+  * NOTE: This session recording player implementation is based on the Session
+  * Recording Player for Glyptodon Enterprise which is available at
+  * https://github.com/glyptodon/glyptodon-enterprise-player under the
+  * following license:
+  *
+  * Copyright (C) 2019 Glyptodon, Inc.
+  *
+  * Permission is hereby granted, free of charge, to any person obtaining a copy
+  * of this software and associated documentation files (the "Software"), to deal
+  * in the Software without restriction, including without limitation the rights
+  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  * copies of the Software, and to permit persons to whom the Software is
+  * furnished to do so, subject to the following conditions:
+  *
+  * The above copyright notice and this permission notice shall be included in
+  * all copies or substantial portions of the Software.
+  *
+  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+  * THE SOFTWARE.
+  */
+
 /**
  * A service for formatting time, specifically for the recording player.
  */
diff --git a/guacamole/src/main/frontend/src/app/player/styles/textView.css b/guacamole/src/main/frontend/src/app/player/styles/textView.css
index 3a73c940e..d7502b188 100644
--- a/guacamole/src/main/frontend/src/app/player/styles/textView.css
+++ b/guacamole/src/main/frontend/src/app/player/styles/textView.css
@@ -17,33 +17,6 @@
  * under the License.
  */
 
-/*
- * NOTE: This session recording player implementation is based on the Session
- * Recording Player for Glyptodon Enterprise which is available at
- * https://github.com/glyptodon/glyptodon-enterprise-player under the
- * following license:
- *
- * Copyright (C) 2019 Glyptodon, Inc.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
 .text-batches {
 
     display: flex;
@@ -113,3 +86,25 @@
     margin: 0.25em;
 
 }
+
+.text-batches .text {
+
+    display: block;
+    margin: 0;
+    padding: 0;
+    max-width: 100%;
+    overflow-wrap: break-word;
+
+}
+
+.text-batches .text .not-typed {
+
+    font-weight: bold;
+
+}
+
+.text-batches .text .future {
+
+    color: dimgray;
+
+}
diff --git a/guacamole/src/main/frontend/src/app/player/templates/textView.html b/guacamole/src/main/frontend/src/app/player/templates/textView.html
index 1d30da58f..4cef97639 100644
--- a/guacamole/src/main/frontend/src/app/player/templates/textView.html
+++ b/guacamole/src/main/frontend/src/app/player/templates/textView.html
@@ -15,9 +15,15 @@
             translate-values="{RESULTS: filteredBatches.length}"></div>
 
     <div class="text-batches">
-        <div ng-repeat="batch in filteredBatches" class="text-batch" ng-click="seek({timestamp: batch.timestamp})">
-            <div class="timestamp">{{ formatTime(batch.timestamp) }}</div>
-            <div class="text">{{ batch.text }}</div>
+        <div ng-repeat="batch in filteredBatches" class="text-batch" ng-click="seek({timestamp: batch.events[0].timestamp})">
+            <div class="timestamp">{{ formatTime(batch.events[0].timestamp) }}</div>
+            <div class="text">
+                <span
+                    ng-repeat="event in batch.events"
+                    class="key-event"
+                    ng-class="{ 'not-typed' : !event.typed, 'future': event.timestamp >= currentPosition }"
+                >{{ event.text }}</span>
+            </div>
         </span>
     </div>
 </div>
diff --git a/guacamole/src/main/frontend/src/app/player/types/TextBatch.js b/guacamole/src/main/frontend/src/app/player/types/TextBatch.js
deleted file mode 100644
index fbe92c7d2..000000000
--- a/guacamole/src/main/frontend/src/app/player/types/TextBatch.js
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * Service which defines the TextBatch class.
- */
-angular.module('player').factory('TextBatch', [function defineTextBatch() {
-
-    /**
-     * A batch of text associated with a recording. The batch consists of a
-     * string representation of the text that would be typed based on the key
-     * events in the recording, as well as a timestamp when the batch started.
-     *
-     * @constructor
-     * @param {TextBatch|Object} [template={}]
-     *     The object whose properties should be copied within the new TextBatch.
-     */
-    const TextBatch = function TextBatch(template) {
-
-        // Use empty object by default
-        template = template || {};
-
-        /**
-         * The text that was typed in this batch.
-         *
-         * @type String
-         */
-        this.text = template.text;
-
-        /**
-         * The timestamp at which the batch of text was typed.
-         *
-         * @type Number
-         */
-        this.timestamp = template.timestamp;
-
-    };
-
-    return TextBatch;
-
-}]);

From 983393bdb7cc59709f338805ec5592431dffa1e2 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 5 Jul 2023 20:29:14 +0000
Subject: [PATCH 221/289] GUACAMOLE-1820: Conslidate similar key events for
 better performance.

---
 .../webapp/modules/KeyEventInterpreter.js     |   1 +
 .../src/app/player/directives/player.js       |  10 +-
 .../src/app/player/directives/textView.js     |   4 +-
 .../src/app/player/types/TextBatch.js         | 117 ++++++++++++++++++
 4 files changed, 128 insertions(+), 4 deletions(-)
 create mode 100644 guacamole/src/main/frontend/src/app/player/types/TextBatch.js

diff --git a/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js b/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
index 3e37629c1..376e3ebe4 100644
--- a/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
+++ b/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
@@ -575,4 +575,5 @@ Guacamole.KeyEventInterpreter.KeyEventBatch = function KeyEventBatch(events, sim
      * @type {!String}
      */
     this.simpleValue = simpleValue || '';
+
 }
diff --git a/guacamole/src/main/frontend/src/app/player/directives/player.js b/guacamole/src/main/frontend/src/app/player/directives/player.js
index 7e50dd7af..f2d24ece0 100644
--- a/guacamole/src/main/frontend/src/app/player/directives/player.js
+++ b/guacamole/src/main/frontend/src/app/player/directives/player.js
@@ -80,6 +80,9 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
     // Required services
     const playerTimeService = $injector.get('playerTimeService');
 
+    // Required types
+    const TextBatch = $injector.get('TextBatch');
+
     const config = {
         restrict : 'E',
         templateUrl : 'app/player/templates/player.html'
@@ -148,7 +151,7 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
         /**
          * Any batches of text typed during the recording.
          *
-         * @type {Guacamole.KeyEventInterpeter.KeyEventBatch[]}
+         * @type {TextBatch[]}
          */
         $scope.textBatches = [];
 
@@ -356,7 +359,10 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
 
                 // Append any extracted batches of typed text
                 $scope.recording.ontext = function appendTextBatch(batch) {
-                    $scope.textBatches.push(batch);
+
+                    // Convert to the display-optimized TextBatch type
+                    $scope.textBatches.push(new TextBatch(batch));
+
                 }
 
                 // Notify listeners when current position within the recording
diff --git a/guacamole/src/main/frontend/src/app/player/directives/textView.js b/guacamole/src/main/frontend/src/app/player/directives/textView.js
index 3ff5b1b17..979cd947d 100644
--- a/guacamole/src/main/frontend/src/app/player/directives/textView.js
+++ b/guacamole/src/main/frontend/src/app/player/directives/textView.js
@@ -38,7 +38,7 @@ angular.module('player').directive('guacPlayerTextView',
         /**
          * All the batches of text extracted from this recording.
          *
-         * @type {!Guacamole.KeyEventInterpeter.KeyEventBatch[]}
+         * @type {!TextBatch[]}
          */
         textBatches : '=',
 
@@ -74,7 +74,7 @@ angular.module('player').directive('guacPlayerTextView',
          * The text batches that match the current search phrase, or all
          * batches if no search phrase is set.
          *
-         * @type {!Guacamole.KeyEventInterpeter.KeyEventBatch[]}
+         * @type {!TextBatch[]}
          */
         $scope.filteredBatches = $scope.textBatches;
 
diff --git a/guacamole/src/main/frontend/src/app/player/types/TextBatch.js b/guacamole/src/main/frontend/src/app/player/types/TextBatch.js
new file mode 100644
index 000000000..58575e4c1
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/player/types/TextBatch.js
@@ -0,0 +1,117 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/* global _ */
+
+/**
+ * Service which defines the TextBatch class.
+ */
+angular.module('player').factory('TextBatch', [function defineTextBatch() {
+
+    /**
+     * A batch of text associated with a recording. The batch consists of a
+     * string representation of the text that would be typed based on the key
+     * events in the recording, as well as a timestamp when the batch started.
+     *
+     * @constructor
+     * @param {Guacamole.KeyEventInterpreter.KeyEvent|TextBatch|Object} [template={}]
+     *     The object whose properties should be copied within the new TextBatch.
+     */
+    const TextBatch = function TextBatch(template) {
+
+        /**
+         * All key events for this batch, with sequences of key events having
+         * the same `typed` field value combined.
+         *
+         * @type {!KeyEventBatch[]}
+         */
+        this.events = _.reduce(template.events, (consolidatedEvents, rawEvent) => {
+
+            const currentEvent = _.last(consolidatedEvents);
+
+            // If a current event exists with the same `typed` value, conslidate
+            // the raw text event into it
+            if (currentEvent && currentEvent.typed === rawEvent.typed)
+                currentEvent.text += rawEvent.text;
+
+            // Otherwise, create a new conslidated event starting now
+            else
+                consolidatedEvents.push(new TextBatch.ConsolidatedKeyEvent(rawEvent));
+
+            return consolidatedEvents;
+
+        }, []);
+
+        /**
+         * The simplified, human-readable value representing the key events for
+         * this batch, equivalent to concatenating the `text` field of all key
+         * events in the batch.
+         *
+         * @type {!String}
+         */
+        this.simpleValue = template.simpleValue || '';
+
+    };
+
+    /**
+     * A granular description of an extracted key event or sequence of events.
+     * Similar to the Guacamole.KeyEventInterpreter.KeyEvent type, except that
+     * this KeyEventBatch may contain multiple contiguous events of the same type,
+     * meaning that all event(s) that were combined into this event must have
+     * had the same `typed` field value. A single timestamp for the first combined
+     * event will be used for the whole batch.
+     *
+     * @constructor
+     * @param {Guacamole.KeyEventInterpreter.KeyEventBatch|ConsolidatedKeyEvent|Object} [template={}]
+     *     The object whose properties should be copied within the new KeyEventBatch.
+     */
+    TextBatch.ConsolidatedKeyEvent = function ConsolidatedKeyEvent(template) {
+
+        /**
+         * A human-readable representation of the event(s). If a series of printable
+         * characters was directly typed, this will just be those character(s).
+         * Otherwise it will be a string describing the event(s).
+         *
+         * @type {!String}
+         */
+        this.text = template.text;
+
+        /**
+         * True if this text of this event is exactly a typed character, or false
+         * otherwise.
+         *
+         * @type {!boolean}
+         */
+        this.typed = template.typed;
+
+        /**
+         * The timestamp from the recording when this event occured. If a
+         * `startTimestamp` value was provided to the interpreter constructor, this
+         * will be relative to start of the recording. If not, it will be the raw
+         * timestamp from the key event.
+         *
+         * @type {!Number}
+         */
+        this.timestamp = template.timestamp;
+
+    };
+
+    return TextBatch;
+
+}]);

From 1b2c52d4962e4889f81cd7c3657d44fc1a167e3a Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 11 Jul 2023 18:03:14 +0000
Subject: [PATCH 222/289] GUACAMOLE-1820: Simplify unicode interpretation.

---
 .../webapp/modules/KeyEventInterpreter.js     | 45 ++++---------------
 .../src/app/player/directives/player.js       |  2 +-
 2 files changed, 9 insertions(+), 38 deletions(-)

diff --git a/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js b/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
index 376e3ebe4..44354fb6e 100644
--- a/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
+++ b/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
@@ -62,9 +62,9 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
      *
      * @constructor
      * @private
-     * @param {KEY_DEFINITION|object} [template={}]
+     * @param {KeyDefinition|object} [template={}]
      *     The object whose properties should be copied within the new
-     *     KEY_DEFINITION.
+     *     KeyDefinition.
      */
     var KeyDefinition = function KeyDefinition(template) {
 
@@ -278,38 +278,9 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
         if (keysym < 0x00 || (keysym > 0xFF && (keysym | 0xFFFF) != 0x0100FFFF))
             return null;
 
-        var codepoint = keysym & 0xFFFF;
-        var mask;
-        var bytes;
-
-        // Determine size and initial byte mask
-        if (codepoint <= 0x007F) {
-            mask  = 0x00;
-            bytes = 1;
-        }
-        else if (codepoint <= 0x7FF) {
-            mask  = 0xC0;
-            bytes = 2;
-        }
-        else {
-            mask  = 0xE0;
-            bytes = 3;
-        }
-
-        var byteArray = new ArrayBuffer(bytes);
-        var byteView = new Int8Array(byteArray);
-
-        // Add trailing bytes, if any
-        for (var i = 1; i < bytes; i++) {
-            byteView[bytes - i] = 0x80 | (codepoint & 0x3F);
-            codepoint >>= 6;
-        }
-
-        // Set initial byte
-        byteView[0] = mask | codepoint;
-
         // Convert to UTF8 string
-        var name = new TextDecoder("utf-8").decode(byteArray);
+        var codepoint = keysym & 0xFFFF;
+        var name = String.fromCharCode(codepoint);
 
         // Create and return the definition
         return new KeyDefinition({keysym: keysym, name: name, value: name, modifier: false});
@@ -482,7 +453,7 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
 
         }
 
-    }
+    };
 
     /**
      * Return the current batch of typed text. Note that the batch may be
@@ -494,8 +465,8 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
      */
     this.getCurrentBatch = function getCurrentBatch() {
         return currentBatch;
-    }
-}
+    };
+};
 
 /**
  * A granular description of an extracted key event, including a human-readable
@@ -576,4 +547,4 @@ Guacamole.KeyEventInterpreter.KeyEventBatch = function KeyEventBatch(events, sim
      */
     this.simpleValue = simpleValue || '';
 
-}
+};
diff --git a/guacamole/src/main/frontend/src/app/player/directives/player.js b/guacamole/src/main/frontend/src/app/player/directives/player.js
index f2d24ece0..ae300bcbf 100644
--- a/guacamole/src/main/frontend/src/app/player/directives/player.js
+++ b/guacamole/src/main/frontend/src/app/player/directives/player.js
@@ -363,7 +363,7 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
                     // Convert to the display-optimized TextBatch type
                     $scope.textBatches.push(new TextBatch(batch));
 
-                }
+                };
 
                 // Notify listeners when current position within the recording
                 // has changed

From d7e91a8ebe294712c031699a9fe4b0ba233c9d1e Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Thu, 20 Jul 2023 17:45:43 -0400
Subject: [PATCH 223/289] GUACAMOLE-1332: Client-side parameters for
 certificate fingerprints and trust.

---
 .../org/apache/guacamole/protocols/rdp.json   |  9 +++++++
 .../main/frontend/src/translations/en.json    | 24 ++++++++++---------
 2 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
index b46a8a80c..f1c6c35a4 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
@@ -45,6 +45,15 @@
                     "name"    : "ignore-cert",
                     "type"    : "BOOLEAN",
                     "options" : [ "true" ]
+                },
+                {
+                    "name"    : "cert-tofu",
+                    "type"    : "BOOLEAN",
+                    "options" : [ "true" ]
+                },
+                {
+                    "name"    : "cert-fingerprints",
+                    "type"    : "TEXT"
                 }
             ]
         },
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index a2df4ff48..a3071b4c5 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -561,20 +561,22 @@
 
     "PROTOCOL_RDP" : {
 
-        "FIELD_HEADER_CLIENT_NAME"     : "Client name:",
-        "FIELD_HEADER_COLOR_DEPTH"     : "Color depth:",
-        "FIELD_HEADER_CONSOLE"         : "Administrator console:",
-        "FIELD_HEADER_CONSOLE_AUDIO"   : "Support audio in console:",
-        "FIELD_HEADER_CREATE_DRIVE_PATH" : "Automatically create drive:",
+        "FIELD_HEADER_CERT_TOFU"             : "Trust host certificate on first use:",
+        "FIELD_HEADER_CERT_FINGERPRINTS"     : "Fingerprints of trusted host certificates:",
+        "FIELD_HEADER_CLIENT_NAME"           : "Client name:",
+        "FIELD_HEADER_COLOR_DEPTH"           : "Color depth:",
+        "FIELD_HEADER_CONSOLE"               : "Administrator console:",
+        "FIELD_HEADER_CONSOLE_AUDIO"         : "Support audio in console:",
+        "FIELD_HEADER_CREATE_DRIVE_PATH"     : "Automatically create drive:",
         "FIELD_HEADER_CREATE_RECORDING_PATH" : "Automatically create recording path:",
-        "FIELD_HEADER_DISABLE_AUDIO"   : "Disable audio:",
-        "FIELD_HEADER_DISABLE_AUTH"    : "Disable authentication:",
-        "FIELD_HEADER_DISABLE_COPY"    : "Disable copying from remote desktop:",
+        "FIELD_HEADER_DISABLE_AUDIO"    : "Disable audio:",
+        "FIELD_HEADER_DISABLE_AUTH"     : "Disable authentication:",
+        "FIELD_HEADER_DISABLE_COPY"     : "Disable copying from remote desktop:",
         "FIELD_HEADER_DISABLE_DOWNLOAD" : "Disable file download:",
-        "FIELD_HEADER_DISABLE_PASTE"   : "Disable pasting from client:",
+        "FIELD_HEADER_DISABLE_PASTE"    : "Disable pasting from client:",
         "FIELD_HEADER_DISABLE_UPLOAD"   : "Disable file upload:",
-        "FIELD_HEADER_DOMAIN"          : "Domain:",
-        "FIELD_HEADER_DPI"             : "Resolution (DPI):",
+        "FIELD_HEADER_DOMAIN"           : "Domain:",
+        "FIELD_HEADER_DPI"              : "Resolution (DPI):",
         "FIELD_HEADER_DRIVE_NAME"       : "Drive name:",
         "FIELD_HEADER_DRIVE_PATH"       : "Drive path:",
         "FIELD_HEADER_ENABLE_AUDIO_INPUT"         : "Enable audio input (microphone):",

From ef8da32159996275b47f47beb9b5f6a171cb3f7f Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 29 Aug 2023 23:37:15 +0000
Subject: [PATCH 224/289] GUACAMOLE-1820: Allow newlines within key events.

---
 .../src/main/frontend/src/app/player/styles/textView.css    | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/guacamole/src/main/frontend/src/app/player/styles/textView.css b/guacamole/src/main/frontend/src/app/player/styles/textView.css
index d7502b188..0348339ab 100644
--- a/guacamole/src/main/frontend/src/app/player/styles/textView.css
+++ b/guacamole/src/main/frontend/src/app/player/styles/textView.css
@@ -97,6 +97,12 @@
 
 }
 
+.text-batches .text .key-event {
+
+    white-space: pre-wrap;
+
+}
+
 .text-batches .text .not-typed {
 
     font-weight: bold;

From e3a249d39a3f9455a377d1edf168c48f6371317c Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 30 Aug 2023 23:22:13 +0000
Subject: [PATCH 225/289] GUACAMOLE-1820: Refactor key event interpretation,
 moving display-specific code to the webapp.

---
 .../webapp/modules/KeyEventInterpreter.js     | 397 ++++--------------
 .../main/webapp/modules/SessionRecording.js   |  32 +-
 .../src/app/player/directives/player.js       |  15 +-
 .../src/app/player/directives/textView.js     |   8 +-
 .../player/services/keyEventDisplayService.js | 371 ++++++++++++++++
 .../src/app/player/types/TextBatch.js         | 117 ------
 6 files changed, 484 insertions(+), 456 deletions(-)
 create mode 100644 guacamole/src/main/frontend/src/app/player/services/keyEventDisplayService.js
 delete mode 100644 guacamole/src/main/frontend/src/app/player/types/TextBatch.js

diff --git a/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js b/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
index 44354fb6e..47b090243 100644
--- a/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
+++ b/guacamole-common-js/src/main/webapp/modules/KeyEventInterpreter.js
@@ -20,84 +20,22 @@
 var Guacamole = Guacamole || {};
 
 /**
- * An object that will accept raw key events and produce human readable text
- * batches, seperated by at least `batchSeperation` milliseconds, which can be
- * retrieved through the onbatch callback or by calling getCurrentBatch().
- *
- * NOTE: The event processing logic and output format is based on the `guaclog`
- * tool, with the addition of batching support.
+ * An object that will accept raw key events and produce a chronologically
+ * ordered array of key event objects. These events can be obtained by
+ * calling getEvents().
  *
  * @constructor
- *
- * @param {number} [batchSeperation=5000]
- *     The minimum number of milliseconds that must elapse between subsequent
- *     batches of key-event-generated text. If 0 or negative, no splitting will
- *     occur, resulting in a single batch for all provided key events.
- *
  * @param {number} [startTimestamp=0]
  *     The starting timestamp for the recording being intepreted. If provided,
  *     the timestamp of each intepreted event will be relative to this timestamp.
  *     If not provided, the raw recording timestamp will be used.
  */
-Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, startTimestamp) {
-
-    /**
-     * Reference to this Guacamole.KeyEventInterpreter.
-     *
-     * @private
-     * @type {!Guacamole.SessionRecording}
-     */
-    var interpreter = this;
-
-    // Default to 5 seconds if the batch seperation was not provided
-    if (batchSeperation === undefined || batchSeperation === null)
-        batchSeperation = 5000;
+Guacamole.KeyEventInterpreter = function KeyEventInterpreter(startTimestamp) {
 
     // Default to 0 seconds to keep the raw timestamps
     if (startTimestamp === undefined || startTimestamp === null)
         startTimestamp = 0;
 
-    /**
-     * A definition for a known key.
-     *
-     * @constructor
-     * @private
-     * @param {KeyDefinition|object} [template={}]
-     *     The object whose properties should be copied within the new
-     *     KeyDefinition.
-     */
-    var KeyDefinition = function KeyDefinition(template) {
-
-        /**
-         * The X11 keysym of the key.
-         * @type {!number}
-         */
-        this.keysym = parseInt(template.keysym);
-
-        /**
-         * A human-readable name for the key.
-         * @type {!String}
-         */
-        this.name = template.name;
-
-        /**
-         * The value which would be typed in a typical text editor, if any. If the
-         * key is not associated with any typable value, or if the typable value is
-         * not generally useful in an auditing context, this will be undefined.
-         * @type {String}
-         */
-        this.value = template.value;
-
-        /**
-         * Whether this key is a modifier which may affect the interpretation of
-         * other keys, and thus should be tracked as it is held down.
-         * @type {!boolean}
-         * @default false
-         */
-        this.modifier = template.modifier || false;
-
-    };
-
     /**
      * A precursor array to the KNOWN_KEYS map. The objects contained within
      * will be constructed into full KeyDefinition objects.
@@ -107,7 +45,7 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
      * @type {Object[]}
      */
     var _KNOWN_KEYS = [
-        {keysym: 0xFE03, name: 'AltGr', value: "", modifier: true },
+        {keysym: 0xFE03, name: 'AltGr' },
         {keysym: 0xFF08, name: 'Backspace' },
         {keysym: 0xFF09, name: 'Tab' },
         {keysym: 0xFF0B, name: 'Clear' },
@@ -178,19 +116,19 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
         {keysym: 0xFFD3, name: 'F22' },
         {keysym: 0xFFD4, name: 'F23' },
         {keysym: 0xFFD5, name: 'F24' },
-        {keysym: 0xFFE1, name: 'Shift', value: "", modifier: true },
-        {keysym: 0xFFE2, name: 'Shift', value: "", modifier: true },
-        {keysym: 0xFFE3, name: 'Ctrl', value: null, modifier: true },
-        {keysym: 0xFFE4, name: 'Ctrl', value: null, modifier: true },
+        {keysym: 0xFFE1, name: 'Shift' },
+        {keysym: 0xFFE2, name: 'Shift' },
+        {keysym: 0xFFE3, name: 'Ctrl' },
+        {keysym: 0xFFE4, name: 'Ctrl' },
         {keysym: 0xFFE5, name: 'Caps' },
-        {keysym: 0xFFE7, name: 'Meta', value: null, modifier: true },
-        {keysym: 0xFFE8, name: 'Meta', value: null, modifier: true },
-        {keysym: 0xFFE9, name: 'Alt', value: null, modifier: true },
-        {keysym: 0xFFEA, name: 'Alt', value: null, modifier: true },
-        {keysym: 0xFFEB, name: 'Super', value: null, modifier: true },
-        {keysym: 0xFFEC, name: 'Super', value: null, modifier: true },
-        {keysym: 0xFFED, name: 'Hyper', value: null, modifier: true },
-        {keysym: 0xFFEE, name: 'Hyper', value: null, modifier: true },
+        {keysym: 0xFFE7, name: 'Meta' },
+        {keysym: 0xFFE8, name: 'Meta' },
+        {keysym: 0xFFE9, name: 'Alt' },
+        {keysym: 0xFFEA, name: 'Alt' },
+        {keysym: 0xFFEB, name: 'Super' },
+        {keysym: 0xFFEC, name: 'Super' },
+        {keysym: 0xFFED, name: 'Hyper' },
+        {keysym: 0xFFEE, name: 'Hyper' },
         {keysym: 0xFFFF, name: 'Delete' }
     ];
 
@@ -205,60 +143,18 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
     _KNOWN_KEYS.forEach(function createKeyDefinitionMap(keyDefinition) {
 
         // Construct a map of keysym to KeyDefinition object
-        KNOWN_KEYS[keyDefinition.keysym] = new KeyDefinition(keyDefinition)
+        KNOWN_KEYS[keyDefinition.keysym] = (
+                new Guacamole.KeyEventInterpreter.KeyDefinition(keyDefinition));
 
     });
 
     /**
-     * A map of X11 keysyms to a KeyDefinition object, if the corresponding
-     * key is currently pressed. If a keysym has no entry in this map at all,
-     * it means that the key is not being pressed. Note that not all keysyms
-     * are necessarily tracked within this map - only those that are explicitly
-     * tracked.
+     * All key events parsed as of the most recent handleKeyEvent() invocation.
      *
      * @private
-     * @type {Object.<String,KeyDefinition> }
+     * @type {!Guacamole.KeyEventInterpreter.KeyEvent[]}
      */
-    var pressedKeys = {};
-
-    /**
-     * The current key event batch, containing a representation of all key
-     * events processed since the end of the last batch passed to onbatch.
-     * Null if no key events have been processed yet.
-     *
-     * @private
-     * @type {!KeyEventBatch}
-     */
-    var currentBatch = null;
-
-    /**
-     * The timestamp of the most recent key event processed.
-     *
-     * @private
-     * @type {Number}
-     */
-    var lastKeyEvent = 0;
-
-    /**
-     * Returns true if the currently-pressed keys are part of a shortcut, or
-     * false otherwise.
-     *
-     * @private
-     * @returns {!boolean}
-     *     True if the currently-pressed keys are part of a shortcut, or false
-     *     otherwise.
-     */
-    function isShortcut() {
-
-        // If one of the currently-pressed keys is non-printable, a shortcut
-        // is being typed
-        for (var keysym in pressedKeys) {
-            if (pressedKeys[keysym].value === null)
-                return true;
-        }
-
-        return false;
-    }
+    var parsedEvents = [];
 
     /**
      * If the provided keysym corresponds to a valid UTF-8 character, return
@@ -268,7 +164,7 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
      * @param {Number} keysym
      *     The keysym to produce a UTF-8 KeyDefinition for, if valid.
      *
-     * @returns {KeyDefinition}
+     * @returns {Guacamole.KeyEventInterpreter.KeyDefinition}
      *     A KeyDefinition for the provided keysym, if it's a valid UTF-8
      *     keysym, or null otherwise.
      */
@@ -283,7 +179,8 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
         var name = String.fromCharCode(codepoint);
 
         // Create and return the definition
-        return new KeyDefinition({keysym: keysym, name: name, value: name, modifier: false});
+        return new Guacamole.KeyEventInterpreter.KeyDefinition({
+                keysym: keysym, name: name, value: name});
 
     }
 
@@ -310,7 +207,7 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
 
         // If it's not UTF-8, return an unknown definition, with the name
         // just set to the hex value of the keysym
-        return new KeyDefinition({
+        return new Guacamole.KeyEventInterpreter.KeyDefinition({
             keysym: keysym,
             name: '0x' + String(keysym.toString(16))
         })
@@ -318,20 +215,8 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
     }
 
     /**
-     * Fired whenever a new batch of typed text extracted from key events
-     * is available. A new batch will be provided every time a new key event
-     * is processed after more than batchSeperation milliseconds after the
-     * previous key event.
-     *
-     * @event
-     * @param {!Guacamole.KeyEventInterpreter.KeyEventBatch}
-     */
-    this.onbatch = null;
-
-    /**
-     * Handles a raw key event, potentially appending typed text to the
-     * current batch, and calling onbatch with the current batch, if the
-     * callback is set and a new batch is about to be started.
+     * Handles a raw key event, appending a new key event object for every
+     * handled raw event.
      *
      * @param {!string[]} args
      *     The arguments of the key event.
@@ -347,111 +232,18 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
         // The timestamp when this key event occured
         var timestamp = parseInt(args[2]);
 
-        // If no current batch exists, start a new one now
-        if (!currentBatch)
-            currentBatch = new Guacamole.KeyEventInterpreter.KeyEventBatch();
+        // The timestamp relative to the provided initial timestamp
+        var relativeTimestap = timestamp - startTimestamp;
 
-        // Only switch to a new batch of text if sufficient time has passed
-        // since the last key event
-        var newBatch = (batchSeperation >= 0
-                && (timestamp - lastKeyEvent) >= batchSeperation);
-        lastKeyEvent = timestamp;
+        // Known information about the parsed key
+        var definition = getKeyDefinitionByKeysym(keysym);
 
-        if (newBatch) {
-
-            // Call the handler with the current batch of text and the timestamp
-            // at which the current batch started
-            if (currentBatch.events.length && interpreter.onbatch)
-                interpreter.onbatch(currentBatch);
-
-            // Move on to the next batch of text
-            currentBatch = new Guacamole.KeyEventInterpreter.KeyEventBatch();
-
-        }
-
-        var keyDefinition = getKeyDefinitionByKeysym(keysym);
-
-        // Mark down whether the key was pressed or released
-        if (keyDefinition.modifier) {
-            if (pressed)
-                pressedKeys[keysym] = keyDefinition;
-            else
-                delete pressedKeys[keysym];
-        }
-
-        // Append to the current typed value when a printable
-        // (non-modifier) key is pressed
-        else if (pressed) {
-
-            var relativeTimestap = timestamp - startTimestamp;
-
-            if (isShortcut()) {
-
-                var shortcutText = '<';
-
-                var firstKey = true;
-
-                // Compose entry by inspecting the state of each tracked key.
-                // At least one key must be pressed when in a shortcut.
-                for (var keysym in pressedKeys) {
-
-                    var pressedKeyDefinition = pressedKeys[keysym];
-
-                    // Print name of key
-                    if (firstKey) {
-                        shortcutText += pressedKeyDefinition.name;
-                        firstKey = false;
-                    }
-
-                    else
-                        shortcutText += ('+' + pressedKeyDefinition.name);
-
-                }
-
-                // Finally, append the printable key to close the shortcut
-                shortcutText += ('+' + keyDefinition.name + '>')
-
-                // Add the shortcut to the current batch
-                currentBatch.simpleValue += shortcutText;
-                currentBatch.events.push(new Guacamole.KeyEventInterpreter.KeyEvent(
-                        shortcutText, false, relativeTimestap));
-
-            }
-
-            // Print the key itself
-            else {
-
-                var keyText;
-                var typed;
-
-                // Print the value if explicitly defined
-                if (keyDefinition.value != null) {
-
-                    keyText = keyDefinition.value;
-                    typed = true;
-
-                }
-
-                // Otherwise print the name
-                else {
-
-                    keyText = ('<' + keyDefinition.name + '>');
-
-                    // While this is a representation for a single character,
-                    // the key text is the name of the key, not the actual
-                    // character itself
-                    typed = false;
-
-                }
-
-                // Add the key to the current batch
-                currentBatch.simpleValue += keyText;
-                currentBatch.events.push(new Guacamole.KeyEventInterpreter.KeyEvent(
-                        keyText, typed, relativeTimestap));
-
-            }
-
-        }
+        // Push the latest parsed event into the list
+        parsedEvents.push(new Guacamole.KeyEventInterpreter.KeyEvent({
+            definition: definition,
+            pressed: pressed,
+            timestamp: relativeTimestap
+        }));
 
     };
 
@@ -460,12 +252,47 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
      * incomplete, as more key events might be processed before the next
      * batch starts.
      *
-     * @returns {Guacamole.KeyEventInterpreter.KeyEventBatch}
+     * @returns {Guacamole.KeyEventInterpreter.KeyEvent[]}
      *     The current batch of text.
      */
-    this.getCurrentBatch = function getCurrentBatch() {
-        return currentBatch;
+    this.getEvents = function getEvents() {
+        return parsedEvents;
     };
+
+};
+
+/**
+ * A definition for a known key.
+ *
+ * @constructor
+ * @param {Guacamole.KeyEventInterpreter.KeyDefinition|object} [template={}]
+ *     The object whose properties should be copied within the new
+ *     KeyDefinition.
+ */
+Guacamole.KeyEventInterpreter.KeyDefinition = function KeyDefinition(template) {
+
+    // Use empty object by default
+    template = template || {};
+
+    /**
+     * The X11 keysym of the key.
+     * @type {!number}
+     */
+    this.keysym = parseInt(template.keysym);
+
+    /**
+     * A human-readable name for the key.
+     * @type {!String}
+     */
+    this.name = template.name;
+
+    /**
+     * The value which would be typed in a typical text editor, if any. If the
+     * key is not associated with any typeable value, this will be undefined.
+     * @type {String}
+     */
+    this.value = template.value;
+
 };
 
 /**
@@ -474,77 +301,35 @@ Guacamole.KeyEventInterpreter = function KeyEventInterpreter(batchSeperation, st
  * and the timestamp when the event occured.
  *
  * @constructor
- * @param {!String} text
- *     A human-readable representation of the event.
- *
- * @param {!boolean} typed
- *     True if this event represents a directly-typed character, or false
- *     otherwise.
- *
- * @param {!Number} timestamp
- *     The timestamp from the recording when this event occured.
+ * @param {Guacamole.KeyEventInterpreter.KeyEvent|object} [template={}]
+ *     The object whose properties should be copied within the new
+ *     KeyEvent.
  */
-Guacamole.KeyEventInterpreter.KeyEvent = function KeyEvent(text, typed, timestamp) {
+Guacamole.KeyEventInterpreter.KeyEvent = function KeyEvent(template) {
+
+    // Use empty object by default
+    template = template || {};
 
     /**
-     * A human-readable representation of the event. If a printable character
-     * was directly typed, this will just be that character. Otherwise it will
-     * be a string describing the event.
+     * The key definition for the pressed key.
      *
-     * @type {!String}
+     * @type {!Guacamole.KeyEventInterpreter.KeyDefinition}
      */
-    this.text = text;
+    this.definition = template.definition;
 
     /**
-     * True if this text of this event is exactly a typed character, or false
-     * otherwise.
+     * True if the key was pressed to create this event, or false if it was
+     * released.
      *
      * @type {!boolean}
      */
-    this.typed = typed;
+    this.pressed = !!template.pressed;
 
     /**
-     * The timestamp from the recording when this event occured. If a
-     * `startTimestamp` value was provided to the interpreter constructor, this
-     * will be relative to start of the recording. If not, it will be the raw
-     * timestamp from the key event.
+     * The timestamp from the recording when this event occured.
      *
      * @type {!Number}
      */
-    this.timestamp = timestamp;
-
-};
-
-/**
- * A series of intepreted key events, seperated by at least the configured
- * batchSeperation value from any other key events in the recording corresponding
- * to the interpreted key events. A batch will always consist of at least one key
- * event, and an associated simplified representation of the event(s).
- *
- * @constructor
- * @param {!Guacamole.KeyEventInterpreter.KeyEvent[]} events
- *     The interpreted key events for this batch.
- *
- * @param {!String} simpleValue
- *     The simplified, human-readable value representing the key events for
- *     this batch.
- */
-Guacamole.KeyEventInterpreter.KeyEventBatch = function KeyEventBatch(events, simpleValue) {
-
-    /**
-     * All key events for this batch.
-     *
-     * @type {!Guacamole.KeyEventInterpreter.KeyEvent[]}
-     */
-    this.events = events || [];
-
-    /**
-     * The simplified, human-readable value representing the key events for
-     * this batch, equivalent to concatenating the `text` field of all key
-     * events in the batch.
-     *
-     * @type {!String}
-     */
-    this.simpleValue = simpleValue || '';
+    this.timestamp = template.timestamp;
 
 };
diff --git a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
index 619f78fba..95f881a08 100644
--- a/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
+++ b/guacamole-common-js/src/main/webapp/modules/SessionRecording.js
@@ -394,17 +394,7 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
      *     the recording.
      */
     function initializeKeyInterpreter(startTimestamp) {
-
-        keyEventInterpreter = new Guacamole.KeyEventInterpreter(null, startTimestamp);
-
-        // Pass through any received batches to the recording ontext handler
-        keyEventInterpreter.onbatch = function onbatch(batch) {
-
-            // Pass the batch through if a handler is set
-            if (recording.ontext)
-                recording.ontext(batch);
-
-        };
+        keyEventInterpreter = new Guacamole.KeyEventInterpreter(startTimestamp);
     }
 
     /**
@@ -527,11 +517,10 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
                     instructionBuffer = '';
                 }
 
-                // If there's any typed text that's yet to be sent to the ontext
-                // handler, send it now
-                var batch = keyEventInterpreter.getCurrentBatch();
-                if (batch && recording.ontext)
-                    recording.ontext(batch);
+                // Now that the recording is fully processed, and all key events
+                // have been extracted, call the onkeyevents handler if defined
+                if (recording.onkeyevents)
+                    recording.onkeyevents(keyEventInterpreter.getEvents());
 
                 // Consider recording loaded if tunnel has closed without errors
                 if (!errorEncountered)
@@ -919,14 +908,15 @@ Guacamole.SessionRecording = function SessionRecording(source, refreshInterval)
     this.onpause = null;
 
     /**
-     * Fired whenever a new batch of typed text extracted from key events
-     * is available.
+     * Fired with all extracted key events when the recording is fully
+     * processed. The callback will be invoked with an empty list
+     * if no key events were extracted.
      *
      * @event
-     * @param {!Guacamole.KeyEventInterpreter.KeyEventBatch} batch
-     *     The batch of extracted text.
+     * @param {!Guacamole.KeyEventInterpreter.KeyEvent[]} batch
+     *     The extracted key events.
      */
-    this.ontext = null;
+    this.onkeyevents = null;
 
     /**
      * Fired whenever the playback position within the recording changes.
diff --git a/guacamole/src/main/frontend/src/app/player/directives/player.js b/guacamole/src/main/frontend/src/app/player/directives/player.js
index ae300bcbf..a239e0d2b 100644
--- a/guacamole/src/main/frontend/src/app/player/directives/player.js
+++ b/guacamole/src/main/frontend/src/app/player/directives/player.js
@@ -78,11 +78,9 @@
 angular.module('player').directive('guacPlayer', ['$injector', function guacPlayer($injector) {
 
     // Required services
+    const keyEventDisplayService = $injector.get('keyEventDisplayService');
     const playerTimeService = $injector.get('playerTimeService');
 
-    // Required types
-    const TextBatch = $injector.get('TextBatch');
-
     const config = {
         restrict : 'E',
         templateUrl : 'app/player/templates/player.html'
@@ -151,7 +149,7 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
         /**
          * Any batches of text typed during the recording.
          *
-         * @type {TextBatch[]}
+         * @type {keyEventDisplayService.TextBatch[]}
          */
         $scope.textBatches = [];
 
@@ -357,11 +355,12 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
                     $scope.$evalAsync();
                 };
 
-                // Append any extracted batches of typed text
-                $scope.recording.ontext = function appendTextBatch(batch) {
+                // Extract key events from the recording
+                $scope.recording.onkeyevents = function keyEventsReceived(events) {
 
-                    // Convert to the display-optimized TextBatch type
-                    $scope.textBatches.push(new TextBatch(batch));
+                    // Convert to a display-optimized format
+                    $scope.textBatches = (
+                            keyEventDisplayService.parseEvents(events));
 
                 };
 
diff --git a/guacamole/src/main/frontend/src/app/player/directives/textView.js b/guacamole/src/main/frontend/src/app/player/directives/textView.js
index 979cd947d..6e0ea060c 100644
--- a/guacamole/src/main/frontend/src/app/player/directives/textView.js
+++ b/guacamole/src/main/frontend/src/app/player/directives/textView.js
@@ -38,7 +38,7 @@ angular.module('player').directive('guacPlayerTextView',
         /**
          * All the batches of text extracted from this recording.
          *
-         * @type {!TextBatch[]}
+         * @type {!keyEventDisplayService.TextBatch[]}
          */
         textBatches : '=',
 
@@ -74,7 +74,7 @@ angular.module('player').directive('guacPlayerTextView',
          * The text batches that match the current search phrase, or all
          * batches if no search phrase is set.
          *
-         * @type {!TextBatch[]}
+         * @type {!keyEventDisplayService.TextBatch[]}
          */
         $scope.filteredBatches = $scope.textBatches;
 
@@ -117,8 +117,8 @@ angular.module('player').directive('guacPlayerTextView',
 
         };
 
-        // Reapply the filter to the updated text batches
-        $scope.$watch('textBatches', applyFilter);
+        // Reapply the current filter to the updated text batches
+        $scope.$watch('textBatches', () => applyFilter($scope.searchPhrase));
 
         // Reapply the filter whenever the search phrase is updated
         $scope.$watch('searchPhrase', applyFilter);
diff --git a/guacamole/src/main/frontend/src/app/player/services/keyEventDisplayService.js b/guacamole/src/main/frontend/src/app/player/services/keyEventDisplayService.js
new file mode 100644
index 000000000..cbfce14d7
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/player/services/keyEventDisplayService.js
@@ -0,0 +1,371 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * 'License'); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+ /*
+  * NOTE: This session recording player implementation is based on the Session
+  * Recording Player for Glyptodon Enterprise which is available at
+  * https://github.com/glyptodon/glyptodon-enterprise-player under the
+  * following license:
+  *
+  * Copyright (C) 2019 Glyptodon, Inc.
+  *
+  * Permission is hereby granted, free of charge, to any person obtaining a copy
+  * of this software and associated documentation files (the "Software"), to deal
+  * in the Software without restriction, including without limitation the rights
+  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  * copies of the Software, and to permit persons to whom the Software is
+  * furnished to do so, subject to the following conditions:
+  *
+  * The above copyright notice and this permission notice shall be included in
+  * all copies or substantial portions of the Software.
+  *
+  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+  * THE SOFTWARE.
+  */
+
+/* global _ */
+
+/**
+ * A service for translating parsed key events in the format produced by
+ * KeyEventInterpreter into display-optimized text batches.
+ */
+angular.module('player').factory('keyEventDisplayService',
+        ['$injector', function keyEventDisplayService($injector) {
+
+    /**
+     * A set of all keysyms corresponding to modifier keys.
+     * @type{Object.<Number, Boolean>}
+     */
+    const MODIFIER_KEYS = {
+        0xFE03: true, // AltGr
+        0xFFE1: true, // Left Shift
+        0xFFE2: true, // Right Shift
+        0xFFE3: true, // Left Control
+        0xFFE4: true, // Right Control,
+        0xFFE7: true, // Left Meta
+        0xFFE8: true, // Right Meta
+        0xFFE9: true, // Left Alt
+        0xFFEA: true, // Right Alt
+        0xFFEB: true, // Left Super
+        0xFFEC: true, // Right Super
+        0xFFED: true, // Left Hyper
+        0xFFEE: true  // Right Super
+    };
+
+    /**
+     * A set of all keysyms for which the name should be printed alongside the
+     * value of the key itself.
+     * @type{Object.<Number, Boolean>}
+     */
+    const PRINT_NAME_TOO_KEYS = {
+        0xFF09: true, // Tab
+        0xFF0D: true, // Return
+        0xFF8D: true, // Enter
+    };
+
+    /**
+     * A set of all keysyms corresponding to keys commonly used in shortcuts.
+     * @type{Object.<Number, Boolean>}
+     */
+    const SHORTCUT_KEYS = {
+        0xFFE3: true, // Left Control
+        0xFFE4: true, // Right Control,
+        0xFFE7: true, // Left Meta
+        0xFFE8: true, // Right Meta
+        0xFFE9: true, // Left Alt
+        0xFFEA: true, // Right Alt
+        0xFFEB: true, // Left Super
+        0xFFEC: true, // Right Super
+        0xFFED: true, // Left Hyper
+        0xFFEE: true  // Right Super
+    }
+
+    /**
+     * Format and return a key name for display.
+     *
+     * @param {*} name
+     *     The name of the key
+     *
+     * @returns
+     *     The formatted key name.
+     */
+    const formatKeyName = name => ('<' + name + '>');
+
+    const service = {};
+
+    /**
+     * A batch of text associated with a recording. The batch consists of a
+     * string representation of the text that would be typed based on the key
+     * events in the recording, as well as a timestamp when the batch started.
+     *
+     * @constructor
+     * @param {TextBatch|Object} [template={}]
+     *     The object whose properties should be copied within the new TextBatch.
+     */
+    service.TextBatch = function TextBatch(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * All key events for this batch, some of which may be conslidated,
+         * representing multiple raw events.
+         *
+         * @type {ConsolidatedKeyEvent[]}
+         */
+        this.events = template.events || [];
+
+        /**
+         * The simplified, human-readable value representing the key events for
+         * this batch, equivalent to concatenating the `text` field of all key
+         * events in the batch.
+         *
+         * @type {!String}
+         */
+        this.simpleValue = template.simpleValue || '';
+
+    };
+
+    /**
+     * A granular description of an extracted key event or sequence of events.
+     * It may contain multiple contiguous events of the same type, meaning that all
+     * event(s) that were combined into this event must have had the same `typed`
+     * field value. A single timestamp for the first combined event will be used
+     * for the whole batch if consolidated.
+     *
+     * @constructor
+     * @param {ConsolidatedKeyEvent|Object} [template={}]
+     *     The object whose properties should be copied within the new KeyEventBatch.
+     */
+    service.ConsolidatedKeyEvent = function ConsolidatedKeyEvent(template) {
+
+        // Use empty object by default
+        template = template || {};
+
+        /**
+         * A human-readable representation of the event(s). If a series of printable
+         * characters was directly typed, this will just be those character(s).
+         * Otherwise it will be a string describing the event(s).
+         *
+         * @type {!String}
+         */
+        this.text = template.text;
+
+        /**
+         * True if this text of this event is exactly a typed character, or false
+         * otherwise.
+         *
+         * @type {!boolean}
+         */
+        this.typed = template.typed;
+
+        /**
+         * The timestamp from the recording when this event occured.
+         *
+         * @type {!Number}
+         */
+        this.timestamp = template.timestamp;
+
+    };
+
+    /**
+     * Accepts key events in the format produced by KeyEventInterpreter and returns
+     * human readable text batches, seperated by at least `batchSeperation` milliseconds
+     * if provided.
+     *
+     * NOTE: The event processing logic and output format is based on the `guaclog`
+     * tool, with the addition of batching support.
+     *
+     * @param {Guacamole.KeyEventInterpreter.KeyEvent[]} [rawEvents]
+     *     The raw key events to prepare for display.
+     *
+     * @param {number} [batchSeperation=5000]
+     *     The minimum number of milliseconds that must elapse between subsequent
+     *     batches of key-event-generated text. If 0 or negative, no splitting will
+     *     occur, resulting in a single batch for all provided key events.
+     *
+     * @param {boolean} [consolidateEvents=false]
+     *     Whether consecutive sequences of events with similar properties
+     *     should be consolidated into a single ConsolidatedKeyEvent object for
+     *     display performance reasons.
+     */
+    service.parseEvents = function parseEvents(
+            rawEvents, batchSeperation, consolidateEvents) {
+
+        // Default to 5 seconds if the batch seperation was not provided
+        if (batchSeperation === undefined || batchSeperation === null)
+            batchSeperation = 5000;
+        /**
+         * A map of X11 keysyms to a KeyDefinition object, if the corresponding
+         * key is currently pressed. If a keysym has no entry in this map at all
+         * it means that the key is not being pressed. Note that not all keysyms
+         * are necessarily tracked within this map - only those that are
+         * explicitly tracked.
+         */
+        const pressedKeys = {};
+
+        // The timestamp of the most recent key event processed
+        let lastKeyEvent = 0;
+
+        // All text batches produced from the provided raw key events
+        const batches = [new service.TextBatch()];
+
+        // Process every provided raw
+        _.forEach(rawEvents, event => {
+
+            // Extract all fields from the raw event
+            const { definition, pressed, timestamp } = event;
+            const { keysym, name, value } = definition;
+
+            // Only switch to a new batch of text if sufficient time has passed
+            // since the last key event
+            const newBatch = (batchSeperation >= 0
+                && (timestamp - lastKeyEvent) >= batchSeperation);
+            lastKeyEvent = timestamp;
+
+            if (newBatch)
+                batches.push(new service.TextBatch());
+
+            const currentBatch = _.last(batches);
+
+            /**
+             * Either push the a new event constructed using the provided fields
+             * into the latest batch, or consolidate into the latest event as
+             * appropriate given the consolidation configuration and event type.
+             *
+             * @param {!String} text
+             *     The text representation of the event.
+             *
+             * @param {!Boolean} typed
+             *     Whether the text value would be literally produced by typing
+             *     the key that produced the event.
+             */
+            const pushEvent = (text, typed) => {
+                const latestEvent = _.last(currentBatch.events);
+
+                // Only consolidate the event if configured to do so and it
+                // matches the type of the previous event
+                if (consolidateEvents && latestEvent && latestEvent.typed === typed) {
+                    latestEvent.text += text;
+                    currentBatch.simpleValue += text;
+                }
+
+                // Otherwise, push a new event
+                else {
+                    currentBatch.events.push(new service.ConsolidatedKeyEvent({
+                        text, typed, timestamp}));
+                    currentBatch.simpleValue += text;
+                }
+            }
+
+            // Track modifier state
+            if (MODIFIER_KEYS[keysym]) {
+                if (pressed)
+                    pressedKeys[keysym] = definition;
+                else
+                    delete pressedKeys[keysym];
+            }
+
+            // Append to the current typed value when a printable
+            // (non-modifier) key is pressed
+            else if (pressed) {
+
+                // If any shorcut keys are currently pressed
+                if (_.some(pressedKeys, (def, key) => SHORTCUT_KEYS[key])) {
+
+                    var shortcutText = '<';
+
+                    var firstKey = true;
+
+                    // Compose entry by inspecting the state of each tracked key.
+                    // At least one key must be pressed when in a shortcut.
+                    for (let pressedKeysym in pressedKeys) {
+
+                        var pressedKeyDefinition = pressedKeys[pressedKeysym];
+
+                        // Print name of key
+                        if (firstKey) {
+                            shortcutText += pressedKeyDefinition.name;
+                            firstKey = false;
+                        }
+
+                        else
+                            shortcutText += ('+' + pressedKeyDefinition.name);
+
+                    }
+
+                    // Finally, append the printable key to close the shortcut
+                    shortcutText += ('+' + name + '>')
+
+                    // Add the shortcut to the current batch
+                    pushEvent(shortcutText, false);
+                }
+            }
+
+            // Print the key itself
+            else {
+
+                var keyText;
+                var typed;
+
+                // Print the value if explicitly defined
+                if (value !== undefined) {
+
+                    keyText = value;
+                    typed = true;
+
+                    // If the name should be printed in addition, add it as a
+                    // seperate event before the actual character value
+                    if (PRINT_NAME_TOO_KEYS[keysym])
+                        pushEvent(formatKeyName(name), false);
+
+                }
+
+                // Otherwise print the name
+                else {
+
+                    keyText = formatKeyName(name);
+
+                    // While this is a representation for a single character,
+                    // the key text is the name of the key, not the actual
+                    // character itself
+                    typed = false;
+
+                }
+
+                // Add the key to the current batch
+                pushEvent(keyText, typed);
+
+            }
+
+        });
+
+        // All processed batches
+        return batches;
+
+    };
+
+    return service;
+
+}]);
diff --git a/guacamole/src/main/frontend/src/app/player/types/TextBatch.js b/guacamole/src/main/frontend/src/app/player/types/TextBatch.js
deleted file mode 100644
index 58575e4c1..000000000
--- a/guacamole/src/main/frontend/src/app/player/types/TextBatch.js
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/* global _ */
-
-/**
- * Service which defines the TextBatch class.
- */
-angular.module('player').factory('TextBatch', [function defineTextBatch() {
-
-    /**
-     * A batch of text associated with a recording. The batch consists of a
-     * string representation of the text that would be typed based on the key
-     * events in the recording, as well as a timestamp when the batch started.
-     *
-     * @constructor
-     * @param {Guacamole.KeyEventInterpreter.KeyEvent|TextBatch|Object} [template={}]
-     *     The object whose properties should be copied within the new TextBatch.
-     */
-    const TextBatch = function TextBatch(template) {
-
-        /**
-         * All key events for this batch, with sequences of key events having
-         * the same `typed` field value combined.
-         *
-         * @type {!KeyEventBatch[]}
-         */
-        this.events = _.reduce(template.events, (consolidatedEvents, rawEvent) => {
-
-            const currentEvent = _.last(consolidatedEvents);
-
-            // If a current event exists with the same `typed` value, conslidate
-            // the raw text event into it
-            if (currentEvent && currentEvent.typed === rawEvent.typed)
-                currentEvent.text += rawEvent.text;
-
-            // Otherwise, create a new conslidated event starting now
-            else
-                consolidatedEvents.push(new TextBatch.ConsolidatedKeyEvent(rawEvent));
-
-            return consolidatedEvents;
-
-        }, []);
-
-        /**
-         * The simplified, human-readable value representing the key events for
-         * this batch, equivalent to concatenating the `text` field of all key
-         * events in the batch.
-         *
-         * @type {!String}
-         */
-        this.simpleValue = template.simpleValue || '';
-
-    };
-
-    /**
-     * A granular description of an extracted key event or sequence of events.
-     * Similar to the Guacamole.KeyEventInterpreter.KeyEvent type, except that
-     * this KeyEventBatch may contain multiple contiguous events of the same type,
-     * meaning that all event(s) that were combined into this event must have
-     * had the same `typed` field value. A single timestamp for the first combined
-     * event will be used for the whole batch.
-     *
-     * @constructor
-     * @param {Guacamole.KeyEventInterpreter.KeyEventBatch|ConsolidatedKeyEvent|Object} [template={}]
-     *     The object whose properties should be copied within the new KeyEventBatch.
-     */
-    TextBatch.ConsolidatedKeyEvent = function ConsolidatedKeyEvent(template) {
-
-        /**
-         * A human-readable representation of the event(s). If a series of printable
-         * characters was directly typed, this will just be those character(s).
-         * Otherwise it will be a string describing the event(s).
-         *
-         * @type {!String}
-         */
-        this.text = template.text;
-
-        /**
-         * True if this text of this event is exactly a typed character, or false
-         * otherwise.
-         *
-         * @type {!boolean}
-         */
-        this.typed = template.typed;
-
-        /**
-         * The timestamp from the recording when this event occured. If a
-         * `startTimestamp` value was provided to the interpreter constructor, this
-         * will be relative to start of the recording. If not, it will be the raw
-         * timestamp from the key event.
-         *
-         * @type {!Number}
-         */
-        this.timestamp = template.timestamp;
-
-    };
-
-    return TextBatch;
-
-}]);

From ed31d6f2e0e8ea079d6e8c59ca0d5a2930bb38ac Mon Sep 17 00:00:00 2001
From: Mike Jumper <mjumper@apache.org>
Date: Fri, 6 Oct 2023 12:17:15 -0700
Subject: [PATCH 226/289] GUACAMOLE-839: Force usage of non-dynamic version of
 Bouncy Castle FIPS.

---
 .../modules/guacamole-auth-sso-ssl/pom.xml    | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
index 2f705eae7..945be98c4 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
@@ -124,6 +124,25 @@
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcpkix-fips</artifactId>
             <version>1.0.7</version>
+
+            <!-- Force usage of known version of bc-fips, rather than a future
+            unknown version (bcpkix-fips references bc-fips using a version
+            range, resulting in newer versions getting pulled in automatically,
+            breaking the automated license check) -->
+            <exclusions>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bc-fips</artifactId>
+                </exclusion>
+            </exclusions>
+
+        </dependency>
+
+        <!-- Force usage of known version of bc-fips (see bcpkix-fips above) -->
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bc-fips</artifactId>
+            <version>1.0.2.4</version>
         </dependency>
 
     </dependencies>

From b4fef17f3584488106a31c507bf9a9609fefccd4 Mon Sep 17 00:00:00 2001
From: sirux88 <sirux88@gmail.com>
Date: Sun, 15 Oct 2023 12:34:13 +0200
Subject: [PATCH 227/289] GUACAMOLE-1692: Updated german translation

---
 .../src/main/resources/translations/de.json   |  22 +-
 .../main/frontend/src/translations/de.json    | 342 +++++++++++++++---
 2 files changed, 316 insertions(+), 48 deletions(-)

diff --git a/extensions/guacamole-auth-totp/src/main/resources/translations/de.json b/extensions/guacamole-auth-totp/src/main/resources/translations/de.json
index 58f32a62f..56536d7df 100644
--- a/extensions/guacamole-auth-totp/src/main/resources/translations/de.json
+++ b/extensions/guacamole-auth-totp/src/main/resources/translations/de.json
@@ -25,8 +25,28 @@
         "INFO_VERIFICATION_FAILED" : "Verifikation fehlgeschlagen. Bitte nochmals versuchen.",
 
         "HELP_ENROLL_BARCODE" : "Bitte scannen Sie den Barcode mittels einer Zweifaktor-Authentifizierungs-App auf Ihrem Smartphone oder einem anderen Gerät, um den Prozess fortzusetzen.",
-        "HELP_ENROLL_VERIFY"  : "Nach dem Scannen des Barcodes wird Ihnen ein {DIGITS}-stelliger Authentifizierungscode angezeigt. Bitte geben Sie diesen Code ein um die Aktivierung des Zweifaktor-Verfahrens abzuschliessen."
+        "HELP_ENROLL_VERIFY"  : "Nach dem Scannen des Barcodes wird Ihnen ein {DIGITS}-stelliger Authentifizierungscode angezeigt. Bitte geben Sie diesen Code ein um die Aktivierung des Zweifaktor-Verfahrens abzuschliessen.",
 
+        "SECTION_HEADER_DETAILS" : "Details:"
+
+    },
+    
+    "USER_ATTRIBUTES" : {
+        
+        "FIELD_HEADER_GUAC_TOTP_DISABLED"      : "TOTP deaktivieren:",
+        "FIELD_HEADER_GUAC_TOTP_KEY_GENERATED" : "Geheimer Schlüssel erstellt:",
+        "FIELD_HEADER_GUAC_TOTP_KEY_CONFIRMED" : "Authentifizierungs-Gerät bestätigt:",
+        
+        "SECTION_HEADER_TOTP_ENROLLMENT_STATUS" : "TOTP Ausroll-Status"
+        
+    },
+
+    "USER_GROUP_ATTRIBUTES" : {
+        
+        "FIELD_HEADER_GUAC_TOTP_DISABLED" : "TOTP deaktivieren:",
+        
+        "SECTION_HEADER_TOTP_USER_GROUP_CONFIG" : "TOTP Konfiguration"
+        
     }
 
 }
diff --git a/guacamole/src/main/frontend/src/translations/de.json b/guacamole/src/main/frontend/src/translations/de.json
index f252c6192..6c5a1b8ab 100644
--- a/guacamole/src/main/frontend/src/translations/de.json
+++ b/guacamole/src/main/frontend/src/translations/de.json
@@ -6,12 +6,15 @@
 
         "ACTION_ACKNOWLEDGE"        : "OK",
         "ACTION_CANCEL"             : "Abbruch",
+        "ACTION_CLEAR"              : "Bereinigen",
         "ACTION_CLONE"              : "Kopieren",
         "ACTION_CONTINUE"           : "Weiter",
         "ACTION_DELETE"             : "Löschen",
         "ACTION_DELETE_SESSIONS"    : "Sitzung beenden",
         "ACTION_DOWNLOAD"           : "Download",
+        "ACTION_IMPORT"             : "Import",
         "ACTION_LOGIN"              : "Anmelden",
+        "ACTION_LOGIN_AGAIN"        : "Neuanmelden",
         "ACTION_LOGOUT"             : "Abmelden",
         "ACTION_MANAGE_CONNECTIONS" : "Verbindungen",
         "ACTION_MANAGE_PREFERENCES" : "Einstellungen",
@@ -21,17 +24,21 @@
         "ACTION_MANAGE_USER_GROUPS" : "Gruppen",
         "ACTION_NAVIGATE_BACK"      : "Zurück",
         "ACTION_NAVIGATE_HOME"      : "Startseite",
+        "ACTION_PAUSE"              : "Pause",
+        "ACTION_PLAY"               : "Abspielen",
         "ACTION_SAVE"               : "Speichern",
         "ACTION_SEARCH"             : "Suche",
         "ACTION_SHARE"              : "Teilen",
         "ACTION_UPDATE_PASSWORD"    : "Passwort aktualisieren",
         "ACTION_VIEW_HISTORY"       : "Verlauf",
+        "ACTION_VIEW_RECORDING"     : "Ansicht",
 
         "DIALOG_HEADER_ERROR" : "Fehler",
 
         "ERROR_PAGE_UNAVAILABLE"  : "Ein Fehler ist aufgetreten und die gewünschte Aktion kann nicht fortgesetzt werden. Bitte informieren Sie ihren Systemadministrator oder prüfen Sie die Logdateien, falls das Problem bestehen bleiben sollte.",
         "ERROR_PASSWORD_BLANK"    : "Das Passwort darf nicht leer sein.",
         "ERROR_PASSWORD_MISMATCH" : "Die Passwörter stimmen nicht überein.",
+        "ERROR_SINGLE_FILE_ONLY"  : "Bitte nur eine Datei zeitgleich hochladen",
         
         "FIELD_HEADER_PASSWORD"       : "Passwort:",
         "FIELD_HEADER_PASSWORD_AGAIN" : "Wiederhole Passwort:",
@@ -41,16 +48,21 @@
         "FORMAT_DATE_TIME_PRECISE" : "dd-MM-yyyy HH:mm:ss",
 
         "INFO_ACTIVE_USER_COUNT" : "In Benutzung durch {USERS} Benutzer.",
+        "INFO_LOGGED_OUT"        : "Sie wurden ausgeloggt.",
 
         "TEXT_ANONYMOUS_USER"   : "Anonymer Benutzer",
-        "TEXT_HISTORY_DURATION" : "{VALUE} {UNIT, select, second{{VALUE, plural, one{Sekunde} other{Sekunden}}} minute{{VALUE, plural, one{Minute} other{Minuten}}} hour{{VALUE, plural, one{Stunde} other{Stunden}}} day{{VALUE, plural, one{Tag} other{Tage}}} other{}}"
+        "TEXT_HISTORY_DURATION" : "{VALUE} {UNIT, select, second{{VALUE, plural, one{Sekunde} other{Sekunden}}} minute{{VALUE, plural, one{Minute} other{Minuten}}} hour{{VALUE, plural, one{Stunde} other{Stunden}}} day{{VALUE, plural, one{Tag} other{Tage}}} other{}}",
+        "TEXT_UNTRANSLATED" : "{MESSAGE}"
 
     },
 
     "CLIENT" : {
 
         "ACTION_ACKNOWLEDGE"               : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_CANCEL"                    : "@:APP.ACTION_CANCEL",
+        "ACTION_CLEAR_CLIENT_MESSAGES"     : "@:APP.ACTION_CLEAR",
         "ACTION_CLEAR_COMPLETED_TRANSFERS" : "Entferne abgeschlossene Übertragungen",
+        "ACTION_CONTINUE"                  : "@:APP.ACTION_CONTINUE",
         "ACTION_DISCONNECT"                : "Trennen",
         "ACTION_LOGOUT"                    : "@:APP.ACTION_LOGOUT",
         "ACTION_NAVIGATE_BACK"             : "@:APP.ACTION_NAVIGATE_BACK",
@@ -114,8 +126,10 @@
         "HELP_MOUSE_MODE_RELATIVE" : "Den Mauszeiger zur Zielposition bewegen und klicken. Der Klick erfolgt an der Position des Mauszeigers.",
         "HELP_SHARE_LINK"          : "Die aktuelle Verbindung wird gegenwärtig geteilt und kann von jeder Person über den folgenden Link erreicht werden:",
 
-        "INFO_CONNECTION_SHARED" : "Diese Verbindung wird nun geteilt.",
-        "INFO_NO_FILE_TRANSFERS" : "Keine Dateiübertragungen.",
+        "INFO_ANONYMOUS_USER_COUNT" : "Anonym{COUNT, plural, one{} other{ (#)}}",
+        "INFO_CONNECTION_SHARED"    : "Diese Verbindung wird nun geteilt.",
+        "INFO_NO_FILE_TRANSFERS"    : "Keine Dateiübertragungen.",
+        "INFO_USER_COUNT"           : "{USERNAME}{COUNT, plural, one{} other{ (#)}}",
 
         "NAME_INPUT_METHOD_NONE"   : "Keine",
         "NAME_INPUT_METHOD_OSK"    : "Bildschirmtastatur",
@@ -127,26 +141,123 @@
         "NAME_MOUSE_MODE_ABSOLUTE" : "Touchscreen",
         "NAME_MOUSE_MODE_RELATIVE" : "Touchpad",
 
-        "SECTION_HEADER_CLIPBOARD"      : "Zwischenablage",
-        "SECTION_HEADER_DEVICES"        : "Geräte",
-        "SECTION_HEADER_DISPLAY"        : "Anzeige",
-        "SECTION_HEADER_FILE_TRANSFERS" : "Dateiübertragung",
-        "SECTION_HEADER_INPUT_METHOD"   : "Eingabemethode",
+        "SECTION_HEADER_CLIENT_MESSAGES" : "Nachrichten",
+        "SECTION_HEADER_CLIPBOARD"       : "Zwischenablage",
+        "SECTION_HEADER_DEVICES"         : "Geräte",
+        "SECTION_HEADER_DISPLAY"         : "Anzeige",
+        "SECTION_HEADER_FILE_TRANSFERS"  : "Dateiübertragung",
+        "SECTION_HEADER_INPUT_METHOD"    : "Eingabemethode",
+
         "SECTION_HEADER_MOUSE_MODE"     : "Mausemulationsmodus",
 
+        "TEXT_ANONYMOUS_USER_JOINED"      : "Ein unbekannter Benutzer ist der Verbindung beigetreten.",
+        "TEXT_ANONYMOUS_USER_LEFT"        : "Ein unbekannter Benutzer hat die Verbindung verlassen.",
         "TEXT_ZOOM_AUTO_FIT"              : "Autoanpassung Fenstergröße",
         "TEXT_CLIENT_STATUS_IDLE"         : "Inaktiv.",
         "TEXT_CLIENT_STATUS_CONNECTING"   : "Verbindungsaufbau zu Guacamole...",
         "TEXT_CLIENT_STATUS_DISCONNECTED" : "Verbindung wurde getrennt.",
         "TEXT_CLIENT_STATUS_UNSTABLE"     : "Die Verbindung zum Guacamole-Server ist nicht stabil.",
         "TEXT_CLIENT_STATUS_WAITING"      : "Verbindungsaufbau zu Guacamole. Bitte warten...",
+        "TEXT_USER_JOINED"                : "{USERNAME} ist der Verbindung beigetreten.",
+        "TEXT_USER_LEFT"                  : "{USERNAME} hat die Verbindung verlassen.",
         "TEXT_RECONNECT_COUNTDOWN"        : "Neuverbindung in {REMAINING} {REMAINING, plural, one{Sekunde} other{Sekunden}}...",
         "TEXT_FILE_TRANSFER_PROGRESS"     : "{PROGRESS} {UNIT, select, b{B} kb{KB} mb{MB} gb{GB} other{}}",
+        "TEXT_CLIPBOARD_AWAITING_FOCUS"   : "Klicken um Zwischenablage anzuzeigen...",
 
         "URL_OSK_LAYOUT" : "layouts/de-de-qwertz.json"
 
     },
 
+    "COLOR_SCHEME" : {
+
+        "ACTION_CANCEL"       : "@:APP.ACTION_CANCEL",
+        "ACTION_HIDE_DETAILS" : "Ausblenden",
+        "ACTION_SAVE"         : "@:APP.ACTION_SAVE",
+        "ACTION_SHOW_DETAILS" : "Anzeigen",
+
+        "FIELD_HEADER_BACKGROUND" : "Hintergrund",
+        "FIELD_HEADER_FOREGROUND" : "Vordergrund",
+
+        "FIELD_OPTION_CUSTOM" : "Benutzerdefiniert...",
+
+        "SECTION_HEADER_DETAILS" : "Details:"
+
+    },
+
+    "IMPORT": {
+
+        "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_BROWSE"             : "Datei auswählen",
+        "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
+        "ACTION_CLEAR"              : "@:APP.ACTION_CLEAR",
+        "ACTION_VIEW_FORMAT_HELP"   : "Formatierungshinweise anzeigen",
+        "ACTION_IMPORT"             : "@:APP.ACTION_IMPORT",
+        "ACTION_IMPORT_CONNECTIONS" : "Verbindungen importieren",
+
+        "DIALOG_HEADER_ERROR"   : "@:APP.DIALOG_HEADER_ERROR",
+        "DIALOG_HEADER_SUCCESS" : "Erfolgreich",
+
+        "ERROR_AMBIGUOUS_CSV_HEADER"         : "Mehrdeutige CSV Kopfzeile \"{HEADER}\" könnte ein Verbindungsattribute oder Parameter sein",
+        "ERROR_AMBIGUOUS_PARENT_GROUP"       : "group und parentIdentifier können nicht zeitgleich verwendet werden",
+        "ERROR_ARRAY_REQUIRED"               : "Die verwendete Datei muss eine Liste an Verbindungen beinhalten",
+        "ERROR_DETECTED_INVALID_TYPE"        : "Nicht unterstüzter Dateityp. Die Datei muss  CSV, JSON, oder YAML sein.",
+        "ERROR_DUPLICATE_CONNECTION_IN_FILE" : "Doppelte Verbindung \"{NAME}\" bei \"{PATH}\" in der Import Datei",
+        "ERROR_DUPLICATE_CSV_HEADER"         : "Doppelte CSV Kopfzeile: {HEADER}",
+        "ERROR_EMPTY_FILE"                   : "Die verwendete Datei ist leer",
+        "ERROR_INVALID_CSV_HEADER"           : "Ungültige CSV Kopfzeile \"{HEADER}\" ist weder ein Attribute noch ein Parameter",
+        "ERROR_INVALID_MIME_TYPE"            : "Nicht unterstüzter Dateityp: \"{TYPE}\"",
+        "ERROR_INVALID_GROUP"                : "Keine passende Gruppe \"{GROUP}\" gefunden",
+        "ERROR_INVALID_GROUP_IDENTIFIER"     : "Keine passende Verbindungsgruppe \"{IDENTIFIER}\" gefunden",
+        "ERROR_INVALID_GROUP_TYPE"           : "Ungültige Gruppe - Muss string sein.",
+        "ERROR_INVALID_PROTOCOL"             : "Ungültiges Protokoll \"{PROTOCOL}\"",
+        "ERROR_INVALID_USER_GROUPS_TYPE"     : "Ungültige Benutzergruppen - muss eine Liste mit Gruppen-IDs sein.",
+        "ERROR_INVALID_USERS_TYPE"           : "Ungültige Benutzer  - muss eine Liste mit Benutzer-IDs sein.",
+        "ERROR_NO_FILE_SUPPLIED"             : "Bitte eine Datei zum importieren auswählen",
+        "ERROR_PARSE_FAILURE_CSV"            : "Bitte prüfen, ob die Datei eine gültige CSV ist. Folgender Verarbeitungfehler ist aufgetreten \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_JSON"           : "Bitte prüfen, ob die Datei eine gültige JSON ist. Folgender Verarbeitungfehler ist aufgetreten \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_YAML"           : "Bitte prüfen, ob die Datei eine gültige YML ist. Folgender Verarbeitungfehler ist aufgetreten \"{ERROR}\". ",
+        "ERROR_REJECT_UPDATE_CONNECTION"     : "Verbindung  \"{NAME}\" bereits vorhanden bei \"{PATH}\"",
+        "ERROR_REQUIRED_NAME_CONNECTION"     : "Der Verbindungsname wird benötigt",
+        "ERROR_REQUIRED_PROTOCOL_CONNECTION" : "Das Verbindungsprotokoll wird benötigt",
+        "ERROR_REQUIRED_NAME_FILE"           : "Kein Verbindungsnamen gefunden in der verwendeten Datei",
+        "ERROR_REQUIRED_PROTOCOL_FILE"       : "Kein Verbindungsprotokoll gefunden in der verwendeten Datei",
+
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+
+        "FIELD_HEADER_EXISTING_CONNECTION_MODE" : "Vorhandene Verbindungen ersetzen/aktualisieren",
+        "FIELD_HEADER_EXISTING_PERMISSION_MODE" : "Berechtigungen zurücksetzen",
+
+        "HELP_CSV_DESCRIPTION"              : "Eine CSV-Verbindungsimportdatei verfügt über einen Verbindungsdatensatz pro Zeile. Jede Spalte gibt ein Verbindungsfeld an. Es müssen mindestens der Verbindungsname und das Protokoll angegeben werden.",
+        "HELP_CSV_EXAMPLE"                  : "name,protocol,username,password,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,alice,pass1,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,bob,pass2,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,carol,pass3,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,,,",
+        "HELP_CSV_MORE_DETAILS"             : "Die CSV Kopfzeile gibt das Verbindungsfeld für jede Zeile an. Die Verbindungsgruppen-ID, in welche die Verbindung importiert werden soll, kann direkt mit „parentIdentifier“ angegeben werden oder der Pfad zur übergeordneten Gruppe kann mit „group“ angegeben werden, wie unten gezeigt. In den meisten Fällen sollte es keinen Konflikt zwischen Feldern geben, aber bei Bedarf kann zur eindeutigen Unterscheidung das Suffix „(Attribut)“ oder „(Parameter)“ hinzugefügt werden. Listen mit Benutzer- oder Benutzergruppen-IDs müssen durch Semikolons getrennt sein.¹",
+        "HELP_FILE_TYPE_DESCRIPTION"        : "Für den Verbindungsimport werden drei Dateitypen unterstützt: CSV, JSON und YAML. Für jeden Dateityp können die gleichen Daten angegeben werden. Dies muss den Verbindungsnamen und das Protokoll enthalten. Optional können auch ein Verbindungsgruppenstandort, eine Liste von Benutzern und/oder Benutzergruppen, denen Zugriff gewährt werden soll, Verbindungsparameter oder Verbindungsprotokolle angegeben werden. Alle Benutzer oder Benutzergruppen, die in der aktuellen Datenquelle nicht vorhanden sind, werden automatisch erstellt. Beachten Sie, dass vorhandene Verbindungsberechtigungen für aktualisierte Verbindungen nicht entfernt werden, es sei denn, „Berechtigungen zurücksetzen“ ist aktiviert.",
+        "HELP_FILE_TYPE_HEADER"             : "Dateitypen",
+        "HELP_JSON_DESCRIPTION"             : "Eine JSON-Verbindungsimportdatei ist eine Liste von Verbindungsobjekten. In jedem Verbindungsobjekt müssen mindestens der Verbindungsname und das Protokoll angegeben werden.",
+        "HELP_JSON_EXAMPLE"                 : "[\n  \\{\n    \"name\": \"conn1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"username\": \"alice\", \"password\": \"pass1\", \"hostname\": \"conn1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac user 1\", \"guac user 2\" ],\n    \"groups\": [ \"Connection 1 Users\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"username\": \"bob\", \"password\": \"pass2\", \"hostname\": \"conn2.web.com\" \\},\n    \"group\": \"ROOT/Parent Group\",\n    \"users\": [ \"guac user 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"username\": \"carol\", \"password\": \"pass3\", \"hostname\": \"conn3.web.com\" \\},\n    \"group\": \"ROOT/Parent Group/Child Group\",\n    \"users\": [ \"guac user 2\", \"guac user 3\" ]\n  \\},\n  \\{\n    \"name\": \"conn4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
+        "HELP_JSON_MORE_DETAILS"            : "Die Verbindungsgruppen-ID, in welche die Verbindung importiert werden soll, kann direkt mit einem Feld „parentIdentifier“ angegeben werden oder der Pfad zur übergeordneten Gruppe kann wie unten gezeigt mit einem Feld „group“ angegeben werden. Pro Verbindung kann ein Array von Benutzer- und Benutzergruppen-IDs angegeben werden, denen Zugriff gewährt werden soll.",
+        "HELP_EXISTING_CONNECTION_MODE"     : "Vorhandene Verbindungen vollständig ersetzen/aktualisieren, wenn ihre Namen und übergeordneten Verbindungsgruppen mit den Werten in der bereitgestellten Datei übereinstimmen. Wenn diese Option deaktiviert ist, wird der Versuch, eine Verbindung mit demselben Namen und derselben übergeordneten Verbindungsgruppe wie eine vorhandene Verbindung zu importieren, als Fehler gewertet.",
+        "HELP_EXISTING_PERMISSION_MODE"     : "Setzen Sie die für alle Verbindungen in der bereitgestellten Datei gewährten Berechtigungen vollständig auf die in dieser Datei angegebenen Berechtigungen zurück. Wenn keine Berechtigungen angegeben werden, werden alle relevanten Verbindungsberechtigungen widerrufen. Wenn diese Option deaktiviert ist, bleiben vorhandene Berechtigungen erhalten und alle in der Datei angegebenen Berechtigungen werden hinzugefügt.",
+        "HELP_SEMICOLON_FOOTNOTE"           : "Falls vorhanden, können Semikolons mit einem Backslash maskiert werden, z.B. \"first\\\\;last\"",
+        "HELP_UPLOAD_DROP_TITLE"            : "Datei hier hinziehen",
+        "HELP_UPLOAD_FILE_TYPES"            : "CSV, JSON, oder YAML",
+        "HELP_YAML_DESCRIPTION"             : "Eine YAML-Verbindungsimportdatei ist eine Liste von Verbindungsobjekten mit genau der gleichen Struktur wie das JSON-Format.",
+        "HELP_YAML_EXAMPLE"                 : "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      username: alice\n      password: pass1\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n      - guac user 1\n      - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      username: bob\n      password: pass2\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n      - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      username: carol\n      password: pass3\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n      - guac user 2\n      - guac user 3\n  - name: conn4\n    protocol: kubernetes",
+
+        "INFO_CONNECTIONS_IMPORTED_SUCCESS" : "{NUMBER} {NUMBER, plural, one{connection} other{connections}} erfolgreich importiert.",
+        
+        "SECTION_HEADER_CONNECTION_IMPORT"           : "Verbindungsimport",
+        "SECTION_HEADER_HELP_CONNECTION_IMPORT_FILE" : "Dateiformat für Verbindungsimport",
+        "SECTION_HEADER_CSV"                         : "CSV Format",
+        "SECTION_HEADER_JSON"                        : "JSON Format",
+        "SECTION_HEADER_YAML"                        : "YAML Format",
+
+        "TABLE_HEADER_ERRORS"     : "Fehler",
+        "TABLE_HEADER_GROUP"      : "Gruppe",
+        "TABLE_HEADER_NAME"       : "Name",
+        "TABLE_HEADER_PROTOCOL"   : "Protokol",
+        "TABLE_HEADER_ROW_NUMBER" : "Zeile #"
+    },
+
     "DATA_SOURCE_DEFAULT" : {
         "NAME" : "Standard (XML)"
     },
@@ -190,7 +301,7 @@
 
         "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
-        "ERROR_INVALID_LOGIN" : "Anmeldungsfehler",
+        "ERROR_INVALID_LOGIN" : "Anmeldungefehler",
 
         "FIELD_HEADER_USERNAME" : "Benutzername",
         "FIELD_HEADER_PASSWORD" : "Passwort"
@@ -222,9 +333,9 @@
         "SECTION_HEADER_HISTORY"         : "Verlauf",
         "SECTION_HEADER_PARAMETERS"      : "Parameter",
 
-        "TABLE_HEADER_HISTORY_USERNAME" : "Benutzername",
-        "TABLE_HEADER_HISTORY_START"    : "Beginn",
-        "TABLE_HEADER_HISTORY_DURATION" : "Dauer",
+        "TABLE_HEADER_HISTORY_USERNAME"   : "Benutzername",
+        "TABLE_HEADER_HISTORY_START"      : "Beginn",
+        "TABLE_HEADER_HISTORY_DURATION"   : "Dauer",
         "TABLE_HEADER_HISTORY_REMOTEHOST" : "Entfernter Host",
 
         "TEXT_CONFIRM_DELETE"   : "Dieser Löschvorgang ist unumkehrbar. Soll diese Verbindung wirklich gelöscht werden?",
@@ -361,21 +472,92 @@
         "TEXT_CONFIRM_DELETE" : "Dieser Löschvorgang ist unumkehrbar. Möchten Sie diese Benutzergruppe wirklich löschen?"
 
     },
-    
+
+    "PLAYER" : {
+
+        "ACTION_CANCEL"       : "@:APP.ACTION_CANCEL",
+        "ACTION_PAUSE"        : "@:APP.ACTION_PAUSE",
+        "ACTION_PLAY"         : "@:APP.ACTION_PLAY",
+        "ACTION_SHOW_KEY_LOG" : "Tastenanschlag-Protokoll",
+
+        "INFO_LOADING_RECORDING" : "Aufnahme wird geladen. Bitte warten...",
+        "INFO_NO_KEY_LOG"        : "Tastenanschlag-Protokoll nicht vorhanden",
+        "INFO_NUMBER_OF_RESULTS" : "{RESULTS} {RESULTS, plural, one{Match} other{Matches}}",
+        "INFO_SEEK_IN_PROGRESS"  : "Spule zu gewünschten Stelle. Bitte warten...",
+
+        "FIELD_PLACEHOLDER_TEXT_BATCH_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER"
+
+    },
+
+    "PROTOCOL_KUBERNETES" : {
+
+        "FIELD_HEADER_BACKSPACE"       : "Rücktaste sendet:",
+        "FIELD_HEADER_CA_CERT"         : "Zertifikate der Zertifizierungsstelle:",
+        "FIELD_HEADER_CLIENT_CERT"     : "Client Zertifikat:",
+        "FIELD_HEADER_CLIENT_KEY"      : "Client Schlüssel:",
+        "FIELD_HEADER_COLOR_SCHEME"    : "Farbschema:",
+        "FIELD_HEADER_CONTAINER"       : "Container Name:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH"  : "Aufname-Pfad automatisch erstellen:",
+        "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "Typescript-Pfad automatisch erstellen:",
+        "FIELD_HEADER_EXEC_COMMAND"    : "Befehl ausführen (exec):",
+        "FIELD_HEADER_FONT_NAME"       : "Schriftname:",
+        "FIELD_HEADER_FONT_SIZE"       : "Schriftgröße:",
+        "FIELD_HEADER_HOSTNAME"        : "Hostname:",
+        "FIELD_HEADER_IGNORE_CERT"     : "Server-Zertifikate ignorieren:",
+        "FIELD_HEADER_NAMESPACE"       : "Namespace:",
+        "FIELD_HEADER_POD"             : "Pod Name:",
+        "FIELD_HEADER_PORT"            : "Port:",
+        "FIELD_HEADER_READ_ONLY"       : "Schreibgeschützt:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Maus auschließen:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Grafik/Streams ausschließen:",
+        "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Tasten-Ereignisse einschließen:",
+        "FIELD_HEADER_RECORDING_NAME"  : "Aufnahme-Name:",
+        "FIELD_HEADER_RECORDING_PATH"  : "Aufnahme-Pfad:",
+        "FIELD_HEADER_SCROLLBACK"      : "Maximale Scrollback Größe:",
+        "FIELD_HEADER_TYPESCRIPT_NAME" : "Typescript Name:",
+        "FIELD_HEADER_TYPESCRIPT_PATH" : "Typescript Pfad:",
+        "FIELD_HEADER_USE_SSL"         : "SSL/TLS verwenden",
+
+        "FIELD_OPTION_BACKSPACE_EMPTY" : "",
+        "FIELD_OPTION_BACKSPACE_8"     : "Rücktaste (Strg-H)",
+        "FIELD_OPTION_BACKSPACE_127"   : "Löschen (Strg-?)",
+
+        "FIELD_OPTION_COLOR_SCHEME_BLACK_WHITE" : "Schwarz auf Weiß",
+        "FIELD_OPTION_COLOR_SCHEME_EMPTY"       : "",
+        "FIELD_OPTION_COLOR_SCHEME_GRAY_BLACK"  : "Grau auf Schwarz",
+        "FIELD_OPTION_COLOR_SCHEME_GREEN_BLACK" : "Grün auf Schwarz",
+        "FIELD_OPTION_COLOR_SCHEME_WHITE_BLACK" : "Weiß auf Schwarz",
+
+        "SECTION_HEADER_AUTHENTICATION" : "Authentifizierung",
+        "SECTION_HEADER_BEHAVIOR"       : "Konsolenverhalten",
+        "SECTION_HEADER_CONTAINER"      : "Container",
+        "SECTION_HEADER_DISPLAY"        : "Bildschirm",
+        "SECTION_HEADER_RECORDING"      : "Monitor-Aufnahme",
+        "SECTION_HEADER_TYPESCRIPT"     : "Typescript (Text Session Aufnahme)",
+        "SECTION_HEADER_NETWORK"        : "Netzwerk"
+
+    },
+
     "PROTOCOL_RDP" : {
 
-        "FIELD_HEADER_CLIENT_NAME"     : "Client-Name:",
-        "FIELD_HEADER_COLOR_DEPTH"     : "Farbtiefe:",
-        "FIELD_HEADER_CONSOLE"         : "Mit Konsole verbinden (Windows 2003 / 2003 R2):",
-        "FIELD_HEADER_CONSOLE_AUDIO"   : "Audiounterstützung Konsole:",
-        "FIELD_HEADER_CREATE_DRIVE_PATH" : "Austauschlaufwerk automatisch erstellen:",
-        "FIELD_HEADER_CREATE_RECORDING_PATH": "Aufzeichnungspfad automatisch erstellen:",
-        "FIELD_HEADER_DISABLE_AUDIO"   : "Audio deaktivieren:",
-        "FIELD_HEADER_DISABLE_AUTH"    : "Authentifizierung deaktivieren:",
-        "FIELD_HEADER_DOMAIN"          : "Domäne:",
-        "FIELD_HEADER_DPI"             : "Auflösung (DPI):",
-        "FIELD_HEADER_DRIVE_NAME"      : "Laufwerksname:",
-        "FIELD_HEADER_DRIVE_PATH"      : "Laufwerkspfad:",
+        "FIELD_HEADER_CERT_TOFU"             : "Vertraue Host Zertifikat bei erster Verwendung:",
+        "FIELD_HEADER_CERT_FINGERPRINTS"     : "Fingerprints bekannter Host Zertifikate:",
+        "FIELD_HEADER_CLIENT_NAME"           : "Client name:",
+        "FIELD_HEADER_COLOR_DEPTH"           : "Farbtiefe:",
+        "FIELD_HEADER_CONSOLE"               : "Mit Konsole verbinden (Windows 2003 / 2003 R2):",
+        "FIELD_HEADER_CONSOLE_AUDIO"         : "Audiounterstützung Konsole:",
+        "FIELD_HEADER_CREATE_DRIVE_PATH"     : "Austauschlaufwerk automatisch erstellen:",
+        "FIELD_HEADER_CREATE_RECORDING_PATH" : "Aufzeichnungspfad automatisch erstellen:",
+        "FIELD_HEADER_DISABLE_AUDIO"    : "Audio deaktivieren:",
+        "FIELD_HEADER_DISABLE_AUTH"     : "Authentifizierung deaktivieren:",
+        "FIELD_HEADER_DISABLE_COPY"     : "Kopieren deaktivieren:",
+        "FIELD_HEADER_DISABLE_DOWNLOAD" : "Dateidownload deaktivieren:",
+        "FIELD_HEADER_DISABLE_PASTE"    : "Einfügen deaktivieren:",
+        "FIELD_HEADER_DISABLE_UPLOAD"   : "Dateiupload deaktivieren:",
+        "FIELD_HEADER_DOMAIN"           : "Domäne:",
+        "FIELD_HEADER_DPI"              : "Auflösung (DPI):",
+        "FIELD_HEADER_DRIVE_NAME"       : "Laufwerksname:",
+        "FIELD_HEADER_DRIVE_PATH"       : "Laufwerkspfad:",
         "FIELD_HEADER_ENABLE_AUDIO_INPUT"         : "Audioeingänge (Mikrofon) aktivieren:",
         "FIELD_HEADER_ENABLE_DESKTOP_COMPOSITION" : "Desktop Gestaltung (Aero) aktivieren:",
         "FIELD_HEADER_ENABLE_DRIVE"               : "Austauschlaufwerk aktivieren:",
@@ -385,10 +567,13 @@
         "FIELD_HEADER_DISABLE_BITMAP_CACHING"     : "Bitmap-Zwischenspeicherung deaktivieren:",
         "FIELD_HEADER_DISABLE_OFFSCREEN_CACHING"  : "Offscreen-Caching deaktivieren:",
         "FIELD_HEADER_DISABLE_GLYPH_CACHING"      : "Glyph-Caching deaktivieren:",
+        "FIELD_HEADER_DISABLE_GFX"                : "Grafik-Pipline-Erweiterung deaktivieren:",
         "FIELD_HEADER_ENABLE_PRINTING"            : "Druckunterstützung aktivieren:",
-        "FIELD_HEADER_ENABLE_SFTP"     : "SFTP aktivieren:",
+        "FIELD_HEADER_ENABLE_SFTP"                : "SFTP aktivieren:",
         "FIELD_HEADER_ENABLE_THEMING"             : "Themen-Unterstützung aktivieren:",
+        "FIELD_HEADER_ENABLE_TOUCH"               : "Multi-Touch-Unterstützung aktivieren:",
         "FIELD_HEADER_ENABLE_WALLPAPER"           : "Desktophintergrund aktivieren:",
+        "FIELD_HEADER_FORCE_LOSSLESS"             : "Verlustlose Kompression erzweingen:",
         "FIELD_HEADER_GATEWAY_DOMAIN"   : "Domäne:",
         "FIELD_HEADER_GATEWAY_HOSTNAME" : "Hostname:",
         "FIELD_HEADER_GATEWAY_PASSWORD" : "Passwort:",
@@ -399,6 +584,7 @@
         "FIELD_HEADER_IGNORE_CERT"     : "Serverzertifikat ignorieren:",
         "FIELD_HEADER_INITIAL_PROGRAM" : "Startprogramme:",
         "FIELD_HEADER_LOAD_BALANCE_INFO" : "Lastverteilungs-Info/Cookie:",
+        "FIELD_HEADER_NORMALIZE_CLIPBOARD" : "Zeilenende:",
         "FIELD_HEADER_PASSWORD"        : "Passwort:",
         "FIELD_HEADER_PORT"            : "Port:",
         "FIELD_HEADER_PRINTER_NAME"    : "Name des weitergeleiteten Druckers:",
@@ -407,6 +593,7 @@
         "FIELD_HEADER_READ_ONLY"      : "Nur-Lesen:",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Mausaufzeichnung deaktivieren:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Aufzeichnung der Anzeige deaktivieren:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_TOUCH"  : "Touch-Ereignisse deaktivieren:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Tastendrücke aufzeichnen:",
         "FIELD_HEADER_RECORDING_NAME" : "Aufzeichnungsname:",
         "FIELD_HEADER_RECORDING_PATH" : "Aufzeichnungspfad:",
@@ -417,6 +604,7 @@
         "FIELD_HEADER_SECURITY"        : "Sicherheitsmodus:",
         "FIELD_HEADER_SERVER_LAYOUT"   : "Tastaturlayout:",
         "FIELD_HEADER_SFTP_DIRECTORY"             : "Standardverzeichnis:",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "Dateidownload deaktivieren:",
         "FIELD_HEADER_SFTP_HOST_KEY"              : "Öffentlicher Schlüssel des Host (Base64):",
         "FIELD_HEADER_SFTP_HOSTNAME"              : "Hostname:",
         "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "SFTP keepalive Intervall:",
@@ -425,10 +613,22 @@
         "FIELD_HEADER_SFTP_PORT"                  : "Port:",
         "FIELD_HEADER_SFTP_PRIVATE_KEY"           : "Privater Schlüssel:",
         "FIELD_HEADER_SFTP_ROOT_DIRECTORY"        : "SFTP-Wurzelverzeichnis:",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "Dateiupload deaktivieren:",
         "FIELD_HEADER_SFTP_USERNAME"              : "Benutzername¨:",
         "FIELD_HEADER_STATIC_CHANNELS" : "Statische Kanäle:",
+        "FIELD_HEADER_TIMEZONE"        : "Zeitzone:",
         "FIELD_HEADER_USERNAME"        : "Benutzername:",
         "FIELD_HEADER_WIDTH"           : "Breite:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Broadcast Adresse für WoL-Paket:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "MAC Adresse des Remote Hosts:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "WoL Paket senden:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "UDP-Port für WoL Paket: ",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Wartezeit für Host-Boot:",
+
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_EMPTY"    : "",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_PRESERVE" : "Belassen",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_UNIX"     : "Linux/Mac/Unix (LF)",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_WINDOWS"  : "Windows (CRLF)",
 
         "FIELD_OPTION_COLOR_DEPTH_16"    : "Hohe Farbtiefe (16-bit)",
         "FIELD_OPTION_COLOR_DEPTH_24"    : "Echtfarben (24-bit)",
@@ -445,22 +645,30 @@
         "FIELD_OPTION_SECURITY_NLA"   : "NLA (Netzwerkebene Authentifizierung)",
         "FIELD_OPTION_SECURITY_RDP"   : "RDP Verschlüsselung",
         "FIELD_OPTION_SECURITY_TLS"   : "TLS Verschlüsselung",
+        "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY": "Dänisch (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Deutsch (Schweiz) (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "Deutsch (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_EMPTY"        : "",
         "FIELD_OPTION_SERVER_LAYOUT_EN_GB_QWERTY" : "Englisch (GB) (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_EN_US_QWERTY" : "Englisch (US) (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_ES_ES_QWERTY" : "Spanisch (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_ES_LATAM_QWERTY" : "Latein-Amerikanisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_FAILSAFE"     : "Unicode",
-        "FIELD_OPTION_SERVER_LAYOUT_FR_CH_QWERTZ" : "Schweiz/Französisch (Qwertz)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_BE_AZERTY" : "Französisch (Belgien) (Azerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_CA_QWERTY" : "Französisch (Kanada) (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_FR_CH_QWERTZ" : "Französisch (Schweiz) (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_FR_FR_AZERTY" : "Französisch (Azerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_HU_HU_QWERTZ" : "Ungarisch (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_IT_IT_QWERTY" : "Italienisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japanisch (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_NO_NO_QWERTY" : "Norwegisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polnisches (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portugiesisch (BR) (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugiesisch (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY" : "Rumänisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Schwedisch (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dänisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Türkisch (Qwerty)",
 
         "NAME" : "RDP",
@@ -471,33 +679,38 @@
         "SECTION_HEADER_DEVICE_REDIRECTION" : "Geräteumleitung",
         "SECTION_HEADER_DISPLAY"            : "Bildschirm",
         "SECTION_HEADER_GATEWAY"            : "Remote Desktop Gateway",
-        "SECTION_HEADER_LOAD_BALANCING"     : "Load Balancing",
+        "SECTION_HEADER_LOAD_BALANCING"     : "Lastverteilung",
         "SECTION_HEADER_NETWORK"            : "Netzwerk",
         "SECTION_HEADER_PERFORMANCE"        : "Geschwindigkeit",
         "SECTION_HEADER_PRECONNECTION_PDU"  : "Preconnection PDU / Hyper-V",
         "SECTION_HEADER_RECORDING"          : "Bildschirmaufzeichnung",
         "SECTION_HEADER_REMOTEAPP"          : "Entferntes Programm",
-        "SECTION_HEADER_SFTP"               : "SFTP"
+        "SECTION_HEADER_SFTP"               : "SFTP",
+        "SECTION_HEADER_WOL"                : "Wake-on-LAN (WoL)"
 
     },
 
     "PROTOCOL_SSH" : {
 
-        "FIELD_HEADER_BACKSPACE"      : "Rücktaste:",
-        "FIELD_HEADER_COLOR_SCHEME"   : "Farbschema:",
+        "FIELD_HEADER_BACKSPACE"    : "Rücktaste:",
+        "FIELD_HEADER_COLOR_SCHEME" : "Farbschema:",
         "FIELD_HEADER_COMMAND"      : "Befehl ausführen:",
         "FIELD_HEADER_CREATE_RECORDING_PATH" : "Bildschirmaufzeichnungspfad automatisch erzeugen:",
         "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "Textaufzeichnungspfad automatisch erzeugen:",
-        "FIELD_HEADER_FONT_NAME"      : "Schriftart:",
-        "FIELD_HEADER_FONT_SIZE"      : "Schriftgröße:",
+        "FIELD_HEADER_DISABLE_COPY"  : "Kopieren deaktivieren:",
+        "FIELD_HEADER_DISABLE_PASTE" : "Einfügen deaktivieren:",
+        "FIELD_HEADER_FONT_NAME"     : "Schriftart:",
+        "FIELD_HEADER_FONT_SIZE"     : "Schriftgröße:",
         "FIELD_HEADER_ENABLE_SFTP"   : "SFTP aktivieren:",
         "FIELD_HEADER_HOST_KEY"      : "Öffentlicher Schlüssel des Hosts (Base64):",
         "FIELD_HEADER_HOSTNAME"      : "Hostname:",
+        "FIELD_HEADER_LOCALE"        : "Sprache ($LANG):",
         "FIELD_HEADER_USERNAME"      : "Benutzername:",
         "FIELD_HEADER_PASSWORD"      : "Passwort:",
         "FIELD_HEADER_PASSPHRASE"    : "Passphrase:",
         "FIELD_HEADER_PORT"          : "Port:",
         "FIELD_HEADER_PRIVATE_KEY"   : "Privater Schlüssel:",
+        "FIELD_HEADER_SCROLLBACK"    : "Maximaler Scrollback:",
         "FIELD_HEADER_READ_ONLY"     : "Nur-Lesen:",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Mausaufzeichnung deaktivieren:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Aufzeichnung der Anzeige deaktivieren:",
@@ -505,10 +718,18 @@
         "FIELD_HEADER_RECORDING_NAME" : "Aufzeichnungsname:",
         "FIELD_HEADER_RECORDING_PATH" : "Aufzeichnungspfad:",
         "FIELD_HEADER_SERVER_ALIVE_INTERVAL" : "Server keepalive Intervall:",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD" : "Dateidownload deaktivieren:",
         "FIELD_HEADER_SFTP_ROOT_DIRECTORY"   : "SFTP-Wurzelverzeichnis:",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"   : "Dateiupload deaktivieren:",
         "FIELD_HEADER_TERMINAL_TYPE"   : "Terminaltyp:",
+        "FIELD_HEADER_TIMEZONE"        : "Zeitzone ($TZ):",
         "FIELD_HEADER_TYPESCRIPT_NAME" : "Textaufzeichnungsname:",
         "FIELD_HEADER_TYPESCRIPT_PATH" : "Textaufzeichnungspfad:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Broadcast Adresse für WoL-Paket:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "MAC Adresse des Remote Hosts:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "WoL Paket senden:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "UDP-Port für WoL Paket: ",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Wartezeit für Host-Boot:",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
         "FIELD_OPTION_BACKSPACE_8"     : "Rücktaste (Strg-H)",
@@ -554,7 +775,8 @@
         "SECTION_HEADER_RECORDING"      : "Bildschirmaufzeichnung",
         "SECTION_HEADER_SESSION"        : "Sitzung / Umgebung",
         "SECTION_HEADER_TYPESCRIPT"     : "Textaufzeichnung",
-        "SECTION_HEADER_SFTP"           : "SFTP"
+        "SECTION_HEADER_SFTP"           : "SFTP",
+        "SECTION_HEADER_WOL"            : "Wake-on-LAN (WoL)"
 
     },
 
@@ -564,6 +786,8 @@
         "FIELD_HEADER_COLOR_SCHEME"   : "Farbschema:",
         "FIELD_HEADER_CREATE_RECORDING_PATH" : "Bildschirmaufzeichnungspfad automatisch erzeugen:",
         "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "Textaufzeichnungspfad automatisch erzeugen:",
+        "FIELD_HEADER_DISABLE_COPY"   : "Kopieren deaktivieren:",
+        "FIELD_HEADER_DISABLE_PASTE"  : "Einfügen deaktivieren:",
         "FIELD_HEADER_FONT_NAME"      : "Schriftart:",
         "FIELD_HEADER_FONT_SIZE"      : "Schriftgröße:",
         "FIELD_HEADER_HOSTNAME"       : "Hostname:",
@@ -580,9 +804,15 @@
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Tastendrücke aufzeichnen:",
         "FIELD_HEADER_RECORDING_NAME" : "Aufzeichnungsname:",
         "FIELD_HEADER_RECORDING_PATH" : "Aufzeichnungspfad:",
+        "FIELD_HEADER_SCROLLBACK"     : "Maximaler Scrollback:",
         "FIELD_HEADER_TERMINAL_TYPE"   : "Terminaltyp:",
         "FIELD_HEADER_TYPESCRIPT_NAME" : "Textaufzeichnungsname:",
         "FIELD_HEADER_TYPESCRIPT_PATH" : "Textaufzeichnungspfad:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Broadcast Adresse für WoL-Paket:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "MAC Adresse des Remote Hosts:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "WoL Paket senden:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "UDP-Port für WoL Paket: ",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Wartezeit für Host-Boot:",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
         "FIELD_OPTION_BACKSPACE_8"     : "Rücktaste (Strg-H)",
@@ -626,7 +856,8 @@
         "SECTION_HEADER_DISPLAY"        : "Bildschirm",
         "SECTION_HEADER_RECORDING"      : "Bildschirmaufzeichnung",
         "SECTION_HEADER_TYPESCRIPT"     : "Textaufzeichnung",
-        "SECTION_HEADER_NETWORK"        : "Netzwerk"
+        "SECTION_HEADER_NETWORK"        : "Netzwerk",
+        "SECTION_HEADER_WOL"            : "Wake-on-LAN (WoL)"
 
     },
 
@@ -639,8 +870,11 @@
         "FIELD_HEADER_CURSOR"           : "Cursor:",
         "FIELD_HEADER_DEST_HOST"        : "Ziel Host:",
         "FIELD_HEADER_DEST_PORT"        : "Ziel Port:",
+        "FIELD_HEADER_DISABLE_COPY"     : "Kopieren deaktivieren:",
+        "FIELD_HEADER_DISABLE_PASTE"    : "Einfügen deaktivieren:",
         "FIELD_HEADER_ENABLE_AUDIO"     : "Audio aktivieren:",
         "FIELD_HEADER_ENABLE_SFTP"      : "SFTP aktivieren:",
+        "FIELD_HEADER_FORCE_LOSSLESS"   : "Verlustlose Kompression erzwingen:",
         "FIELD_HEADER_HOSTNAME"         : "Hostname:",
         "FIELD_HEADER_USERNAME"         : "Benutzername:",
         "FIELD_HEADER_PASSWORD"         : "Passwort:",
@@ -652,16 +886,23 @@
         "FIELD_HEADER_RECORDING_NAME" : "Aufzeichnungsname:",
         "FIELD_HEADER_RECORDING_PATH" : "Aufzeichnungspfad:",
         "FIELD_HEADER_SFTP_DIRECTORY"             : "Standard Uploadverzeichnis:",
+        "FIELD_HEADER_SFTP_DISABLE_DOWNLOAD"      : "Dateidownload deaktivieren:",
         "FIELD_HEADER_SFTP_HOST_KEY"              : "Öffentlicher Schlüssel des Host (Base64):",
         "FIELD_HEADER_SFTP_HOSTNAME"              : "Hostname:",
-        "FIELD_HEADER_SFTP_ROOT_DIRECTORY": "SFTP-Wurzelverzeichnis:",
         "FIELD_HEADER_SFTP_SERVER_ALIVE_INTERVAL" : "SFTP keepalive Intervall:",
-        "FIELD_HEADER_SFTP_PASSPHRASE"  : "Passphrase:",
-        "FIELD_HEADER_SFTP_PASSWORD"    : "Passwort:",
-        "FIELD_HEADER_SFTP_PORT"        : "Port:",
-        "FIELD_HEADER_SFTP_PRIVATE_KEY" : "Privater Schlüssel:",
-        "FIELD_HEADER_SFTP_USERNAME"    : "Benutzername:",
-        "FIELD_HEADER_SWAP_RED_BLUE"    : "Vertausche rot/blau Komponenten:",
+        "FIELD_HEADER_SFTP_PASSPHRASE"            : "Passphrase:",
+        "FIELD_HEADER_SFTP_PASSWORD"              : "Passwort:",
+        "FIELD_HEADER_SFTP_PORT"                  : "Port:",
+        "FIELD_HEADER_SFTP_PRIVATE_KEY"           : "Privater Schlüssel:",
+        "FIELD_HEADER_SFTP_ROOT_DIRECTORY"        : "SFTP-Wurzelverzeichnis:",
+        "FIELD_HEADER_SFTP_DISABLE_UPLOAD"        : "Hochladen deaktivieren:",
+        "FIELD_HEADER_SFTP_USERNAME"              : "Benutzername:",
+        "FIELD_HEADER_SWAP_RED_BLUE"      : "Vertausche rot/blau Komponenten:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Broadcast Adresse für WoL-Paket:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "MAC Adresse des Remote Hosts:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "WoL Paket senden:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "UDP-Port für WoL Paket: ",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Wartezeit für Host-Boot:",
 
         "FIELD_OPTION_COLOR_DEPTH_8"     : "256 Farben",
         "FIELD_OPTION_COLOR_DEPTH_16"    : "Hohe Farbtiefe (16-bit)",
@@ -688,7 +929,8 @@
         "SECTION_HEADER_NETWORK"        : "Netzwerk",
         "SECTION_HEADER_RECORDING"      : "Bildschirmaufzeichnung",
         "SECTION_HEADER_REPEATER"       : "VNC Repeater",
-        "SECTION_HEADER_SFTP"           : "SFTP"
+        "SECTION_HEADER_SFTP"           : "SFTP",
+        "SECTION_HEADER_WOL"            : "Wake-on-LAN (WoL)"
 
     },
 
@@ -700,8 +942,9 @@
 
     "SETTINGS_CONNECTION_HISTORY" : {
 
-        "ACTION_DOWNLOAD" : "@:APP.ACTION_DOWNLOAD",
-        "ACTION_SEARCH"   : "@:APP.ACTION_SEARCH",
+        "ACTION_DOWNLOAD"       : "@:APP.ACTION_DOWNLOAD",
+        "ACTION_SEARCH"         : "@:APP.ACTION_SEARCH",
+        "ACTION_VIEW_RECORDING" : "@:APP.ACTION_VIEW_RECORDING",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
@@ -716,6 +959,7 @@
 
         "TABLE_HEADER_SESSION_CONNECTION_NAME" : "Verbindungsname",
         "TABLE_HEADER_SESSION_DURATION"        : "Verbindungsdauer",
+        "TABLE_HEADER_SESSION_LOGS"            : "Protokolle",
         "TABLE_HEADER_SESSION_REMOTEHOST"      : "Entfernter Host",
         "TABLE_HEADER_SESSION_STARTDATE"       : "Sitzung aktiv seit",
         "TABLE_HEADER_SESSION_USERNAME"        : "Benutzername",
@@ -727,6 +971,7 @@
     "SETTINGS_CONNECTIONS" : {
 
         "ACTION_ACKNOWLEDGE"          : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_IMPORT"               : "@:APP.ACTION_IMPORT",
         "ACTION_NEW_CONNECTION"       : "Neue Verbindung",
         "ACTION_NEW_CONNECTION_GROUP" : "Neue Verbindungsgruppe",
         "ACTION_NEW_SHARING_PROFILE"  : "Neues Verteil-Profil",
@@ -747,6 +992,7 @@
 
         "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
         "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
+        "ACTION_SAVE"               : "@:APP.ACTION_SAVE",
         "ACTION_UPDATE_PASSWORD"    : "@:APP.ACTION_UPDATE_PASSWORD",
 
         "DIALOG_HEADER_ERROR"    : "@:APP.DIALOG_HEADER_ERROR",
@@ -759,6 +1005,7 @@
         "FIELD_HEADER_PASSWORD_OLD"       : "Aktuelles Passwort:",
         "FIELD_HEADER_PASSWORD_NEW"       : "Neues Passwort:",
         "FIELD_HEADER_PASSWORD_NEW_AGAIN" : "Passwort wiederholen:",
+        "FIELD_HEADER_TIMEZONE"           : "Zeitzone:",
         "FIELD_HEADER_USERNAME"           : "Benutzername:",
         
         "HELP_DEFAULT_INPUT_METHOD" : "Die Standardeingabemethode bestimmt wie Tastaturereignisse an Guacamole weitergeleitet werden. Eine Änderung dieser Einstellung kann erforderlich sein, wenn ein mobiles Gerät verwendet wird oder bei der Eingabe durch einen IME. Dieses Verhalten kann im Menü innerhalb der Guacamole Verbindung geändert werden.",
@@ -766,12 +1013,13 @@
         "HELP_INPUT_METHOD_NONE"    : "@:CLIENT.HELP_INPUT_METHOD_NONE",
         "HELP_INPUT_METHOD_OSK"     : "@:CLIENT.HELP_INPUT_METHOD_OSK",
         "HELP_INPUT_METHOD_TEXT"    : "@:CLIENT.HELP_INPUT_METHOD_TEXT",
-        "HELP_LANGUAGE"             : "Um die Spracheinstellungen von Guacamole zu ändern,  wählen Sie eine der verfügbaren Sprachen.",
+        "HELP_LOCALE"             : "Um die Spracheinstellungen von Guacamole zu ändern,  wählen Sie eine der verfügbaren Sprachen.",
         "HELP_MOUSE_MODE_ABSOLUTE"  : "@:CLIENT.HELP_MOUSE_MODE_ABSOLUTE",
         "HELP_MOUSE_MODE_RELATIVE"  : "@:CLIENT.HELP_MOUSE_MODE_RELATIVE",
         "HELP_UPDATE_PASSWORD"      : "Wenn Sie das Passwort ändern wollen, geben Sie das aktuelle und das gewünschte Passwort ein und klicken Sie auf \"Ändere Passwort\". Die Änderung wird sofort wirksam.",
 
         "INFO_PASSWORD_CHANGED" : "Passwort geändert.",
+        "INFO_PREFERENCE_ATTRIBUTES_CHANGED" : "Benutzereinstellungen gespeichert.",
 
         "NAME_INPUT_METHOD_NONE" : "@:CLIENT.NAME_INPUT_METHOD_NONE",
         "NAME_INPUT_METHOD_OSK"  : "@:CLIENT.NAME_INPUT_METHOD_OSK",

From ab59339173d1bac8e9790b00645997d640bc09b4 Mon Sep 17 00:00:00 2001
From: sirux88 <sirux88@gmail.com>
Date: Sun, 15 Oct 2023 14:01:00 +0200
Subject: [PATCH 228/289] GUACAMOLE-1692: fixed
 FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY order within RDP section

---
 guacamole/src/main/frontend/src/translations/ca.json | 3 +--
 guacamole/src/main/frontend/src/translations/cs.json | 2 +-
 guacamole/src/main/frontend/src/translations/de.json | 2 +-
 guacamole/src/main/frontend/src/translations/en.json | 2 +-
 guacamole/src/main/frontend/src/translations/es.json | 2 +-
 guacamole/src/main/frontend/src/translations/fr.json | 2 +-
 guacamole/src/main/frontend/src/translations/ko.json | 2 +-
 guacamole/src/main/frontend/src/translations/pl.json | 2 +-
 guacamole/src/main/frontend/src/translations/pt.json | 2 +-
 guacamole/src/main/frontend/src/translations/zh.json | 2 +-
 10 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/guacamole/src/main/frontend/src/translations/ca.json b/guacamole/src/main/frontend/src/translations/ca.json
index 21e0d48cf..632031053 100644
--- a/guacamole/src/main/frontend/src/translations/ca.json
+++ b/guacamole/src/main/frontend/src/translations/ca.json
@@ -538,9 +538,9 @@
         "FIELD_OPTION_SECURITY_TLS"   : "TLS encryption",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danès (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Suís alemany (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "Alemany (Qwertz)",
-
         "FIELD_OPTION_SERVER_LAYOUT_EN_GB_QWERTY" : "Anglès del Regne Unit (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_EN_US_QWERTY" : "Anglès dels Estats Units (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_ES_ES_QWERTY" : "Espanyol (Qwerty)",
@@ -556,7 +556,6 @@
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portuguès brasiler (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portuguès (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Suec (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danès (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Q-Turc (Qwerty)",
 
         "NAME" : "RDP",
diff --git a/guacamole/src/main/frontend/src/translations/cs.json b/guacamole/src/main/frontend/src/translations/cs.json
index 6e56426b8..fd52edb64 100644
--- a/guacamole/src/main/frontend/src/translations/cs.json
+++ b/guacamole/src/main/frontend/src/translations/cs.json
@@ -659,6 +659,7 @@
         "FIELD_OPTION_SECURITY_TLS"       : "Šifrování TLS",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dánština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Švícarská Němčina (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "Němčina (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_EMPTY"        : "",
@@ -680,7 +681,6 @@
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugalština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY" : "Rumunština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Švédština (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dánština (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turečtina (Qwerty)",
 
         "NAME" : "RDP",
diff --git a/guacamole/src/main/frontend/src/translations/de.json b/guacamole/src/main/frontend/src/translations/de.json
index 6c5a1b8ab..b52fc08d3 100644
--- a/guacamole/src/main/frontend/src/translations/de.json
+++ b/guacamole/src/main/frontend/src/translations/de.json
@@ -647,6 +647,7 @@
         "FIELD_OPTION_SECURITY_TLS"   : "TLS Verschlüsselung",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dänisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Deutsch (Schweiz) (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "Deutsch (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_EMPTY"        : "",
@@ -668,7 +669,6 @@
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugiesisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY" : "Rumänisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Schwedisch (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dänisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Türkisch (Qwerty)",
 
         "NAME" : "RDP",
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index a3071b4c5..bac460320 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -668,6 +668,7 @@
         "FIELD_OPTION_SECURITY_TLS"   : "TLS encryption",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dänisch (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Swiss German (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "German (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_EMPTY"        : "",
@@ -689,7 +690,6 @@
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portuguese (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY" : "Romanian (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Swedish (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turkish-Q (Qwerty)",
 
         "NAME" : "RDP",
diff --git a/guacamole/src/main/frontend/src/translations/es.json b/guacamole/src/main/frontend/src/translations/es.json
index ffbb25c0d..dcacb7067 100644
--- a/guacamole/src/main/frontend/src/translations/es.json
+++ b/guacamole/src/main/frontend/src/translations/es.json
@@ -546,6 +546,7 @@
         "FIELD_OPTION_SECURITY_TLS"   : "Encriptación TLS",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY"    : "Danés (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ"    : "Alemán Suizo (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ"    : "Alemán (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_EMPTY"           : "",
@@ -565,7 +566,6 @@
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY"    : "Portugués (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY"    : "Rumano (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY"    : "Sueco (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY"    : "Danés (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY"    : "Turco-Q (Qwerty)",
 
         "NAME" : "RDP",
diff --git a/guacamole/src/main/frontend/src/translations/fr.json b/guacamole/src/main/frontend/src/translations/fr.json
index 2c7d5bc8e..bf2904303 100644
--- a/guacamole/src/main/frontend/src/translations/fr.json
+++ b/guacamole/src/main/frontend/src/translations/fr.json
@@ -541,6 +541,7 @@
         "FIELD_OPTION_SECURITY_TLS"   : "Chiffrement TLS",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danois (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Suisse Allemand (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "Allemand (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_EMPTY"        : "",
@@ -561,7 +562,6 @@
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugais (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY" : "Roumaine (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Suédois (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danois (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turque (Qwerty)",
 
         "NAME" : "RDP",
diff --git a/guacamole/src/main/frontend/src/translations/ko.json b/guacamole/src/main/frontend/src/translations/ko.json
index 957b3b571..8b01d8559 100644
--- a/guacamole/src/main/frontend/src/translations/ko.json
+++ b/guacamole/src/main/frontend/src/translations/ko.json
@@ -536,6 +536,7 @@
         "FIELD_OPTION_SECURITY_TLS"   : "TLS 암호화",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Swiss German (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "German (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_EN_GB_QWERTY" : "UK English (Qwerty)",
@@ -553,7 +554,6 @@
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portuguese Brazilian (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portuguese (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Swedish (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turkish-Q (Qwerty)",
 
         "NAME" : "RDP",
diff --git a/guacamole/src/main/frontend/src/translations/pl.json b/guacamole/src/main/frontend/src/translations/pl.json
index 2be8d8fb6..6f999697b 100644
--- a/guacamole/src/main/frontend/src/translations/pl.json
+++ b/guacamole/src/main/frontend/src/translations/pl.json
@@ -574,6 +574,7 @@
         "FIELD_OPTION_SECURITY_TLS"   : "szyfrowanie TLS",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Duński (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Szwajcarski Niemiecki (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "Niemiecki (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_EMPTY"        : "",
@@ -594,7 +595,6 @@
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portugalski Brazylijski (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugalski (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Szwecki (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Duński (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turecki-Q (Qwerty)",
 
         "NAME" : "RDP",
diff --git a/guacamole/src/main/frontend/src/translations/pt.json b/guacamole/src/main/frontend/src/translations/pt.json
index 77b956404..9cebddf26 100644
--- a/guacamole/src/main/frontend/src/translations/pt.json
+++ b/guacamole/src/main/frontend/src/translations/pt.json
@@ -544,6 +544,7 @@
         "FIELD_OPTION_SECURITY_TLS"   : "Encriptação TLS",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dinamarquês (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Alemão-Suiço (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "Alemão (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_EMPTY"        : "",
@@ -562,7 +563,6 @@
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Português Brasileiro (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Português (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Sueco (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dinamarquês (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turco-Q (Qwerty)",
 
         "NAME" : "RDP",
diff --git a/guacamole/src/main/frontend/src/translations/zh.json b/guacamole/src/main/frontend/src/translations/zh.json
index 1431ed9e0..72b7cb384 100644
--- a/guacamole/src/main/frontend/src/translations/zh.json
+++ b/guacamole/src/main/frontend/src/translations/zh.json
@@ -654,6 +654,7 @@
         "FIELD_OPTION_SECURITY_TLS"   : "TLS 加密",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Swiss German (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "German (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_EMPTY"        : "",
@@ -675,7 +676,6 @@
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portuguese (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_RO_RO_QWERTY" : "Romanian (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_SV_SE_QWERTY" : "Swedish (Qwerty)",
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_TR_TR_QWERTY" : "Turkish-Q (Qwerty)",
 
         "NAME" : "RDP",

From 8d14bd88781a25281ff289772ebd74210d7a2578 Mon Sep 17 00:00:00 2001
From: sirux88 <sirux88@gmail.com>
Date: Mon, 16 Oct 2023 19:55:32 +0200
Subject: [PATCH 229/289] GUACAMOLE-1692: Fix follow-up error on en.json

---
 guacamole/src/main/frontend/src/translations/en.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index bac460320..4997439f5 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -668,7 +668,7 @@
         "FIELD_OPTION_SECURITY_TLS"   : "TLS encryption",
         "FIELD_OPTION_SECURITY_VMCONNECT" : "Hyper-V / VMConnect",
 
-        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Dänisch (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_DA_DK_QWERTY" : "Danish (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_CH_QWERTZ" : "Swiss German (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_DE_DE_QWERTZ" : "German (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_EMPTY"        : "",

From ea4d6edd1ca12128153ef28e6f1fa0b778d8dec6 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 20 Oct 2023 00:05:33 +0000
Subject: [PATCH 230/289] GUACAMOLE-1868: Add support for new PAM Hostname
 field.

---
 .../vault/ksm/secret/KsmRecordService.java         | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java
index 8e363f3b9..d22f703a7 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java
@@ -30,6 +30,7 @@ import com.keepersecurity.secretsManager.core.KeeperRecordField;
 import com.keepersecurity.secretsManager.core.KeyPair;
 import com.keepersecurity.secretsManager.core.KeyPairs;
 import com.keepersecurity.secretsManager.core.Login;
+import com.keepersecurity.secretsManager.core.PamHostnames;
 import com.keepersecurity.secretsManager.core.Password;
 import com.keepersecurity.secretsManager.core.SecretsManager;
 import com.keepersecurity.secretsManager.core.Text;
@@ -393,9 +394,11 @@ public class KsmRecordService {
     /**
      * Returns the single hostname (or address) associated with the given
      * record. If the record has no associated hostname, or multiple hostnames,
-     * null is returned. Hostnames are retrieved from "Hosts" fields, as well
-     * as "Text" and "Hidden" fields that have the label "hostname", "address",
-     * or "ip address" (case-insensitive, space optional).
+     * null is returned. Hostnames are retrieved from "Hosts" or "PamHostnames"
+     * fields, as well as "Text" and "Hidden" fields that have the label
+     * "hostname", "address", or "ip address" (case-insensitive, space optional).
+     * These field types are checked in the above order, and the first matching
+     * field is returned.
      *
      * @param record
      *     The record to retrieve the hostname from.
@@ -411,6 +414,11 @@ public class KsmRecordService {
         if (hostsField != null)
             return getSingleStringValue(hostsField.getValue(), Host::getHostName);
 
+        // Next, try a PAM hostname
+        PamHostnames pamHostsField = getField(record, PamHostnames.class, null);
+        if (pamHostsField != null)
+            return getSingleStringValue(pamHostsField.getValue(), Host::getHostName);
+
         KeeperRecordData data = record.getData();
         List<KeeperRecordField> custom = data.getCustom();
 

From 6bd19b47146bbcf69d18b346bab68287415399b3 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 25 Oct 2023 22:36:48 +0000
Subject: [PATCH 231/289] GUACAMOLE-1876: Display points of interest heatmap in
 history recording player.

---
 doc/licenses/d3-path-3.1.0/LICENSE            |  13 +
 doc/licenses/d3-path-3.1.0/README             |   8 +
 .../d3-path-3.1.0/dep-coordinates.txt         |   1 +
 doc/licenses/d3-shape-3.2.0/LICENSE           |  13 +
 doc/licenses/d3-shape-3.2.0/README            |   8 +
 .../d3-shape-3.2.0/dep-coordinates.txt        |   1 +
 guacamole/src/main/frontend/package-lock.json |  34 +++
 guacamole/src/main/frontend/package.json      |   2 +
 .../src/app/player/directives/player.js       |  97 ++++++-
 .../player/services/playerHeatmapService.js   | 264 ++++++++++++++++++
 .../src/app/player/templates/player.html      |  15 +
 .../app/settings/styles/history-player.css    |  73 +++++
 .../main/frontend/src/translations/en.json    |  10 +-
 13 files changed, 534 insertions(+), 5 deletions(-)
 create mode 100644 doc/licenses/d3-path-3.1.0/LICENSE
 create mode 100644 doc/licenses/d3-path-3.1.0/README
 create mode 100644 doc/licenses/d3-path-3.1.0/dep-coordinates.txt
 create mode 100644 doc/licenses/d3-shape-3.2.0/LICENSE
 create mode 100644 doc/licenses/d3-shape-3.2.0/README
 create mode 100644 doc/licenses/d3-shape-3.2.0/dep-coordinates.txt
 create mode 100644 guacamole/src/main/frontend/src/app/player/services/playerHeatmapService.js

diff --git a/doc/licenses/d3-path-3.1.0/LICENSE b/doc/licenses/d3-path-3.1.0/LICENSE
new file mode 100644
index 000000000..ed25746bb
--- /dev/null
+++ b/doc/licenses/d3-path-3.1.0/LICENSE
@@ -0,0 +1,13 @@
+Copyright 2015-2022 Mike Bostock
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.
diff --git a/doc/licenses/d3-path-3.1.0/README b/doc/licenses/d3-path-3.1.0/README
new file mode 100644
index 000000000..5bbf02a56
--- /dev/null
+++ b/doc/licenses/d3-path-3.1.0/README
@@ -0,0 +1,8 @@
+d3-path (https://github.com/d3/d3-path)
+----------------------------------------------------------
+
+    Version: 3.1.0
+    From: 'Mike Bostock'
+    License(s):
+        BSD 0-clause (bundled/d3-path-3.1.0/LICENSE)
+
diff --git a/doc/licenses/d3-path-3.1.0/dep-coordinates.txt b/doc/licenses/d3-path-3.1.0/dep-coordinates.txt
new file mode 100644
index 000000000..5159b4e03
--- /dev/null
+++ b/doc/licenses/d3-path-3.1.0/dep-coordinates.txt
@@ -0,0 +1 @@
+d3-path:3.1.0
diff --git a/doc/licenses/d3-shape-3.2.0/LICENSE b/doc/licenses/d3-shape-3.2.0/LICENSE
new file mode 100644
index 000000000..fbe44bdc9
--- /dev/null
+++ b/doc/licenses/d3-shape-3.2.0/LICENSE
@@ -0,0 +1,13 @@
+Copyright 2010-2022 Mike Bostock
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.
diff --git a/doc/licenses/d3-shape-3.2.0/README b/doc/licenses/d3-shape-3.2.0/README
new file mode 100644
index 000000000..f0adda5c5
--- /dev/null
+++ b/doc/licenses/d3-shape-3.2.0/README
@@ -0,0 +1,8 @@
+d3-path (https://github.com/d3/d3-shape)
+----------------------------------------------------------
+
+    Version: 3.2.0
+    From: 'Mike Bostock'
+    License(s):
+        BSD 0-clause (bundled/d3-shape-3.2.0/LICENSE)
+
diff --git a/doc/licenses/d3-shape-3.2.0/dep-coordinates.txt b/doc/licenses/d3-shape-3.2.0/dep-coordinates.txt
new file mode 100644
index 000000000..10973f489
--- /dev/null
+++ b/doc/licenses/d3-shape-3.2.0/dep-coordinates.txt
@@ -0,0 +1 @@
+d3-shape:3.2.0
diff --git a/guacamole/src/main/frontend/package-lock.json b/guacamole/src/main/frontend/package-lock.json
index e44b0da8d..b40c26743 100644
--- a/guacamole/src/main/frontend/package-lock.json
+++ b/guacamole/src/main/frontend/package-lock.json
@@ -14,6 +14,8 @@
                 "angular-translate-loader-static-files": "^2.19.0",
                 "blob-polyfill": ">=7.0.20220408",
                 "csv": "^6.2.5",
+                "d3-path": "^3.1.0",
+                "d3-shape": "^3.2.0",
                 "datalist-polyfill": "^1.25.1",
                 "file-saver": "^2.0.5",
                 "fuzzysort": "^2.0.4",
@@ -4651,6 +4653,25 @@
             "resolved": "https://registry.npmjs.org/cyclist/-/cyclist-1.0.1.tgz",
             "integrity": "sha512-NJGVKPS81XejHcLhaLJS7plab0fK3slPh11mESeeDq2W4ZI5kUKK/LRRdVDvjJseojbPB7ZwjnyOybg3Igea/A=="
         },
+        "node_modules/d3-path": {
+            "version": "3.1.0",
+            "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
+            "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
+            "engines": {
+                "node": ">=12"
+            }
+        },
+        "node_modules/d3-shape": {
+            "version": "3.2.0",
+            "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
+            "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
+            "dependencies": {
+                "d3-path": "^3.1.0"
+            },
+            "engines": {
+                "node": ">=12"
+            }
+        },
         "node_modules/datalist-polyfill": {
             "version": "1.25.1",
             "resolved": "https://registry.npmjs.org/datalist-polyfill/-/datalist-polyfill-1.25.1.tgz",
@@ -14937,6 +14958,19 @@
             "resolved": "https://registry.npmjs.org/cyclist/-/cyclist-1.0.1.tgz",
             "integrity": "sha512-NJGVKPS81XejHcLhaLJS7plab0fK3slPh11mESeeDq2W4ZI5kUKK/LRRdVDvjJseojbPB7ZwjnyOybg3Igea/A=="
         },
+        "d3-path": {
+            "version": "3.1.0",
+            "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
+            "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ=="
+        },
+        "d3-shape": {
+            "version": "3.2.0",
+            "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
+            "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
+            "requires": {
+                "d3-path": "^3.1.0"
+            }
+        },
         "datalist-polyfill": {
             "version": "1.25.1",
             "resolved": "https://registry.npmjs.org/datalist-polyfill/-/datalist-polyfill-1.25.1.tgz",
diff --git a/guacamole/src/main/frontend/package.json b/guacamole/src/main/frontend/package.json
index 99d742dcf..dcb270507 100644
--- a/guacamole/src/main/frontend/package.json
+++ b/guacamole/src/main/frontend/package.json
@@ -13,6 +13,8 @@
         "angular-translate-loader-static-files": "^2.19.0",
         "blob-polyfill": ">=7.0.20220408",
         "csv": "^6.2.5",
+        "d3-path": "^3.1.0",
+        "d3-shape": "^3.2.0",
         "datalist-polyfill": "^1.25.1",
         "file-saver": "^2.0.5",
         "fuzzysort": "^2.0.4",
diff --git a/guacamole/src/main/frontend/src/app/player/directives/player.js b/guacamole/src/main/frontend/src/app/player/directives/player.js
index b864b0e93..83acb68ae 100644
--- a/guacamole/src/main/frontend/src/app/player/directives/player.js
+++ b/guacamole/src/main/frontend/src/app/player/directives/player.js
@@ -81,6 +81,7 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
 
     // Required services
     const keyEventDisplayService = $injector.get('keyEventDisplayService');
+    const playerHeatmapService = $injector.get('playerHeatmapService');
     const playerTimeService = $injector.get('playerTimeService');
 
     /**
@@ -187,6 +188,65 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
          */
         $scope.showKeyLog = false;
 
+        /**
+         * The height, in pixels, of the SVG heatmap paths. Note that this is not
+         * necessarily the actual rendered height, just the initial size of the
+         * SVG path before any styling is applied.
+         *
+         * @type {!number}
+         */
+        $scope.HEATMAP_HEIGHT = 100;
+
+        /**
+         * The width, in pixels, of the SVG heatmap paths. Note that this is not
+         * necessarily the actual rendered width, just the initial size of the
+         * SVG path before any styling is applied.
+         *
+         * @type {!number}
+         */
+        $scope.HEATMAP_WIDTH = 1000;
+
+        /**
+         * The maximum number of key events per millisecond to display in the
+         * key event heatmap. Any key event rates exceeding this value will be
+         * capped at this rate to ensure that unsually large spikes don't make
+         * swamp the rest of the data.
+         *
+         * Note: This is 6 keys per second (events include both presses and
+         * releases) - equivalent to ~88 words per minute typed.
+         *
+         * @type {!number}
+         */
+        const KEY_EVENT_RATE_CAP = 12 / 1000;
+
+        /**
+         * The maximum number of frames per millisecond to display in the
+         * frame heatmap. Any frame rates exceeding this value will be
+         * capped at this rate to ensure that unsually large spikes don't make
+         * swamp the rest of the data.
+         *
+         * @type {!number}
+         */
+        const FRAME_RATE_CAP = 10 / 1000;
+
+        /**
+         * An SVG path describing a smoothed curve that visualizes the relative
+         * number of frames rendered throughout the recording - i.e. a heatmap
+         * of screen updates.
+         *
+         * @type {!string}
+         */
+        $scope.frameHeatmap = '';
+
+        /**
+         * An SVG path describing a smoothed curve that visualizes the relative
+         * number of key events recorded throughout the recording - i.e. a
+         * heatmap of key events.
+         *
+         * @type {!string}
+         */
+        $scope.keyHeatmap = '';
+
         /**
          * Whether a seek request is currently in progress. A seek request is
          * in progress if the user is attempting to change the current playback
@@ -213,6 +273,22 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
          */
         var mouseActivityTimer = null;
 
+        /**
+         * The recording-relative timestamp of each frame of the recording that
+         * has been processed so far.
+         *
+         * @type {!number[]}
+         */
+        var frameTimestamps = [];
+
+        /**
+         * The recording-relative timestamp of each text event that has been
+         * processed so far.
+         *
+         * @type {!number[]}
+         */
+        var keyTimestamps = [];
+
         /**
          * Return true if any batches of key event logs are available for this
          * recording, or false otherwise.
@@ -355,11 +431,25 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
                 // Begin downloading the recording
                 $scope.recording.connect();
 
-                // Notify listeners when the recording is completely loaded
+                // Notify listeners and set any heatmap paths
+                // when the recording is completely loaded
                 $scope.recording.onload = function recordingLoaded() {
                     $scope.operationMessage = null;
                     $scope.$emit('guacPlayerLoaded');
                     $scope.$evalAsync();
+
+                    const recordingDuration = $scope.recording.getDuration();
+
+                    // Generate heat maps for rendered frames and typed text
+                    $scope.frameHeatmap = (
+                        playerHeatmapService.generateHeatmapPath(
+                            frameTimestamps, recordingDuration, FRAME_RATE_CAP,
+                            $scope.HEATMAP_HEIGHT, $scope.HEATMAP_WIDTH));
+                    $scope.keyHeatmap = (
+                        playerHeatmapService.generateHeatmapPath(
+                            keyTimestamps, recordingDuration, KEY_EVENT_RATE_CAP,
+                            $scope.HEATMAP_HEIGHT, $scope.HEATMAP_WIDTH));
+
                 };
 
                 // Notify listeners if an error occurs
@@ -375,6 +465,9 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
                     $scope.operationProgress = src.size ? current / src.size : 0;
                     $scope.$emit('guacPlayerProgress', duration, current);
                     $scope.$evalAsync();
+
+                    // Store the timestamp of the just-received frame
+                    frameTimestamps.push(duration);
                 };
 
                 // Notify listeners when playback has started/resumed
@@ -396,6 +489,8 @@ angular.module('player').directive('guacPlayer', ['$injector', function guacPlay
                     $scope.textBatches = (
                             keyEventDisplayService.parseEvents(events));
 
+                    keyTimestamps = events.map(event => event.timestamp);
+
                 };
 
                 // Notify listeners when current position within the recording
diff --git a/guacamole/src/main/frontend/src/app/player/services/playerHeatmapService.js b/guacamole/src/main/frontend/src/app/player/services/playerHeatmapService.js
new file mode 100644
index 000000000..9259aa4dc
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/player/services/playerHeatmapService.js
@@ -0,0 +1,264 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * 'License'); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { curveCatmullRom } from 'd3-shape';
+import { path } from 'd3-path';
+
+/**
+ * A service for generating heat maps of activity levels per time interval,
+ * for session recording playback.
+ */
+angular.module('player').factory('playerHeatmapService', [() => {
+
+    /**
+     * A default, relatively-gentle Gaussian smoothing kernel. This kernel
+     * should help heatmaps look a bit less jagged, while not reducing fidelity
+     * very much.
+     *
+     * @type {!number[]}
+     */
+    const GAUSSIAN_KERNEL = [0.0013, 0.1573, 0.6827, 0.1573, 0.0013];
+
+    /**
+     * The number of buckets that a series of activity timestamps should be
+     * divided into.
+     *
+     * @type {!number}
+     */
+    const NUM_BUCKETS = 100;
+
+    /**
+     * Given a list of values to smooth out, produce a smoothed data set with
+     * the same length as the original provided list.
+     *
+     * @param {!number[]} values
+     *     The list of histogram values to smooth out.
+     *
+     * @returns {!number[]}
+     *     The smoothed value array.
+     */
+    function smooth(values) {
+
+        // The starting offset into the values array for each calculation
+        const lookBack = Math.floor(GAUSSIAN_KERNEL.length / 2);
+
+        // Apply the smoothing kernel to each value in the provided array
+        return _.map(values, (value, index) => {
+
+            // Total up the weighted values for each position in the kernel
+            return _.reduce(GAUSSIAN_KERNEL, (total, weight, kernelIndex) => {
+
+                // The offset into the original values array for the kernel
+                const valuesOffset = kernelIndex - lookBack;
+
+                // The position inside the original values array to be included
+                const valuesIndex = index + valuesOffset;
+
+                // If the contribution to the final smoothed value would be outside
+                // the bounds of the array, just use the original value instead
+                const contribution = ((valuesIndex >= 0) && valuesIndex < values.length)
+                        ? values[valuesIndex] : value;
+
+                // Use the provided weight from the kernel and add to the total
+                return total + (contribution * weight);
+
+            }, 0);
+
+        });
+    }
+
+    /**
+     * Given an array of values, with each value representing an activity count
+     * during a bucket of time, generate a smooth curve, scaled to PATH_HEIGHT
+     * height, and PATH_WIDTH width.
+     *
+     * @param {!number[]} bucketizedData
+     *     The bucketized counts to create an SVG path from.
+     *
+     * @param {!number} maxBucketValue
+     *     The size of the largest value in the bucketized data.
+     *
+     * @param {!number} height
+     *     The target height, in pixels, of the highest point in the heatmap.
+     *
+     * @param {!number} width
+     *     The target width, in pixels, of the heatmap.
+     *
+     * @returns {!string}
+     *     An SVG path representing a smooth curve, passing through all points
+     *     in the provided data.
+     */
+    function createPath(bucketizedData, maxBucketValue, height, width) {
+
+        // Calculate scaling factor to ensure that paths are all the same heigh
+        const yScalingFactor = height / maxBucketValue;
+
+        // Scale a given Y value appropriately
+        const scaleYValue = yValue => height - (yValue * yScalingFactor);
+
+        // Calculate scaling factor to ensure that paths are all the same width
+        const xScalingFactor = width / bucketizedData.length;
+
+        // Construct a continuous curved path
+        const curvedPath = path();
+        const curve = curveCatmullRom(curvedPath);
+
+        curve.lineStart();
+
+        // Add all the data points
+        for (let i = 0; i < bucketizedData.length; i++) {
+
+            // Scale up the x value to hit the target width
+            const x = xScalingFactor * i;
+
+            // Scale and invert the height for display
+            const y = scaleYValue(bucketizedData[i]);
+
+            // Add the scaled point
+            curve.point(x, y);
+
+        }
+
+        // Move back to 0 to complete the path
+        curve.lineEnd();
+        curvedPath.lineTo(width, scaleYValue(0));
+
+        // Generate the SVG path for this curve
+        const rawPathText = curvedPath.toString();
+
+        // The SVG path as generated by D3 starts with a move to the first data
+        // point. This means that when the path ends and the subpath is closed,
+        // it returns to the position of the first data point instead of the
+        // origin. To fix this, the initial move command is removed, and the
+        // path is amended to start at the origin. TODO: Find a better way to
+        // handle this.
+        const startAtOrigin = (
+
+            // Start at origin
+            'M0,' + scaleYValue(0) +
+
+            // Line to the first point in the curve, to close the shape
+            'L0,' + scaleYValue(bucketizedData[0])
+
+        );
+
+        // Strip off the first move command from the path
+        const strippedPathText = _.replace(rawPathText, /^[^C]*/, '');
+
+        return startAtOrigin + strippedPathText;
+    }
+
+    const service = {};
+
+    /**
+     * Given a raw array of timestamps indicating when events of a certain type
+     * occured during a record, generate and return a smoothed SVG path
+     * indicating how many events occured during each equal-length bucket.
+     *
+     * @param {!number[]} timestamps
+     *     A raw array of timestamps, one for every relevant event. These
+     *     must be monotonically increasing.
+     *
+     * @param {!number} duration
+     *     The duration over which the heatmap should apply. This value may
+     *     be greater than the maximum timestamp value, in which case the path
+     *     will drop to 0 after the last timestamp in the provided array.
+     *
+     * @param {number} maxRate
+     *     The maximum number of events per millisecond that should be displayed
+     *     in the final path. Any rates over this amount will just be capped at
+     *     this value.
+     *
+     * @param {!number} height
+     *     The target height, in pixels, of the highest point in the heatmap.
+     *
+     * @param {!number} width
+     *     The target width, in pixels, of the heatmap.
+     *
+     * @returns {!string}
+     *     A smoothed, graphable SVG path representing levels of activity over
+     *     time, as extracted from the provided timestamps.
+     */
+    service.generateHeatmapPath = (timestamps, duration, maxRate, height, width) => {
+
+        // The height and width must both be valid in order to create the path
+        if (!height || !width) {
+            console.warn("Heatmap height and width must be positive.");
+            return '';
+        }
+
+        // If no timestamps are available, no path can be created
+        if (!timestamps || !timestamps.length)
+            return '';
+
+        // An initially empty array containing no activity in any bucket
+        const buckets = new Array(NUM_BUCKETS).fill(0);
+
+        // If no events occured, return the an empty path
+        if (!timestamps.length)
+            return '';
+
+        // Determine the bucket granularity
+        const bucketDuration = duration / NUM_BUCKETS;
+
+        // The rate-limited maximum number of events that any bucket can have,
+        const maxPossibleBucketValue = Math.floor(bucketDuration * maxRate);
+
+        // If the duration is invalid, return the still-empty array
+        if (duration <= 0)
+            return '';
+
+        let maxBucketValue = 0;
+
+        // Partition the events into a count of events per bucket
+        let currentBucketIndex = 0;
+        timestamps.forEach(timestamp => {
+
+            // If the current timestamp has passed the end of the current
+            // bucket, move to the appropriate bucket
+            if (timestamp >= (currentBucketIndex + 1) * bucketDuration)
+                currentBucketIndex = Math.min(
+                    Math.floor((timestamp / bucketDuration)), NUM_BUCKETS - 1);
+
+            // Do not record events that exceed the maximum allowable rate
+            if (buckets[currentBucketIndex] >= maxPossibleBucketValue)
+                buckets[currentBucketIndex] = maxPossibleBucketValue;
+
+            else
+                // Increment the count for the current bucket
+                buckets[currentBucketIndex]++;
+
+            // Keep track of the maximum value seen so far
+            maxBucketValue = Math.max(
+                maxBucketValue, buckets[currentBucketIndex]);
+
+        });
+
+        // Smooth the data for better aesthetics before creating the path
+        const smoothed = smooth(buckets);
+
+        // Create an SVG path based on the smoothed data
+        return createPath(smoothed, maxBucketValue, height, width);
+
+    }
+
+
+    return service;
+
+}]);
diff --git a/guacamole/src/main/frontend/src/app/player/templates/player.html b/guacamole/src/main/frontend/src/app/player/templates/player.html
index eeb3744b5..f002bd42c 100644
--- a/guacamole/src/main/frontend/src/app/player/templates/player.html
+++ b/guacamole/src/main/frontend/src/app/player/templates/player.html
@@ -28,6 +28,21 @@
            ng-model="playbackPosition"
            ng-on-change="commitSeekRequest()">
 
+    <div class="heat-map">
+        <svg class="frame-events" ng-attr-view_box="0 0 {{ HEATMAP_WIDTH }} {{ HEATMAP_HEIGHT }}" preserveAspectRatio="none">
+            <path ng-attr-d="{{ frameHeatmap }}"/>
+        </svg>
+
+        <svg class="key-events" ng-attr-view_box="0 0 {{ HEATMAP_WIDTH }} {{ HEATMAP_HEIGHT }}" preserveAspectRatio="none">
+            <path ng-attr-d="{{ keyHeatmap }}"/>
+        </svg>
+
+        <div class="legend">
+            <span class="frame-events">{{ 'PLAYER.INFO_FRAME_EVENTS_LEGEND' | translate }}</span>
+            <span class="key-events">{{ 'PLAYER.INFO_KEY_EVENTS_LEGEND' | translate }}</span>
+        </div>
+    </div>
+
     <div class="guac-player-buttons">
 
         <!-- Play button -->
diff --git a/guacamole/src/main/frontend/src/app/settings/styles/history-player.css b/guacamole/src/main/frontend/src/app/settings/styles/history-player.css
index bf4a909d1..1cda2c652 100644
--- a/guacamole/src/main/frontend/src/app/settings/styles/history-player.css
+++ b/guacamole/src/main/frontend/src/app/settings/styles/history-player.css
@@ -116,3 +116,76 @@
 .settings.connectionHistoryPlayer guac-player.recent-mouse-movement .guac-player-controls.playing {
     opacity: 1;
 }
+
+.settings.connectionHistoryPlayer .guac-player-controls .heat-map {
+    position: absolute;
+    width: 100%;
+}
+
+.settings.connectionHistoryPlayer .guac-player-controls .heat-map svg {
+    position: absolute;
+    bottom: 7px;
+    height: 50px;
+    width: 100%;
+    z-index: 100;
+    pointer-events: none;
+    opacity: 0;
+    -webkit-transition: opacity 0.1s linear 0.1s;
+    -moz-transition: opacity 0.1s linear 0.1s;
+    -o-transition: opacity 0.1s linear 0.1s;
+    transition: opacity 0.1s linear 0.1s;
+}
+
+.settings.connectionHistoryPlayer .guac-player-controls:hover .heat-map svg {
+    opacity: 0.5;
+}
+
+.settings.connectionHistoryPlayer .guac-player-controls .heat-map .legend {
+    position: absolute;
+    display: flex;
+    flex-direction: column;
+    align-items: end;
+    bottom: 65px;
+    right: 10px;
+    z-index: 100;
+    opacity: 0;
+    -webkit-transition: opacity 0.1s linear 0.1s;
+    -moz-transition: opacity 0.1s linear 0.1s;
+    -o-transition: opacity 0.1s linear 0.1s;
+    transition: opacity 0.1s linear 0.1s;
+}
+
+.settings.connectionHistoryPlayer .guac-player-controls:hover .heat-map .legend {
+    opacity: 1;
+}
+
+.settings.connectionHistoryPlayer .guac-player-controls .heat-map .legend .key-events::after,
+.settings.connectionHistoryPlayer .guac-player-controls .heat-map .legend .frame-events::after {
+    display: inline-block;
+    content: '';
+    width: 25px;
+    height: 10px;
+    margin-left: 3px;
+    margin-right: 10px;
+    border-radius: 3px;
+}
+
+.settings.connectionHistoryPlayer .guac-player-controls .heat-map .legend .key-events::after {
+    background-color: #5BA300;
+}
+
+.settings.connectionHistoryPlayer .guac-player-controls .heat-map .legend .frame-events::after {
+    background-color: #FFFFFF;
+}
+
+.settings.connectionHistoryPlayer .heat-map svg.key-events {
+
+    /* Convert to #5BA300 color */
+    filter: invert(69%) sepia(80%) saturate(5092%) hue-rotate(54deg) brightness(96%) contrast(101%);
+}
+
+.settings.connectionHistoryPlayer .heat-map svg.frame-events {
+
+    /* Convert to #FFFFFF color */
+    filter: invert(100%) sepia(0%) saturate(0%) hue-rotate(93deg) brightness(103%) contrast(103%);
+}
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 4997439f5..e3423d724 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -483,10 +483,12 @@
         "ACTION_PLAY"         : "@:APP.ACTION_PLAY",
         "ACTION_SHOW_KEY_LOG" : "Keystroke Log",
 
-        "INFO_LOADING_RECORDING" : "Your recording is now being loaded. Please wait...",
-        "INFO_NO_KEY_LOG"        : "Keystroke Log Unavailable",
-        "INFO_NUMBER_OF_RESULTS" : "{RESULTS} {RESULTS, plural, one{Match} other{Matches}}",
-        "INFO_SEEK_IN_PROGRESS"  : "Seeking to the requested position. Please wait...",
+        "INFO_FRAME_EVENTS_LEGEND" : "On-screen Activity",
+        "INFO_KEY_EVENTS_LEGEND"   : "Keyboard Activity",
+        "INFO_LOADING_RECORDING"   : "Your recording is now being loaded. Please wait...",
+        "INFO_NO_KEY_LOG"          : "Keystroke Log Unavailable",
+        "INFO_NUMBER_OF_RESULTS"   : "{RESULTS} {RESULTS, plural, one{Match} other{Matches}}",
+        "INFO_SEEK_IN_PROGRESS"    : "Seeking to the requested position. Please wait...",
 
         "FIELD_PLACEHOLDER_TEXT_BATCH_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER"
 

From 075ca92189a6cf780f251d17f941640b5eb388d8 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 7 Nov 2023 00:46:56 +0000
Subject: [PATCH 232/289] GUACAMOLE-1876: Fix heatmap and legend styling to
 work better with event viewer open.

---
 .../app/settings/styles/history-player.css    | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/settings/styles/history-player.css b/guacamole/src/main/frontend/src/app/settings/styles/history-player.css
index 1cda2c652..d9122b83d 100644
--- a/guacamole/src/main/frontend/src/app/settings/styles/history-player.css
+++ b/guacamole/src/main/frontend/src/app/settings/styles/history-player.css
@@ -137,7 +137,7 @@
 }
 
 .settings.connectionHistoryPlayer .guac-player-controls:hover .heat-map svg {
-    opacity: 0.5;
+    opacity: 1;
 }
 
 .settings.connectionHistoryPlayer .guac-player-controls .heat-map .legend {
@@ -148,6 +148,11 @@
     bottom: 65px;
     right: 10px;
     z-index: 100;
+    background-color: rgba(0, 0, 0, 0.85);
+    padding-top: 3px;
+    padding-bottom: 3px;
+    padding-left: 6px;
+    border-radius: 5px;
     opacity: 0;
     -webkit-transition: opacity 0.1s linear 0.1s;
     -moz-transition: opacity 0.1s linear 0.1s;
@@ -175,17 +180,17 @@
 }
 
 .settings.connectionHistoryPlayer .guac-player-controls .heat-map .legend .frame-events::after {
-    background-color: #FFFFFF;
+    background-color: #888888;
 }
 
-.settings.connectionHistoryPlayer .heat-map svg.key-events {
+.settings.connectionHistoryPlayer .heat-map svg.key-events path {
 
-    /* Convert to #5BA300 color */
-    filter: invert(69%) sepia(80%) saturate(5092%) hue-rotate(54deg) brightness(96%) contrast(101%);
+    /* #5BA300 color at 50% opacity */
+    fill: rgba(91, 163, 0, 0.5);
 }
 
-.settings.connectionHistoryPlayer .heat-map svg.frame-events {
+.settings.connectionHistoryPlayer .heat-map svg.frame-events path {
 
-    /* Convert to #FFFFFF color */
-    filter: invert(100%) sepia(0%) saturate(0%) hue-rotate(93deg) brightness(103%) contrast(103%);
+    /* #888888 color at 75% opacity */
+    fill: rgba(135, 135, 135, 0.75);
 }

From 57e9fd1569b48aa032a464d5d5c610fdc9b038d5 Mon Sep 17 00:00:00 2001
From: Matthias G <sirux88@gmail.com>
Date: Wed, 8 Nov 2023 15:53:47 +0100
Subject: [PATCH 233/289] GUACAMOLE-1525: Support for true fullscreen mode and
 keyboard lock

---
 .../client/controllers/clientController.js    | 20 ++++++-
 .../src/app/client/services/guacFullscreen.js | 55 +++++++++++++++++++
 .../main/frontend/src/translations/de.json    |  1 +
 .../main/frontend/src/translations/en.json    |  1 +
 4 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 guacamole/src/main/frontend/src/app/client/services/guacFullscreen.js

diff --git a/guacamole/src/main/frontend/src/app/client/controllers/clientController.js b/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
index 2821146f8..85d89ae2a 100644
--- a/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
+++ b/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
@@ -39,6 +39,7 @@ angular.module('client').controller('clientController', ['$scope', '$routeParams
     const clipboardService       = $injector.get('clipboardService');
     const dataSourceService      = $injector.get('dataSourceService');
     const guacClientManager      = $injector.get('guacClientManager');
+    const guacFullscreen         = $injector.get('guacFullscreen');
     const iconService            = $injector.get('iconService');
     const preferenceService      = $injector.get('preferenceService');
     const requestService         = $injector.get('requestService');
@@ -683,8 +684,22 @@ angular.module('client').controller('clientController', ['$scope', '$routeParams
         callback  : $scope.disconnect
     };
 
+    /**
+     * Action that toggles fullscreen mode within the
+     * currently-connected client and then closes the menu.
+     */
+    var FULLSCREEN_MENU_ACTION = {
+        name      : 'CLIENT.ACTION_FULLSCREEN',
+        classname : 'fullscreen action',
+        callback  : function fullscreen() {
+            
+            guacFullscreen.toggleFullscreenMode();
+            $scope.menu.shown = false;
+        }
+    };
+
     // Set client-specific menu actions
-    $scope.clientMenuActions = [ DISCONNECT_MENU_ACTION ];
+    $scope.clientMenuActions = [ DISCONNECT_MENU_ACTION,FULLSCREEN_MENU_ACTION ];
 
     /**
      * @borrows Protocol.getNamespace
@@ -833,6 +848,9 @@ angular.module('client').controller('clientController', ['$scope', '$routeParams
     // Clean up when view destroyed
     $scope.$on('$destroy', function clientViewDestroyed() {
         setAttachedGroup(null);
+
+        // always unset fullscreen mode to not confuse user 
+        guacFullscreen.setFullscreenMode(false);
     });
 
 }]);
diff --git a/guacamole/src/main/frontend/src/app/client/services/guacFullscreen.js b/guacamole/src/main/frontend/src/app/client/services/guacFullscreen.js
new file mode 100644
index 000000000..12720e936
--- /dev/null
+++ b/guacamole/src/main/frontend/src/app/client/services/guacFullscreen.js
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * A service for providing true fullscreen and keyboard lock support.
+ * Keyboard lock is currently only supported by Chromium based browsers
+ * (Edge >= V79, Chrome >= V68 and Opera >= V55)
+ */
+angular.module('client').factory('guacFullscreen', ['$injector', 
+        function guacFullscreen($injector) {
+
+    var service = {};
+
+    // check is browser in true fullscreen mode
+    service.isInFullscreenMode = function isInFullscreenMode() {
+        return document.fullscreenElement;
+    }
+
+    // set fullscreen mode
+    service.setFullscreenMode = function setFullscreenMode(state) {
+        if (document.fullscreenEnabled) {
+            if (state && !service.isInFullscreenMode())
+                document.documentElement.requestFullscreen().then(navigator.keyboard.lock()); 
+            else if (!state && service.isInFullscreenMode())
+                document.exitFullscreen().then(navigator.keyboard.unlock()); 
+        }
+    }
+
+    // toggles current fullscreen mode (off if on, on if off)
+    service.toggleFullscreenMode = function toggleFullscreenMode() {
+        if (!service.isInFullscreenMode())
+            service.setFullscreenMode(true);
+        else
+            service.setFullscreenMode(false);
+    }
+
+    return service;
+    
+}]);
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/translations/de.json b/guacamole/src/main/frontend/src/translations/de.json
index b52fc08d3..04059693d 100644
--- a/guacamole/src/main/frontend/src/translations/de.json
+++ b/guacamole/src/main/frontend/src/translations/de.json
@@ -64,6 +64,7 @@
         "ACTION_CLEAR_COMPLETED_TRANSFERS" : "Entferne abgeschlossene Übertragungen",
         "ACTION_CONTINUE"                  : "@:APP.ACTION_CONTINUE",
         "ACTION_DISCONNECT"                : "Trennen",
+        "ACTION_FULLSCREEN"                : "Vollbild",
         "ACTION_LOGOUT"                    : "@:APP.ACTION_LOGOUT",
         "ACTION_NAVIGATE_BACK"             : "@:APP.ACTION_NAVIGATE_BACK",
         "ACTION_NAVIGATE_HOME"             : "@:APP.ACTION_NAVIGATE_HOME",
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index e3423d724..a9d720940 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -67,6 +67,7 @@
         "ACTION_CLEAR_COMPLETED_TRANSFERS" : "@:APP.ACTION_CLEAR",
         "ACTION_CONTINUE"                  : "@:APP.ACTION_CONTINUE",
         "ACTION_DISCONNECT"                : "Disconnect",
+        "ACTION_FULLSCREEN"                : "Fullscreen",
         "ACTION_LOGOUT"                    : "@:APP.ACTION_LOGOUT",
         "ACTION_NAVIGATE_BACK"             : "@:APP.ACTION_NAVIGATE_BACK",
         "ACTION_NAVIGATE_HOME"             : "@:APP.ACTION_NAVIGATE_HOME",

From 4d162810f74c27f01216621c5469567798109a14 Mon Sep 17 00:00:00 2001
From: Mike Jumper <mjumper@apache.org>
Date: Thu, 23 Nov 2023 08:18:35 -0800
Subject: [PATCH 234/289] GUACAMOLE-1887: Bump versions numbers of projects
 outside 1.5.4 scope.

---
 extensions/guacamole-auth-ban/pom.xml                       | 6 +++---
 .../src/main/resources/guac-manifest.json                   | 2 +-
 .../modules/guacamole-auth-sso-dist/pom.xml                 | 2 +-
 .../modules/guacamole-auth-sso-ssl/pom.xml                  | 4 ++--
 .../src/main/resources/guac-manifest.json                   | 2 +-
 extensions/guacamole-display-statistics/pom.xml             | 4 ++--
 .../src/main/resources/guac-manifest.json                   | 2 +-
 7 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/extensions/guacamole-auth-ban/pom.xml b/extensions/guacamole-auth-ban/pom.xml
index 6f39a4513..5d0643682 100644
--- a/extensions/guacamole-auth-ban/pom.xml
+++ b/extensions/guacamole-auth-ban/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-auth-ban</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.3</version>
+    <version>1.5.4</version>
     <name>guacamole-auth-ban</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.5.3</version>
+        <version>1.5.4</version>
         <relativePath>../</relativePath>
     </parent>
 
@@ -51,7 +51,7 @@
         <dependency>
             <groupId>org.apache.guacamole</groupId>
             <artifactId>guacamole-ext</artifactId>
-            <version>1.5.3</version>
+            <version>1.5.4</version>
             <scope>provided</scope>
 
             <!-- Exclude transitive dependencies that will be overridden by
diff --git a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
index 75b09bc27..7000befdf 100644
--- a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.3",
+    "guacamoleVersion" : "1.5.4",
 
     "name"      : "Brute-force Authentication Detection/Prevention",
     "namespace" : "ban",
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
index 9c1fa824a..6d395506c 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
@@ -63,7 +63,7 @@
         <dependency>
             <groupId>org.apache.guacamole</groupId>
             <artifactId>guacamole-auth-sso-ssl</artifactId>
-            <version>1.5.3</version>
+            <version>1.5.4</version>
         </dependency>
 
     </dependencies>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
index 945be98c4..5ed65255e 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-auth-sso-ssl</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.3</version>
+    <version>1.5.4</version>
     <name>guacamole-auth-sso-ssl</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>guacamole-auth-sso</artifactId>
-        <version>1.5.3</version>
+        <version>1.5.4</version>
         <relativePath>../../</relativePath>
     </parent>
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
index fe8dad84f..8758ec520 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.3",
+    "guacamoleVersion" : "1.5.4",
 
     "name"      : "SSL Authentication Extension",
     "namespace" : "ssl",
diff --git a/extensions/guacamole-display-statistics/pom.xml b/extensions/guacamole-display-statistics/pom.xml
index fb96bd99d..428061b56 100644
--- a/extensions/guacamole-display-statistics/pom.xml
+++ b/extensions/guacamole-display-statistics/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-display-statistics</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.3</version>
+    <version>1.5.4</version>
     <name>guacamole-display-statistics</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.5.3</version>
+        <version>1.5.4</version>
         <relativePath>../</relativePath>
     </parent>
 
diff --git a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
index 8e528b745..54c32adcf 100644
--- a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.3",
+    "guacamoleVersion" : "1.5.4",
 
     "name"      : "Display Statistic Toolbar",
     "namespace" : "display-stats",

From 4ab265af735d91fa4e9716a30e768b203dd45717 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Thu, 12 Oct 2023 22:50:17 -0400
Subject: [PATCH 235/289] GUACAMOLE-1866: Add capability for users to configure
 recent connections.

---
 .../src/app/history/services/guacHistory.js    | 11 +++--------
 .../src/app/home/controllers/homeController.js | 11 +++++++++++
 .../home/directives/guacRecentConnections.js   | 13 ++++++++++++-
 .../main/frontend/src/app/home/styles/home.css |  5 +++++
 .../home/templates/guacRecentConnections.html  |  2 +-
 .../frontend/src/app/home/templates/home.html  | 12 ++++++++----
 .../frontend/src/app/index/styles/headers.css  |  4 ++--
 .../directives/guacSettingsPreferences.js      |  2 +-
 .../app/settings/services/preferenceService.js | 14 ++++++++++++++
 .../templates/settingsPreferences.html         | 18 ++++++++++++++++++
 .../src/main/frontend/src/translations/en.json | 18 +++++++++++-------
 11 files changed, 86 insertions(+), 24 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/history/services/guacHistory.js b/guacamole/src/main/frontend/src/app/history/services/guacHistory.js
index 74046ef9f..e47cb29e9 100644
--- a/guacamole/src/main/frontend/src/app/history/services/guacHistory.js
+++ b/guacamole/src/main/frontend/src/app/history/services/guacHistory.js
@@ -28,17 +28,12 @@ angular.module('history').factory('guacHistory', ['$injector',
 
     // Required services
     var localStorageService = $injector.get('localStorageService');
+    var preferenceService   = $injector.get('preferenceService');
 
     var service = {};
 
     // The parameter name for getting the history from local storage
     var GUAC_HISTORY_STORAGE_KEY = "GUAC_HISTORY";
-                                    
-    /**
-     * The number of entries to allow before removing old entries based on the
-     * cutoff.
-     */
-    var IDEAL_LENGTH = 6;
 
     /**
      * The top few recent connections, sorted in order of most recent access.
@@ -77,8 +72,8 @@ angular.module('history').factory('guacHistory', ['$injector',
         ));
 
         // Truncate history to ideal length
-        if (service.recentConnections.length > IDEAL_LENGTH)
-            service.recentConnections.length = IDEAL_LENGTH;
+        if (service.recentConnections.length > preferenceService.preferences.numberOfRecentConnections)
+            service.recentConnections.length = preferenceService.preferences.numberOfRecentConnections;
 
         // Save updated history
         localStorageService.setItem(GUAC_HISTORY_STORAGE_KEY, service.recentConnections);
diff --git a/guacamole/src/main/frontend/src/app/home/controllers/homeController.js b/guacamole/src/main/frontend/src/app/home/controllers/homeController.js
index a6d359e7f..92c149e6b 100644
--- a/guacamole/src/main/frontend/src/app/home/controllers/homeController.js
+++ b/guacamole/src/main/frontend/src/app/home/controllers/homeController.js
@@ -31,6 +31,7 @@ angular.module('home').controller('homeController', ['$scope', '$injector',
     var authenticationService  = $injector.get('authenticationService');
     var connectionGroupService = $injector.get('connectionGroupService');
     var dataSourceService      = $injector.get('dataSourceService');
+    var preferenceService      = $injector.get('preferenceService');
     var requestService         = $injector.get('requestService');
 
     /**
@@ -59,6 +60,16 @@ angular.module('home').controller('homeController', ['$scope', '$injector',
     $scope.filteredConnectionGroupProperties = [
         'name'
     ];
+    
+    /**
+     * Returns true if recent connections should be displayed on the Guacamole
+     * home page, otherwise false.
+     * 
+     * @returns {!boolean}
+     */
+    $scope.willShowRecentConnections = function willShowRecentConnections() {
+        return preferenceService.preferences.showRecentConnections;
+    };
 
     /**
      * Returns whether critical data has completed being loaded.
diff --git a/guacamole/src/main/frontend/src/app/home/directives/guacRecentConnections.js b/guacamole/src/main/frontend/src/app/home/directives/guacRecentConnections.js
index c59ad4734..1f16e036e 100644
--- a/guacamole/src/main/frontend/src/app/home/directives/guacRecentConnections.js
+++ b/guacamole/src/main/frontend/src/app/home/directives/guacRecentConnections.js
@@ -50,6 +50,7 @@ angular.module('home').directive('guacRecentConnections', [function guacRecentCo
 
             // Required services
             var guacHistory       = $injector.get('guacHistory');
+            var preferenceService = $injector.get('preferenceService');
 
             /**
              * Array of all known and visible recently-used connections.
@@ -57,11 +58,21 @@ angular.module('home').directive('guacRecentConnections', [function guacRecentCo
              * @type RecentConnection[]
              */
             $scope.recentConnections = [];
+            
+            /**
+             * Returns whether or not recent connections should be displayed.
+             * 
+             * @returns {!boolean}
+             *     true if recent connections should be displayed, otherwise false.
+             */
+            $scope.willShowRecentConnections = function willShowRecentConnections() {
+                return preferenceService.preferences.showRecentConnections;
+            };
 
             /**
              * Returns whether recent connections are available for display.
              *
-             * @returns {Boolean}
+             * @returns {!boolean}
              *     true if recent connections are present, false otherwise.
              */
             $scope.hasRecentConnections = function hasRecentConnections() {
diff --git a/guacamole/src/main/frontend/src/app/home/styles/home.css b/guacamole/src/main/frontend/src/app/home/styles/home.css
index 33b867a9f..e6837f45c 100644
--- a/guacamole/src/main/frontend/src/app/home/styles/home.css
+++ b/guacamole/src/main/frontend/src/app/home/styles/home.css
@@ -75,3 +75,8 @@ a.home-connection, .empty.balancer a.home-connection-group {
 .all-connections .connection-group.empty.balancer > .caption .icon.expand {
     display: none;
 }
+
+.header-app-name {
+    font-size: 0.85em;
+    box-shadow: none;
+}
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/home/templates/guacRecentConnections.html b/guacamole/src/main/frontend/src/app/home/templates/guacRecentConnections.html
index 08362f66f..96c75ec71 100644
--- a/guacamole/src/main/frontend/src/app/home/templates/guacRecentConnections.html
+++ b/guacamole/src/main/frontend/src/app/home/templates/guacRecentConnections.html
@@ -1,4 +1,4 @@
-<div class="recent-connections">
+<div class="recent-connections" ng-show="willShowRecentConnections()">
 
     <!-- Text displayed if no recent connections exist -->
     <p class="placeholder" ng-hide="hasRecentConnections()">{{'HOME.INFO_NO_RECENT_CONNECTIONS' | translate}}</p>
diff --git a/guacamole/src/main/frontend/src/app/home/templates/home.html b/guacamole/src/main/frontend/src/app/home/templates/home.html
index 06c0f2211..6ba553025 100644
--- a/guacamole/src/main/frontend/src/app/home/templates/home.html
+++ b/guacamole/src/main/frontend/src/app/home/templates/home.html
@@ -2,12 +2,16 @@
 
     <div class="connection-list-ui">
 
-        <!-- The recent connections for this user -->
-        <div class="header">
-            <h2 id="section-header-recent-connections">{{'HOME.SECTION_HEADER_RECENT_CONNECTIONS' | translate}}</h2>
+        <div class="header header-app-name">
+            <h2 id="section-header-app-name">{{'APP.NAME' | translate}}</h2>
             <guac-user-menu></guac-user-menu>
         </div>
-        <guac-recent-connections root-groups="rootConnectionGroups"></guac-recent-connections>
+        
+        <!-- The recent connections for this user -->
+        <div class="header" ng-show="willShowRecentConnections()">
+            <h2 id="section-header-recent-connections">{{'HOME.SECTION_HEADER_RECENT_CONNECTIONS' | translate}}</h2>
+        </div>
+        <guac-recent-connections root-groups="rootConnectionGroups" ng-show="willShowRecentConnections()"></guac-recent-connections>
 
         <!-- All connections for this user -->
         <div class="header">
diff --git a/guacamole/src/main/frontend/src/app/index/styles/headers.css b/guacamole/src/main/frontend/src/app/index/styles/headers.css
index b4d96f66b..245fa398c 100644
--- a/guacamole/src/main/frontend/src/app/index/styles/headers.css
+++ b/guacamole/src/main/frontend/src/app/index/styles/headers.css
@@ -42,7 +42,7 @@ h2 {
     box-shadow: 0 1px 2px rgba(0, 0, 0, 0.125);
     background: rgba(0, 0, 0, 0.04);
 
-    margin-bottom: 1em;
+    margin-bottom: 0;
     margin-top: 0;
     border-top: none;
     width: 100%;
@@ -80,7 +80,7 @@ h2 {
 
 .header ~ * .header,
 .header ~ .header {
-    margin-top: 1em;
+    margin-top: 0;
     border-top: 1px solid rgba(0, 0, 0, 0.125);
 }
 
diff --git a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
index 4656631de..347c75177 100644
--- a/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
+++ b/guacamole/src/main/frontend/src/app/settings/directives/guacSettingsPreferences.js
@@ -258,7 +258,7 @@ angular.module('settings').directive('guacSettingsPreferences', [function guacSe
             // Fetch the user record
             userService.getUser(dataSource, username).then(function saveUserData(user) {
                 $scope.user = user;
-            })
+            });
 
             // Fetch all user preference attribute forms defined
             schemaService.getUserPreferenceAttributes(dataSource).then(function saveAttributes(attributes) {
diff --git a/guacamole/src/main/frontend/src/app/settings/services/preferenceService.js b/guacamole/src/main/frontend/src/app/settings/services/preferenceService.js
index 9c4d5fc94..f029790f8 100644
--- a/guacamole/src/main/frontend/src/app/settings/services/preferenceService.js
+++ b/guacamole/src/main/frontend/src/app/settings/services/preferenceService.js
@@ -142,6 +142,20 @@ angular.module('settings').provider('preferenceService', ['$injector',
          */
         language : getDefaultLanguageKey(),
         
+        /**
+         * The number of recent connections to display.
+         * 
+         * @type {!number}
+         */
+        numberOfRecentConnections: 6,
+        
+        /**
+         * Whether or not to show the "Recent Connections" section.
+         * 
+         * @type {!boolean}
+         */
+        showRecentConnections : true,
+        
         /**
          * The timezone set by the user, in IANA zone key format (Olson time
          * zone database).
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
index 7c154df89..84ebc7230 100644
--- a/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsPreferences.html
@@ -88,6 +88,24 @@
 
         </div>
     </div>
+    
+    <!-- Recent connections -->
+    <h2 class="header">{{'SETTINGS_PREFERENCES.SECTION_HEADER_RECENT_CONNECTIONS' | translate}}</h2>
+    <div class="settings section recent">
+        <p>{{'SETTINGS_PREFERENCES.HELP_RECENT_CONNECTIONS' | translate}}</p>
+        <div class='form'>
+            <table class='fields'>
+                <tr>
+                    <th>{{'SETTINGS_PREFERENCES.FIELD_HEADER_SHOW_RECENT_CONNECTIONS' | translate}}</th>
+                    <td><input ng-model="preferences.showRecentConnections" type="checkbox"/></td>
+                </tr>
+                <tr>
+                    <th>{{'SETTINGS_PREFERENCES.FIELD_HEADER_NUMBER_RECENT_CONNECTIONS' | translate}}</th>
+                    <td><input ng-model="preferences.numberOfRecentConnections" type="number" min="1" max="20"/></td>
+                </tr>
+            </table>
+        </div>
+    </div>
 
     <!-- User attributes section -->
     <div class="attributes" ng-show="canUpdateSelf && attributes.length">
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index e3423d724..c6aeda702 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -1023,13 +1023,15 @@
         "ERROR_PASSWORD_BLANK"    : "@:APP.ERROR_PASSWORD_BLANK",
         "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
 
-        "FIELD_HEADER_LANGUAGE"           : "Display language:",
-        "FIELD_HEADER_PASSWORD"           : "Password:",
-        "FIELD_HEADER_PASSWORD_OLD"       : "Current Password:",
-        "FIELD_HEADER_PASSWORD_NEW"       : "New Password:",
-        "FIELD_HEADER_PASSWORD_NEW_AGAIN" : "Confirm New Password:",
-        "FIELD_HEADER_TIMEZONE"           : "Timezone:",
-        "FIELD_HEADER_USERNAME"           : "Username:",
+        "FIELD_HEADER_LANGUAGE"                  : "Display language:",
+        "FIELD_HEADER_NUMBER_RECENT_CONNECTIONS" : "Number of Recent Connections to show:",
+        "FIELD_HEADER_PASSWORD"                  : "Password:",
+        "FIELD_HEADER_PASSWORD_OLD"              : "Current Password:",
+        "FIELD_HEADER_PASSWORD_NEW"              : "New Password:",
+        "FIELD_HEADER_PASSWORD_NEW_AGAIN"        : "Confirm New Password:",
+        "FIELD_HEADER_SHOW_RECENT_CONNECTIONS"   : "Display Recent Connections:",
+        "FIELD_HEADER_TIMEZONE"                  : "Timezone:",
+        "FIELD_HEADER_USERNAME"                  : "Username:",
         
         "HELP_DEFAULT_INPUT_METHOD" : "The default input method determines how keyboard events are received by Guacamole. Changing this setting may be necessary when using a mobile device, or when typing through an IME. This setting can be overridden on a per-connection basis within the Guacamole menu.",
         "HELP_DEFAULT_MOUSE_MODE"   : "The default mouse emulation mode determines how the remote mouse will behave in new connections with respect to touches. This setting can be overridden on a per-connection basis within the Guacamole menu.",
@@ -1039,6 +1041,7 @@
         "HELP_LOCALE"               : "Options below are related to the locale of the user and will impact how various parts of the interface are displayed.",
         "HELP_MOUSE_MODE_ABSOLUTE"  : "@:CLIENT.HELP_MOUSE_MODE_ABSOLUTE",
         "HELP_MOUSE_MODE_RELATIVE"  : "@:CLIENT.HELP_MOUSE_MODE_RELATIVE",
+        "HELP_RECENT_CONNECTIONS"   : "Here you can enable or disable recent conections in the Guacamole Home Page, and adjust the number of recent connections that will be displayed.",
         "HELP_UPDATE_PASSWORD"      : "If you wish to change your password, enter your current password and the desired new password below, and click \"Update Password\". The change will take effect immediately.",
 
         "INFO_PASSWORD_CHANGED" : "Password changed.",
@@ -1050,6 +1053,7 @@
 
         "SECTION_HEADER_DEFAULT_INPUT_METHOD" : "Default Input Method",
         "SECTION_HEADER_DEFAULT_MOUSE_MODE"   : "Default Mouse Emulation Mode",
+        "SECTION_HEADER_RECENT_CONNECTIONS"   : "Recent Connections Preferences",
         "SECTION_HEADER_UPDATE_PASSWORD"      : "Change Password"
 
     },

From 012663ed9aa7235749400649e156aee27e0136a9 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 2 Jan 2024 21:21:47 +0000
Subject: [PATCH 236/289] GUACAMOLE-1904: Pass the client directly to the field
 to allow saving field values.

---
 .../main/frontend/src/app/client/templates/client.html   | 1 +
 .../src/main/frontend/src/app/form/directives/form.js    | 9 ++++++++-
 .../main/frontend/src/app/form/directives/formField.js   | 9 ++++++++-
 .../src/main/frontend/src/app/form/templates/form.html   | 1 +
 4 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/client/templates/client.html b/guacamole/src/main/frontend/src/app/client/templates/client.html
index 829d5ef7d..66dca3a77 100644
--- a/guacamole/src/main/frontend/src/app/client/templates/client.html
+++ b/guacamole/src/main/frontend/src/app/client/templates/client.html
@@ -124,6 +124,7 @@
                     <guac-form namespace="getProtocolNamespace(focusedClient.protocol)"
                                content="focusedClient.forms"
                                model="menu.connectionParameters"
+                               client="focusedClient"
                                model-only="true"></guac-form>
                 </div>
 
diff --git a/guacamole/src/main/frontend/src/app/form/directives/form.js b/guacamole/src/main/frontend/src/app/form/directives/form.js
index 8d35774c7..4aa99668a 100644
--- a/guacamole/src/main/frontend/src/app/form/directives/form.js
+++ b/guacamole/src/main/frontend/src/app/form/directives/form.js
@@ -79,7 +79,14 @@ angular.module('form').directive('guacForm', [function form() {
              *
              * @type String
              */
-            focused : '='
+            focused : '=',
+
+            /**
+             * The client associated with this form, if any.
+             *
+             * @type ManagedClient
+             */
+            client: '='
 
         },
         templateUrl: 'app/form/templates/form.html',
diff --git a/guacamole/src/main/frontend/src/app/form/directives/formField.js b/guacamole/src/main/frontend/src/app/form/directives/formField.js
index 4fcead1d6..73ffb127e 100644
--- a/guacamole/src/main/frontend/src/app/form/directives/formField.js
+++ b/guacamole/src/main/frontend/src/app/form/directives/formField.js
@@ -68,7 +68,14 @@ angular.module('form').directive('guacFormField', [function formField() {
              *
              * @type Boolean
              */
-            focused : '='
+            focused : '=',
+
+            /**
+             * The client associated with this form field, if any.
+             *
+             * @type ManagedClient
+             */
+            client: '='
 
         },
         templateUrl: 'app/form/templates/formField.html',
diff --git a/guacamole/src/main/frontend/src/app/form/templates/form.html b/guacamole/src/main/frontend/src/app/form/templates/form.html
index 397a210c5..084d55df9 100644
--- a/guacamole/src/main/frontend/src/app/form/templates/form.html
+++ b/guacamole/src/main/frontend/src/app/form/templates/form.html
@@ -13,6 +13,7 @@
                              data-disabled="disabled"
                              focused="isFocused(field)"
                              field="field"
+                             client="client"
                              model="values[field.name]"></guac-form-field>
         </div>
 

From 15b88dd4f4edb0b53eb240a4c6b6f14a9049df48 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 9 Jan 2024 01:17:28 +0000
Subject: [PATCH 237/289] GUACAMOLE-1904: Disable ManagedArgument instead of
 deleting when updated, to avoid fields disappearing upon modification.

---
 .../src/app/client/types/ManagedArgument.js   | 35 ++++++++++---------
 .../src/app/client/types/ManagedClient.js     |  5 ++-
 .../frontend/src/app/form/directives/form.js  | 28 +++++++++++++++
 .../frontend/src/app/form/templates/form.html |  2 +-
 4 files changed, 49 insertions(+), 21 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/client/types/ManagedArgument.js b/guacamole/src/main/frontend/src/app/client/types/ManagedArgument.js
index 247d9f679..5e676bfcb 100644
--- a/guacamole/src/main/frontend/src/app/client/types/ManagedArgument.js
+++ b/guacamole/src/main/frontend/src/app/client/types/ManagedArgument.js
@@ -58,6 +58,16 @@ angular.module('client').factory('ManagedArgument', ['$q', function defineManage
          */
         this.stream = template.stream;
 
+        /**
+         * True if this argument has been modified in the webapp, but yet to
+         * be confirmed by guacd, or false in any other case. A pending
+         * argument cannot be modified again, and must be recreated before
+         * editing is enabled again.
+         *
+         * @type {boolean}
+         */
+        this.pending = false;
+
     };
 
     /**
@@ -110,9 +120,9 @@ angular.module('client').factory('ManagedArgument', ['$q', function defineManage
      * Sets the given editable argument (connection parameter) to the given
      * value, updating the behavior of the associated connection in real-time.
      * If successful, the ManagedArgument provided cannot be used for future
-     * calls to setValue() and must be replaced with a new instance. This
-     * function only has an effect if the new parameter value is different from
-     * the current value.
+     * calls to setValue() and will be read-only until replaced with a new
+     * instance. This function only has an effect if the new parameter value
+     * is different from the current value.
      *
      * @param {ManagedArgument} managedArgument
      *     The ManagedArgument instance associated with the connection
@@ -120,33 +130,24 @@ angular.module('client').factory('ManagedArgument', ['$q', function defineManage
      *
      * @param {String} value
      *     The new value to assign to the connection parameter.
-     *
-     * @returns {Boolean}
-     *     true if the connection parameter was sent and the provided
-     *     ManagedArgument instance may no longer be used for future setValue()
-     *     calls, false if the connection parameter was NOT sent as it has not
-     *     changed.
      */
     ManagedArgument.setValue = function setValue(managedArgument, value) {
 
-        // Stream new value only if value has changed
-        if (value !== managedArgument.value) {
+        // Stream new value only if value has changed and a change is not
+        // already pending
+        if (!managedArgument.pending && value !== managedArgument.value) {
 
             var writer = new Guacamole.StringWriter(managedArgument.stream);
             writer.sendText(value);
             writer.sendEnd();
 
             // ManagedArgument instance is no longer usable
-            return true;
+            managedArgument.pending = true;
 
         }
 
-        // No parameter value change was attempted and the ManagedArgument
-        // instance may be reused
-        return false;
-
     };
 
     return ManagedArgument;
 
-}]);
\ No newline at end of file
+}]);
diff --git a/guacamole/src/main/frontend/src/app/client/types/ManagedClient.js b/guacamole/src/main/frontend/src/app/client/types/ManagedClient.js
index 5dc8bce44..01769ea94 100644
--- a/guacamole/src/main/frontend/src/app/client/types/ManagedClient.js
+++ b/guacamole/src/main/frontend/src/app/client/types/ManagedClient.js
@@ -836,8 +836,7 @@ angular.module('client').factory('ManagedClient', ['$rootScope', '$injector',
      */
     ManagedClient.setArgument = function setArgument(managedClient, name, value) {
         var managedArgument = managedClient.arguments[name];
-        if (managedArgument && ManagedArgument.setValue(managedArgument, value))
-            delete managedClient.arguments[name];
+        managedArgument && ManagedArgument.setValue(managedArgument, value);
     };
 
     /**
@@ -1007,4 +1006,4 @@ angular.module('client').factory('ManagedClient', ['$rootScope', '$injector',
 
     return ManagedClient;
 
-}]);
\ No newline at end of file
+}]);
diff --git a/guacamole/src/main/frontend/src/app/form/directives/form.js b/guacamole/src/main/frontend/src/app/form/directives/form.js
index 4aa99668a..4de051bfd 100644
--- a/guacamole/src/main/frontend/src/app/form/directives/form.js
+++ b/guacamole/src/main/frontend/src/app/form/directives/form.js
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+/* global _ */
 
 /**
  * A directive that allows editing of a collection of fields.
@@ -84,6 +85,11 @@ angular.module('form').directive('guacForm', [function form() {
             /**
              * The client associated with this form, if any.
              *
+             * NOTE: If the provided client has any managed arguments in the
+             * pending state, any fields with the same name rendered by this
+             * form will be disabled. The fields will be re-enabled when guacd
+             * sends an updated argument with a the same name.
+             *
              * @type ManagedClient
              */
             client: '='
@@ -247,6 +253,28 @@ angular.module('form').directive('guacForm', [function form() {
 
             };
 
+
+            /**
+             * Returns whether the given field should be disabled (read-only)
+             * when presented to the current user.
+             *
+             * @param {Field} field
+             *     The field to check.
+             *
+             * @returns {Boolean}
+             *     true if the given field should be disabled, false otherwise.
+             */
+            $scope.isDisabled = function isDisabled(field) {
+
+                /*
+                 * The field is disabled if either the form as a whole is disabled,
+                 * or if a client is provided to the directive, and the field is
+                 * marked as pending.
+                 */
+                return $scope.disabled ||
+                        _.get($scope.client, ['arguments', field.name, 'pending']);
+            };
+
             /**
              * Returns whether at least one of the given fields should be
              * displayed to the current user.
diff --git a/guacamole/src/main/frontend/src/app/form/templates/form.html b/guacamole/src/main/frontend/src/app/form/templates/form.html
index 084d55df9..642c57783 100644
--- a/guacamole/src/main/frontend/src/app/form/templates/form.html
+++ b/guacamole/src/main/frontend/src/app/form/templates/form.html
@@ -10,7 +10,7 @@
         <div class="fields">
             <guac-form-field ng-repeat="field in form.fields" namespace="namespace"
                              ng-if="isVisible(field)"
-                             data-disabled="disabled"
+                             data-disabled="isDisabled(field)"
                              focused="isFocused(field)"
                              field="field"
                              client="client"

From 4d85c81200fb6bb114f31731e7dcbad75a221152 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 9 Jan 2024 20:16:37 +0000
Subject: [PATCH 238/289] GUACAMOLE-1904: Always render client menu even if not
 shown.

---
 .../main/frontend/src/app/client/styles/menu.css   | 14 +++++++-------
 .../frontend/src/app/client/templates/client.html  |  2 +-
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/client/styles/menu.css b/guacamole/src/main/frontend/src/app/client/styles/menu.css
index b5742ab5d..81552b168 100644
--- a/guacamole/src/main/frontend/src/app/client/styles/menu.css
+++ b/guacamole/src/main/frontend/src/app/client/styles/menu.css
@@ -27,11 +27,11 @@
     background: #EEE;
     box-shadow: inset -1px 0 2px white, 1px 0 2px black;
     z-index: 100;
-    -webkit-transition: left 0.125s, opacity 0.125s;
-    -moz-transition: left 0.125s, opacity 0.125s;
-    -ms-transition: left 0.125s, opacity 0.125s;
-    -o-transition: left 0.125s, opacity 0.125s;
-    transition: left 0.125s, opacity 0.125s;
+    -webkit-transition: left 0.125s;
+    -moz-transition: left 0.125s;
+    -ms-transition: left 0.125s;
+    -o-transition: left 0.125s;
+    transition: left 0.125s;
 }
 
 .menu-content {
@@ -137,10 +137,10 @@
 .menu,
 .menu.closed {
     left: -480px;
-    opacity: 0;
+    visibility: hidden;
 }
 
 .menu.open {
     left: 0px;
-    opacity: 1;
+    visibility: visible;
 }
diff --git a/guacamole/src/main/frontend/src/app/client/templates/client.html b/guacamole/src/main/frontend/src/app/client/templates/client.html
index 66dca3a77..943e59953 100644
--- a/guacamole/src/main/frontend/src/app/client/templates/client.html
+++ b/guacamole/src/main/frontend/src/app/client/templates/client.html
@@ -47,7 +47,7 @@
     
     <!-- Menu -->
     <div class="menu" ng-class="{open: menu.shown}" id="guac-menu">
-        <div class="menu-content" ng-if="menu.shown" guac-touch-drag="menuDrag">
+        <div class="menu-content" guac-touch-drag="menuDrag">
 
             <!-- Stationary header -->
             <div class="header">

From 2a18c330fcdfbec8eb9e9de934ec40c27e04d755 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Wed, 10 Jan 2024 23:59:24 +0000
Subject: [PATCH 239/289] GUACAMOLE-1904: Add new events to allow children to
 open/close the client menu.

---
 .../src/app/client/controllers/clientController.js  | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/guacamole/src/main/frontend/src/app/client/controllers/clientController.js b/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
index 8cacc77de..29860f23c 100644
--- a/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
+++ b/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
@@ -468,8 +468,21 @@ angular.module('client').controller('clientController', ['$scope', '$routeParams
         else if (menuShownPreviousState)
             $scope.applyParameterChanges($scope.focusedClient);
 
+        /* Broadcast changes to the menu display state */
+        $scope.$broadcast('guacMenuShown', menuShown);
+
     });
 
+    // Toggle the menu when the guacClientToggleMenu event is received
+    $scope.$on('guacToggleMenu',
+            () => $scope.menu.shown = !$scope.menu.shown);
+
+    // Show the menu when the guacClientShowMenu event is received
+    $scope.$on('guacShowMenu', () => $scope.menu.shown = true);
+
+    // Hide the menu when the guacClientHideMenu event is received
+    $scope.$on('guacHideMenu', () => $scope.menu.shown = false);
+
     // Automatically track and cache the currently-focused client
     $scope.$on('guacClientFocused', function focusedClientChanged(event, newFocusedClient) {
 

From 99e02b4166c8798d08eda1927c20ad5bfd5e4f5a Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Mon, 15 Jan 2024 23:44:00 +0000
Subject: [PATCH 240/289] WIP: Allow the extension to do its own rendering of
 fields outside the menu if needed.

---
 .../client/controllers/clientController.js    | 25 ++++++++++++++++---
 .../app/client/directives/guacTiledClients.js |  5 ++++
 .../frontend/src/app/client/styles/menu.css   | 14 +++++------
 .../src/app/client/templates/client.html      |  2 +-
 4 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/client/controllers/clientController.js b/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
index 29860f23c..3517f2d5f 100644
--- a/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
+++ b/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
@@ -498,17 +498,34 @@ angular.module('client').controller('clientController', ['$scope', '$routeParams
         $scope.menu.connectionParameters = newFocusedClient ?
             ManagedClient.getArgumentModel(newFocusedClient) : {};
 
+        // Re-broadcast the updated client
+        $scope.$broadcast('guacClientChanged', newFocusedClient);
+
+    });
+
+    // Track when the protocol changes for the current client - generally
+    // this will be when the protocol is first set for the client
+    $scope.$on('guacClientProtocolUpdated', function protocolChanged(event, focusedClient) {
+
+        // Ignore any updated protocol not for the current focused client
+        if ($scope.focusedClient && $scope.focusedClient === focusedClient)
+
+            // Re-broadcast the updated protocol
+            $scope.$broadcast('guacClientProtocolChanged', focusedClient);
     });
 
     // Automatically update connection parameters that have been modified
     // for the current focused client
-    $scope.$on('guacClientArgumentsUpdated', function focusedClientChanged(event, focusedClient) {
+    $scope.$on('guacClientArgumentsUpdated', function argumentsChanged(event, focusedClient) {
 
-        // Update available connection parameters, if the updated arguments are
-        // for the current focused client - otherwise ignore them
-        if ($scope.focusedClient && $scope.focusedClient === focusedClient)
+        // Ignore any updated arguments not for the current focused client
+        if ($scope.focusedClient && $scope.focusedClient === focusedClient) {
             $scope.menu.connectionParameters = ManagedClient.getArgumentModel(focusedClient);
 
+            // Re-broadcast the updated arguments
+            $scope.$broadcast('guacClientArgumentsChanged', focusedClient);
+        }
+
     });
 
     // Update page icon when thumbnail changes
diff --git a/guacamole/src/main/frontend/src/app/client/directives/guacTiledClients.js b/guacamole/src/main/frontend/src/app/client/directives/guacTiledClients.js
index e43c2603f..3aa60ac74 100644
--- a/guacamole/src/main/frontend/src/app/client/directives/guacTiledClients.js
+++ b/guacamole/src/main/frontend/src/app/client/directives/guacTiledClients.js
@@ -97,6 +97,11 @@ angular.module('client').directive('guacTiledClients', [function guacTiledClient
             $scope.$emit('guacClientArgumentsUpdated', $scope.getFocusedClient());
         }, true);
 
+        // Notify whenever protocol of currently-focused client changes
+        $scope.$watch('getFocusedClient().protocol', function focusedClientParametersChanged() {
+            $scope.$emit('guacClientProtocolUpdated', $scope.getFocusedClient());
+        }, true);
+
         /**
          * Returns a callback for guacClick that assigns or updates keyboard
          * focus to the given client, allowing that client to receive and
diff --git a/guacamole/src/main/frontend/src/app/client/styles/menu.css b/guacamole/src/main/frontend/src/app/client/styles/menu.css
index 81552b168..b5742ab5d 100644
--- a/guacamole/src/main/frontend/src/app/client/styles/menu.css
+++ b/guacamole/src/main/frontend/src/app/client/styles/menu.css
@@ -27,11 +27,11 @@
     background: #EEE;
     box-shadow: inset -1px 0 2px white, 1px 0 2px black;
     z-index: 100;
-    -webkit-transition: left 0.125s;
-    -moz-transition: left 0.125s;
-    -ms-transition: left 0.125s;
-    -o-transition: left 0.125s;
-    transition: left 0.125s;
+    -webkit-transition: left 0.125s, opacity 0.125s;
+    -moz-transition: left 0.125s, opacity 0.125s;
+    -ms-transition: left 0.125s, opacity 0.125s;
+    -o-transition: left 0.125s, opacity 0.125s;
+    transition: left 0.125s, opacity 0.125s;
 }
 
 .menu-content {
@@ -137,10 +137,10 @@
 .menu,
 .menu.closed {
     left: -480px;
-    visibility: hidden;
+    opacity: 0;
 }
 
 .menu.open {
     left: 0px;
-    visibility: visible;
+    opacity: 1;
 }
diff --git a/guacamole/src/main/frontend/src/app/client/templates/client.html b/guacamole/src/main/frontend/src/app/client/templates/client.html
index 943e59953..66dca3a77 100644
--- a/guacamole/src/main/frontend/src/app/client/templates/client.html
+++ b/guacamole/src/main/frontend/src/app/client/templates/client.html
@@ -47,7 +47,7 @@
     
     <!-- Menu -->
     <div class="menu" ng-class="{open: menu.shown}" id="guac-menu">
-        <div class="menu-content" guac-touch-drag="menuDrag">
+        <div class="menu-content" ng-if="menu.shown" guac-touch-drag="menuDrag">
 
             <!-- Stationary header -->
             <div class="header">

From 70a7696f7451483fc54cd4b73591df95a7bc634c Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 18 Jan 2024 19:37:38 +0000
Subject: [PATCH 241/289] GUACAMOLE-1904: Deduplicate events by broadcasting
 all directly from the root scope.

---
 .../client/controllers/clientController.js    | 20 +------------------
 .../app/client/directives/guacTiledClients.js |  9 ++++++---
 2 files changed, 7 insertions(+), 22 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/client/controllers/clientController.js b/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
index 3517f2d5f..6a486fe9a 100644
--- a/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
+++ b/guacamole/src/main/frontend/src/app/client/controllers/clientController.js
@@ -498,20 +498,6 @@ angular.module('client').controller('clientController', ['$scope', '$routeParams
         $scope.menu.connectionParameters = newFocusedClient ?
             ManagedClient.getArgumentModel(newFocusedClient) : {};
 
-        // Re-broadcast the updated client
-        $scope.$broadcast('guacClientChanged', newFocusedClient);
-
-    });
-
-    // Track when the protocol changes for the current client - generally
-    // this will be when the protocol is first set for the client
-    $scope.$on('guacClientProtocolUpdated', function protocolChanged(event, focusedClient) {
-
-        // Ignore any updated protocol not for the current focused client
-        if ($scope.focusedClient && $scope.focusedClient === focusedClient)
-
-            // Re-broadcast the updated protocol
-            $scope.$broadcast('guacClientProtocolChanged', focusedClient);
     });
 
     // Automatically update connection parameters that have been modified
@@ -519,13 +505,9 @@ angular.module('client').controller('clientController', ['$scope', '$routeParams
     $scope.$on('guacClientArgumentsUpdated', function argumentsChanged(event, focusedClient) {
 
         // Ignore any updated arguments not for the current focused client
-        if ($scope.focusedClient && $scope.focusedClient === focusedClient) {
+        if ($scope.focusedClient && $scope.focusedClient === focusedClient)
             $scope.menu.connectionParameters = ManagedClient.getArgumentModel(focusedClient);
 
-            // Re-broadcast the updated arguments
-            $scope.$broadcast('guacClientArgumentsChanged', focusedClient);
-        }
-
     });
 
     // Update page icon when thumbnail changes
diff --git a/guacamole/src/main/frontend/src/app/client/directives/guacTiledClients.js b/guacamole/src/main/frontend/src/app/client/directives/guacTiledClients.js
index 3aa60ac74..52289bcd0 100644
--- a/guacamole/src/main/frontend/src/app/client/directives/guacTiledClients.js
+++ b/guacamole/src/main/frontend/src/app/client/directives/guacTiledClients.js
@@ -62,6 +62,9 @@ angular.module('client').directive('guacTiledClients', [function guacTiledClient
     directive.controller = ['$scope', '$injector', '$element',
             function guacTiledClientsController($scope, $injector, $element) {
 
+        // Required services
+        const $rootScope = $injector.get('$rootScope');
+
         // Required types
         const ManagedClient      = $injector.get('ManagedClient');
         const ManagedClientGroup = $injector.get('ManagedClientGroup');
@@ -89,17 +92,17 @@ angular.module('client').directive('guacTiledClients', [function guacTiledClient
 
         // Notify whenever identify of currently-focused client changes
         $scope.$watch('getFocusedClient()', function focusedClientChanged(focusedClient) {
-            $scope.$emit('guacClientFocused', focusedClient);
+            $rootScope.$broadcast('guacClientFocused', focusedClient);
         });
 
         // Notify whenever arguments of currently-focused client changes
         $scope.$watch('getFocusedClient().arguments', function focusedClientParametersChanged() {
-            $scope.$emit('guacClientArgumentsUpdated', $scope.getFocusedClient());
+            $rootScope.$broadcast('guacClientArgumentsUpdated', $scope.getFocusedClient());
         }, true);
 
         // Notify whenever protocol of currently-focused client changes
         $scope.$watch('getFocusedClient().protocol', function focusedClientParametersChanged() {
-            $scope.$emit('guacClientProtocolUpdated', $scope.getFocusedClient());
+            $rootScope.$broadcast('guacClientProtocolUpdated', $scope.getFocusedClient());
         }, true);
 
         /**

From 46db5f249dc43e4ddcafd5e0cb9cfe2f194eb98d Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Mon, 29 Jan 2024 21:49:12 -0500
Subject: [PATCH 242/289] GUACAMOLE-1915: Bump versions for projects outside
 the 1.5.5 scope.

---
 extensions/guacamole-auth-ban/pom.xml                       | 6 +++---
 .../src/main/resources/guac-manifest.json                   | 2 +-
 .../modules/guacamole-auth-sso-dist/pom.xml                 | 2 +-
 .../modules/guacamole-auth-sso-ssl/pom.xml                  | 4 ++--
 .../src/main/resources/guac-manifest.json                   | 2 +-
 extensions/guacamole-display-statistics/pom.xml             | 4 ++--
 .../src/main/resources/guac-manifest.json                   | 2 +-
 7 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/extensions/guacamole-auth-ban/pom.xml b/extensions/guacamole-auth-ban/pom.xml
index 5d0643682..8b7e90f4e 100644
--- a/extensions/guacamole-auth-ban/pom.xml
+++ b/extensions/guacamole-auth-ban/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-auth-ban</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.4</version>
+    <version>1.5.5</version>
     <name>guacamole-auth-ban</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.5.4</version>
+        <version>1.5.5</version>
         <relativePath>../</relativePath>
     </parent>
 
@@ -51,7 +51,7 @@
         <dependency>
             <groupId>org.apache.guacamole</groupId>
             <artifactId>guacamole-ext</artifactId>
-            <version>1.5.4</version>
+            <version>1.5.5</version>
             <scope>provided</scope>
 
             <!-- Exclude transitive dependencies that will be overridden by
diff --git a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
index 7000befdf..2ec3fddc6 100644
--- a/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-ban/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.4",
+    "guacamoleVersion" : "1.5.5",
 
     "name"      : "Brute-force Authentication Detection/Prevention",
     "namespace" : "ban",
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
index 7bc0c2bdf..4ceb3810d 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/pom.xml
@@ -63,7 +63,7 @@
         <dependency>
             <groupId>org.apache.guacamole</groupId>
             <artifactId>guacamole-auth-sso-ssl</artifactId>
-            <version>1.5.4</version>
+            <version>1.5.5</version>
         </dependency>
 
     </dependencies>
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
index 5ed65255e..8926517df 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-auth-sso-ssl</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.4</version>
+    <version>1.5.5</version>
     <name>guacamole-auth-sso-ssl</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>guacamole-auth-sso</artifactId>
-        <version>1.5.4</version>
+        <version>1.5.5</version>
         <relativePath>../../</relativePath>
     </parent>
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
index 8758ec520..7f67fc5ba 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.4",
+    "guacamoleVersion" : "1.5.5",
 
     "name"      : "SSL Authentication Extension",
     "namespace" : "ssl",
diff --git a/extensions/guacamole-display-statistics/pom.xml b/extensions/guacamole-display-statistics/pom.xml
index 428061b56..5c250f69c 100644
--- a/extensions/guacamole-display-statistics/pom.xml
+++ b/extensions/guacamole-display-statistics/pom.xml
@@ -26,14 +26,14 @@
     <groupId>org.apache.guacamole</groupId>
     <artifactId>guacamole-display-statistics</artifactId>
     <packaging>jar</packaging>
-    <version>1.5.4</version>
+    <version>1.5.5</version>
     <name>guacamole-display-statistics</name>
     <url>http://guacamole.apache.org/</url>
 
     <parent>
         <groupId>org.apache.guacamole</groupId>
         <artifactId>extensions</artifactId>
-        <version>1.5.4</version>
+        <version>1.5.5</version>
         <relativePath>../</relativePath>
     </parent>
 
diff --git a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
index 54c32adcf..4823dbf77 100644
--- a/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-display-statistics/src/main/resources/guac-manifest.json
@@ -1,6 +1,6 @@
 {
 
-    "guacamoleVersion" : "1.5.4",
+    "guacamoleVersion" : "1.5.5",
 
     "name"      : "Display Statistic Toolbar",
     "namespace" : "display-stats",

From 56ca4e9aa53ca43d9a130274e998025447f6088c Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 30 Jan 2024 20:19:00 +0000
Subject: [PATCH 243/289] GUACAMOLE-1904: Broadcast events for mouse/touch
 events in client.

---
 .../src/app/client/directives/guacClient.js   | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/guacamole/src/main/frontend/src/app/client/directives/guacClient.js b/guacamole/src/main/frontend/src/app/client/directives/guacClient.js
index fb88f99f5..18a1b080c 100644
--- a/guacamole/src/main/frontend/src/app/client/directives/guacClient.js
+++ b/guacamole/src/main/frontend/src/app/client/directives/guacClient.js
@@ -54,6 +54,7 @@ angular.module('client').directive('guacClient', [function guacClient() {
         const ManagedClient = $injector.get('ManagedClient');
             
         // Required services
+        const $rootScope = $injector.get('$rootScope');
         const $window = $injector.get('$window');
             
         /**
@@ -197,6 +198,28 @@ angular.module('client').directive('guacClient', [function guacClient() {
 
         };
 
+        /**
+         * Return the name of the angular event associated with the provided
+         * mouse event.
+         *
+         * @param {Guacamole.Mouse.MouseEvent} event
+         *     The mouse event to determine an angular event name for.
+         *
+         * @returns
+         *     The name of the angular event associated with the provided
+         *     mouse event.
+         */
+        const getMouseEventName = event => {
+            switch (event.type) {
+                case 'mousedown':
+                    return 'guacClientMouseDown';
+                case 'mouseup':
+                    return 'guacClientMouseUp';
+                default:
+                    return 'guacClientMouseMove';
+            }
+        };
+
         /**
          * Handles a mouse event originating from the user's actual mouse.
          * This differs from handleEmulatedMouseEvent() in that the
@@ -220,6 +243,9 @@ angular.module('client').directive('guacClient', [function guacClient() {
             display.showCursor(!localCursor);
             client.sendMouseState(event.state, true);
 
+            // Broadcast the mouse event
+            $rootScope.$broadcast(getMouseEventName(event), event, client);
+
         };
 
         /**
@@ -248,6 +274,31 @@ angular.module('client').directive('guacClient', [function guacClient() {
             scrollToMouse(event.state);
             client.sendMouseState(event.state, true);
 
+            // Broadcast the mouse event
+            $rootScope.$broadcast(getMouseEventName(event), event, client);
+
+        };
+
+        /**
+         * Return the name of the angular event associated with the provided
+         * touch event.
+         *
+         * @param {Guacamole.Touch.TouchEvent} event
+         *     The touch event to determine an angular event name for.
+         *
+         * @returns
+         *     The name of the angular event associated with the provided
+         *     touch event.
+         */
+        const getTouchEventName = event => {
+            switch (event.type) {
+                case 'touchstart':
+                    return 'guacClientTouchStart';
+                case 'touchend':
+                    return 'guacClientTouchEnd';
+                default:
+                    return 'guacClientTouchMove';
+            }
         };
 
         /**
@@ -269,6 +320,9 @@ angular.module('client').directive('guacClient', [function guacClient() {
             display.showCursor(false);
             client.sendTouchState(event.state, true);
 
+            // Broadcast the touch event
+            $rootScope.$broadcast(getTouchEventName(event), event, client);
+
         };
 
         // Attach any given managed client

From 8c425535643a0dae5741018a9968b2bceddfcb4a Mon Sep 17 00:00:00 2001
From: mildis <me@mildis.org>
Date: Mon, 15 Jan 2024 18:47:52 +0100
Subject: [PATCH 244/289] GUACAMOLE-1844 : OIDC JWT claims as user token

GUACAMOLE-1844 : OIDC JWT claims as user token

This patch allows IDP to send JWT claims that can be mapped to user tokens, prefixed with OIDC_.
Same case transormation apply than LDAP_ and CAS_.

Define openid-attributes-claim-type with a comma-separated list of claims that should be mapped.

Multivalued JWT claims are not unrolled.
---
 .../openid/AuthenticationProviderService.java |  5 +-
 .../openid/conf/ConfigurationService.java     | 34 +++++++++
 .../openid/token/TokenValidationService.java  | 70 ++++++++++++++++++-
 3 files changed, 107 insertions(+), 2 deletions(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java
index e83ca092e..17301f5b6 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/AuthenticationProviderService.java
@@ -25,6 +25,7 @@ import com.google.inject.Singleton;
 import java.net.URI;
 import java.util.Arrays;
 import java.util.Collections;
+import java.util.Map;
 import java.util.Set;
 import javax.servlet.http.HttpServletRequest;
 import javax.ws.rs.core.UriBuilder;
@@ -84,6 +85,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
 
         String username = null;
         Set<String> groups = null;
+        Map<String,String> tokens = Collections.emptyMap();
 
         // Validate OpenID token in request, if present, and derive username
         HttpServletRequest request = credentials.getRequest();
@@ -94,6 +96,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
                 if (claims != null) {
                     username = tokenService.processUsername(claims);
                     groups = tokenService.processGroups(claims);
+                    tokens = tokenService.processAttributes(claims);
                 }
             }
         }
@@ -104,7 +107,7 @@ public class AuthenticationProviderService implements SSOAuthenticationProviderS
 
             // Create corresponding authenticated user
             SSOAuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
-            authenticatedUser.init(username, credentials, groups, Collections.emptyMap());
+            authenticatedUser.init(username, credentials, groups, tokens);
             return authenticatedUser;
 
         }
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java
index 68c22ef99..bbfdea17e 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/conf/ConfigurationService.java
@@ -21,10 +21,13 @@ package org.apache.guacamole.auth.openid.conf;
 
 import com.google.inject.Inject;
 import java.net.URI;
+import java.util.Collections;
+import java.util.List;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.properties.IntegerGuacamoleProperty;
 import org.apache.guacamole.properties.StringGuacamoleProperty;
+import org.apache.guacamole.properties.StringListProperty;
 import org.apache.guacamole.properties.URIGuacamoleProperty;
 
 /**
@@ -45,6 +48,11 @@ public class ConfigurationService {
      */
     private static final String DEFAULT_GROUPS_CLAIM_TYPE = "groups";
 
+    /**
+     * The default JWT claims list to map to tokens.
+     */
+    private static final List<String> DEFAULT_ATTRIBUTES_CLAIM_TYPE = Collections.emptyList();
+
     /**
      * The default space-separated list of OpenID scopes to request.
      */
@@ -126,6 +134,16 @@ public class ConfigurationService {
 
     };
 
+    /**
+     * The claims within any valid JWT that should be mapped to
+     * the authenticated user's tokens, as configured with guacamole.properties.
+     */
+    private static final StringListProperty OPENID_ATTRIBUTES_CLAIM_TYPE =
+            new StringListProperty() {
+                @Override
+                public String getName() { return "openid-attributes-claim-type"; }
+            };
+
     /**
      * The space-separated list of OpenID scopes to request.
      */
@@ -326,6 +344,22 @@ public class ConfigurationService {
         return environment.getProperty(OPENID_GROUPS_CLAIM_TYPE, DEFAULT_GROUPS_CLAIM_TYPE);
     }
 
+    /**
+     * Returns the claims list within any valid JWT that should be mapped to
+     * the authenticated user's tokens, as configured with guacamole.properties.
+     * Empty by default.
+     *
+     * @return
+     *     The claims list within any valid JWT that should be mapped to
+     *     the authenticated user's tokens, as configured with guacamole.properties.
+     *
+     * @throws GuacamoleException
+     *     If guacamole.properties cannot be parsed.
+     */
+    public List<String> getAttributesClaimType() throws GuacamoleException {
+        return environment.getProperty(OPENID_ATTRIBUTES_CLAIM_TYPE, DEFAULT_ATTRIBUTES_CLAIM_TYPE);
+    }
+
     /**
      * Returns the space-separated list of OpenID scopes to request. By default,
      * this will be "openid email profile". The OpenID scopes determine the
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
index b9c2add2a..2fad48ce4 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java
@@ -21,12 +21,15 @@ package org.apache.guacamole.auth.openid.token;
 
 import com.google.inject.Inject;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
-import org.apache.guacamole.auth.openid.conf.ConfigurationService;
 import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.auth.openid.conf.ConfigurationService;
 import org.apache.guacamole.auth.sso.NonceService;
+import org.apache.guacamole.token.TokenName;
 import org.jose4j.jwk.HttpsJwks;
 import org.jose4j.jwt.JwtClaims;
 import org.jose4j.jwt.MalformedClaimException;
@@ -48,6 +51,11 @@ public class TokenValidationService {
      */
     private final Logger logger = LoggerFactory.getLogger(TokenValidationService.class);
 
+    /**
+     * The prefix to use when generating token names.
+     */
+    public static final String OIDC_ATTRIBUTE_TOKEN_PREFIX = "OIDC_";
+
     /**
      * Service for retrieving OpenID configuration information.
      */
@@ -202,4 +210,64 @@ public class TokenValidationService {
         // Could not retrieve groups from JWT
         return Collections.emptySet();
     }
+
+    /**
+     * Parses the given JwtClaims, returning the attributes contained
+     * therein, as defined by the attributes claim type given in
+     * guacamole.properties. If the attributes claim type is missing or
+     * is invalid, an empty set is returned.
+     *
+     * @param claims
+     *     A valid JwtClaims to extract attributes from.
+     *
+     * @return
+     *     A Map of String,String representing the attributes and values
+     *     from the OpenID provider point of view, or an empty Map if
+     *     claim is not valid or the attributes claim type is missing.
+     *
+     * @throws GuacamoleException
+     *     If guacamole.properties could not be parsed.
+     */
+    public Map<String, String> processAttributes(JwtClaims claims) throws GuacamoleException {
+        List<String> attributesClaim = confService.getAttributesClaimType();
+
+        if (claims != null && !attributesClaim.isEmpty()) {
+            try {
+                logger.debug("Iterating over attributes claim list : {}", attributesClaim);
+
+                // We suppose all claims are resolved, so the hashmap is initialised to
+                // the size of the configuration list
+                Map<String, String> tokens = new HashMap<String, String>(attributesClaim.size());
+
+                // We iterate over the configured attributes
+                for (String key: attributesClaim) {
+                    // Retrieve the corresponding claim
+                    String oidcAttr = claims.getStringClaimValue(key);
+
+                    // We do have a matching claim and it is not empty
+                    if (oidcAttr != null && !oidcAttr.isEmpty()) {
+                        // append the prefixed claim value to the token map with its value
+                        String tokenName = TokenName.canonicalize(key, OIDC_ATTRIBUTE_TOKEN_PREFIX);
+                        tokens.put(tokenName, oidcAttr);
+                        logger.debug("Claim {} found and set to {}", key, tokenName);
+                    }
+                    else {
+                        // wanted attribute is not found in the claim
+                        logger.debug("Claim {} not found in JWT.", key);
+                    }
+                }
+
+                // We did process all the expected claims
+                return Collections.unmodifiableMap(tokens);
+            }
+            catch (MalformedClaimException e) {
+                logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage());
+                logger.debug("Malformed claim within received JWT.", e);
+            }
+        }
+
+        // Could not retrieve attributes from JWT
+        logger.debug("Attributes claim not defined. Returning empty map.");
+        return Collections.emptyMap();
+    }
 }

From 3d7d37c938d7a97f30a5899c9d988661196dfab4 Mon Sep 17 00:00:00 2001
From: Leonard Wagner <25386154+leonard2901@users.noreply.github.com>
Date: Thu, 22 Feb 2024 13:16:34 +0100
Subject: [PATCH 245/289] GUACAMOLE-926: Fix connection CSV imports for fields
 with "(attribute)" and "(parameter)" suffixes

---
 .../frontend/src/app/import/services/connectionCSVService.js  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
index 641318b5b..375ce0a2a 100644
--- a/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
+++ b/guacamole/src/main/frontend/src/app/import/services/connectionCSVService.js
@@ -286,7 +286,7 @@ angular.module('import').factory('connectionCSVService',
                 else if (header.endsWith(PARAMETER_SUFFIX)) {
 
                     // Push as an explicit parameter getter
-                    const parameterName = header.replace(PARAMETER_SUFFIX);
+                    const parameterName = header.replace(PARAMETER_SUFFIX, '');
                     transformConfig.parameterOrAttributeGetters.push(
                         row => ({
                             type: 'parameters',
@@ -300,7 +300,7 @@ angular.module('import').factory('connectionCSVService',
                 else if (header.endsWith(ATTRIBUTE_SUFFIX)) {
 
                     // Push as an explicit attribute getter
-                    const attributeName = header.replace(ATTRIBUTE_SUFFIX);
+                    const attributeName = header.replace(ATTRIBUTE_SUFFIX, '');
                     transformConfig.parameterOrAttributeGetters.push(
                         row => ({
                             type: 'attributes',

From 455c05aa37b106e0b82f8d2359d8487276822d3e Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 15 Mar 2024 23:46:15 +0000
Subject: [PATCH 246/289] GUACAMOLE-1931: Add configuration option to allow
 overwriting recording files.

---
 .../org/apache/guacamole/protocols/kubernetes.json          | 5 +++++
 .../main/resources/org/apache/guacamole/protocols/rdp.json  | 5 +++++
 .../main/resources/org/apache/guacamole/protocols/ssh.json  | 5 +++++
 .../resources/org/apache/guacamole/protocols/telnet.json    | 5 +++++
 .../main/resources/org/apache/guacamole/protocols/vnc.json  | 5 +++++
 guacamole/src/main/frontend/src/translations/en.json        | 6 ++++++
 6 files changed, 31 insertions(+)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/kubernetes.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/kubernetes.json
index f3e52608a..266d9f271 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/kubernetes.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/kubernetes.json
@@ -156,6 +156,11 @@
                     "name"  : "create-recording-path",
                     "type"  : "BOOLEAN",
                     "options" : [ "true" ]
+                },
+                {
+                    "name"  : "recording-write-existing",
+                    "type"  : "BOOLEAN",
+                    "options" : [ "true" ]
                 }
             ]
         }
diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
index f1c6c35a4..e26bbb42e 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/rdp.json
@@ -395,6 +395,11 @@
                     "name"  : "create-recording-path",
                     "type"  : "BOOLEAN",
                     "options" : [ "true" ]
+                },
+                {
+                    "name"  : "recording-write-existing",
+                    "type"  : "BOOLEAN",
+                    "options" : [ "true" ]
                 }
             ]
         },
diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/ssh.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/ssh.json
index 54727581d..34b1ed5b7 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/ssh.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/ssh.json
@@ -174,6 +174,11 @@
                     "name"  : "create-recording-path",
                     "type"  : "BOOLEAN",
                     "options" : [ "true" ]
+                },
+                {
+                    "name"  : "recording-write-existing",
+                    "type"  : "BOOLEAN",
+                    "options" : [ "true" ]
                 }
             ]
         },
diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/telnet.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/telnet.json
index 5a9746e85..679d120fb 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/telnet.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/telnet.json
@@ -156,6 +156,11 @@
                     "name"  : "create-recording-path",
                     "type"  : "BOOLEAN",
                     "options" : [ "true" ]
+                },
+                {
+                    "name"  : "recording-write-existing",
+                    "type"  : "BOOLEAN",
+                    "options" : [ "true" ]
                 }
             ]
         },
diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
index 525e1958e..c80dcdf27 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
@@ -130,6 +130,11 @@
                     "name"  : "create-recording-path",
                     "type"  : "BOOLEAN",
                     "options" : [ "true" ]
+                },
+                {
+                    "name"  : "recording-write-existing",
+                    "type"  : "BOOLEAN",
+                    "options" : [ "true" ]
                 }
             ]
         },
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index a9d720940..5a2ecfdf4 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -45,6 +45,7 @@
         
         "FIELD_HEADER_PASSWORD"       : "Password:",
         "FIELD_HEADER_PASSWORD_AGAIN" : "Re-enter Password:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "Allow writing to existing recording file:",
 
         "FIELD_PLACEHOLDER_FILTER" : "Filter",
 
@@ -514,6 +515,7 @@
         "FIELD_HEADER_POD"             : "Pod name:",
         "FIELD_HEADER_PORT"            : "Port:",
         "FIELD_HEADER_READ_ONLY"       : "Read-only:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "@:APP.FIELD_HEADER_RECORDING_WRITE_EXISTING",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Exclude mouse:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Exclude graphics/streams:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Include key events:",
@@ -615,6 +617,7 @@
         "FIELD_HEADER_PRECONNECTION_BLOB" : "Preconnection BLOB (VM ID):",
         "FIELD_HEADER_PRECONNECTION_ID"   : "RDP source ID:",
         "FIELD_HEADER_READ_ONLY"      : "Read-only:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "@:APP.FIELD_HEADER_RECORDING_WRITE_EXISTING",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Exclude mouse:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Exclude graphics/streams:",
         "FIELD_HEADER_RECORDING_EXCLUDE_TOUCH"  : "Exclude touch events:",
@@ -736,6 +739,7 @@
         "FIELD_HEADER_PRIVATE_KEY"   : "Private key:",
         "FIELD_HEADER_SCROLLBACK"    : "Maximum scrollback size:",
         "FIELD_HEADER_READ_ONLY"     : "Read-only:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "@:APP.FIELD_HEADER_RECORDING_WRITE_EXISTING",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Exclude mouse:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Exclude graphics/streams:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Include key events:",
@@ -823,6 +827,7 @@
         "FIELD_HEADER_PASSWORD_REGEX" : "Password regular expression:",
         "FIELD_HEADER_PORT"           : "Port:",
         "FIELD_HEADER_READ_ONLY"      : "Read-only:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "@:APP.FIELD_HEADER_RECORDING_WRITE_EXISTING",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Exclude mouse:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Exclude graphics/streams:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Include key events:",
@@ -904,6 +909,7 @@
         "FIELD_HEADER_PASSWORD"         : "Password:",
         "FIELD_HEADER_PORT"             : "Port:",
         "FIELD_HEADER_READ_ONLY"        : "Read-only:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "@:APP.FIELD_HEADER_RECORDING_WRITE_EXISTING",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Exclude mouse:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Exclude graphics/streams:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Include key events:",

From 0ee8fb52d1b6f92930bc30b84735c7b57f909327 Mon Sep 17 00:00:00 2001
From: "Nathaniel.Belles" <Nathaniel.Belles@me.com>
Date: Sat, 23 Mar 2024 22:45:21 -0400
Subject: [PATCH 247/289] GUACAMOLE-1374: Updating base Docker image for
 building on ARM

---
 Dockerfile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 29231f363..f56d73d01 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,11 +24,11 @@
 # Use args for Tomcat image label to allow image builder to choose alternatives
 # such as `--build-arg TOMCAT_JRE=jre8-alpine`
 #
-ARG TOMCAT_VERSION=8.5
-ARG TOMCAT_JRE=jdk8
+ARG TOMCAT_VERSION=9
+ARG TOMCAT_JRE=jdk21
 
 # Use official maven image for the build
-FROM maven:3-eclipse-temurin-8-focal AS builder
+FROM maven:3-eclipse-temurin-21 AS builder
 
 # Use Mozilla's Firefox PPA (newer Ubuntu lacks a "firefox-esr" package and
 # provides only a transitional "firefox" package that actually requires Snap

From 13494baa4a298ef287d533ffdac24ecce9b86bb3 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Thu, 5 Oct 2023 17:08:11 -0400
Subject: [PATCH 248/289] GUACAMOLE-1289: Move AuthenticationSession components
 to guacamole-exit.

---
 .../guacamole/auth/sso/NonceService.java       | 10 ++--------
 .../saml/acs/SAMLAuthenticationSession.java    |  2 +-
 .../acs/SAMLAuthenticationSessionManager.java  |  2 +-
 .../guacamole/auth/saml/acs/SAMLService.java   | 10 ++--------
 .../auth/saml/conf/ConfigurationService.java   |  1 -
 .../ssl/SSLAuthenticationEventListener.java    |  6 ------
 .../auth/ssl/SSLAuthenticationSession.java     |  2 +-
 .../ssl/SSLAuthenticationSessionManager.java   |  2 +-
 .../net/auth}/AuthenticationSession.java       |  2 +-
 .../auth}/AuthenticationSessionManager.java    | 18 ++++--------------
 .../net/auth}/IdentifierGenerator.java         | 12 +++++-------
 11 files changed, 18 insertions(+), 49 deletions(-)
 rename {extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso => guacamole-ext/src/main/java/org/apache/guacamole/net/auth}/AuthenticationSession.java (97%)
 rename {extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso => guacamole-ext/src/main/java/org/apache/guacamole/net/auth}/AuthenticationSessionManager.java (94%)
 rename {extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso => guacamole-ext/src/main/java/org/apache/guacamole/net/auth}/IdentifierGenerator.java (92%)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
index 5717794fd..d43a0047b 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/NonceService.java
@@ -19,11 +19,11 @@
 
 package org.apache.guacamole.auth.sso;
 
-import com.google.inject.Inject;
 import java.util.Iterator;
 import java.util.Locale;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
+import org.apache.guacamole.net.auth.IdentifierGenerator;
 
 /**
  * Service for generating and validating single-use random tokens (nonces).
@@ -31,12 +31,6 @@ import java.util.concurrent.ConcurrentHashMap;
  */
 public class NonceService {
 
-    /**
-     * Generator of arbitrary, unique, unpredictable identifiers.
-     */
-    @Inject
-    private IdentifierGenerator idGenerator;
-
     /**
      * Map of all generated nonces to their corresponding expiration timestamps.
      * This Map must be periodically swept of expired nonces to avoid growing
@@ -107,7 +101,7 @@ public class NonceService {
         sweepExpiredNonces();
 
         // Generate and store nonce, along with expiration timestamp
-        String nonce = idGenerator.generateIdentifier(NONCE_BITS, false);
+        String nonce = IdentifierGenerator.generateIdentifier(NONCE_BITS, false);
         nonces.put(nonce, System.currentTimeMillis() + maxAge);
         return nonce;
 
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSession.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSession.java
index bbd74e2a9..f89502de4 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSession.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSession.java
@@ -19,7 +19,7 @@
 
 package org.apache.guacamole.auth.saml.acs;
 
-import org.apache.guacamole.auth.sso.AuthenticationSession;
+import org.apache.guacamole.net.auth.AuthenticationSession;
 
 /**
  * Representation of an in-progress SAML authentication attempt.
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSessionManager.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSessionManager.java
index 4adf82f2c..2371bb54d 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSessionManager.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLAuthenticationSessionManager.java
@@ -20,7 +20,7 @@
 package org.apache.guacamole.auth.saml.acs;
 
 import com.google.inject.Singleton;
-import org.apache.guacamole.auth.sso.AuthenticationSessionManager;
+import org.apache.guacamole.net.auth.AuthenticationSessionManager;
 
 /**
  * Manager service that temporarily stores SAML authentication attempts while
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java
index 2fe6da4c8..37d7fa920 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/acs/SAMLService.java
@@ -36,7 +36,7 @@ import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleSecurityException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.auth.saml.conf.ConfigurationService;
-import org.apache.guacamole.auth.sso.IdentifierGenerator;
+import org.apache.guacamole.net.auth.IdentifierGenerator;
 import org.xml.sax.SAXException;
 
 /**
@@ -58,12 +58,6 @@ public class SAMLService {
     @Inject
     private SAMLAuthenticationSessionManager sessionManager;
 
-    /**
-     * Generator of arbitrary, unique, unpredictable identifiers.
-     */
-    @Inject
-    private IdentifierGenerator idGenerator;
-
     /**
      * Creates a new SAML request, beginning the overall authentication flow
      * that will ultimately result in an asserted user identity if the user is
@@ -89,7 +83,7 @@ public class SAMLService {
             Auth auth = new Auth(samlSettings, null, null);
 
             // Generate a unique ID to use for the relay state
-            String identifier = idGenerator.generateIdentifier();
+            String identifier = IdentifierGenerator.generateIdentifier();
 
             // Create the request URL for the SAML IdP
             String requestUrl = auth.login(
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
index d2a73c46a..47ead8820 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/conf/ConfigurationService.java
@@ -24,7 +24,6 @@ import com.onelogin.saml2.settings.IdPMetadataParser;
 import com.onelogin.saml2.settings.Saml2Settings;
 import com.onelogin.saml2.settings.SettingsBuilder;
 import com.onelogin.saml2.util.Constants;
-
 import java.io.File;
 import java.io.IOException;
 import java.net.URI;
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationEventListener.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationEventListener.java
index 26769ced9..2d353b58e 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationEventListener.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationEventListener.java
@@ -20,14 +20,8 @@
 package org.apache.guacamole.auth.ssl;
 
 import com.google.inject.Inject;
-import com.google.inject.Singleton;
-import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.ssl.SSLAuthenticationSessionManager;
 import org.apache.guacamole.auth.sso.SSOAuthenticationEventListener;
 import org.apache.guacamole.net.auth.Credentials;
-import org.apache.guacamole.net.event.AuthenticationFailureEvent;
-import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
-import org.apache.guacamole.net.event.listener.Listener;
 
 /**
  * A Listener that will reactivate or invalidate SSL auth sessions depending on
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java
index 4a4c9ce8f..41813a462 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSession.java
@@ -19,7 +19,7 @@
 
 package org.apache.guacamole.auth.ssl;
 
-import org.apache.guacamole.auth.sso.AuthenticationSession;
+import org.apache.guacamole.net.auth.AuthenticationSession;
 
 /**
  * Representation of an in-progress SSL/TLS authentication attempt.
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java
index fc1b0842f..252a2c94e 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLAuthenticationSessionManager.java
@@ -20,7 +20,7 @@
 package org.apache.guacamole.auth.ssl;
 
 import com.google.inject.Singleton;
-import org.apache.guacamole.auth.sso.AuthenticationSessionManager;
+import org.apache.guacamole.net.auth.AuthenticationSessionManager;
 
 /**
  * Manager service that temporarily stores SSL/TLS authentication attempts
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSession.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AuthenticationSession.java
similarity index 97%
rename from extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSession.java
rename to guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AuthenticationSession.java
index 89d75df70..8d13e6111 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSession.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AuthenticationSession.java
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-package org.apache.guacamole.auth.sso;
+package org.apache.guacamole.net.auth;
 
 /**
  * Representation of an in-progress authentication attempt.
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AuthenticationSessionManager.java
similarity index 94%
rename from extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
rename to guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AuthenticationSessionManager.java
index 11ef307e2..d8a47f4ef 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/AuthenticationSessionManager.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AuthenticationSessionManager.java
@@ -17,10 +17,7 @@
  * under the License.
  */
 
-package org.apache.guacamole.auth.sso;
-
-import com.google.inject.Inject;
-import com.google.inject.Singleton;
+package org.apache.guacamole.net.auth;
 
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
@@ -39,14 +36,7 @@ import java.util.concurrent.TimeUnit;
  * @param <T>
  *     The type of sessions managed by this session manager.
  */
-@Singleton
-public class AuthenticationSessionManager<T extends AuthenticationSession> {
-
-    /**
-     * Generator of arbitrary, unique, unpredictable identifiers.
-     */
-    @Inject
-    private IdentifierGenerator idGenerator;
+public abstract class AuthenticationSessionManager<T extends AuthenticationSession> {
 
     /**
      * Map of authentication session identifiers to their associated
@@ -98,7 +88,7 @@ public class AuthenticationSessionManager<T extends AuthenticationSession> {
      *     token.
      */
     public String generateInvalid() {
-        return idGenerator.generateIdentifier();
+        return IdentifierGenerator.generateIdentifier();
     }
 
     /**
@@ -193,7 +183,7 @@ public class AuthenticationSessionManager<T extends AuthenticationSession> {
      *     given session when calling resume().
      */
     public String defer(T session) {
-        String identifier = idGenerator.generateIdentifier();
+        String identifier = IdentifierGenerator.generateIdentifier();
         sessions.put(identifier, session);
         return identifier;
     }
diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/IdentifierGenerator.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/IdentifierGenerator.java
similarity index 92%
rename from extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/IdentifierGenerator.java
rename to guacamole-ext/src/main/java/org/apache/guacamole/net/auth/IdentifierGenerator.java
index 82538c6a9..fcc365a9b 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/IdentifierGenerator.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/IdentifierGenerator.java
@@ -17,10 +17,9 @@
  * under the License.
  */
 
-package org.apache.guacamole.auth.sso;
+package org.apache.guacamole.net.auth;
 
 import com.google.common.io.BaseEncoding;
-import com.google.inject.Singleton;
 import java.math.BigInteger;
 import java.security.SecureRandom;
 
@@ -29,14 +28,13 @@ import java.security.SecureRandom;
  * is an arbitrary, random string produced using a cryptographically-secure
  * random number generator.
  */
-@Singleton
 public class IdentifierGenerator {
 
     /**
      * Cryptographically-secure random number generator for generating unique
      * identifiers.
      */
-    private final SecureRandom secureRandom = new SecureRandom();
+    private static final SecureRandom secureRandom = new SecureRandom();
 
     /**
      * Generates a unique and unpredictable identifier. Each identifier is at
@@ -48,7 +46,7 @@ public class IdentifierGenerator {
      *     A unique and unpredictable identifier with at least 256 bits of
      *     entropy.
      */
-    public String generateIdentifier() {
+    public static String generateIdentifier() {
         return generateIdentifier(256);
     }
 
@@ -65,7 +63,7 @@ public class IdentifierGenerator {
      *     A unique and unpredictable identifier with at least the given number
      *     of bits of entropy.
      */
-    public String generateIdentifier(int minBits) {
+    public static String generateIdentifier(int minBits) {
         return generateIdentifier(minBits, true);
     }
 
@@ -87,7 +85,7 @@ public class IdentifierGenerator {
      *     A unique and unpredictable identifier with at least the given number
      *     of bits of entropy.
      */
-    public String generateIdentifier(int minBits, boolean caseSensitive) {
+    public static String generateIdentifier(int minBits, boolean caseSensitive) {
 
         // Generate a base64 identifier if we're allowed to vary by case
         if (caseSensitive) {

From e8860e4dd8f8d769b9877c3570a0407633f9bf74 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Thu, 5 Oct 2023 17:09:32 -0400
Subject: [PATCH 249/289] GUACAMOLE-1289: Update the Duo extension to the v4
 API

---
 extensions/guacamole-auth-duo/pom.xml         | 100 +----
 .../duo/DuoAuthenticationProviderModule.java  |   3 +-
 .../auth/duo/DuoAuthenticationSession.java    |  74 ++++
 .../duo/DuoAuthenticationSessionManager.java} |  22 +-
 .../auth/duo/UserVerificationService.java     | 102 +++--
 .../guacamole/auth/duo/api/DuoCookie.java     | 245 ------------
 .../guacamole/auth/duo/api/DuoService.java    | 205 ----------
 .../auth/duo/api/SignedDuoCookie.java         | 332 ----------------
 .../auth/duo/conf/ConfigurationService.java   | 107 +++--
 .../auth/duo/form/DuoSignedResponseField.java |  98 -----
 .../src/main/resources/config/duoConfig.js    |  33 --
 .../duoSignedResponseController.js            |  86 ----
 .../src/main/resources/guac-manifest.json     |  14 +-
 .../main/resources/lib/DuoWeb/Duo-Web-v2.js   | 366 ------------------
 .../src/main/resources/lib/DuoWeb/LICENSE.js  |  27 --
 .../src/main/resources/styles/duo.css         |  62 ---
 .../templates/duoSignedResponseField.html     |   6 -
 17 files changed, 251 insertions(+), 1631 deletions(-)
 create mode 100644 extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java
 rename extensions/guacamole-auth-duo/src/main/{resources/duoModule.js => java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java} (64%)
 delete mode 100644 extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/DuoCookie.java
 delete mode 100644 extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/DuoService.java
 delete mode 100644 extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/SignedDuoCookie.java
 delete mode 100644 extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/form/DuoSignedResponseField.java
 delete mode 100644 extensions/guacamole-auth-duo/src/main/resources/config/duoConfig.js
 delete mode 100644 extensions/guacamole-auth-duo/src/main/resources/controllers/duoSignedResponseController.js
 delete mode 100644 extensions/guacamole-auth-duo/src/main/resources/lib/DuoWeb/Duo-Web-v2.js
 delete mode 100644 extensions/guacamole-auth-duo/src/main/resources/lib/DuoWeb/LICENSE.js
 delete mode 100644 extensions/guacamole-auth-duo/src/main/resources/styles/duo.css
 delete mode 100644 extensions/guacamole-auth-duo/src/main/resources/templates/duoSignedResponseField.html

diff --git a/extensions/guacamole-auth-duo/pom.xml b/extensions/guacamole-auth-duo/pom.xml
index 7d6ab3b23..0614cb47d 100644
--- a/extensions/guacamole-auth-duo/pom.xml
+++ b/extensions/guacamole-auth-duo/pom.xml
@@ -39,93 +39,9 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <enforcer.skip>true</enforcer.skip>
     </properties>
 
-    <build>
-        <plugins>
-
-            <!-- Pre-cache Angular templates with maven-angular-plugin -->
-            <plugin>
-                <groupId>com.keithbranton.mojo</groupId>
-                <artifactId>angular-maven-plugin</artifactId>
-                <version>0.3.4</version>
-                <executions>
-                    <execution>
-                        <phase>generate-resources</phase>
-                        <goals>
-                            <goal>html2js</goal>
-                        </goals>
-                    </execution>
-                </executions>
-                <configuration>
-                    <sourceDir>${basedir}/src/main/resources</sourceDir>
-                    <include>**/*.html</include>
-                    <target>${basedir}/src/main/resources/generated/templates-main/templates.js</target>
-                    <prefix>app/ext/duo</prefix>
-                </configuration>
-            </plugin>
-
-            <!-- JS/CSS Minification Plugin -->
-            <plugin>
-                <groupId>com.github.buckelieg</groupId>
-                <artifactId>minify-maven-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>default-cli</id>
-                        <configuration>
-                            <charset>UTF-8</charset>
-
-                            <webappSourceDir>${basedir}/src/main/resources</webappSourceDir>
-                            <webappTargetDir>${project.build.directory}/classes</webappTargetDir>
-
-                            <cssSourceDir>/</cssSourceDir>
-                            <cssTargetDir>/</cssTargetDir>
-                            <cssFinalFile>duo.css</cssFinalFile>
-
-                            <cssSourceFiles>
-                                <cssSourceFile>license.txt</cssSourceFile>
-                            </cssSourceFiles>
-
-                            <cssSourceIncludes>
-                                <cssSourceInclude>**/*.css</cssSourceInclude>
-                            </cssSourceIncludes>
-
-                            <jsSourceDir>/</jsSourceDir>
-                            <jsTargetDir>/</jsTargetDir>
-                            <jsFinalFile>duo.js</jsFinalFile>
-
-                            <jsSourceFiles>
-                                <jsSourceFile>license.txt</jsSourceFile>
-                                <jsSourceFile>lib/DuoWeb/LICENSE.js</jsSourceFile>
-                            </jsSourceFiles>
-
-                            <jsSourceIncludes>
-                                <jsSourceInclude>**/*.js</jsSourceInclude>
-                            </jsSourceIncludes>
-
-                            <!-- Do not minify and include tests -->
-                            <jsSourceExcludes>
-                                <jsSourceExclude>**/*.test.js</jsSourceExclude>
-                            </jsSourceExcludes>
-                            <jsEngine>CLOSURE</jsEngine>
-
-                            <!-- Disable warnings for JSDoc annotations -->
-                            <closureWarningLevels>
-                                <misplacedTypeAnnotation>OFF</misplacedTypeAnnotation>
-                                <nonStandardJsDocs>OFF</nonStandardJsDocs>
-                            </closureWarningLevels>
-
-                        </configuration>
-                        <goals>
-                            <goal>minify</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-
-        </plugins>
-    </build>
-
     <dependencies>
 
        <!-- Guacamole Extension API -->
@@ -155,6 +71,20 @@
             <version>2.5</version>
             <scope>provided</scope>
         </dependency>
+        
+        <!-- Duo SDK -->
+        <dependency>
+            <groupId>com.duosecurity</groupId>
+            <artifactId>duo-universal-sdk</artifactId>
+            <version>1.1.3</version>
+        </dependency>
+        
+        <!-- kotlin-stdlib-common -->
+        <dependency>
+            <groupId>org.jetbrains.kotlin</groupId>
+            <artifactId>kotlin-stdlib-common</artifactId>
+            <version>1.4.10</version>
+        </dependency>
 
     </dependencies>
 
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
index a60523bf8..c50e1039d 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
@@ -21,7 +21,6 @@ package org.apache.guacamole.auth.duo;
 
 import com.google.inject.AbstractModule;
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.duo.api.DuoService;
 import org.apache.guacamole.auth.duo.conf.ConfigurationService;
 import org.apache.guacamole.environment.Environment;
 import org.apache.guacamole.environment.LocalEnvironment;
@@ -74,8 +73,8 @@ public class DuoAuthenticationProviderModule extends AbstractModule {
 
         // Bind Duo-specific services
         bind(ConfigurationService.class);
-        bind(DuoService.class);
         bind(UserVerificationService.class);
+        bind(DuoAuthenticationSessionManager.class);
 
     }
 
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java
new file mode 100644
index 000000000..8dd3e8db1
--- /dev/null
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.duo;
+
+import org.apache.guacamole.net.auth.AuthenticationSession;
+
+/**
+ * An AuthenticationSession that stores the information required for an
+ * in-progress Duo authentication attempt.
+ */
+public class DuoAuthenticationSession extends AuthenticationSession {
+    
+    /**
+     * The session state generated by the Duo client, which is used to track
+     * the session through the redirect and return process.
+     */
+    private final String state;
+    
+    /**
+     * The username of the user who is authenticating with this session.
+     */
+    private final String username;
+    
+    /**
+     * Create a new instance of this authenticaiton session, having the given length of time
+     * for expriation and the state generated by the Duo Client.
+     * 
+     * @param expires
+     *     The number of milliseconds before this session is invalid.
+     * 
+     * @param state 
+     *     The session state, as generated by the Duo Client.
+     * 
+     * @param username
+     *     The username of the user who is attempting authentication with Duo.
+     */
+    public DuoAuthenticationSession(long expires, String state, String username) {
+        super(expires);
+        this.state = state;
+        this.username = username;
+    }
+    
+    /**
+     * Return the stored session state.
+     * 
+     * @return 
+     *     The stored session state.
+     */
+    public String getState() {
+        return state;
+    }
+    
+    public String getUsername() {
+        return username;
+    }
+    
+}
diff --git a/extensions/guacamole-auth-duo/src/main/resources/duoModule.js b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java
similarity index 64%
rename from extensions/guacamole-auth-duo/src/main/resources/duoModule.js
rename to extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java
index 49a342f84..9bfbcc466 100644
--- a/extensions/guacamole-auth-duo/src/main/resources/duoModule.js
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java
@@ -17,12 +17,18 @@
  * under the License.
  */
 
-/**
- * Module which provides handling for Duo multi-factor authentication.
- */
-angular.module('guacDuo', [
-    'form'
-]);
+package org.apache.guacamole.auth.duo;
 
-// Ensure the guacDuo module is loaded along with the rest of the app
-angular.module('index').requires.push('guacDuo');
+import com.google.inject.Singleton;
+import org.apache.guacamole.net.auth.AuthenticationSessionManager;
+
+/**
+ * An AuthenticationSessionManager implementation that temporarily stores
+ * authentication attempts for Duo MFA while they are underway.
+ */
+@Singleton
+public class DuoAuthenticationSessionManager extends AuthenticationSessionManager<DuoAuthenticationSession> {
+    
+    // Nothing to see here.
+    
+}
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
index abcb48605..7ac16d51a 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
@@ -19,16 +19,21 @@
 
 package org.apache.guacamole.auth.duo;
 
+import com.duosecurity.Client;
+import com.duosecurity.exception.DuoException;
+import com.duosecurity.model.Token;
 import com.google.inject.Inject;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.util.Collections;
 import javax.servlet.http.HttpServletRequest;
 import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.duo.api.DuoService;
+import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.auth.duo.conf.ConfigurationService;
-import org.apache.guacamole.auth.duo.form.DuoSignedResponseField;
-import org.apache.guacamole.form.Field;
+import org.apache.guacamole.form.RedirectField;
 import org.apache.guacamole.language.TranslatableGuacamoleClientException;
 import org.apache.guacamole.language.TranslatableGuacamoleInsufficientCredentialsException;
+import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
@@ -38,6 +43,24 @@ import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
  */
 public class UserVerificationService {
 
+    /**
+     * The name of the parameter which Duo will return in it's GET call-back
+     * that contains the code that the client will use to generate a token.
+     */
+    private static final String DUO_CODE_PARAMETER_NAME = "duo_code";
+    
+    /**
+     * The name of the parameter that will be used in the GET call-back that
+     * contains the session state.
+     */
+    private static final String DUO_STATE_PARAMETER_NAME = "state";
+    
+    /**
+     * The value that will be returned in the token if Duo authentication
+     * was successful.
+     */
+    private static final String DUO_TOKEN_SUCCESS_VALUE = "ALLOW";
+    
     /**
      * Service for retrieving Duo configuration information.
      */
@@ -45,10 +68,11 @@ public class UserVerificationService {
     private ConfigurationService confService;
 
     /**
-     * Service for verifying users against Duo.
+     * The authentication session manager that temporarily stores in-progress
+     * authentication attempts.
      */
     @Inject
-    private DuoService duoService;
+    private DuoAuthenticationSessionManager duoSessionManager;
 
     /**
      * Verifies the identity of the given user via the Duo multi-factor
@@ -75,39 +99,69 @@ public class UserVerificationService {
         // Ignore anonymous users
         if (authenticatedUser.getIdentifier().equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
             return;
+        
+        String username = authenticatedUser.getIdentifier();
 
-        // Retrieve signed Duo response from request
-        String signedResponse = request.getParameter(DuoSignedResponseField.PARAMETER_NAME);
+        try {
 
-        // If no signed response, request one
-        if (signedResponse == null) {
+        // Set up the Duo Client
+        Client duoClient = new Client.Builder(
+                confService.getClientId(),
+                confService.getClientSecret(),
+                confService.getAPIHostname(),
+                confService.getRedirectUrl().toString())
+                .build();
+        
+            duoClient.healthCheck();
+        
+        
+        // Retrieve signed Duo Code and State from the request
+        String duoCode = request.getParameter(DUO_CODE_PARAMETER_NAME);
+        String duoState = request.getParameter(DUO_STATE_PARAMETER_NAME);
 
-            // Create field which requests a signed response from Duo that
-            // verifies the identity of the given user via the configured
-            // Duo API endpoint
-            Field signedResponseField = new DuoSignedResponseField(
-                    confService.getAPIHostname(),
-                    duoService.createSignedRequest(authenticatedUser));
+        // If no code or state is received, assume Duo MFA redirect has not occured and do it.
+        if (duoCode == null || duoState == null) {
 
-            // Create an overall description of the additional credentials
-            // required to verify identity
-            CredentialsInfo expectedCredentials = new CredentialsInfo(
-                        Collections.singletonList(signedResponseField));
+            // Get a new session state from the Duo client
+            duoState = duoClient.generateState();
+            
+            // Add this session 
+            duoSessionManager.defer(new DuoAuthenticationSession(confService.getAuthTimeout(), duoState, username), duoState);
 
             // Request additional credentials
             throw new TranslatableGuacamoleInsufficientCredentialsException(
-                    "Verification using Duo is required before authentication "
-                    + "can continue.", "LOGIN.INFO_DUO_AUTH_REQUIRED",
-                    expectedCredentials);
+                "Verification using Duo is required before authentication "
+                + "can continue.", "LOGIN.INFO_DUO_AUTH_REQUIRED",
+                new CredentialsInfo(Collections.singletonList(
+                    new RedirectField(
+                            DUO_CODE_PARAMETER_NAME,
+                            new URI(duoClient.createAuthUrl(username, duoState)),
+                            new TranslatableMessage("LOGIN.INFO_DUO_REDIRECT_PENDING")
+                    )
+                ))
+            );
 
         }
 
-        // If signed response does not verify this user's identity, abort auth
-        if (!duoService.isValidSignedResponse(authenticatedUser, signedResponse))
+        // Retrieve the deferred authenticaiton attempt
+        DuoAuthenticationSession duoSession = duoSessionManager.resume(duoState);
+        
+        // Get the token from the DuoClient using the code and username, and check status
+        Token token = duoClient.exchangeAuthorizationCodeFor2FAResult(duoCode, duoSession.getUsername());
+        if (token == null 
+                || token.getAuth_result() == null 
+                || !DUO_TOKEN_SUCCESS_VALUE.equals(token.getAuth_result().getStatus()))
             throw new TranslatableGuacamoleClientException("Provided Duo "
                     + "validation code is incorrect.",
                     "LOGIN.INFO_DUO_VALIDATION_CODE_INCORRECT");
 
+        }
+        catch (DuoException e) {
+            throw new GuacamoleServerException("Duo Client error.", e);
+        }
+        catch (URISyntaxException e) {
+            throw new GuacamoleServerException("Error creating URI from Duo Authentication URL.", e);
+        }
     }
 
 }
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/DuoCookie.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/DuoCookie.java
deleted file mode 100644
index 6fa2a88c4..000000000
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/DuoCookie.java
+++ /dev/null
@@ -1,245 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.duo.api;
-
-import com.google.common.io.BaseEncoding;
-import java.io.UnsupportedEncodingException;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import org.apache.guacamole.GuacamoleClientException;
-import org.apache.guacamole.GuacamoleException;
-
-/**
- * Data which describes the identity of the user being verified by Duo.
- */
-public class DuoCookie {
-
-    /**
-     * Pattern which matches valid cookies. Each cookie is made up of three
-     * sections, separated from each other by pipe symbols ("|").
-     */
-    private static final Pattern COOKIE_FORMAT = Pattern.compile("([^|]+)\\|([^|]+)\\|([0-9]+)");
-
-    /**
-     * The index of the capturing group within COOKIE_FORMAT which contains the
-     * username.
-     */
-    private static final int USERNAME_GROUP = 1;
-
-    /**
-     * The index of the capturing group within COOKIE_FORMAT which contains the
-     * integration key.
-     */
-    private static final int INTEGRATION_KEY_GROUP = 2;
-
-    /**
-     * The index of the capturing group within COOKIE_FORMAT which contains the
-     * expiration timestamp.
-     */
-    private static final int EXPIRATION_TIMESTAMP_GROUP = 3;
-
-    /**
-     * The username of the user being verified.
-     */
-    private final String username;
-
-    /**
-     * The integration key provided by Duo and specific to this deployment of
-     * Guacamole.
-     */
-    private final String integrationKey;
-
-    /**
-     * The time that this cookie expires, in seconds since midnight of
-     * 1970-01-01 (UTC).
-     */
-    private final long expires;
-
-    /**
-     * Creates a new DuoCookie which describes the identity of a user being
-     * verified.
-     *
-     * @param username
-     *     The username of the user being verified.
-     *
-     * @param integrationKey
-     *     The integration key provided by Duo and specific to this deployment
-     *     of Guacamole.
-     *
-     * @param expires
-     *     The time that this cookie expires, in seconds since midnight of
-     *     1970-01-01 (UTC).
-     */
-    public DuoCookie(String username, String integrationKey, long expires) {
-        this.username = username;
-        this.integrationKey = integrationKey;
-        this.expires = expires;
-    }
-
-    /**
-     * Returns the username of the user being verified.
-     *
-     * @return
-     *     The username of the user being verified.
-     */
-    public String getUsername() {
-        return username;
-    }
-
-    /**
-     * Returns the integration key provided by Duo and specific to this
-     * deployment of Guacamole.
-     *
-     * @return
-     *     The integration key provided by Duo and specific to this deployment
-     *     of Guacamole.
-     */
-    public String getIntegrationKey() {
-        return integrationKey;
-    }
-
-    /**
-     * Returns the time that this cookie expires. The expiration time is
-     * represented in seconds since midnight of 1970-01-01 (UTC).
-     *
-     * @return
-     *     The time that this cookie expires, in seconds since midnight of
-     *     1970-01-01 (UTC).
-     */
-    public long getExpirationTimestamp(){
-        return expires;
-    }
-
-    /**
-     * Returns the current time as the number of seconds elapsed since
-     * midnight of 1970-01-01 (UTC).
-     *
-     * @return
-     *     The current time as the number of seconds elapsed since midnight of
-     *     1970-01-01 (UTC).
-     */
-    public static long currentTimestamp() {
-        return System.currentTimeMillis() / 1000;
-    }
-
-    /**
-     * Returns whether this cookie has expired (the current time has met or
-     * exceeded the expiration timestamp).
-     *
-     * @return
-     *     true if this cookie has expired, false otherwise.
-     */
-    public boolean isExpired() {
-        return currentTimestamp() >= expires;
-    }
-
-    /**
-     * Parses a base64-encoded Duo cookie, producing a new DuoCookie object
-     * containing the data therein. If the given string is not a valid Duo
-     * cookie, an exception is thrown. Note that the cookie may be expired, and
-     * must be checked for expiration prior to actual use.
-     *
-     * @param str
-     *     The base64-encoded Duo cookie to parse.
-     *
-     * @return
-     *     A new DuoCookie object containing the same data as the given
-     *     base64-encoded Duo cookie string.
-     *
-     * @throws GuacamoleException
-     *     If the given string is not a valid base64-encoded Duo cookie.
-     */
-    public static DuoCookie parseDuoCookie(String str) throws GuacamoleException {
-
-        // Attempt to decode data as base64
-        String data;
-        try {
-            data = new String(BaseEncoding.base64().decode(str), "UTF-8");
-        }
-
-        // Bail if invalid base64 is provided
-        catch (IllegalArgumentException e) {
-            throw new GuacamoleClientException("Username is not correctly "
-                    + "encoded as base64.", e);
-        }
-
-        // Throw hard errors if standard pieces of Java are missing
-        catch (UnsupportedEncodingException e) {
-            throw new UnsupportedOperationException("Unexpected lack of "
-                    + "UTF-8 support.", e);
-        }
-
-        // Verify format of provided data
-        Matcher matcher = COOKIE_FORMAT.matcher(data);
-        if (!matcher.matches())
-            throw new GuacamoleClientException("Format of base64-encoded "
-                    + "username is invalid.");
-
-        // Get username and key (simple strings)
-        String username = matcher.group(USERNAME_GROUP);
-        String key = matcher.group(INTEGRATION_KEY_GROUP);
-
-        // Parse expiration time
-        long expires;
-        try {
-            expires = Long.parseLong(matcher.group(EXPIRATION_TIMESTAMP_GROUP));
-        }
-
-        // Bail if expiration timestamp is not a valid long
-        catch (NumberFormatException e) {
-            throw new GuacamoleClientException("Expiration timestamp is "
-                    + "not valid.", e);
-        }
-
-        // Return parsed cookie
-        return new DuoCookie(username, key, expires);
-
-    }
-
-    /**
-     * Returns the base64-encoded string representation of this DuoCookie. The
-     * format used is identical to that required by the Duo service: the
-     * username, integration key, and expiration timestamp separated by pipe
-     * symbols ("|") and encoded with base64.
-     *
-     * @return
-     *     The base64-encoded string representation of this DuoCookie.
-     */
-    @Override
-    public String toString() {
-
-        try {
-
-            // Separate each cookie field with pipe symbols
-            String data = username + "|" + integrationKey + "|" + expires;
-
-            // Encode resulting cookie string with base64
-            return BaseEncoding.base64().encode(data.getBytes("UTF-8"));
-
-        }
-
-        // Throw hard errors if standard pieces of Java are missing
-        catch (UnsupportedEncodingException e) {
-            throw new UnsupportedOperationException("Unexpected lack of UTF-8 support.", e);
-        }
-
-    }
-
-}
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/DuoService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/DuoService.java
deleted file mode 100644
index 11cca13c5..000000000
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/DuoService.java
+++ /dev/null
@@ -1,205 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.duo.api;
-
-import com.google.inject.Inject;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.auth.duo.conf.ConfigurationService;
-import org.apache.guacamole.net.auth.AuthenticatedUser;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Service which produces signed requests and parses/verifies signed responses
- * as required by Duo's API.
- */
-public class DuoService {
-
-    /**
-     * Logger for this class.
-     */
-    private static final Logger logger = LoggerFactory.getLogger(DuoService.class);
-
-    /**
-     * Pattern which matches valid Duo responses. Each response is made up of
-     * two sections, separated from each other by a colon, where each section
-     * is a signed Duo cookie.
-     */
-    private static final Pattern RESPONSE_FORMAT = Pattern.compile("([^:]+):([^:]+)");
-
-    /**
-     * The index of the capturing group within RESPONSE_FORMAT which
-     * contains the DUO_RESPONSE cookie signed by the secret key.
-     */
-    private static final int DUO_COOKIE_GROUP = 1;
-
-    /**
-     * The index of the capturing group within RESPONSE_FORMAT which
-     * contains the APPLICATION cookie signed by the application key.
-     */
-    private static final int APP_COOKIE_GROUP = 2;
-
-    /**
-     * The amount of time that each generated cookie remains valid, in seconds.
-     */
-    private static final int COOKIE_EXPIRATION_TIME = 300;
-
-    /**
-     * Service for retrieving Duo configuration information.
-     */
-    @Inject
-    private ConfigurationService confService;
-
-    /**
-     * Creates and signs a new request to verify the identity of the given
-     * user. This request may ultimately be sent to Duo, resulting in a signed
-     * response from Duo if that verification succeeds.
-     *
-     * @param authenticatedUser
-     *     The user whose identity should be verified.
-     *
-     * @return
-     *     A signed user verification request which can be sent to Duo.
-     *
-     * @throws GuacamoleException
-     *     If required Duo-specific configuration options are missing or
-     *     invalid, or if an error prevents generation of the signature.
-     */
-    public String createSignedRequest(AuthenticatedUser authenticatedUser)
-        throws GuacamoleException {
-
-        // Generate a cookie associating the username with the integration key
-        DuoCookie cookie = new DuoCookie(authenticatedUser.getIdentifier(),
-                confService.getIntegrationKey(),
-                DuoCookie.currentTimestamp() + COOKIE_EXPIRATION_TIME);
-
-        // Sign cookie with secret key
-        SignedDuoCookie duoCookie = new SignedDuoCookie(cookie,
-                SignedDuoCookie.Type.DUO_REQUEST,
-                confService.getSecretKey());
-
-        // Sign cookie with application key
-        SignedDuoCookie appCookie = new SignedDuoCookie(cookie,
-                SignedDuoCookie.Type.APPLICATION,
-                confService.getApplicationKey());
-
-        // Return signed request containing both signed cookies, separated by
-        // a colon (as required by Duo)
-        return duoCookie + ":" + appCookie;
-
-    }
-
-    /**
-     * Returns whether the given signed response is a valid response from Duo
-     * which verifies the identity of the given user. If the given response is
-     * invalid or does not verify the identity of the given user (including if
-     * it is a valid response which verifies the identity of a DIFFERENT user),
-     * false is returned.
-     *
-     * @param authenticatedUser
-     *     The user that the given signed response should verify.
-     *
-     * @param signedResponse
-     *     The signed response received from Duo in response to a signed
-     *     request.
-     *
-     * @return
-     *     true if the signed response is a valid response from Duo AND verifies
-     *     the identity of the given user, false otherwise.
-     *
-     * @throws GuacamoleException
-     *     If required Duo-specific configuration options are missing or
-     *     invalid, or if an error occurs prevents validation of the signature.
-     */
-    public boolean isValidSignedResponse(AuthenticatedUser authenticatedUser,
-            String signedResponse) throws GuacamoleException {
-
-        SignedDuoCookie duoCookie;
-        SignedDuoCookie appCookie;
-
-        // Retrieve username from externally-authenticated user
-        String username = authenticatedUser.getIdentifier();
-
-        // Retrieve Duo-specific keys from configuration
-        String applicationKey = confService.getApplicationKey();
-        String integrationKey = confService.getIntegrationKey();
-        String secretKey = confService.getSecretKey();
-
-        try {
-
-            // Verify format of response
-            Matcher matcher = RESPONSE_FORMAT.matcher(signedResponse);
-            if (!matcher.matches()) {
-                logger.debug("Duo response is not in correct format.");
-                return false;
-            }
-
-            // Parse signed cookie defining the user verified by Duo
-            duoCookie = SignedDuoCookie.parseSignedDuoCookie(secretKey,
-                    matcher.group(DUO_COOKIE_GROUP));
-
-            // Parse signed cookie defining the user this application
-            // originally requested
-            appCookie = SignedDuoCookie.parseSignedDuoCookie(applicationKey,
-                    matcher.group(APP_COOKIE_GROUP));
-
-        }
-
-        // Simply return false if signature fails to verify
-        catch (GuacamoleException e) {
-            logger.debug("Duo signature verification failed.", e);
-            return false;
-        }
-
-        // Verify neither cookie is expired
-        if (duoCookie.isExpired() || appCookie.isExpired()) {
-            logger.debug("Duo response contained expired cookie(s).");
-            return false;
-        }
-
-        // Verify the cookies in the response have the correct types
-        if (duoCookie.getType() != SignedDuoCookie.Type.DUO_RESPONSE
-         || appCookie.getType() != SignedDuoCookie.Type.APPLICATION) {
-            logger.debug("Duo response did not contain correct cookie type(s).");
-            return false;
-        }
-
-        // Verify integration key matches both cookies
-        if (!duoCookie.getIntegrationKey().equals(integrationKey)
-         || !appCookie.getIntegrationKey().equals(integrationKey)) {
-            logger.debug("Integration key of Duo response is incorrect.");
-            return false;
-        }
-
-        // Verify both cookies are for the current user
-        if (!duoCookie.getUsername().equals(username)
-         || !appCookie.getUsername().equals(username)) {
-            logger.debug("Username of Duo response is incorrect.");
-            return false;
-        }
-
-        // All verifications tests pass
-        return true;
-
-    }
-
-}
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/SignedDuoCookie.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/SignedDuoCookie.java
deleted file mode 100644
index c959acdd1..000000000
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/api/SignedDuoCookie.java
+++ /dev/null
@@ -1,332 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.duo.api;
-
-import com.google.common.io.BaseEncoding;
-import java.io.UnsupportedEncodingException;
-import java.security.InvalidKeyException;
-import java.security.NoSuchAlgorithmException;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import javax.crypto.Mac;
-import javax.crypto.spec.SecretKeySpec;
-import org.apache.guacamole.GuacamoleClientException;
-import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.GuacamoleServerException;
-
-/**
- * A DuoCookie which is cryptographically signed with a provided key using
- * HMAC-SHA1.
- */
-public class SignedDuoCookie extends DuoCookie {
-
-    /**
-     * Pattern which matches valid signed cookies. Like unsigned cookies, each
-     * signed cookie is made up of three sections, separated from each other by
-     * pipe symbols ("|").
-     */
-    private static final Pattern SIGNED_COOKIE_FORMAT = Pattern.compile("([^|]+)\\|([^|]+)\\|([0-9a-f]+)");
-
-    /**
-     * The index of the capturing group within SIGNED_COOKIE_FORMAT which
-     * contains the cookie type prefix.
-     */
-    private static final int PREFIX_GROUP = 1;
-
-    /**
-     * The index of the capturing group within SIGNED_COOKIE_FORMAT which
-     * contains the cookie's base64-encoded data.
-     */
-    private static final int DATA_GROUP = 2;
-
-    /**
-     * The index of the capturing group within SIGNED_COOKIE_FORMAT which
-     * contains the signature.
-     */
-    private static final int SIGNATURE_GROUP = 3;
-
-    /**
-     * The signature algorithm that should be used to sign the cookie, as
-     * defined by:
-     * http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#Mac
-     */
-    private static final String SIGNATURE_ALGORITHM = "HmacSHA1";
-
-    /**
-     * The type of a signed Duo cookie. Each signed Duo cookie has an
-     * associated type which determines the prefix included in the string
-     * representation of that cookie. As that type is included in the data
-     * that is signed, different types will result in different signatures,
-     * even if the data portion of the cookie is otherwise identical.
-     */
-    public enum Type {
-
-        /**
-         * A Duo cookie which has been signed with the secret key for inclusion
-         * in a Duo request.
-         */
-        DUO_REQUEST("TX"),
-
-        /**
-         * A Duo cookie which has been signed with the secret key by Duo and
-         * was included in a Duo response.
-         */
-        DUO_RESPONSE("AUTH"),
-
-        /**
-         * A Duo cookie which has been signed with the application key for
-         * inclusion in a Duo request. Such cookies are also included in Duo
-         * responses, for verification by the application.
-         */
-        APPLICATION("APP");
-
-        /**
-         * The prefix associated with the Duo cookie type. This prefix will
-         * be included in the string representation of the cookie.
-         */
-        private final String prefix;
-
-        /**
-         * Creates a new Duo cookie type associated with the given string
-         * prefix. This prefix will be included in the string representation of
-         * the cookie.
-         *
-         * @param prefix
-         *     The prefix to associated with the Duo cookie type.
-         */
-        Type(String prefix) {
-            this.prefix = prefix;
-        }
-
-        /**
-         * Returns the prefix associated with the Duo cookie type.
-         *
-         * @return
-         *     The prefix to associated with this Duo cookie type.
-         */
-        public String getPrefix() {
-            return prefix;
-        }
-
-        /**
-         * Returns the cookie type associated with the given prefix. If no such
-         * cookie type exists, null is returned.
-         *
-         * @param prefix
-         *     The prefix of the cookie type to search for.
-         *
-         * @return
-         *     The cookie type associated with the given prefix, or null if no
-         *     such cookie type exists.
-         */
-        public static Type fromPrefix(String prefix) {
-
-            // Search through all defined cookie types for the given prefix
-            for (Type type : Type.values()) {
-                if (type.getPrefix().equals(prefix))
-                    return type;
-            }
-
-            // No such cookie type exists
-            return null;
-
-        }
-
-    }
-
-    /**
-     * The type of this Duo cookie.
-     */
-    private final Type type;
-
-    /**
-     * The signature produced when the cookie was signed with HMAC-SHA1. The
-     * signature covers the prefix of the type and the cookie's base64-encoded
-     * data, separated by a pipe symbol.
-     */
-    private final String signature;
-
-    /**
-     * Creates a new SignedDuoCookie which describes the identity of a user
-     * being verified and is cryptographically signed with HMAC-SHA1 by a given
-     * key.
-     *
-     * @param cookie
-     *     The cookie defining the identity being verified.
-     *
-     * @param type
-     *     The type of the cookie being created.
-     *
-     * @param key
-     *     The key to use to generate the cryptographic signature. This key
-     *     will not be stored within the cookie.
-     *
-     * @throws GuacamoleException
-     *     If the given signing key is invalid.
-     */
-    public SignedDuoCookie(DuoCookie cookie, Type type, String key)
-            throws GuacamoleException {
-
-        // Init underlying cookie
-        super(cookie.getUsername(), cookie.getIntegrationKey(),
-                cookie.getExpirationTimestamp());
-
-        // Store cookie type and signature
-        this.type = type;
-        this.signature = sign(key, type.getPrefix() + "|" + cookie.toString());
-
-    }
-
-    /**
-     * Signs the given arbitrary string data with the given key using the
-     * algorithm defined by SIGNATURE_ALGORITHM. Both the data and the key will
-     * be interpreted as UTF-8 bytes.
-     *
-     * @param key
-     *     The key which should be used to sign the given data.
-     *
-     * @param data
-     *     The data being signed.
-     *
-     * @return
-     *     The signature produced by signing the given data with the given key,
-     *     encoded as lowercase hexadecimal.
-     *
-     * @throws GuacamoleException
-     *     If the given signing key is invalid.
-     */
-    private static String sign(String key, String data) throws GuacamoleException {
-
-        try {
-
-            // Attempt to sign UTF-8 bytes of provided data
-            Mac mac = Mac.getInstance(SIGNATURE_ALGORITHM);
-            mac.init(new SecretKeySpec(key.getBytes("UTF-8"), SIGNATURE_ALGORITHM));
-
-            // Return signature as hex
-            return BaseEncoding.base16().lowerCase().encode(mac.doFinal(data.getBytes("UTF-8")));
-
-        }
-
-        // Re-throw any errors which prevent signature
-        catch (InvalidKeyException e){
-            throw new GuacamoleServerException("Signing key is invalid.", e);
-        }
-
-        // Throw hard errors if standard pieces of Java are missing
-        catch (UnsupportedEncodingException e) {
-            throw new UnsupportedOperationException("Unexpected lack of UTF-8 support.", e);
-        }
-        catch (NoSuchAlgorithmException e) {
-            throw new UnsupportedOperationException("Unexpected lack of support "
-                    + "for required signature algorithm "
-                    + "\"" + SIGNATURE_ALGORITHM + "\".", e);
-        }
-
-    }
-
-    /**
-     * Returns the type of this Duo cookie. The Duo cookie type is dictated
-     * by the context of the cookie's use, and is included with the cookie's
-     * underlying data when generating the signature.
-     *
-     * @return
-     *     The type of this Duo cookie.
-     */
-    public Type getType() {
-        return type;
-    }
-
-    /**
-     * Returns the signature produced when the cookie was signed with HMAC-SHA1.
-     * The signature covers the prefix of the cookie's type and the cookie's
-     * base64-encoded data, separated by a pipe symbol.
-     *
-     * @return
-     *     The signature produced when the cookie was signed with HMAC-SHA1.
-     */
-    public String getSignature() {
-        return signature;
-    }
-
-    /**
-     * Parses a signed Duo cookie string, such as that produced by the
-     * toString() function or received from the Duo service, producing a new
-     * SignedDuoCookie object containing the associated cookie data and
-     * signature. If the given string is not a valid Duo cookie, or if the
-     * signature is incorrect, an exception is thrown. Note that the cookie may
-     * be expired, and must be checked for expiration prior to actual use.
-     *
-     * @param key
-     *     The key that was used to sign the Duo cookie.
-     *
-     * @param str
-     *     The Duo cookie string to parse.
-     *
-     * @return
-     *     A new SignedDuoCookie object containing the same data and signature
-     *     as the given Duo cookie string.
-     *
-     * @throws GuacamoleException
-     *     If the given string is not a valid Duo cookie string, or if the
-     *     signature of the cookie is invalid.
-     */
-    public static SignedDuoCookie parseSignedDuoCookie(String key, String str)
-            throws GuacamoleException {
-
-        // Verify format of provided data
-        Matcher matcher = SIGNED_COOKIE_FORMAT.matcher(str);
-        if (!matcher.matches())
-            throw new GuacamoleClientException("Format of signed Duo cookie "
-                    + "is invalid.");
-
-        // Parse type from prefix
-        Type type = Type.fromPrefix(matcher.group(PREFIX_GROUP));
-        if (type == null)
-            throw new GuacamoleClientException("Invalid Duo cookie prefix.");
-
-        // Parse cookie from base64-encoded data
-        DuoCookie cookie = DuoCookie.parseDuoCookie(matcher.group(DATA_GROUP));
-
-        // Verify signature of cookie
-        SignedDuoCookie signedCookie = new SignedDuoCookie(cookie, type, key);
-        if (!signedCookie.getSignature().equals(matcher.group(SIGNATURE_GROUP)))
-            throw new GuacamoleClientException("Duo cookie has incorrect signature.");
-
-        // Cookie has valid signature and has parsed successfully
-        return signedCookie;
-
-    }
-
-    /**
-     * Returns the string representation of this SignedDuoCookie. The format
-     * used is identical to that required by the Duo service: the type prefix,
-     * base64-encoded cookie data, and HMAC-SHA1 signature separated by pipe
-     * symbols ("|").
-     *
-     * @return
-     *     The string representation of this SignedDuoCookie.
-     */
-    @Override
-    public String toString() {
-        return type.getPrefix() + "|" + super.toString() + "|" + signature;
-    }
-
-}
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java
index 40ccde9e0..212b4a618 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java
@@ -20,9 +20,12 @@
 package org.apache.guacamole.auth.duo.conf;
 
 import com.google.inject.Inject;
+import java.net.URI;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.environment.Environment;
+import org.apache.guacamole.properties.IntegerGuacamoleProperty;
 import org.apache.guacamole.properties.StringGuacamoleProperty;
+import org.apache.guacamole.properties.URIGuacamoleProperty;
 
 /**
  * Service for retrieving configuration information regarding the Duo
@@ -56,11 +59,11 @@ public class ConfigurationService {
      * key received from Duo for verifying Guacamole users. This value MUST be
      * exactly 20 characters.
      */
-    private static final StringGuacamoleProperty DUO_INTEGRATION_KEY =
+    private static final StringGuacamoleProperty DUO_CLIENT_ID =
             new StringGuacamoleProperty() {
 
         @Override
-        public String getName() { return "duo-integration-key"; }
+        public String getName() { return "duo-client-id"; }
 
     };
 
@@ -69,26 +72,38 @@ public class ConfigurationService {
      * received from Duo for verifying Guacamole users. This value MUST be
      * exactly 40 characters.
      */
-    private static final StringGuacamoleProperty DUO_SECRET_KEY =
+    private static final StringGuacamoleProperty DUO_CLIENT_SECRET =
             new StringGuacamoleProperty() {
 
         @Override
-        public String getName() { return "duo-secret-key"; }
+        public String getName() { return "duo-client-secret"; }
 
     };
-
+    
     /**
-     * The property within guacamole.properties which defines the arbitrary
-     * random key which was generated for Guacamole. Note that this value is not
-     * provided by Duo, but is expected to be generated by the administrator of
-     * the system hosting Guacamole. This value MUST be at least 40 characters.
+     * The property within guacamole.properties which defines the redirect URL
+     * that Duo will call after the second factor has been completed. This
+     * should be the URL used to access Guacamole.
      */
-    private static final StringGuacamoleProperty DUO_APPLICATION_KEY =
-            new StringGuacamoleProperty() {
-
+    private static final URIGuacamoleProperty DUO_REDIRECT_URL =
+            new URIGuacamoleProperty() {
+    
         @Override
-        public String getName() { return "duo-application-key"; }
-
+        public String getName() { return "duo-redirect-url"; }
+                
+    };
+    
+    /**
+     * The property that configures the timeout, in seconds, of in-progress
+     * Duo authentication attempts. Authentication attempts that take longer
+     * than this period of time will be invalidated.
+     */
+    private static final IntegerGuacamoleProperty DUO_AUTH_TIMEOUT =
+            new IntegerGuacamoleProperty() {
+                
+        @Override
+        public String getName() { return "duo-auth-timeout"; }
+                
     };
 
     /**
@@ -110,51 +125,65 @@ public class ConfigurationService {
     }
 
     /**
-     * Returns the integration key received from Duo for verifying Guacamole
-     * users, as defined in guacamole.properties by the "duo-integration-key"
+     * Returns the Duo client id received from Duo for verifying Guacamole
+     * users, as defined in guacamole.properties by the "duo-client-id"
      * property. This value MUST be exactly 20 characters.
      *
      * @return
-     *     The integration key received from Duo for verifying Guacamole
-     *     users.
+     *     The client id received from Duo for verifying Guacamole users.
      *
      * @throws GuacamoleException
      *     If the associated property within guacamole.properties is missing.
      */
-    public String getIntegrationKey() throws GuacamoleException {
-        return environment.getRequiredProperty(DUO_INTEGRATION_KEY);
+    public String getClientId() throws GuacamoleException {
+        return environment.getRequiredProperty(DUO_CLIENT_ID);
     }
 
     /**
-     * Returns the secret key received from Duo for verifying Guacamole users,
-     * as defined in guacamole.properties by the "duo-secret-key" property. This
-     * value MUST be exactly 20 characters.
+     * Returns the client secert received from Duo for verifying Guacamole users,
+     * as defined in guacamole.properties by the "duo-client-secert" property.
+     * This value MUST be exactly 20 characters.
      *
      * @return
-     *     The secret key received from Duo for verifying Guacamole users.
+     *     The client secret received from Duo for verifying Guacamole users.
      *
      * @throws GuacamoleException
      *     If the associated property within guacamole.properties is missing.
      */
-    public String getSecretKey() throws GuacamoleException {
-        return environment.getRequiredProperty(DUO_SECRET_KEY);
+    public String getClientSecret() throws GuacamoleException {
+        return environment.getRequiredProperty(DUO_CLIENT_SECRET);
     }
-
+    
     /**
-     * Returns the arbitrary random key which was generated for Guacamole, as
-     * defined in guacamole.properties by the "duo-application-key" property.
-     * Note that this value is not provided by Duo, but is expected to be
-     * generated by the administrator of the system hosting Guacamole. This
-     * value MUST be at least 40 characters.
-     *
+     * Return the callback URL that will be called by Duo after authentication
+     * with Duo has been completed. This should be the URL to return the user
+     * to the Guacamole interface, and will be a full URL.
+     * 
      * @return
-     *     The arbitrary random key which was generated for Guacamole.
-     *
-     * @throws GuacamoleException
-     *     If the associated property within guacamole.properties is missing.
+     *     The URL for Duo to use to callback to the Guacamole interface after
+     *     authentication has been completed.
+     * 
+     * @throws GuacamoleException 
+     *     If guacamole.properties cannot be read, or if the property is not
+     *     defined.
      */
-    public String getApplicationKey() throws GuacamoleException {
-        return environment.getRequiredProperty(DUO_APPLICATION_KEY);
+    public URI getRedirectUrl() throws GuacamoleException {
+        return environment.getRequiredProperty(DUO_REDIRECT_URL);
+    }
+    
+    /**
+     * Return the number of seconds after which in-progress authentication attempts with
+     * Duo should be invalidated. The default is 30 seconds.
+     * 
+     * @return
+     *     The number of seconds after which in-progress Duo MFA attempts should
+     *     be invalidated.
+     * 
+     * @throws GuacamoleException 
+     *     If guacamole.properties cannot be parsed.
+     */
+    public int getAuthTimeout() throws GuacamoleException {
+        return environment.getProperty(DUO_AUTH_TIMEOUT, 30);
     }
 
 }
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/form/DuoSignedResponseField.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/form/DuoSignedResponseField.java
deleted file mode 100644
index df46a3122..000000000
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/form/DuoSignedResponseField.java
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.duo.form;
-
-import org.apache.guacamole.form.Field;
-
-/**
- * A custom field type which uses the DuoWeb API to produce a signed response
- * for a particular user. The signed response serves as an additional
- * authentication factor, as it cryptographically verifies possession of the
- * physical device associated with that user's Duo account.
- */
-public class DuoSignedResponseField extends Field {
-
-    /**
-     * The name of the HTTP parameter which an instance of this field will
-     * populate within a user's credentials.
-     */
-    public static final String PARAMETER_NAME = "guac-duo-signed-response";
-
-    /**
-     * The unique name associated with this field type.
-     */
-    private static final String FIELD_TYPE_NAME = "GUAC_DUO_SIGNED_RESPONSE";
-
-    /**
-     * The hostname of the DuoWeb API endpoint.
-     */
-    private final String apiHost;
-
-    /**
-     * The signed request generated by a call to DuoWeb.signRequest().
-     */
-    private final String signedRequest;
-
-    /**
-     * Creates a new field which uses the DuoWeb API to prompt the user for
-     * additional credentials. The provided credentials, if valid, will
-     * ultimately be verified by Duo's service, resulting in a signed response
-     * which can be cryptographically verified.
-     *
-     * @param apiHost
-     *     The hostname of the DuoWeb API endpoint.
-     *
-     * @param signedRequest
-     *     A signed request generated for the user in question by a call to
-     *     DuoWeb.signRequest().
-     */
-    public DuoSignedResponseField(String apiHost, String signedRequest) {
-
-        // Init base field type properties
-        super(PARAMETER_NAME, FIELD_TYPE_NAME);
-
-        // Init Duo-specific properties
-        this.apiHost = apiHost;
-        this.signedRequest = signedRequest;
-
-    }
-
-    /**
-     * Returns the hostname of the DuoWeb API endpoint.
-     *
-     * @return
-     *     The hostname of the DuoWeb API endpoint.
-     */
-    public String getApiHost() {
-        return apiHost;
-    }
-
-    /**
-     * Returns the signed request string, which must have been generated by a
-     * call to DuoWeb.signRequest().
-     *
-     * @return
-     *     The signed request generated by a call to DuoWeb.signRequest().
-     */
-    public String getSignedRequest() {
-        return signedRequest;
-    }
-
-}
diff --git a/extensions/guacamole-auth-duo/src/main/resources/config/duoConfig.js b/extensions/guacamole-auth-duo/src/main/resources/config/duoConfig.js
deleted file mode 100644
index 43c37dc0c..000000000
--- a/extensions/guacamole-auth-duo/src/main/resources/config/duoConfig.js
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * Config block which registers Duo-specific field types.
- */
-angular.module('guacDuo').config(['formServiceProvider',
-    function guacDuoConfig(formServiceProvider) {
-
-    // Define field for the signed response from the Duo service
-    formServiceProvider.registerFieldType('GUAC_DUO_SIGNED_RESPONSE', {
-        module      : 'guacDuo',
-        controller  : 'duoSignedResponseController',
-        templateUrl : 'app/ext/duo/templates/duoSignedResponseField.html'
-    });
-
-}]);
diff --git a/extensions/guacamole-auth-duo/src/main/resources/controllers/duoSignedResponseController.js b/extensions/guacamole-auth-duo/src/main/resources/controllers/duoSignedResponseController.js
deleted file mode 100644
index b4ca4f360..000000000
--- a/extensions/guacamole-auth-duo/src/main/resources/controllers/duoSignedResponseController.js
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * Controller for the "GUAC_DUO_SIGNED_RESPONSE" field which uses the DuoWeb
- * API to prompt the user for additional credentials, ultimately receiving a
- * signed response from the Duo service.
- */
-angular.module('guacDuo').controller('duoSignedResponseController', ['$scope', '$element',
-    function duoSignedResponseController($scope, $element) {
-
-    /**
-     * The iframe which contains the Duo authentication interface.
-     *
-     * @type HTMLIFrameElement
-     */
-    var iframe = $element.find('iframe')[0];
-
-    /**
-     * The submit button which should be used to submit the login form once
-     * the Duo response has been received.
-     *
-     * @type HTMLInputElement
-     */
-    var submit = $element.find('input[type="submit"]')[0];
-
-    /**
-     * Whether the Duo interface has finished loading within the iframe.
-     *
-     * @type Boolean
-     */
-    $scope.duoInterfaceLoaded = false;
-
-    /**
-     * Submits the signed response from Duo once the user has authenticated.
-     * This is a callback invoked by the DuoWeb API after the user has been
-     * verified and the signed response has been received.
-     *
-     * @param {HTMLFormElement} form
-     *     The form element provided by the DuoWeb API containing the signed
-     *     response as the value of an input field named "sig_response".
-     */
-    var submitSignedResponse = function submitSignedResponse(form) {
-
-        // Update model to match received response
-        $scope.$apply(function updateModel() {
-            $scope.model = form.elements['sig_response'].value;
-        });
-
-        // Submit updated credentials
-        submit.click();
-
-    };
-
-    // Update Duo loaded state when iframe finishes loading
-    iframe.onload = function duoLoaded() {
-        $scope.$apply(function updateLoadedState() {
-            $scope.duoInterfaceLoaded = true;
-        });
-    };
-
-    // Initialize Duo interface within iframe
-    Duo.init({
-        iframe          : iframe,
-        host            : $scope.field.apiHost,
-        sig_request     : $scope.field.signedRequest,
-        submit_callback : submitSignedResponse
-    });
-
-}]);
diff --git a/extensions/guacamole-auth-duo/src/main/resources/guac-manifest.json b/extensions/guacamole-auth-duo/src/main/resources/guac-manifest.json
index 5d98adca4..2a9d727a9 100644
--- a/extensions/guacamole-auth-duo/src/main/resources/guac-manifest.json
+++ b/extensions/guacamole-auth-duo/src/main/resources/guac-manifest.json
@@ -20,18 +20,6 @@
         "translations/pt.json",
         "translations/ru.json",
         "translations/zh.json"
-    ],
-
-    "js" : [
-        "duo.min.js"
-    ],
-
-    "css" : [
-        "duo.min.css"
-    ],
-
-    "resources" : {
-        "templates/duoSignedResponseField.html" : "text/html"
-    }
+    ]
 
 }
diff --git a/extensions/guacamole-auth-duo/src/main/resources/lib/DuoWeb/Duo-Web-v2.js b/extensions/guacamole-auth-duo/src/main/resources/lib/DuoWeb/Duo-Web-v2.js
deleted file mode 100644
index a02a95756..000000000
--- a/extensions/guacamole-auth-duo/src/main/resources/lib/DuoWeb/Duo-Web-v2.js
+++ /dev/null
@@ -1,366 +0,0 @@
-/**
- * Duo Web SDK v2
- * Copyright 2015, Duo Security
- */
-window.Duo = (function(document, window) {
-    var DUO_MESSAGE_FORMAT = /^(?:AUTH|ENROLL)+\|[A-Za-z0-9\+\/=]+\|[A-Za-z0-9\+\/=]+$/;
-    var DUO_ERROR_FORMAT = /^ERR\|[\w\s\.\(\)]+$/;
-
-    var iframeId = 'duo_iframe',
-        postAction = '',
-        postArgument = 'sig_response',
-        host,
-        sigRequest,
-        duoSig,
-        appSig,
-        iframe,
-        submitCallback;
-
-    function throwError(message, url) {
-        throw new Error(
-            'Duo Web SDK error: ' + message +
-            (url ? ('\n' + 'See ' + url + ' for more information') : '')
-        );
-    }
-
-    function hyphenize(str) {
-        return str.replace(/([a-z])([A-Z])/, '$1-$2').toLowerCase();
-    }
-
-    // cross-browser data attributes
-    function getDataAttribute(element, name) {
-        if ('dataset' in element) {
-            return element.dataset[name];
-        } else {
-            return element.getAttribute('data-' + hyphenize(name));
-        }
-    }
-
-    // cross-browser event binding/unbinding
-    function on(context, event, fallbackEvent, callback) {
-        if ('addEventListener' in window) {
-            context.addEventListener(event, callback, false);
-        } else {
-            context.attachEvent(fallbackEvent, callback);
-        }
-    }
-
-    function off(context, event, fallbackEvent, callback) {
-        if ('removeEventListener' in window) {
-            context.removeEventListener(event, callback, false);
-        } else {
-            context.detachEvent(fallbackEvent, callback);
-        }
-    }
-
-    function onReady(callback) {
-        on(document, 'DOMContentLoaded', 'onreadystatechange', callback);
-    }
-
-    function offReady(callback) {
-        off(document, 'DOMContentLoaded', 'onreadystatechange', callback);
-    }
-
-    function onMessage(callback) {
-        on(window, 'message', 'onmessage', callback);
-    }
-
-    function offMessage(callback) {
-        off(window, 'message', 'onmessage', callback);
-    }
-
-    /**
-     * Parse the sig_request parameter, throwing errors if the token contains
-     * a server error or if the token is invalid.
-     *
-     * @param {String} sig Request token
-     */
-    function parseSigRequest(sig) {
-        if (!sig) {
-            // nothing to do
-            return;
-        }
-
-        // see if the token contains an error, throwing it if it does
-        if (sig.indexOf('ERR|') === 0) {
-            throwError(sig.split('|')[1]);
-        }
-
-        // validate the token
-        if (sig.indexOf(':') === -1 || sig.split(':').length !== 2) {
-            throwError(
-                'Duo was given a bad token.  This might indicate a configuration ' +
-                'problem with one of Duo\'s client libraries.',
-                'https://www.duosecurity.com/docs/duoweb#first-steps'
-            );
-        }
-
-        var sigParts = sig.split(':');
-
-        // hang on to the token, and the parsed duo and app sigs
-        sigRequest = sig;
-        duoSig = sigParts[0];
-        appSig = sigParts[1];
-
-        return {
-            sigRequest: sig,
-            duoSig: sigParts[0],
-            appSig: sigParts[1]
-        };
-    }
-
-    /**
-     * This function is set up to run when the DOM is ready, if the iframe was
-     * not available during `init`.
-     */
-    function onDOMReady() {
-        iframe = document.getElementById(iframeId);
-
-        if (!iframe) {
-            throw new Error(
-                'This page does not contain an iframe for Duo to use.' +
-                'Add an element like <iframe id="duo_iframe"></iframe> ' +
-                'to this page.  ' +
-                'See https://www.duosecurity.com/docs/duoweb#3.-show-the-iframe ' +
-                'for more information.'
-            );
-        }
-
-        // we've got an iframe, away we go!
-        ready();
-
-        // always clean up after yourself
-        offReady(onDOMReady);
-    }
-
-    /**
-     * Validate that a MessageEvent came from the Duo service, and that it
-     * is a properly formatted payload.
-     *
-     * The Google Chrome sign-in page injects some JS into pages that also
-     * make use of postMessage, so we need to do additional validation above
-     * and beyond the origin.
-     *
-     * @param {MessageEvent} event Message received via postMessage
-     */
-    function isDuoMessage(event) {
-        return Boolean(
-            event.origin === ('https://' + host) &&
-            typeof event.data === 'string' &&
-            (
-                event.data.match(DUO_MESSAGE_FORMAT) ||
-                event.data.match(DUO_ERROR_FORMAT)
-            )
-        );
-    }
-
-    /**
-     * Validate the request token and prepare for the iframe to become ready.
-     *
-     * All options below can be passed into an options hash to `Duo.init`, or
-     * specified on the iframe using `data-` attributes.
-     *
-     * Options specified using the options hash will take precedence over
-     * `data-` attributes.
-     *
-     * Example using options hash:
-     * ```javascript
-     * Duo.init({
-     *     iframe: "some_other_id",
-     *     host: "api-main.duo.test",
-     *     sig_request: "...",
-     *     post_action: "/auth",
-     *     post_argument: "resp"
-     * });
-     * ```
-     *
-     * Example using `data-` attributes:
-     * ```
-     * <iframe id="duo_iframe"
-     *         data-host="api-main.duo.test"
-     *         data-sig-request="..."
-     *         data-post-action="/auth"
-     *         data-post-argument="resp"
-     *         >
-     * </iframe>
-     * ```
-     *
-     * @param {Object} options
-     * @param {String} options.iframe                         The iframe, or id of an iframe to set up
-     * @param {String} options.host                           Hostname
-     * @param {String} options.sig_request                    Request token
-     * @param {String} [options.post_action='']               URL to POST back to after successful auth
-     * @param {String} [options.post_argument='sig_response'] Parameter name to use for response token
-     * @param {Function} [options.submit_callback]            If provided, duo will not submit the form instead execute
-     *                                                        the callback function with reference to the "duo_form" form object
-     *                                                        submit_callback can be used to prevent the webpage from reloading.
-     */
-    function init(options) {
-        if (options) {
-            if (options.host) {
-                host = options.host;
-            }
-
-            if (options.sig_request) {
-                parseSigRequest(options.sig_request);
-            }
-
-            if (options.post_action) {
-                postAction = options.post_action;
-            }
-
-            if (options.post_argument) {
-                postArgument = options.post_argument;
-            }
-
-            if (options.iframe) {
-                if ('tagName' in options.iframe) {
-                    iframe = options.iframe;
-                } else if (typeof options.iframe === 'string') {
-                    iframeId = options.iframe;
-                }
-            }
-
-            if (typeof options.submit_callback === 'function') {
-                submitCallback = options.submit_callback;
-            }
-        }
-
-        // if we were given an iframe, no need to wait for the rest of the DOM
-        if (iframe) {
-            ready();
-        } else {
-            // try to find the iframe in the DOM
-            iframe = document.getElementById(iframeId);
-
-            // iframe is in the DOM, away we go!
-            if (iframe) {
-                ready();
-            } else {
-                // wait until the DOM is ready, then try again
-                onReady(onDOMReady);
-            }
-        }
-
-        // always clean up after yourself!
-        offReady(init);
-    }
-
-    /**
-     * This function is called when a message was received from another domain
-     * using the `postMessage` API.  Check that the event came from the Duo
-     * service domain, and that the message is a properly formatted payload,
-     * then perform the post back to the primary service.
-     *
-     * @param event Event object (contains origin and data)
-     */
-    function onReceivedMessage(event) {
-        if (isDuoMessage(event)) {
-            // the event came from duo, do the post back
-            doPostBack(event.data);
-
-            // always clean up after yourself!
-            offMessage(onReceivedMessage);
-        }
-    }
-
-    /**
-     * Point the iframe at Duo, then wait for it to postMessage back to us.
-     */
-    function ready() {
-        if (!host) {
-            host = getDataAttribute(iframe, 'host');
-
-            if (!host) {
-                throwError(
-                    'No API hostname is given for Duo to use.  Be sure to pass ' +
-                    'a `host` parameter to Duo.init, or through the `data-host` ' +
-                    'attribute on the iframe element.',
-                    'https://www.duosecurity.com/docs/duoweb#3.-show-the-iframe'
-                );
-            }
-        }
-
-        if (!duoSig || !appSig) {
-            parseSigRequest(getDataAttribute(iframe, 'sigRequest'));
-
-            if (!duoSig || !appSig) {
-                throwError(
-                    'No valid signed request is given.  Be sure to give the ' +
-                    '`sig_request` parameter to Duo.init, or use the ' +
-                    '`data-sig-request` attribute on the iframe element.',
-                    'https://www.duosecurity.com/docs/duoweb#3.-show-the-iframe'
-                );
-            }
-        }
-
-        // if postAction/Argument are defaults, see if they are specified
-        // as data attributes on the iframe
-        if (postAction === '') {
-            postAction = getDataAttribute(iframe, 'postAction') || postAction;
-        }
-
-        if (postArgument === 'sig_response') {
-            postArgument = getDataAttribute(iframe, 'postArgument') || postArgument;
-        }
-
-        // point the iframe at Duo
-        iframe.src = [
-            'https://', host, '/frame/web/v1/auth?tx=', duoSig,
-            '&parent=', encodeURIComponent(document.location.href),
-            '&v=2.3'
-        ].join('');
-
-        // listen for the 'message' event
-        onMessage(onReceivedMessage);
-    }
-
-    /**
-     * We received a postMessage from Duo.  POST back to the primary service
-     * with the response token, and any additional user-supplied parameters
-     * given in form#duo_form.
-     */
-    function doPostBack(response) {
-        // create a hidden input to contain the response token
-        var input = document.createElement('input');
-        input.type = 'hidden';
-        input.name = postArgument;
-        input.value = response + ':' + appSig;
-
-        // user may supply their own form with additional inputs
-        var form = document.getElementById('duo_form');
-
-        // if the form doesn't exist, create one
-        if (!form) {
-            form = document.createElement('form');
-
-            // insert the new form after the iframe
-            iframe.parentElement.insertBefore(form, iframe.nextSibling);
-        }
-
-        // make sure we are actually posting to the right place
-        form.method = 'POST';
-        form.action = postAction;
-
-        // add the response token input to the form
-        form.appendChild(input);
-
-        // away we go!
-        if (typeof submitCallback === "function") {
-            submitCallback.call(null, form);
-        } else {
-            form.submit();
-        }
-    }
-
-    // when the DOM is ready, initialize
-    // note that this will get cleaned up if the user calls init directly!
-    onReady(init);
-
-    return {
-        init: init,
-        _parseSigRequest: parseSigRequest,
-        _isDuoMessage: isDuoMessage,
-        _doPostBack: doPostBack
-    };
-}(document, window));
diff --git a/extensions/guacamole-auth-duo/src/main/resources/lib/DuoWeb/LICENSE.js b/extensions/guacamole-auth-duo/src/main/resources/lib/DuoWeb/LICENSE.js
deleted file mode 100644
index 58ead2175..000000000
--- a/extensions/guacamole-auth-duo/src/main/resources/lib/DuoWeb/LICENSE.js
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Copyright (c) 2011, Duo Security, Inc.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
\ No newline at end of file
diff --git a/extensions/guacamole-auth-duo/src/main/resources/styles/duo.css b/extensions/guacamole-auth-duo/src/main/resources/styles/duo.css
deleted file mode 100644
index 6d01a85cd..000000000
--- a/extensions/guacamole-auth-duo/src/main/resources/styles/duo.css
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-
-.duo-signature-response-field-container {
-    height: 100%;
-    width: 100%;
-    position: fixed;
-    left: 0;
-    top: 0;
-    display: table;
-    background: white;
-}
-
-.duo-signature-response-field {
-    width: 100%;
-    display: table-cell;
-    vertical-align: middle;
-}
-
-.duo-signature-response-field input[type="submit"] {
-    display: none !important;
-}
-
-.duo-signature-response-field iframe {
-    width: 100%;
-    max-width: 620px;
-    height: 330px;
-    border: none;
-    box-shadow: 4px 4px 8px rgba(0, 0, 0, 0.5);
-    display: block;
-    margin: 1.5em auto;
-}
-
-.duo-signature-response-field iframe {
-    opacity: 1;
-    -webkit-transition: opacity 0.125s;
-    -moz-transition:    opacity 0.125s;
-    -ms-transition:     opacity 0.125s;
-    -o-transition:      opacity 0.125s;
-    transition:         opacity 0.125s;
-}
-
-.duo-signature-response-field.loading iframe {
-    opacity: 0;
-}
diff --git a/extensions/guacamole-auth-duo/src/main/resources/templates/duoSignedResponseField.html b/extensions/guacamole-auth-duo/src/main/resources/templates/duoSignedResponseField.html
deleted file mode 100644
index e51e1900b..000000000
--- a/extensions/guacamole-auth-duo/src/main/resources/templates/duoSignedResponseField.html
+++ /dev/null
@@ -1,6 +0,0 @@
-<div class="duo-signature-response-field-container">
-    <div class="duo-signature-response-field" ng-class="{ loading : !duoInterfaceLoaded }">
-        <iframe></iframe>
-        <input type="submit">
-    </div>
-</div>

From cbd7f60f5d2bdd7d1c10292fa620e39151042fde Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Thu, 5 Oct 2023 17:10:16 -0400
Subject: [PATCH 250/289] GUACAMOLE-1289: Licenses for updated Duo components.

---
 doc/licenses/apache-commons-codec-1.11/NOTICE |  17 ++
 doc/licenses/apache-commons-codec-1.11/README |   8 +
 .../dep-coordinates.txt                       |   1 +
 doc/licenses/duo-universal-sdk-1.1.3/LICENSE  |  25 +++
 doc/licenses/duo-universal-sdk-1.1.3/README   |   8 +
 .../dep-coordinates.txt                       |   1 +
 doc/licenses/java-jwt-3.3.0/LICENSE           |  21 ++
 doc/licenses/java-jwt-3.3.0/README            |   8 +
 .../java-jwt-3.3.0/dep-coordinates.txt        |   1 +
 doc/licenses/kotlin-1.4.10/NOTICE.txt         |   2 +
 doc/licenses/kotlin-1.4.10/README             |   8 +
 .../kotlin-1.4.10/dep-coordinates.txt         |   5 +
 .../logging-interceptor-4.9.1/LICENSE.txt     | 201 ++++++++++++++++++
 doc/licenses/logging-interceptor-4.9.1/NOTICE |  13 ++
 doc/licenses/logging-interceptor-4.9.1/README |   8 +
 .../dep-coordinates.txt                       |   1 +
 doc/licenses/okhttp-3.14.9/LICENSE.txt        | 201 ++++++++++++++++++
 doc/licenses/okhttp-3.14.9/NOTICE             |  13 ++
 doc/licenses/okhttp-3.14.9/README             |   8 +
 .../okhttp-3.14.9/dep-coordinates.txt         |   1 +
 doc/licenses/okio-1.17.2/LICENSE.txt          | 201 ++++++++++++++++++
 doc/licenses/okio-1.17.2/NOTICE               |  13 ++
 doc/licenses/okio-1.17.2/README               |   8 +
 doc/licenses/okio-1.17.2/dep-coordinates.txt  |   1 +
 doc/licenses/retrofit-2.9.0/LICENSE.txt       | 201 ++++++++++++++++++
 doc/licenses/retrofit-2.9.0/NOTICE            |  13 ++
 doc/licenses/retrofit-2.9.0/README            |   8 +
 .../retrofit-2.9.0/dep-coordinates.txt        |   2 +
 28 files changed, 998 insertions(+)
 create mode 100644 doc/licenses/apache-commons-codec-1.11/NOTICE
 create mode 100644 doc/licenses/apache-commons-codec-1.11/README
 create mode 100644 doc/licenses/apache-commons-codec-1.11/dep-coordinates.txt
 create mode 100644 doc/licenses/duo-universal-sdk-1.1.3/LICENSE
 create mode 100644 doc/licenses/duo-universal-sdk-1.1.3/README
 create mode 100644 doc/licenses/duo-universal-sdk-1.1.3/dep-coordinates.txt
 create mode 100644 doc/licenses/java-jwt-3.3.0/LICENSE
 create mode 100644 doc/licenses/java-jwt-3.3.0/README
 create mode 100644 doc/licenses/java-jwt-3.3.0/dep-coordinates.txt
 create mode 100644 doc/licenses/kotlin-1.4.10/NOTICE.txt
 create mode 100644 doc/licenses/kotlin-1.4.10/README
 create mode 100644 doc/licenses/kotlin-1.4.10/dep-coordinates.txt
 create mode 100644 doc/licenses/logging-interceptor-4.9.1/LICENSE.txt
 create mode 100644 doc/licenses/logging-interceptor-4.9.1/NOTICE
 create mode 100644 doc/licenses/logging-interceptor-4.9.1/README
 create mode 100644 doc/licenses/logging-interceptor-4.9.1/dep-coordinates.txt
 create mode 100644 doc/licenses/okhttp-3.14.9/LICENSE.txt
 create mode 100644 doc/licenses/okhttp-3.14.9/NOTICE
 create mode 100644 doc/licenses/okhttp-3.14.9/README
 create mode 100644 doc/licenses/okhttp-3.14.9/dep-coordinates.txt
 create mode 100644 doc/licenses/okio-1.17.2/LICENSE.txt
 create mode 100644 doc/licenses/okio-1.17.2/NOTICE
 create mode 100644 doc/licenses/okio-1.17.2/README
 create mode 100644 doc/licenses/okio-1.17.2/dep-coordinates.txt
 create mode 100644 doc/licenses/retrofit-2.9.0/LICENSE.txt
 create mode 100644 doc/licenses/retrofit-2.9.0/NOTICE
 create mode 100644 doc/licenses/retrofit-2.9.0/README
 create mode 100644 doc/licenses/retrofit-2.9.0/dep-coordinates.txt

diff --git a/doc/licenses/apache-commons-codec-1.11/NOTICE b/doc/licenses/apache-commons-codec-1.11/NOTICE
new file mode 100644
index 000000000..9899d2108
--- /dev/null
+++ b/doc/licenses/apache-commons-codec-1.11/NOTICE
@@ -0,0 +1,17 @@
+Apache Commons Codec
+Copyright 2002-2020 The Apache Software Foundation
+
+This product includes software developed at
+The Apache Software Foundation (https://www.apache.org/).
+
+src/test/org/apache/commons/codec/language/DoubleMetaphoneTest.java
+contains test data from http://aspell.net/test/orig/batch0.tab.
+Copyright (C) 2002 Kevin Atkinson (kevina@gnu.org)
+
+===============================================================================
+
+The content of package org.apache.commons.codec.language.bm has been translated
+from the original php source code available at http://stevemorse.org/phoneticinfo.htm
+with permission from the original authors.
+Original source copyright:
+Copyright (c) 2008 Alexander Beider & Stephen P. Morse.
diff --git a/doc/licenses/apache-commons-codec-1.11/README b/doc/licenses/apache-commons-codec-1.11/README
new file mode 100644
index 000000000..1c9959a73
--- /dev/null
+++ b/doc/licenses/apache-commons-codec-1.11/README
@@ -0,0 +1,8 @@
+Apache Commons Codec (http://commons.apache.org/proper/commons-codec/)
+-----------------------------------------------------------------------
+
+    Version: 1.11
+    From: 'Apache Software Foundation' (https://www.apache.org/)
+    License(s):
+        Apache v2.0
+
diff --git a/doc/licenses/apache-commons-codec-1.11/dep-coordinates.txt b/doc/licenses/apache-commons-codec-1.11/dep-coordinates.txt
new file mode 100644
index 000000000..6eaa2d04e
--- /dev/null
+++ b/doc/licenses/apache-commons-codec-1.11/dep-coordinates.txt
@@ -0,0 +1 @@
+commons-codec:commons-codec:jar:1.11
\ No newline at end of file
diff --git a/doc/licenses/duo-universal-sdk-1.1.3/LICENSE b/doc/licenses/duo-universal-sdk-1.1.3/LICENSE
new file mode 100644
index 000000000..369fbf813
--- /dev/null
+++ b/doc/licenses/duo-universal-sdk-1.1.3/LICENSE
@@ -0,0 +1,25 @@
+Copyright (c) 2022 Cisco Systems, Inc. and/or its affiliates
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. The name of the author may not be used to endorse or promote products
+   derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
\ No newline at end of file
diff --git a/doc/licenses/duo-universal-sdk-1.1.3/README b/doc/licenses/duo-universal-sdk-1.1.3/README
new file mode 100644
index 000000000..5bc1049ae
--- /dev/null
+++ b/doc/licenses/duo-universal-sdk-1.1.3/README
@@ -0,0 +1,8 @@
+Duo Universal SDK for Java (https://duo.com/docs/duoweb)
+--------------------------------------------------------
+
+    Version: 1.1.3
+    From: 'Cisco Systems'
+    License(s):
+        Duo License (bundled/duo-universal-sdk-1.1.3/LICENSE)
+
diff --git a/doc/licenses/duo-universal-sdk-1.1.3/dep-coordinates.txt b/doc/licenses/duo-universal-sdk-1.1.3/dep-coordinates.txt
new file mode 100644
index 000000000..e89d39cd9
--- /dev/null
+++ b/doc/licenses/duo-universal-sdk-1.1.3/dep-coordinates.txt
@@ -0,0 +1 @@
+com.duosecurity:duo-universal-sdk:jar:1.1.3
\ No newline at end of file
diff --git a/doc/licenses/java-jwt-3.3.0/LICENSE b/doc/licenses/java-jwt-3.3.0/LICENSE
new file mode 100644
index 000000000..4a7a13ada
--- /dev/null
+++ b/doc/licenses/java-jwt-3.3.0/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+ 
+Copyright (c) 2015 Auth0, Inc. <support@auth0.com> (http://auth0.com)
+ 
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+ 
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+ 
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
\ No newline at end of file
diff --git a/doc/licenses/java-jwt-3.3.0/README b/doc/licenses/java-jwt-3.3.0/README
new file mode 100644
index 000000000..f00c8aafd
--- /dev/null
+++ b/doc/licenses/java-jwt-3.3.0/README
@@ -0,0 +1,8 @@
+Java JWT (https://github.com/auth0/java-jwt)
+--------------------------------------------
+
+    Version: 3.3.0
+    From: 'Auth0 by Okta' (https://www.auth0.com)
+    License(s):
+        MIT (bundled/java-jwt-3.3.0/LICENSE)
+
diff --git a/doc/licenses/java-jwt-3.3.0/dep-coordinates.txt b/doc/licenses/java-jwt-3.3.0/dep-coordinates.txt
new file mode 100644
index 000000000..4ad3a6064
--- /dev/null
+++ b/doc/licenses/java-jwt-3.3.0/dep-coordinates.txt
@@ -0,0 +1 @@
+com.auth0:java-jwt:jar:3.3.0
\ No newline at end of file
diff --git a/doc/licenses/kotlin-1.4.10/NOTICE.txt b/doc/licenses/kotlin-1.4.10/NOTICE.txt
new file mode 100644
index 000000000..0f3e7c29d
--- /dev/null
+++ b/doc/licenses/kotlin-1.4.10/NOTICE.txt
@@ -0,0 +1,2 @@
+Kotlin Compiler
+Copyright 2010-2023 JetBrains s.r.o and respective authors and developers
diff --git a/doc/licenses/kotlin-1.4.10/README b/doc/licenses/kotlin-1.4.10/README
new file mode 100644
index 000000000..a89a5ceea
--- /dev/null
+++ b/doc/licenses/kotlin-1.4.10/README
@@ -0,0 +1,8 @@
+Kotlin (https://kotlinlang.org/)
+--------------------------------
+
+    Version: 1.4.10
+    From: 'JetBrains s.r.o and respective authors and developers'
+    License(s):
+        Apache v2.0
+
diff --git a/doc/licenses/kotlin-1.4.10/dep-coordinates.txt b/doc/licenses/kotlin-1.4.10/dep-coordinates.txt
new file mode 100644
index 000000000..9eedc33fe
--- /dev/null
+++ b/doc/licenses/kotlin-1.4.10/dep-coordinates.txt
@@ -0,0 +1,5 @@
+org.jetbrains.kotlin:kotlin-reflect:jar:1.4.10
+org.jetbrains.kotlin:kotlin-stdlib:jar:1.4.10
+org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.4.10
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:jar:1.4.10
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:jar:1.4.10
diff --git a/doc/licenses/logging-interceptor-4.9.1/LICENSE.txt b/doc/licenses/logging-interceptor-4.9.1/LICENSE.txt
new file mode 100644
index 000000000..f49a4e16e
--- /dev/null
+++ b/doc/licenses/logging-interceptor-4.9.1/LICENSE.txt
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/logging-interceptor-4.9.1/NOTICE b/doc/licenses/logging-interceptor-4.9.1/NOTICE
new file mode 100644
index 000000000..d8bff2eef
--- /dev/null
+++ b/doc/licenses/logging-interceptor-4.9.1/NOTICE
@@ -0,0 +1,13 @@
+Copyright 2019 Square, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/logging-interceptor-4.9.1/README b/doc/licenses/logging-interceptor-4.9.1/README
new file mode 100644
index 000000000..4755b031c
--- /dev/null
+++ b/doc/licenses/logging-interceptor-4.9.1/README
@@ -0,0 +1,8 @@
+okhttp logging-interceptor (https://square.github.io/okhttp/)
+-------------------------------------------------------------
+
+    Version: 4.9.1
+    From: 'Square Inc'
+    License(s):
+        Apache v2.0
+
diff --git a/doc/licenses/logging-interceptor-4.9.1/dep-coordinates.txt b/doc/licenses/logging-interceptor-4.9.1/dep-coordinates.txt
new file mode 100644
index 000000000..aeab28247
--- /dev/null
+++ b/doc/licenses/logging-interceptor-4.9.1/dep-coordinates.txt
@@ -0,0 +1 @@
+com.squareup.okhttp3:logging-interceptor:jar:4.9.1
\ No newline at end of file
diff --git a/doc/licenses/okhttp-3.14.9/LICENSE.txt b/doc/licenses/okhttp-3.14.9/LICENSE.txt
new file mode 100644
index 000000000..f49a4e16e
--- /dev/null
+++ b/doc/licenses/okhttp-3.14.9/LICENSE.txt
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okhttp-3.14.9/NOTICE b/doc/licenses/okhttp-3.14.9/NOTICE
new file mode 100644
index 000000000..d8bff2eef
--- /dev/null
+++ b/doc/licenses/okhttp-3.14.9/NOTICE
@@ -0,0 +1,13 @@
+Copyright 2019 Square, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okhttp-3.14.9/README b/doc/licenses/okhttp-3.14.9/README
new file mode 100644
index 000000000..7f343e7bd
--- /dev/null
+++ b/doc/licenses/okhttp-3.14.9/README
@@ -0,0 +1,8 @@
+okhttp (https://square.github.io/okhttp/)
+---------------------------------------------
+
+    Version: 3.14.9
+    From: 'Square Inc'
+    License(s):
+        Apache 2.0
+
diff --git a/doc/licenses/okhttp-3.14.9/dep-coordinates.txt b/doc/licenses/okhttp-3.14.9/dep-coordinates.txt
new file mode 100644
index 000000000..ea402ee6b
--- /dev/null
+++ b/doc/licenses/okhttp-3.14.9/dep-coordinates.txt
@@ -0,0 +1 @@
+com.squareup.okhttp3:okhttp:jar:3.14.9
\ No newline at end of file
diff --git a/doc/licenses/okio-1.17.2/LICENSE.txt b/doc/licenses/okio-1.17.2/LICENSE.txt
new file mode 100644
index 000000000..f49a4e16e
--- /dev/null
+++ b/doc/licenses/okio-1.17.2/LICENSE.txt
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okio-1.17.2/NOTICE b/doc/licenses/okio-1.17.2/NOTICE
new file mode 100644
index 000000000..25fdd5926
--- /dev/null
+++ b/doc/licenses/okio-1.17.2/NOTICE
@@ -0,0 +1,13 @@
+Copyright 2013 Square, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okio-1.17.2/README b/doc/licenses/okio-1.17.2/README
new file mode 100644
index 000000000..74976b808
--- /dev/null
+++ b/doc/licenses/okio-1.17.2/README
@@ -0,0 +1,8 @@
+okio (https://square.github.io/okio/)
+---------------------------------------------
+
+    Version: 1.17.2
+    From: 'Square Inc'
+    License(s):
+        Apache 2.0 (bundled/retrofit-2.9.0/LICENSE.txt)
+
diff --git a/doc/licenses/okio-1.17.2/dep-coordinates.txt b/doc/licenses/okio-1.17.2/dep-coordinates.txt
new file mode 100644
index 000000000..566082a42
--- /dev/null
+++ b/doc/licenses/okio-1.17.2/dep-coordinates.txt
@@ -0,0 +1 @@
+com.squareup.okio:okio:jar:1.17.2
\ No newline at end of file
diff --git a/doc/licenses/retrofit-2.9.0/LICENSE.txt b/doc/licenses/retrofit-2.9.0/LICENSE.txt
new file mode 100644
index 000000000..f49a4e16e
--- /dev/null
+++ b/doc/licenses/retrofit-2.9.0/LICENSE.txt
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/retrofit-2.9.0/NOTICE b/doc/licenses/retrofit-2.9.0/NOTICE
new file mode 100644
index 000000000..25fdd5926
--- /dev/null
+++ b/doc/licenses/retrofit-2.9.0/NOTICE
@@ -0,0 +1,13 @@
+Copyright 2013 Square, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/retrofit-2.9.0/README b/doc/licenses/retrofit-2.9.0/README
new file mode 100644
index 000000000..8de113264
--- /dev/null
+++ b/doc/licenses/retrofit-2.9.0/README
@@ -0,0 +1,8 @@
+retrofit (https://square.github.io/retrofit/)
+---------------------------------------------
+
+    Version: 2.9.0
+    From: 'Square Inc'
+    License(s):
+        Apache 2.0 (bundled/retrofit-2.9.0/LICENSE.txt)
+
diff --git a/doc/licenses/retrofit-2.9.0/dep-coordinates.txt b/doc/licenses/retrofit-2.9.0/dep-coordinates.txt
new file mode 100644
index 000000000..43f8e2898
--- /dev/null
+++ b/doc/licenses/retrofit-2.9.0/dep-coordinates.txt
@@ -0,0 +1,2 @@
+com.squareup.retrofit2:retrofit:jar:2.9.0
+com.squareup.retrofit2:converter-jackson:jar:2.9.0
\ No newline at end of file

From 7807bb9c112b4c7969eceffc79ce842c5f35be1d Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Fri, 6 Oct 2023 14:22:27 -0400
Subject: [PATCH 251/289] GUACMAOLE-1289: Fixup and debugging.

---
 .../auth/duo/DuoAuthenticationProviderModule.java     | 11 ++++++++++-
 .../guacamole/auth/duo/UserVerificationService.java   |  9 +++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
index c50e1039d..2b5e5d0b2 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
@@ -41,6 +41,11 @@ public class DuoAuthenticationProviderModule extends AbstractModule {
      * module has configured injection.
      */
     private final AuthenticationProvider authProvider;
+    
+    /**
+     * The session manager that stores authentication attempts.
+     */
+    private final DuoAuthenticationSessionManager authSessionManager;
 
     /**
      * Creates a new Duo authentication provider module which configures
@@ -61,6 +66,9 @@ public class DuoAuthenticationProviderModule extends AbstractModule {
 
         // Store associated auth provider
         this.authProvider = authProvider;
+        
+        // Create a new session manager
+        this.authSessionManager = new DuoAuthenticationSessionManager();
 
     }
 
@@ -72,9 +80,10 @@ public class DuoAuthenticationProviderModule extends AbstractModule {
         bind(Environment.class).toInstance(environment);
 
         // Bind Duo-specific services
+        bind(DuoAuthenticationSessionManager.class).toInstance(authSessionManager);
         bind(ConfigurationService.class);
         bind(UserVerificationService.class);
-        bind(DuoAuthenticationSessionManager.class);
+        
 
     }
 
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
index 7ac16d51a..d38a4c6c6 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
@@ -37,12 +37,16 @@ import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * Service for verifying the identity of a user against Duo.
  */
 public class UserVerificationService {
 
+    private static final Logger LOGGER = LoggerFactory.getLogger(UserVerificationService.class);
+    
     /**
      * The name of the parameter which Duo will return in it's GET call-back
      * that contains the code that the client will use to generate a token.
@@ -124,6 +128,7 @@ public class UserVerificationService {
 
             // Get a new session state from the Duo client
             duoState = duoClient.generateState();
+            LOGGER.debug(">>> DUO <<< STATE DEFER: {}", duoState);
             
             // Add this session 
             duoSessionManager.defer(new DuoAuthenticationSession(confService.getAuthTimeout(), duoState, username), duoState);
@@ -142,9 +147,13 @@ public class UserVerificationService {
             );
 
         }
+        
+        LOGGER.debug(">>> DUO <<< STATE RESUME: {}", duoState);
 
         // Retrieve the deferred authenticaiton attempt
         DuoAuthenticationSession duoSession = duoSessionManager.resume(duoState);
+        if (duoSession == null)
+            throw new GuacamoleServerException("Failed to resume Duo authentication session.");
         
         // Get the token from the DuoClient using the code and username, and check status
         Token token = duoClient.exchangeAuthorizationCodeFor2FAResult(duoCode, duoSession.getUsername());

From b0e5ecd33e9391782b984f889336630480afee5d Mon Sep 17 00:00:00 2001
From: Alex Leitner <leitnersalex@gmail.com>
Date: Mon, 25 Mar 2024 01:27:11 +0000
Subject: [PATCH 252/289] GUACAMOLE-1289: Handle resumable state for duo
 authentication.

---
 .../duo/DuoAuthenticationProviderModule.java  | 11 ---
 .../auth/duo/DuoAuthenticationSession.java    | 74 -----------------
 .../duo/DuoAuthenticationSessionManager.java  | 34 --------
 .../auth/duo/UserVerificationService.java     | 33 ++------
 ...amoleInsufficientCredentialsException.java | 32 ++++++++
 ...amoleInsufficientCredentialsException.java | 78 ++++++++++++++++++
 .../rest/auth/AuthenticationService.java      | 48 ++++++++++-
 .../auth/ResumableAuthenticationState.java    | 81 +++++++++++++++++++
 8 files changed, 243 insertions(+), 148 deletions(-)
 delete mode 100644 extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java
 delete mode 100644 extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java

diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
index 2b5e5d0b2..b9a37b070 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
@@ -41,11 +41,6 @@ public class DuoAuthenticationProviderModule extends AbstractModule {
      * module has configured injection.
      */
     private final AuthenticationProvider authProvider;
-    
-    /**
-     * The session manager that stores authentication attempts.
-     */
-    private final DuoAuthenticationSessionManager authSessionManager;
 
     /**
      * Creates a new Duo authentication provider module which configures
@@ -66,10 +61,6 @@ public class DuoAuthenticationProviderModule extends AbstractModule {
 
         // Store associated auth provider
         this.authProvider = authProvider;
-        
-        // Create a new session manager
-        this.authSessionManager = new DuoAuthenticationSessionManager();
-
     }
 
     @Override
@@ -80,11 +71,9 @@ public class DuoAuthenticationProviderModule extends AbstractModule {
         bind(Environment.class).toInstance(environment);
 
         // Bind Duo-specific services
-        bind(DuoAuthenticationSessionManager.class).toInstance(authSessionManager);
         bind(ConfigurationService.class);
         bind(UserVerificationService.class);
         
-
     }
 
 }
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java
deleted file mode 100644
index 8dd3e8db1..000000000
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.duo;
-
-import org.apache.guacamole.net.auth.AuthenticationSession;
-
-/**
- * An AuthenticationSession that stores the information required for an
- * in-progress Duo authentication attempt.
- */
-public class DuoAuthenticationSession extends AuthenticationSession {
-    
-    /**
-     * The session state generated by the Duo client, which is used to track
-     * the session through the redirect and return process.
-     */
-    private final String state;
-    
-    /**
-     * The username of the user who is authenticating with this session.
-     */
-    private final String username;
-    
-    /**
-     * Create a new instance of this authenticaiton session, having the given length of time
-     * for expriation and the state generated by the Duo Client.
-     * 
-     * @param expires
-     *     The number of milliseconds before this session is invalid.
-     * 
-     * @param state 
-     *     The session state, as generated by the Duo Client.
-     * 
-     * @param username
-     *     The username of the user who is attempting authentication with Duo.
-     */
-    public DuoAuthenticationSession(long expires, String state, String username) {
-        super(expires);
-        this.state = state;
-        this.username = username;
-    }
-    
-    /**
-     * Return the stored session state.
-     * 
-     * @return 
-     *     The stored session state.
-     */
-    public String getState() {
-        return state;
-    }
-    
-    public String getUsername() {
-        return username;
-    }
-    
-}
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java
deleted file mode 100644
index 9bfbcc466..000000000
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.guacamole.auth.duo;
-
-import com.google.inject.Singleton;
-import org.apache.guacamole.net.auth.AuthenticationSessionManager;
-
-/**
- * An AuthenticationSessionManager implementation that temporarily stores
- * authentication attempts for Duo MFA while they are underway.
- */
-@Singleton
-public class DuoAuthenticationSessionManager extends AuthenticationSessionManager<DuoAuthenticationSession> {
-    
-    // Nothing to see here.
-    
-}
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
index d38a4c6c6..560683686 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
@@ -45,7 +45,7 @@ import org.slf4j.LoggerFactory;
  */
 public class UserVerificationService {
 
-    private static final Logger LOGGER = LoggerFactory.getLogger(UserVerificationService.class);
+    private static final Logger logger = LoggerFactory.getLogger(UserVerificationService.class);
     
     /**
      * The name of the parameter which Duo will return in it's GET call-back
@@ -63,7 +63,7 @@ public class UserVerificationService {
      * The value that will be returned in the token if Duo authentication
      * was successful.
      */
-    private static final String DUO_TOKEN_SUCCESS_VALUE = "ALLOW";
+    private static final String DUO_TOKEN_SUCCESS_VALUE = "allow";
     
     /**
      * Service for retrieving Duo configuration information.
@@ -71,13 +71,6 @@ public class UserVerificationService {
     @Inject
     private ConfigurationService confService;
 
-    /**
-     * The authentication session manager that temporarily stores in-progress
-     * authentication attempts.
-     */
-    @Inject
-    private DuoAuthenticationSessionManager duoSessionManager;
-
     /**
      * Verifies the identity of the given user via the Duo multi-factor
      * authentication service. If a signed response from Duo has not already
@@ -116,8 +109,7 @@ public class UserVerificationService {
                 confService.getRedirectUrl().toString())
                 .build();
         
-            duoClient.healthCheck();
-        
+        duoClient.healthCheck();
         
         // Retrieve signed Duo Code and State from the request
         String duoCode = request.getParameter(DUO_CODE_PARAMETER_NAME);
@@ -128,10 +120,7 @@ public class UserVerificationService {
 
             // Get a new session state from the Duo client
             duoState = duoClient.generateState();
-            LOGGER.debug(">>> DUO <<< STATE DEFER: {}", duoState);
-            
-            // Add this session 
-            duoSessionManager.defer(new DuoAuthenticationSession(confService.getAuthTimeout(), duoState, username), duoState);
+            long expirationTimestamp = System.currentTimeMillis() + (confService.getAuthTimeout() * 1000L);
 
             // Request additional credentials
             throw new TranslatableGuacamoleInsufficientCredentialsException(
@@ -143,27 +132,21 @@ public class UserVerificationService {
                             new URI(duoClient.createAuthUrl(username, duoState)),
                             new TranslatableMessage("LOGIN.INFO_DUO_REDIRECT_PENDING")
                     )
-                ))
+                )),
+                duoState,
+                expirationTimestamp
             );
 
         }
         
-        LOGGER.debug(">>> DUO <<< STATE RESUME: {}", duoState);
-
-        // Retrieve the deferred authenticaiton attempt
-        DuoAuthenticationSession duoSession = duoSessionManager.resume(duoState);
-        if (duoSession == null)
-            throw new GuacamoleServerException("Failed to resume Duo authentication session.");
-        
         // Get the token from the DuoClient using the code and username, and check status
-        Token token = duoClient.exchangeAuthorizationCodeFor2FAResult(duoCode, duoSession.getUsername());
+        Token token = duoClient.exchangeAuthorizationCodeFor2FAResult(duoCode, username);
         if (token == null 
                 || token.getAuth_result() == null 
                 || !DUO_TOKEN_SUCCESS_VALUE.equals(token.getAuth_result().getStatus()))
             throw new TranslatableGuacamoleClientException("Provided Duo "
                     + "validation code is incorrect.",
                     "LOGIN.INFO_DUO_VALIDATION_CODE_INCORRECT");
-
         }
         catch (DuoException e) {
             throw new GuacamoleServerException("Duo Client error.", e);
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java b/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java
index 5b51d2ce9..648e15007 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java
@@ -136,6 +136,38 @@ public class TranslatableGuacamoleInsufficientCredentialsException
         this(message, new TranslatableMessage(key), credentialsInfo);
     }
 
+    /**
+     * Creates a new TranslatableGuacamoleInsufficientCredentialsException with the specified message,
+     * translation key, the credential information required for authentication, the state token, and
+     * an expiration timestamp for the state token. The message is provided in both a non-translatable
+     * form and as a translatable key which can be used to retrieve the localized message.
+     *
+     * @param message
+     *     A human-readable description of the exception that occurred. This
+     *     message should be readable on its own and as-written, without
+     *     requiring a translation service.
+     *
+     * @param key
+     *     The arbitrary key which can be used to look up the message to be
+     *     displayed in the user's native language.
+     *
+     * @param credentialsInfo
+     *     Information describing the form of valid credentials.
+     *
+     * @param state
+     *     An opaque value that may be used by a client to maintain state across requests which are part
+     *     of the same authentication transaction.
+     *
+     * @param expires
+     *     The timestamp after which the state token associated with the authentication process expires,
+     *     specified as the number of milliseconds since the UNIX epoch.
+     */
+    public TranslatableGuacamoleInsufficientCredentialsException(String message,
+            String key, CredentialsInfo credentialsInfo, String state, long expires) {
+                super(message, credentialsInfo, state, expires);
+                this.translatableMessage = new TranslatableMessage(key);
+    }
+
     @Override
     public TranslatableMessage getTranslatableMessage() {
         return translatableMessage;
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
index 06ae3ea5c..c7a903c95 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
@@ -28,6 +28,57 @@ package org.apache.guacamole.net.auth.credentials;
  */
 public class GuacamoleInsufficientCredentialsException extends GuacamoleCredentialsException {
 
+/**
+ * The default state token to use when no specific state information is provided.
+ */
+private static final String DEFAULT_STATE = "";
+
+/**
+ * The default expiration timestamp to use when no specific expiration is provided,
+ * effectively indicating that the state token does not expire.
+ */
+private static final long DEFAULT_EXPIRES = -1L;
+
+/**
+ * An opaque value that may be used by a client to maintain state across requests
+ * which are part of the same authentication transaction.
+ */
+protected final String state;
+
+/**
+ * The timestamp after which the state token associated with the authentication process
+ * should no longer be considered valid, expressed as the number of milliseconds since
+ * UNIX epoch.
+ */
+protected final long expires;
+
+    /**
+     * Creates a new GuacamoleInsufficientCredentialsException with the specified
+     * message, the credential information required for authentication, the state
+     * token associated with the authentication process, and an expiration timestamp.
+     *
+     * @param message
+     *     A human-readable description of the exception that occurred.
+     *
+     * @param credentialsInfo
+     *     Information describing the form of valid credentials.
+     *
+     * @param state
+     *     An opaque value that may be used by a client to maintain state
+     *     across requests which are part of the same authentication transaction.
+     *
+     * @param expires
+     *     The timestamp after which the state token associated with the
+     *     authentication process should no longer be considered valid, expressed
+     *     as the number of milliseconds since UNIX epoch.
+     */
+   public GuacamoleInsufficientCredentialsException(String message,
+            CredentialsInfo credentialsInfo, String state, long expires) {
+        super(message, credentialsInfo);
+        this.state = state;
+        this.expires = expires;
+    }
+
     /**
      * Creates a new GuacamoleInsufficientCredentialsException with the given
      * message, cause, and associated credential information.
@@ -44,6 +95,8 @@ public class GuacamoleInsufficientCredentialsException extends GuacamoleCredenti
     public GuacamoleInsufficientCredentialsException(String message, Throwable cause,
             CredentialsInfo credentialsInfo) {
         super(message, cause, credentialsInfo);
+        this.state = DEFAULT_STATE;
+        this.expires = DEFAULT_EXPIRES;
     }
 
     /**
@@ -58,6 +111,8 @@ public class GuacamoleInsufficientCredentialsException extends GuacamoleCredenti
      */
     public GuacamoleInsufficientCredentialsException(String message, CredentialsInfo credentialsInfo) {
         super(message, credentialsInfo);
+        this.state = DEFAULT_STATE;
+        this.expires = DEFAULT_EXPIRES;
     }
 
     /**
@@ -72,6 +127,29 @@ public class GuacamoleInsufficientCredentialsException extends GuacamoleCredenti
      */
     public GuacamoleInsufficientCredentialsException(Throwable cause, CredentialsInfo credentialsInfo) {
         super(cause, credentialsInfo);
+        this.state = DEFAULT_STATE;
+        this.expires = DEFAULT_EXPIRES;
+    }
+
+    /**
+     * Retrieves the state token associated with the authentication process.
+     *
+     * @return The opaque state token used to maintain consistency across multiple
+     *         requests in the same authentication transaction.
+     */
+    public String getState() {
+        return state;
+    }
+
+    /**
+     * Retrieves the expiration timestamp of the state token, specified as the
+     * number of milliseconds since the UNIX epoch.
+     *
+     * @return The expiration timestamp of the state token, or a negative value if
+     *         the token does not expire.
+     */
+    public long getExpires() {
+        return expires;
     }
 
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
index 305073de3..2946b1276 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
@@ -21,11 +21,14 @@ package org.apache.guacamole.rest.auth;
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
 import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
 
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleSecurityException;
-import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.GuacamoleUnauthorizedException;
 import org.apache.guacamole.GuacamoleSession;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
@@ -43,9 +46,12 @@ import org.glassfish.jersey.server.ContainerRequest;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.google.inject.Singleton;
+
 /**
  * A service for performing authentication checks in REST endpoints.
  */
+@Singleton
 public class AuthenticationService {
 
     /**
@@ -96,6 +102,11 @@ public class AuthenticationService {
      */
     public static final String TOKEN_PARAMETER_NAME = "token";
 
+    /** 
+     * Map to store resumable authentication states with an expiration time.
+     */ 
+    private Map<String, ResumableAuthenticationState> resumableStateMap = new ConcurrentHashMap<>();
+
     /**
      * Attempts authentication against all AuthenticationProviders, in order,
      * using the provided credentials. The first authentication failure takes
@@ -310,6 +321,17 @@ public class AuthenticationService {
                 try {
                     userContext = authProvider.getUserContext(authenticatedUser);
                 }
+                catch (GuacamoleInsufficientCredentialsException e) {
+                    // Store state and expiration
+                    String state = e.getState();
+                    long expiration = e.getExpires();
+
+                    resumableStateMap.put(state, new ResumableAuthenticationState(expiration, credentials));
+
+                    throw new GuacamoleAuthenticationProcessException("User "
+                    + "authentication aborted during initial "
+                    + "UserContext creation.", authProvider, e);
+                }
                 catch (GuacamoleException | RuntimeException | Error e) {
                     throw new GuacamoleAuthenticationProcessException("User "
                             + "authentication aborted during initial "
@@ -366,12 +388,30 @@ public class AuthenticationService {
 
         AuthenticatedUser authenticatedUser;
         String authToken;
+        Credentials actualCredentials = credentials;
+        String state;
+        ResumableAuthenticationState resumableState = null;
+
+        // Retrieve signed State from the request
+        HttpServletRequest request = credentials.getRequest();
+
+        // If state is provided, attempt to resume authentication
+        if ((state = request.getParameter("state")) != null && (resumableState = resumableStateMap.get(state)) != null) {
+            // The resumableState is removed as it should be a single-use token
+            resumableStateMap.remove(state);
+
+            // Check if the resumableState has expired
+            if (!resumableState.isExpired()) {
+                actualCredentials = resumableState.getCredentials();
+                actualCredentials.setRequest(request);
+            }
+        }
 
         try {
 
             // Get up-to-date AuthenticatedUser and associated UserContexts
-            authenticatedUser = getAuthenticatedUser(existingSession, credentials);
-            List<DecoratedUserContext> userContexts = getUserContexts(existingSession, authenticatedUser, credentials);
+            authenticatedUser = getAuthenticatedUser(existingSession, actualCredentials);
+            List<DecoratedUserContext> userContexts = getUserContexts(existingSession, authenticatedUser, actualCredentials);
 
             // Update existing session, if it exists
             if (existingSession != null) {
@@ -401,7 +441,7 @@ public class AuthenticationService {
         // Log and rethrow any authentication errors
         catch (GuacamoleAuthenticationProcessException e) {
 
-            listenerService.handleEvent(new AuthenticationFailureEvent(credentials,
+            listenerService.handleEvent(new AuthenticationFailureEvent(actualCredentials,
                     e.getAuthenticationProvider(), e.getCause()));
 
             // Rethrow exception
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java
new file mode 100644
index 000000000..3e24f4f04
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.guacamole.rest.auth;
+
+import org.apache.guacamole.net.auth.Credentials;
+
+/**
+ * Encapsulates the state information required for resuming an authentication
+ * process. This includes an expiration timestamp to determine state validity
+ * and the original credentials submitted by the user.
+ */
+public class ResumableAuthenticationState {
+    
+    /**
+     * The timestamp at which this state should no longer be considered valid,
+     * measured in milliseconds since the Unix epoch.
+     */
+    private long expirationTimestamp;
+    
+    /**
+     * The original user credentials that were submitted at the start of the
+     * authentication process.
+     */
+    private Credentials credentials;
+
+    /**
+     * Constructs a new ResumableAuthenticationState object with the specified
+     * expiration timestamp and user credentials.
+     *
+     * @param expirationTimestamp
+     *     The timestamp in milliseconds since the Unix epoch when this state
+     *     expires and can no longer be used to resume authentication.
+     *
+     * @param credentials
+     *     The Credentials object initially submitted by the user and associated
+     *     with this resumable state.
+     */
+    public ResumableAuthenticationState(long expirationTimestamp, Credentials credentials) {
+        this.expirationTimestamp = expirationTimestamp;
+        this.credentials = credentials;
+    }
+
+    /**
+     * Checks if this resumable state has expired based on the stored expiration
+     * timestamp and the current system time.
+     *
+     * @return 
+     *     True if the current system time is after the expiration timestamp,
+     *     indicating that the state is expired; false otherwise.
+     */
+    public boolean isExpired() {
+        return System.currentTimeMillis() > expirationTimestamp;
+    }
+
+    /**
+     * Retrieves the original credentials associated with this resumable state.
+     *
+     * @return 
+     *     The Credentials object containing user details that were submitted
+     *     when the state was created.
+     */
+    public Credentials getCredentials() {
+        return this.credentials;
+    }
+}

From f5fa04d331fac3560bb31b7b4d5bd30088f7693d Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Thu, 28 Mar 2024 21:53:29 +0000
Subject: [PATCH 253/289] GUACAMOLE-1931: Add configuration option to allow
 overwriting typescript files.

---
 .../resources/org/apache/guacamole/protocols/kubernetes.json | 5 +++++
 .../main/resources/org/apache/guacamole/protocols/ssh.json   | 5 +++++
 .../resources/org/apache/guacamole/protocols/telnet.json     | 5 +++++
 guacamole/src/main/frontend/src/translations/en.json         | 4 ++++
 4 files changed, 19 insertions(+)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/kubernetes.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/kubernetes.json
index 266d9f271..c0f23eb50 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/kubernetes.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/kubernetes.json
@@ -122,6 +122,11 @@
                     "name"  : "create-typescript-path",
                     "type"  : "BOOLEAN",
                     "options" : [ "true" ]
+                },
+                {
+                    "name"  : "typescript-write-existing",
+                    "type"  : "BOOLEAN",
+                    "options" : [ "true" ]
                 }
             ]
         },
diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/ssh.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/ssh.json
index 34b1ed5b7..3f27172c8 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/ssh.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/ssh.json
@@ -140,6 +140,11 @@
                     "name"  : "create-typescript-path",
                     "type"  : "BOOLEAN",
                     "options" : [ "true" ]
+                },
+                {
+                    "name"  : "typescript-write-existing",
+                    "type"  : "BOOLEAN",
+                    "options" : [ "true" ]
                 }
             ]
         },
diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/telnet.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/telnet.json
index 679d120fb..42640b5eb 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/telnet.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/telnet.json
@@ -122,6 +122,11 @@
                     "name"  : "create-typescript-path",
                     "type"  : "BOOLEAN",
                     "options" : [ "true" ]
+                },
+                {
+                    "name"  : "typescript-write-existing",
+                    "type"  : "BOOLEAN",
+                    "options" : [ "true" ]
                 }
             ]
         },
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 5a2ecfdf4..ade20a940 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -46,6 +46,7 @@
         "FIELD_HEADER_PASSWORD"       : "Password:",
         "FIELD_HEADER_PASSWORD_AGAIN" : "Re-enter Password:",
         "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "Allow writing to existing recording file:",
+        "FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING" : "Allow writing to existing typescript file:",
 
         "FIELD_PLACEHOLDER_FILTER" : "Filter",
 
@@ -524,6 +525,7 @@
         "FIELD_HEADER_SCROLLBACK"      : "Maximum scrollback size:",
         "FIELD_HEADER_TYPESCRIPT_NAME" : "Typescript name:",
         "FIELD_HEADER_TYPESCRIPT_PATH" : "Typescript path:",
+        "FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING" : "@:APP.FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING",
         "FIELD_HEADER_USE_SSL"         : "Use SSL/TLS",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
@@ -753,6 +755,7 @@
         "FIELD_HEADER_TIMEZONE"        : "Time zone ($TZ):",
         "FIELD_HEADER_TYPESCRIPT_NAME" : "Typescript name:",
         "FIELD_HEADER_TYPESCRIPT_PATH" : "Typescript path:",
+        "FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING" : "@:APP.FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING",
         "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Broadcast address for WoL packet:",
         "FIELD_HEADER_WOL_MAC_ADDR"       : "MAC address of the remote host:",
         "FIELD_HEADER_WOL_SEND_PACKET"    : "Send WoL packet:",
@@ -837,6 +840,7 @@
         "FIELD_HEADER_TERMINAL_TYPE"   : "Terminal type:",
         "FIELD_HEADER_TYPESCRIPT_NAME" : "Typescript name:",
         "FIELD_HEADER_TYPESCRIPT_PATH" : "Typescript path:",
+        "FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING" : "@:APP.FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING",
         "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Broadcast address for WoL packet:",
         "FIELD_HEADER_WOL_MAC_ADDR"       : "MAC address of the remote host:",
         "FIELD_HEADER_WOL_SEND_PACKET"    : "Send WoL packet:",

From 17f16428f899b718184cd3759c23f1ecdca496e8 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Sun, 12 Mar 2023 20:18:15 -0400
Subject: [PATCH 254/289] GUACAMOLE-1479: Correct AbstractUserGroup to actually
 be an abstract class.

---
 .../java/org/apache/guacamole/net/auth/AbstractUserGroup.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AbstractUserGroup.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AbstractUserGroup.java
index f63bfae7f..2c89cb050 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AbstractUserGroup.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AbstractUserGroup.java
@@ -29,7 +29,7 @@ import org.apache.guacamole.net.auth.permission.SystemPermissionSet;
  * Base implementation of UserGroup which provides default implementations of
  * most functions.
  */
-public class AbstractUserGroup extends AbstractIdentifiable implements UserGroup {
+public abstract class AbstractUserGroup extends AbstractIdentifiable implements UserGroup {
 
     /**
      * {@inheritDoc}

From beacffbfc78b0940ce8ac4b98ad97ba0e54ae510 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Sun, 12 Mar 2023 20:49:22 -0400
Subject: [PATCH 255/289] GUACAMOLE-1479: Implement the disabled methods in
 guacamole-ext User and UserGroup classes.

---
 .../guacamole/net/auth/DelegatingUser.java    | 10 +++++++++
 .../net/auth/DelegatingUserGroup.java         | 10 +++++++++
 .../org/apache/guacamole/net/auth/User.java   | 17 ++++++++++++++
 .../apache/guacamole/net/auth/UserGroup.java  | 19 ++++++++++++++++
 .../guacamole/net/auth/simple/SimpleUser.java | 22 +++++++++++++++++++
 .../net/auth/simple/SimpleUserGroup.java      | 22 +++++++++++++++++++
 6 files changed, 100 insertions(+)

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUser.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUser.java
index 9da0fb561..9f2d93b23 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUser.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUser.java
@@ -77,6 +77,16 @@ public class DelegatingUser implements User {
     public void setPassword(String password) {
         user.setPassword(password);
     }
+    
+    @Override
+    public boolean isDisabled() {
+        return user.isDisabled();
+    }
+    
+    @Override
+    public void setDisabled(boolean disabled) {
+        user.setDisabled(disabled);
+    }
 
     @Override
     public Map<String, String> getAttributes() {
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserGroup.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserGroup.java
index 22aa39a76..d52530748 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserGroup.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/DelegatingUserGroup.java
@@ -65,6 +65,16 @@ public class DelegatingUserGroup implements UserGroup {
     public void setIdentifier(String identifier) {
         userGroup.setIdentifier(identifier);
     }
+    
+    @Override
+    public boolean isDisabled() {
+        return userGroup.isDisabled();
+    }
+    
+    @Override
+    public void setDisabled(boolean disabled) {
+        userGroup.setDisabled(disabled);
+    }
 
     @Override
     public Map<String, String> getAttributes() {
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/User.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/User.java
index 788e8d674..9cdec2a07 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/User.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/User.java
@@ -79,6 +79,23 @@ public interface User extends Identifiable, Attributes, Permissions {
      * @param password The password to set.
      */
     public void setPassword(String password);
+    
+    /**
+     * Returns true if this user account is disabled, otherwise false.
+     * 
+     * @return 
+     *     True if this user account is disabled, otherwise false.
+     */
+    public boolean isDisabled();
+    
+    /**
+     * Set the disabled status of this account to the boolean parameter as
+     * provided, true if the account should be disabled, otherwise false.
+     * 
+     * @param disabled 
+     *     True if the account should be disabled, otherwise false.
+     */
+    public void setDisabled(boolean disabled);
 
     /**
      * Returns the date and time that this user was last active. If the user
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserGroup.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserGroup.java
index 4dd167d13..cbb26a9e8 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserGroup.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserGroup.java
@@ -28,6 +28,25 @@ import org.apache.guacamole.GuacamoleException;
  */
 public interface UserGroup extends Identifiable, Attributes, Permissions {
 
+    /**
+     * Returns true if the user group is disabled, making membership in the group
+     * ineffective, meaning that any permissions or other group membership
+     * assigned to this group will not apply to member groups and users.
+     * 
+     * @return 
+     *     True if the group is disabled, otherwise false.
+     */
+    public boolean isDisabled();
+    
+    /**
+     * Set the disabled status of the user group, passing a boolean true value
+     * if the user group should be disabled, otherwise false.
+     * 
+     * @param disabled 
+     *     True if the user group should be disabled, otherwise false.
+     */
+    public void setDisabled(boolean disabled);
+    
     /**
      * Returns a set of all readable user groups of which this user group is a
      * member. If permission is granted for the current user to modify the
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUser.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUser.java
index 8e349e27c..9274ea23f 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUser.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUser.java
@@ -64,6 +64,28 @@ public class SimpleUser extends AbstractUser {
     public SimpleUser(String username) {
         super.setIdentifier(username);
     }
+    
+    /**
+     * {@inheritDoc}
+     * 
+     * <p>This User implementation is always enabled, so this method will
+     * always return false.
+     */
+    @Override
+    public boolean isDisabled() {
+        return false;
+    }
+    
+    /**
+     * {@inheritDoc}
+     * 
+     * <p>This User implementation is always enabled, so this method will
+     * silently ignore the value passed in under the disabled parameter.
+     */
+    @Override
+    public void setDisabled(boolean disabled) {
+        // Silently ignore disabled value
+    }
 
     /**
      * Adds a new READ permission to the given set of permissions for each of
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUserGroup.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUserGroup.java
index be52d1642..f06eabfe1 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUserGroup.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUserGroup.java
@@ -43,5 +43,27 @@ public class SimpleUserGroup extends AbstractUserGroup {
     public SimpleUserGroup(String identifier) {
         super.setIdentifier(identifier);
     }
+    
+    /**
+     * {@inheritDoc}
+     * 
+     * <p>This implementation of UserGroup is always enabled, so this will
+     * always return false.
+     */
+    @Override
+    public boolean isDisabled() {
+        return false;
+    }
+    
+    /**
+     * {@inheritDoc}
+     * 
+     * <p>This implementation of UserGroup is always enabled, so this method
+     * will silently ignore the value passed in the disabled parameter.
+     */
+    @Override
+    public void setDisabled(boolean disabled) {
+        // Silently ignore as the UserGroup implementation is always enabled.
+    }
 
 }

From 75250148b0170f71bcd4090a3dd388d13d1845db Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Sun, 12 Mar 2023 20:49:50 -0400
Subject: [PATCH 256/289] GUACAMOLE-1479: Implement the disabled methods for
 User and UserGroup in REST API.

---
 .../apache/guacamole/rest/user/APIUser.java   | 47 +++++++++++++++++--
 .../guacamole/rest/user/APIUserWrapper.java   | 10 ++++
 .../rest/user/UserObjectTranslator.java       |  3 ++
 .../rest/usergroup/APIUserGroup.java          | 27 +++++++++++
 .../rest/usergroup/APIUserGroupWrapper.java   | 10 ++++
 .../usergroup/UserGroupObjectTranslator.java  |  3 ++
 6 files changed, 95 insertions(+), 5 deletions(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/user/APIUser.java b/guacamole/src/main/java/org/apache/guacamole/rest/user/APIUser.java
index f018074b6..06f1de159 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/user/APIUser.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/user/APIUser.java
@@ -43,6 +43,11 @@ public class APIUser {
      */
     private String password;
     
+    /**
+     * Boolean value indicating whether or not this user account is disabled.
+     */
+    private boolean disabled;
+    
     /**
      * Map of all associated attributes by attribute identifier.
      */
@@ -61,7 +66,9 @@ public class APIUser {
     
     /**
      * Construct a new APIUser from the provided User.
-     * @param user The User to construct the APIUser from.
+     * 
+     * @param user
+     *     The User to construct the APIUser from.
      */
     public APIUser(User user) {
 
@@ -69,6 +76,7 @@ public class APIUser {
         this.username = user.getIdentifier();
         this.password = user.getPassword();
         this.lastActive = user.getLastActive();
+        this.disabled = user.isDisabled();
 
         // Associate any attributes
         this.attributes = user.getAttributes();
@@ -77,7 +85,9 @@ public class APIUser {
 
     /**
      * Returns the username for this user.
-     * @return The username for this user. 
+     * 
+     * @return
+     *     The username for this user. 
      */
     public String getUsername() {
         return username;
@@ -85,7 +95,9 @@ public class APIUser {
 
     /**
      * Set the username for this user.
-     * @param username The username for this user.
+     * 
+     * @param username
+     *     The username for this user.
      */
     public void setUsername(String username) {
         this.username = username;
@@ -93,7 +105,9 @@ public class APIUser {
 
     /**
      * Returns the password for this user.
-     * @return The password for this user.
+     * 
+     * @return
+     *     The password for this user.
      */
     public String getPassword() {
         return password;
@@ -101,11 +115,34 @@ public class APIUser {
 
     /**
      * Set the password for this user.
-     * @param password The password for this user.
+     * 
+     * @param password
+     *     The password for this user.
      */
     public void setPassword(String password) {
         this.password = password;
     }
+    
+    /**
+     * Returns true if this user account is disabled, otherwise false.
+     * 
+     * @return 
+     *     True if this user account is disabled, otherwise false.
+     */
+    public boolean isDisabled() {
+        return disabled;
+    }
+    
+    /**
+     * Sets the disabled status of this user account, disabling the account
+     * if set to true.
+     * 
+     * @param disabled 
+     *     True if this user account should be disabled.
+     */
+    public void setDisabled(boolean disabled) {
+        this.disabled = disabled;
+    }
 
     /**
      * Returns a map of all attributes associated with this user. Each entry
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/user/APIUserWrapper.java b/guacamole/src/main/java/org/apache/guacamole/rest/user/APIUserWrapper.java
index b086314f6..f48a9cf46 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/user/APIUserWrapper.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/user/APIUserWrapper.java
@@ -69,6 +69,16 @@ public class APIUserWrapper implements User {
     public void setPassword(String password) {
         apiUser.setPassword(password);
     }
+    
+    @Override
+    public boolean isDisabled() {
+        return apiUser.isDisabled();
+    }
+    
+    @Override
+    public void setDisabled(boolean disabled) {
+        apiUser.setDisabled(disabled);
+    }
 
     @Override
     public Map<String, String> getAttributes() {
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java
index 8c63d7218..f1a595bf7 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java
@@ -49,6 +49,9 @@ public class UserObjectTranslator
         // Do not update the user password if no password was provided
         if (object.getPassword() != null)
             existingObject.setPassword(object.getPassword());
+        
+        // Update disabled status
+        existingObject.setDisabled(object.isDisabled());
 
         // Update user attributes
         existingObject.setAttributes(object.getAttributes());
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/APIUserGroup.java b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/APIUserGroup.java
index df4847bc9..547fb1fca 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/APIUserGroup.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/APIUserGroup.java
@@ -36,6 +36,11 @@ public class APIUserGroup {
      * The identifier of this user group.
      */
     private String identifier;
+    
+    /**
+     * Boolean value indicating if this UserGroup is disabled.
+     */
+    private boolean disabled;
 
     /**
      * Map of all associated attributes by attribute identifier.
@@ -55,6 +60,7 @@ public class APIUserGroup {
      */
     public APIUserGroup(UserGroup group) {
         this.identifier = group.getIdentifier();
+        this.disabled = group.isDisabled();
         this.attributes = group.getAttributes();
     }
 
@@ -79,6 +85,27 @@ public class APIUserGroup {
     public void setIdentifier(String identifier) {
         this.identifier = identifier;
     }
+    
+    /**
+     * Return true if this user group is disabled, otherwise false.
+     * 
+     * @return 
+     *     True if this user group is disabled, otherwise false.
+     */
+    public boolean isDisabled() {
+        return disabled;
+    }
+    
+    /**
+     * Sets whether or not this user group is disabled to the parameter
+     * provided.
+     * 
+     * @param disabled 
+     *     True if the user group should be disabled, otherwise false.
+     */
+    public void setDisabled(boolean disabled) {
+        this.disabled = disabled;
+    }
 
     /**
      * Returns a map of all attributes associated with this user group. Each
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/APIUserGroupWrapper.java b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/APIUserGroupWrapper.java
index 5dc6d7b0a..c195e87d0 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/APIUserGroupWrapper.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/APIUserGroupWrapper.java
@@ -61,6 +61,16 @@ public class APIUserGroupWrapper implements UserGroup {
     public void setIdentifier(String identifier) {
         apiUserGroup.setIdentifier(identifier);
     }
+    
+    @Override
+    public boolean isDisabled() {
+        return apiUserGroup.isDisabled();
+    }
+    
+    @Override
+    public void setDisabled(boolean disabled) {
+        apiUserGroup.setDisabled(disabled);
+    }
 
     @Override
     public Map<String, String> getAttributes() {
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java
index 88000b010..a947b8fd4 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/usergroup/UserGroupObjectTranslator.java
@@ -47,6 +47,9 @@ public class UserGroupObjectTranslator
     public void applyExternalChanges(UserGroup existingObject,
             APIUserGroup object) throws GuacamoleException {
 
+        // Update disabled status
+        existingObject.setDisabled(object.isDisabled());
+        
         // Update user attributes
         existingObject.setAttributes(object.getAttributes());
 

From 015117f079e0c27306db47e3b6eda808e0393188 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Sun, 12 Mar 2023 21:14:47 -0400
Subject: [PATCH 257/289] GUACAMOLE-1479: Switch JDBC module to use disabled
 methods instead of attributes.

---
 .../auth/jdbc/sharing/user/SharedUser.java    | 22 ++++++++++
 .../guacamole/auth/jdbc/user/ModeledUser.java | 38 +++++------------
 .../auth/jdbc/usergroup/ModeledUserGroup.java | 41 ++++++-------------
 3 files changed, 45 insertions(+), 56 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/user/SharedUser.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/user/SharedUser.java
index 80d22198c..5dcd8740d 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/user/SharedUser.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/user/SharedUser.java
@@ -78,6 +78,28 @@ public class SharedUser implements User {
     public void setIdentifier(String identifier) {
         throw new UnsupportedOperationException("Users authenticated via share keys are immutable.");
     }
+    
+    /**
+     * {@inheritDoc}
+     * 
+     * <p>SharedUser accounts are always enabled, as access is controlled via
+     * the shared token.
+     */
+    @Override
+    public boolean isDisabled() {
+        return false;
+    }
+    
+    /**
+     * {@inheritDoc}
+     * 
+     * <p>This method silently ignores the value passed in the disabled parameter,
+     * as disabling the account is done by invalidating the sharing token.
+     */
+    @Override
+    public void setDisabled(boolean disabled) {
+        // Silently ignore the parameter
+    }
 
     @Override
     public Map<String, String> getAttributes() {
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUser.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUser.java
index c10bd435c..811ccaa31 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUser.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUser.java
@@ -63,12 +63,6 @@ public class ModeledUser extends ModeledPermissions<UserModel> implements User {
      */
     private static final Logger logger = LoggerFactory.getLogger(ModeledUser.class);
 
-    /**
-     * The name of the attribute which controls whether a user account is
-     * disabled.
-     */
-    public static final String DISABLED_ATTRIBUTE_NAME = "disabled";
-
     /**
      * The name of the attribute which controls whether a user's password is
      * expired and must be reset upon login.
@@ -121,7 +115,6 @@ public class ModeledUser extends ModeledPermissions<UserModel> implements User {
      * form.
      */
     public static final Form ACCOUNT_RESTRICTIONS = new Form("restrictions", Arrays.<Field>asList(
-        new BooleanField(DISABLED_ATTRIBUTE_NAME, "true"),
         new BooleanField(EXPIRED_ATTRIBUTE_NAME, "true"),
         new TimeField(ACCESS_WINDOW_START_ATTRIBUTE_NAME),
         new TimeField(ACCESS_WINDOW_END_ATTRIBUTE_NAME),
@@ -149,7 +142,6 @@ public class ModeledUser extends ModeledPermissions<UserModel> implements User {
                 User.Attribute.EMAIL_ADDRESS,
                 User.Attribute.ORGANIZATION,
                 User.Attribute.ORGANIZATIONAL_ROLE,
-                DISABLED_ATTRIBUTE_NAME,
                 EXPIRED_ATTRIBUTE_NAME,
                 ACCESS_WINDOW_START_ATTRIBUTE_NAME,
                 ACCESS_WINDOW_END_ATTRIBUTE_NAME,
@@ -281,6 +273,16 @@ public class ModeledUser extends ModeledPermissions<UserModel> implements User {
         userModel.setPasswordDate(new Timestamp(System.currentTimeMillis()));
 
     }
+    
+    @Override
+    public boolean isDisabled() {
+        return getModel().isDisabled();
+    }
+    
+    @Override
+    public void setDisabled(boolean disabled) {
+        getModel().setDisabled(disabled);
+    }
 
     /**
      * Returns the this user's current password record. If the user is new, this
@@ -309,9 +311,6 @@ public class ModeledUser extends ModeledPermissions<UserModel> implements User {
      */
     private void putRestrictedAttributes(Map<String, String> attributes) {
 
-        // Set disabled attribute
-        attributes.put(DISABLED_ATTRIBUTE_NAME, getModel().isDisabled() ? "true" : null);
-
         // Set password expired attribute
         attributes.put(EXPIRED_ATTRIBUTE_NAME, getModel().isExpired() ? "true" : null);
 
@@ -424,10 +423,6 @@ public class ModeledUser extends ModeledPermissions<UserModel> implements User {
      */
     private void setRestrictedAttributes(Map<String, String> attributes) {
 
-        // Translate disabled attribute
-        if (attributes.containsKey(DISABLED_ATTRIBUTE_NAME))
-            getModel().setDisabled("true".equals(attributes.get(DISABLED_ATTRIBUTE_NAME)));
-
         // Translate password expired attribute
         if (attributes.containsKey(EXPIRED_ATTRIBUTE_NAME))
             getModel().setExpired("true".equals(attributes.get(EXPIRED_ATTRIBUTE_NAME)));
@@ -737,19 +732,6 @@ public class ModeledUser extends ModeledPermissions<UserModel> implements User {
         return isActive(getAccessWindowStart(), getAccessWindowEnd());
     }
 
-    /**
-     * Returns whether this user account has been disabled. The credentials of
-     * disabled user accounts are treated as invalid, effectively disabling
-     * that user's access to data for which they would otherwise have
-     * permission.
-     *
-     * @return
-     *     true if this user account has been disabled, false otherwise.
-     */
-    public boolean isDisabled() {
-        return getModel().isDisabled();
-    }
-
     /**
      * Returns whether this user's password has expired. If a user's password
      * is expired, it must be immediately changed upon login. A user account
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/ModeledUserGroup.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/ModeledUserGroup.java
index b31b61e1e..8b30db4b3 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/ModeledUserGroup.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/usergroup/ModeledUserGroup.java
@@ -42,36 +42,17 @@ import org.apache.guacamole.net.auth.UserGroup;
 public class ModeledUserGroup extends ModeledPermissions<UserGroupModel>
         implements UserGroup {
 
-    /**
-     * The name of the attribute which controls whether a user group is
-     * disabled.
-     */
-    public static final String DISABLED_ATTRIBUTE_NAME = "disabled";
-
-    /**
-     * All attributes related to restricting user groups, within a logical
-     * form.
-     */
-    public static final Form ACCOUNT_RESTRICTIONS = new Form("restrictions", Arrays.<Field>asList(
-        new BooleanField(DISABLED_ATTRIBUTE_NAME, "true")
-    ));
-
     /**
      * All possible attributes of user groups organized as individual,
      * logical forms.
      */
-    public static final Collection<Form> ATTRIBUTES = Collections.unmodifiableCollection(Arrays.asList(
-        ACCOUNT_RESTRICTIONS
-    ));
-
+    public static final Collection<Form> ATTRIBUTES = Collections.emptyList();
+    
     /**
      * The names of all attributes which are explicitly supported by this
      * extension's UserGroup objects.
      */
-    public static final Set<String> ATTRIBUTE_NAMES =
-            Collections.unmodifiableSet(new HashSet<String>(Arrays.asList(
-                DISABLED_ATTRIBUTE_NAME
-            )));
+    public static final Set<String> ATTRIBUTE_NAMES = Collections.emptySet();
 
     /**
      * Provider for RelatedObjectSets containing the user groups of which this
@@ -121,6 +102,16 @@ public class ModeledUserGroup extends ModeledPermissions<UserGroupModel>
         super.init(currentUser, model);
         this.exposeRestrictedAttributes = exposeRestrictedAttributes;
     }
+    
+    @Override
+    public boolean isDisabled() {
+        return getModel().isDisabled();
+    }
+    
+    @Override
+    public void setDisabled(boolean disabled) {
+        getModel().setDisabled(disabled);
+    }
 
     /**
      * Stores all restricted (privileged) attributes within the given Map,
@@ -133,9 +124,6 @@ public class ModeledUserGroup extends ModeledPermissions<UserGroupModel>
      */
     private void putRestrictedAttributes(Map<String, String> attributes) {
 
-        // Set disabled attribute
-        attributes.put(DISABLED_ATTRIBUTE_NAME, getModel().isDisabled() ? "true" : null);
-
     }
 
     /**
@@ -147,9 +135,6 @@ public class ModeledUserGroup extends ModeledPermissions<UserGroupModel>
      */
     private void setRestrictedAttributes(Map<String, String> attributes) {
 
-        // Translate disabled attribute
-        getModel().setDisabled("true".equals(attributes.get(DISABLED_ATTRIBUTE_NAME)));
-
     }
 
     @Override

From 61457686e32cd09376d0de694cbfacbce564a800 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Sat, 25 Dec 2021 22:43:09 -0500
Subject: [PATCH 258/289] GUACAMOLE-1479: Update front-end styles and
 translations for disabled users and user groups.

---
 .../src/main/resources/translations/ca.json          |  3 ---
 .../src/main/resources/translations/de.json          |  5 +----
 .../src/main/resources/translations/en.json          |  3 ---
 .../src/main/resources/translations/es.json          |  3 ---
 .../src/main/resources/translations/fr.json          |  3 ---
 .../src/main/resources/translations/ja.json          |  4 +---
 .../src/main/resources/translations/ko.json          |  3 ---
 .../src/main/resources/translations/pl.json          |  3 ---
 .../src/main/resources/translations/pt.json          |  3 ---
 .../src/main/resources/translations/ru.json          |  3 ---
 .../src/main/resources/translations/zh.json          |  3 ---
 .../src/app/manage/templates/manageUser.html         |  4 ++++
 .../src/app/manage/templates/manageUserGroup.html    |  4 ++++
 .../frontend/src/app/manage/types/ManageableUser.js  | 11 +++++++++++
 .../src/main/frontend/src/app/rest/types/User.js     |  7 +++++++
 .../main/frontend/src/app/rest/types/UserGroup.js    |  7 +++++++
 .../src/app/settings/styles/user-group-list.css      | 12 +++++++++---
 .../frontend/src/app/settings/styles/user-list.css   |  8 +++++++-
 .../app/settings/templates/settingsUserGroups.html   |  2 +-
 .../src/app/settings/templates/settingsUsers.html    |  2 +-
 guacamole/src/main/frontend/src/translations/ca.json |  2 ++
 guacamole/src/main/frontend/src/translations/de.json |  2 ++
 guacamole/src/main/frontend/src/translations/en.json |  2 ++
 guacamole/src/main/frontend/src/translations/es.json |  2 ++
 guacamole/src/main/frontend/src/translations/fr.json |  2 ++
 guacamole/src/main/frontend/src/translations/ja.json |  2 ++
 guacamole/src/main/frontend/src/translations/ko.json |  2 ++
 guacamole/src/main/frontend/src/translations/pl.json |  2 ++
 guacamole/src/main/frontend/src/translations/pt.json |  2 ++
 guacamole/src/main/frontend/src/translations/ru.json |  2 ++
 guacamole/src/main/frontend/src/translations/zh.json |  6 ++++--
 31 files changed, 77 insertions(+), 42 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ca.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ca.json
index 64b27238a..c908548f1 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ca.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ca.json
@@ -89,7 +89,6 @@
 
     "USER_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED"            : "Inici de sessió desactivat:",
         "FIELD_HEADER_EXPIRED"             : "Contrasenya caducada:",
         "FIELD_HEADER_ACCESS_WINDOW_END"   : "No permetre l'accés després:",
         "FIELD_HEADER_ACCESS_WINDOW_START" : "Permet l'accés després:",
@@ -104,8 +103,6 @@
 
     "USER_GROUP_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED" : "Desactivat:",
-
         "SECTION_HEADER_RESTRICTIONS" : "Restriccions de grup"
 
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/de.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/de.json
index 452d9ac04..20ffe0988 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/de.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/de.json
@@ -88,7 +88,6 @@
 
     "USER_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED"            : "Login deaktiviert:",
         "FIELD_HEADER_EXPIRED"             : "Passwort abgelaufen:",
         "FIELD_HEADER_ACCESS_WINDOW_END"   : "Zugriff nach dieser Uhrzeit nicht mehr erlauben:",
         "FIELD_HEADER_ACCESS_WINDOW_START" : "Zugriff erst nach dieser Uhrzeit erlauben:",
@@ -102,9 +101,7 @@
     },
 
     "USER_GROUP_ATTRIBUTES" : {
-
-        "FIELD_HEADER_DISABLED" : "Deaktiviert:",
-
+        
         "SECTION_HEADER_RESTRICTIONS" : "Gruppeneinschränkung"
 
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
index b286f0c49..a16880ba7 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json
@@ -89,7 +89,6 @@
 
     "USER_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED"            : "Login disabled:",
         "FIELD_HEADER_EXPIRED"             : "Password expired:",
         "FIELD_HEADER_ACCESS_WINDOW_END"   : "Do not allow access after:",
         "FIELD_HEADER_ACCESS_WINDOW_START" : "Allow access after:",
@@ -104,8 +103,6 @@
 
     "USER_GROUP_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED" : "Disabled:",
-
         "SECTION_HEADER_RESTRICTIONS" : "Group Restrictions"
 
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/es.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/es.json
index e6c06a817..e3b1ef906 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/es.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/es.json
@@ -89,7 +89,6 @@
 
     "USER_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED"            : "Inicio de sesión deshabilitado:",
         "FIELD_HEADER_EXPIRED"             : "Contraseña expirada:",
         "FIELD_HEADER_ACCESS_WINDOW_END"   : "No permitir acceso despues de:",
         "FIELD_HEADER_ACCESS_WINDOW_START" : "Permitir acceso despues de:",
@@ -104,8 +103,6 @@
 
     "USER_GROUP_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED" : "Deshabilitado:",
-
         "SECTION_HEADER_RESTRICTIONS" : "Restricciones de grupo"
 
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/fr.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/fr.json
index a85fad441..63b27cdb9 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/fr.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/fr.json
@@ -89,7 +89,6 @@
 
     "USER_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED"            : "Connexion désactivée:",
         "FIELD_HEADER_EXPIRED"             : "Mot de passe expiré:",
         "FIELD_HEADER_ACCESS_WINDOW_END"   : "Ne pas autoriser l'accès après:",
         "FIELD_HEADER_ACCESS_WINDOW_START" : "Autoriser l'accès après:",
@@ -104,8 +103,6 @@
 
     "USER_GROUP_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED" : "Désactivé:",
-
         "SECTION_HEADER_RESTRICTIONS" : "Restrictions de groupe"
 
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ja.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ja.json
index 2c94c4397..18aaf5971 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ja.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ja.json
@@ -75,7 +75,7 @@
 
     "USER_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED"            : "ログインの無効化:",
+        
         "FIELD_HEADER_EXPIRED"             : "パスワード変更の強制:",
         "FIELD_HEADER_ACCESS_WINDOW_END"   : "指定した時刻からアクセスを禁止する:",
         "FIELD_HEADER_ACCESS_WINDOW_START" : "指定した時刻からアクセスを許可する:",
@@ -90,8 +90,6 @@
 
     "USER_GROUP_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED" : "グループの無効化:",
-
         "SECTION_HEADER_RESTRICTIONS" : "グループ制限"
 
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ko.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ko.json
index 6c1a24da5..bfc124ab9 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ko.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ko.json
@@ -88,7 +88,6 @@
 
     "USER_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED"            : "로그인 비활성화:",
         "FIELD_HEADER_EXPIRED"             : "비밀번호 만료됨:",
         "FIELD_HEADER_ACCESS_WINDOW_END"   : "다음 이후에 액세스 허용 안함 :",
         "FIELD_HEADER_ACCESS_WINDOW_START" : "다음 이후에 엑세스 허용:",
@@ -103,8 +102,6 @@
 
     "USER_GROUP_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED" : "비활성화:",
-
         "SECTION_HEADER_RESTRICTIONS" : "그룹 제한"
 
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pl.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pl.json
index 8c31932aa..a5b5fc11f 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pl.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pl.json
@@ -89,7 +89,6 @@
 
     "USER_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED"            : "Logowanie zablokowane:",
         "FIELD_HEADER_EXPIRED"             : "Hasło wygasło:",
         "FIELD_HEADER_ACCESS_WINDOW_END"   : "Nie zezwalaj na dostęp po:",
         "FIELD_HEADER_ACCESS_WINDOW_START" : "Zezwalaj na dostęp od:",
@@ -104,8 +103,6 @@
 
     "USER_GROUP_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED" : "Wyłączona:",
-
         "SECTION_HEADER_RESTRICTIONS" : "Ograniczenia Grupy"
 
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pt.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pt.json
index 928077038..aafd4675c 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pt.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/pt.json
@@ -90,7 +90,6 @@
 
     "USER_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED"            : "Login desativado:",
         "FIELD_HEADER_EXPIRED"             : "Senha expirada:",
         "FIELD_HEADER_ACCESS_WINDOW_END"   : "Não permitir acesso após:",
         "FIELD_HEADER_ACCESS_WINDOW_START" : "Permitir acesso após:",
@@ -105,8 +104,6 @@
 
     "USER_GROUP_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED" : "Desativado:",
-
         "SECTION_HEADER_RESTRICTIONS" : "Restrições de Grupo"
 
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru.json
index 12e9c6f93..110a4bc5c 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/ru.json
@@ -88,7 +88,6 @@
 
     "USER_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED"            : "Аккаунт отключен:",
         "FIELD_HEADER_EXPIRED"             : "Пароль просрочен:",
         "FIELD_HEADER_ACCESS_WINDOW_END"   : "Запретить доступ после:",
         "FIELD_HEADER_ACCESS_WINDOW_START" : "Разрешить доступ после:",
@@ -103,8 +102,6 @@
 
     "USER_GROUP_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED" : "Группа отключена:",
-
         "SECTION_HEADER_RESTRICTIONS" : "Ограничения"
 
     }
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/zh.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/zh.json
index 44b6bf233..ff91c7e81 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/zh.json
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/zh.json
@@ -89,7 +89,6 @@
 
     "USER_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED"            : "已禁用登录:",
         "FIELD_HEADER_EXPIRED"             : "密码已过期:",
         "FIELD_HEADER_ACCESS_WINDOW_END"   : "之后不允许访问:",
         "FIELD_HEADER_ACCESS_WINDOW_START" : "之后允许访问:",
@@ -104,8 +103,6 @@
 
     "USER_GROUP_ATTRIBUTES" : {
 
-        "FIELD_HEADER_DISABLED" : "禁用:",
-
         "SECTION_HEADER_RESTRICTIONS" : "组限制"
 
     }
diff --git a/guacamole/src/main/frontend/src/app/manage/templates/manageUser.html b/guacamole/src/main/frontend/src/app/manage/templates/manageUser.html
index 014c7659c..d5896ecdd 100644
--- a/guacamole/src/main/frontend/src/app/manage/templates/manageUser.html
+++ b/guacamole/src/main/frontend/src/app/manage/templates/manageUser.html
@@ -37,6 +37,10 @@
                     <th>{{'MANAGE_USER.FIELD_HEADER_PASSWORD_AGAIN' | translate}}</th>
                     <td><input ng-model="passwordMatch" type="password"></td>
                 </tr>
+                <tr>
+                    <th>{{'MANAGE_USER.FIELD_HEADER_USER_DISABLED' | translate}}</th>
+                    <td><input ng-model="user.disabled" type="checkbox"></td>
+                </tr>
             </table>
         </div>
 
diff --git a/guacamole/src/main/frontend/src/app/manage/templates/manageUserGroup.html b/guacamole/src/main/frontend/src/app/manage/templates/manageUserGroup.html
index 09fd3e68b..c450baab9 100644
--- a/guacamole/src/main/frontend/src/app/manage/templates/manageUserGroup.html
+++ b/guacamole/src/main/frontend/src/app/manage/templates/manageUserGroup.html
@@ -28,6 +28,10 @@
                         <span  ng-hide="canEditIdentifier()">{{userGroup.identifier}}</span>
                     </td>
                 </tr>
+                <tr>
+                    <th>{{'MANAGE_USER_GROUP.FIELD_HEADER_USER_GROUP_DISABLED' | translate}}</th>
+                    <td><input ng-model="userGroup.disabled" type="checkbox"></td>
+                </tr>
             </table>
         </div>
 
diff --git a/guacamole/src/main/frontend/src/app/manage/types/ManageableUser.js b/guacamole/src/main/frontend/src/app/manage/types/ManageableUser.js
index b67ddbdb7..d6c987472 100644
--- a/guacamole/src/main/frontend/src/app/manage/types/ManageableUser.js
+++ b/guacamole/src/main/frontend/src/app/manage/types/ManageableUser.js
@@ -45,6 +45,17 @@ angular.module('manage').factory('ManageableUser', [function defineManageableUse
          * @type User
          */
         this.user = template.user;
+        
+        /**
+         * Return true if the underlying user account is disabled, otherwise
+         * return false.
+         * 
+         * @returns
+         *     True if the underlying user account is disabled, otherwise false.
+         */
+        this.isDisabled = function isDisabled() {
+            return template.user.disabled;
+        };
 
     };
 
diff --git a/guacamole/src/main/frontend/src/app/rest/types/User.js b/guacamole/src/main/frontend/src/app/rest/types/User.js
index 3ca138d3b..c74d1cd8a 100644
--- a/guacamole/src/main/frontend/src/app/rest/types/User.js
+++ b/guacamole/src/main/frontend/src/app/rest/types/User.js
@@ -61,6 +61,13 @@ angular.module('rest').factory('User', [function defineUser() {
          * @type Number
          */
         this.lastActive = template.lastActive;
+        
+        /**
+         * True if this user account is disabled, otherwise false.
+         * 
+         * @type boolean
+         */
+        this.disabled = template.disabled;
 
         /**
          * Arbitrary name/value pairs which further describe this user. The
diff --git a/guacamole/src/main/frontend/src/app/rest/types/UserGroup.js b/guacamole/src/main/frontend/src/app/rest/types/UserGroup.js
index f4bf26cfe..e3bc7eae2 100644
--- a/guacamole/src/main/frontend/src/app/rest/types/UserGroup.js
+++ b/guacamole/src/main/frontend/src/app/rest/types/UserGroup.js
@@ -42,6 +42,13 @@ angular.module('rest').factory('UserGroup', [function defineUserGroup() {
          * @type String
          */
         this.identifier = template.identifier;
+        
+        /**
+         * True if this user group is disabled, otherwise false.
+         * 
+         * @type boolean
+         */
+        this.disabled = template.disabled;
 
         /**
          * Arbitrary name/value pairs which further describe this user group.
diff --git a/guacamole/src/main/frontend/src/app/settings/styles/user-group-list.css b/guacamole/src/main/frontend/src/app/settings/styles/user-group-list.css
index 2040eb440..6f29de70f 100644
--- a/guacamole/src/main/frontend/src/app/settings/styles/user-group-list.css
+++ b/guacamole/src/main/frontend/src/app/settings/styles/user-group-list.css
@@ -26,11 +26,17 @@
     width: 100%;
 }
 
-.settings.user-groups table.user-group-list tr.user td.user-group-name a[href] {
+.settings.user-groups table.user-group-list tr.user-group td.user-group-name a[href] {
     display: block;
     padding: .5em 1em;
 }
 
-.settings.user-groups table.user-group-list tr.user td.user-group-name {
-    padding: 0;
+.settings.user-groups table.user-group-list tr.user-group.disabled,
+.settings.user-groups table.user-group-list tr.user-group.disabled td.user-group-name a[href] {
+    color: gray;
+    font-style: italic;
 }
+
+.settings.user-groups table.user-group-list tr.user-group td.user-group-name {
+    padding: 0;
+}
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/settings/styles/user-list.css b/guacamole/src/main/frontend/src/app/settings/styles/user-list.css
index e130d0da1..e9631a950 100644
--- a/guacamole/src/main/frontend/src/app/settings/styles/user-list.css
+++ b/guacamole/src/main/frontend/src/app/settings/styles/user-list.css
@@ -36,6 +36,12 @@
     padding: .5em 1em;
 }
 
+.settings.users table.user-list tr.user.disabled,
+.settings.users table.user-list tr.user.disabled td.username a[href] {
+    color: gray;
+    font-style: italic;
+}
+
 .settings.users table.user-list tr.user td.username {
     padding: 0;
-}
+}
\ No newline at end of file
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsUserGroups.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsUserGroups.html
index ccb534e65..4e7cd4c5a 100644
--- a/guacamole/src/main/frontend/src/app/settings/templates/settingsUserGroups.html
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsUserGroups.html
@@ -30,7 +30,7 @@
             </tr>
         </thead>
         <tbody ng-class="{loading: !isLoaded()}">
-            <tr ng-repeat="manageableUserGroup in manageableUserGroupPage" class="user-group">
+            <tr ng-repeat="manageableUserGroup in manageableUserGroupPage" class="user-group" ng-class="{disabled: manageableUserGroup.userGroup.disabled}">
                 <td class="user-group-name">
                     <a ng-href="#/manage/{{manageableUserGroup.dataSource | escape}}/userGroups/{{manageableUserGroup.userGroup.identifier | escape}}">
                         <div class="icon user-group"></div>
diff --git a/guacamole/src/main/frontend/src/app/settings/templates/settingsUsers.html b/guacamole/src/main/frontend/src/app/settings/templates/settingsUsers.html
index 18a043782..4a178fe49 100644
--- a/guacamole/src/main/frontend/src/app/settings/templates/settingsUsers.html
+++ b/guacamole/src/main/frontend/src/app/settings/templates/settingsUsers.html
@@ -39,7 +39,7 @@
             </tr>
         </thead>
         <tbody ng-class="{loading: !isLoaded()}">
-            <tr ng-repeat="manageableUser in manageableUserPage" class="user">
+            <tr ng-repeat="manageableUser in manageableUserPage" class="user" ng-class="{disabled: manageableUser.user.disabled}">
                 <td class="username">
                     <a ng-href="#/manage/{{manageableUser.dataSource | escape}}/users/{{manageableUser.user.username | escape}}">
                         <div class="icon user"></div>
diff --git a/guacamole/src/main/frontend/src/translations/ca.json b/guacamole/src/main/frontend/src/translations/ca.json
index 3ec74359d..658c9232f 100644
--- a/guacamole/src/main/frontend/src/translations/ca.json
+++ b/guacamole/src/main/frontend/src/translations/ca.json
@@ -343,6 +343,7 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "Crear noves connexions:",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "Crear grups de connexió nous:",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "Crear nous perfils per compartir:",
+        "FIELD_HEADER_USER_DISABLED"                 : "Inici de sessió desactivat:",
         "FIELD_HEADER_USERNAME"                      : "Nom d'usuari:",
 
         "HELP_NO_USER_GROUPS" : "Actualment, aquest usuari no pertany a cap grup. Amplieu aquesta secció per afegir-lo a grups.",
@@ -373,6 +374,7 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
+        "FIELD_HEADER_USER_GROUP_DISABLED"           : "Desactivat:",
         "FIELD_HEADER_USER_GROUP_NAME"               : "Nom del grup:",
 
         "HELP_NO_USER_GROUPS"        : "Actualment aquest grup no pertany a cap grup. Amplieu aquesta secció per afegir grups.",
diff --git a/guacamole/src/main/frontend/src/translations/de.json b/guacamole/src/main/frontend/src/translations/de.json
index 04059693d..e9bcab55d 100644
--- a/guacamole/src/main/frontend/src/translations/de.json
+++ b/guacamole/src/main/frontend/src/translations/de.json
@@ -411,6 +411,7 @@
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "Neues Verteil-Profil erstellen:",
         "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
         "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
+        "FIELD_HEADER_USER_DISABLED"                 : "Login deaktiviert:",
         "FIELD_HEADER_USERNAME"                      : "Benutzername:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
@@ -449,6 +450,7 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
+        "FIELD_HEADER_USER_GROUP_DISABLED"           : "Deaktiviert:",
         "FIELD_HEADER_USER_GROUP_NAME"               : "Name der Benutzergruppe:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index ade20a940..7c2edec57 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -416,6 +416,7 @@
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "Create new sharing profiles:",
         "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
         "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
+        "FIELD_HEADER_USER_DISABLED"                 : "Login disabled:",
         "FIELD_HEADER_USERNAME"                      : "Username:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
@@ -454,6 +455,7 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
+        "FIELD_HEADER_USER_GROUP_DISABLED"           : "Disabled:",
         "FIELD_HEADER_USER_GROUP_NAME"               : "Group name:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
diff --git a/guacamole/src/main/frontend/src/translations/es.json b/guacamole/src/main/frontend/src/translations/es.json
index dcacb7067..b607d0b60 100644
--- a/guacamole/src/main/frontend/src/translations/es.json
+++ b/guacamole/src/main/frontend/src/translations/es.json
@@ -317,6 +317,7 @@
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "Crear nuevos perfiles de compartir:",
         "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
         "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
+        "FIELD_HEADER_USER_DISABLED"                 : "Inicio de sesión deshabilitado:",
         "FIELD_HEADER_USERNAME"                      : "Nombre de usuario:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
@@ -355,6 +356,7 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
+        "FIELD_HEADER_USER_GROUP_DISABLED"           : "Deshabilitado:",
         "FIELD_HEADER_USER_GROUP_NAME"               : "Nombre del grupo:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
diff --git a/guacamole/src/main/frontend/src/translations/fr.json b/guacamole/src/main/frontend/src/translations/fr.json
index bf2904303..085d79e7f 100644
--- a/guacamole/src/main/frontend/src/translations/fr.json
+++ b/guacamole/src/main/frontend/src/translations/fr.json
@@ -316,6 +316,7 @@
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "Créer de nouveaux profils de partage:",
         "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
         "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
+        "FIELD_HEADER_USER_DISABLED"                 : "Connexion désactivée:",
         "FIELD_HEADER_USERNAME"                      : "Identifiant:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
@@ -354,6 +355,7 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
+        "FIELD_HEADER_USER_GROUP_DISABLED"           : "Désactivé:",
         "FIELD_HEADER_USER_GROUP_NAME"               : "Nom Groupe:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
diff --git a/guacamole/src/main/frontend/src/translations/ja.json b/guacamole/src/main/frontend/src/translations/ja.json
index e4c2ad0c4..2750d38fd 100644
--- a/guacamole/src/main/frontend/src/translations/ja.json
+++ b/guacamole/src/main/frontend/src/translations/ja.json
@@ -282,6 +282,7 @@
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "共有プロファイルの作成:",
         "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
         "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
+        "FIELD_HEADER_USER_DISABLED"                 : "ログインの無効化:",
         "FIELD_HEADER_USERNAME"                      : "ユーザ名:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
@@ -320,6 +321,7 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
+        "FIELD_HEADER_USER_GROUP_DISABLED"           : "グループの無効化:",
         "FIELD_HEADER_USER_GROUP_NAME"               : "グループ名:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
diff --git a/guacamole/src/main/frontend/src/translations/ko.json b/guacamole/src/main/frontend/src/translations/ko.json
index 8b01d8559..ac135e440 100644
--- a/guacamole/src/main/frontend/src/translations/ko.json
+++ b/guacamole/src/main/frontend/src/translations/ko.json
@@ -314,6 +314,7 @@
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "새로운 공유 프로파일 생성",
         "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
         "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
+        "FIELD_HEADER_USER_DISABLED"                 : "로그인 비활성화:",
         "FIELD_HEADER_USERNAME"                      : "사용자 이름:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
@@ -351,6 +352,7 @@
         "FIELD_HEADER_CREATE_NEW_USER_GROUPS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_USER_GROUPS",
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
+        "FIELD_HEADER_USER_GROUP_DISABLED"           : "비활성화:",
         "FIELD_HEADER_USER_GROUP_NAME"               : "그룹 이름:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
diff --git a/guacamole/src/main/frontend/src/translations/pl.json b/guacamole/src/main/frontend/src/translations/pl.json
index 6f999697b..bda29e05e 100644
--- a/guacamole/src/main/frontend/src/translations/pl.json
+++ b/guacamole/src/main/frontend/src/translations/pl.json
@@ -326,6 +326,7 @@
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "Tworzenie nowych profili udostępniania:",
         "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
         "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
+        "FIELD_HEADER_USER_DISABLED"                 : "Logowanie zablokowane:",
         "FIELD_HEADER_USERNAME"                      : "Nazwa użytkownika:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
@@ -364,6 +365,7 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
+        "FIELD_HEADER_USER_DISABLED"                 : "Wyłączona:",
         "FIELD_HEADER_USER_GROUP_NAME"               : "Nazwa grupy:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
diff --git a/guacamole/src/main/frontend/src/translations/pt.json b/guacamole/src/main/frontend/src/translations/pt.json
index 9cebddf26..2cf9b4f20 100644
--- a/guacamole/src/main/frontend/src/translations/pt.json
+++ b/guacamole/src/main/frontend/src/translations/pt.json
@@ -318,6 +318,7 @@
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "Criar novos perfis de compartilhamento:",
         "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
         "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
+        "FIELD_HEADER_USER_DISABLED"                 : "Login desativado:",
         "FIELD_HEADER_USERNAME"                      : "Usuário:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
@@ -356,6 +357,7 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
+        "FIELD_HEADER_USER_GROUP_DISABLED"           : "Desativado:",
         "FIELD_HEADER_USER_GROUP_NAME"               : "Nome do grupo:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
diff --git a/guacamole/src/main/frontend/src/translations/ru.json b/guacamole/src/main/frontend/src/translations/ru.json
index 7243e9497..a086f7339 100644
--- a/guacamole/src/main/frontend/src/translations/ru.json
+++ b/guacamole/src/main/frontend/src/translations/ru.json
@@ -309,6 +309,7 @@
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "Создание нового профиля расшаривания:",
         "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
         "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
+        "FIELD_HEADER_USER_DISABLED"                 : "Аккаунт отключен:",
         "FIELD_HEADER_USERNAME"                      : "Имя пользователя:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
@@ -347,6 +348,7 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
+        "FIELD_HEADER_USER_GROUP_DISABLED"           : "Группа отключена:",
         "FIELD_HEADER_USER_GROUP_NAME"               : "Название:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
diff --git a/guacamole/src/main/frontend/src/translations/zh.json b/guacamole/src/main/frontend/src/translations/zh.json
index 72b7cb384..76e9a2a81 100644
--- a/guacamole/src/main/frontend/src/translations/zh.json
+++ b/guacamole/src/main/frontend/src/translations/zh.json
@@ -406,6 +406,7 @@
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "新建共享设定：",
         "FIELD_HEADER_PASSWORD"                      : "@:APP.FIELD_HEADER_PASSWORD",
         "FIELD_HEADER_PASSWORD_AGAIN"                : "@:APP.FIELD_HEADER_PASSWORD_AGAIN",
+        "FIELD_HEADER_USER_DISABLED"                 : "已禁用登录:",
         "FIELD_HEADER_USERNAME"                      : "用户名：",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
@@ -444,7 +445,8 @@
         "FIELD_HEADER_CREATE_NEW_CONNECTIONS"        : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTIONS",
         "FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS"  : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_CONNECTION_GROUPS",
         "FIELD_HEADER_CREATE_NEW_SHARING_PROFILES"   : "@:MANAGE_USER.FIELD_HEADER_CREATE_NEW_SHARING_PROFILES",
-        "FIELD_HEADER_USER_GROUP_NAME"               : "用户组名称：",
+        "FIELD_HEADER_USER_GROUP_DISABLED"           : "禁用:",
+        "FIELD_HEADER_USER_GROUP_NAME"               : "用户组名称:",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
@@ -1130,4 +1132,4 @@
 
     }
 
-}
\ No newline at end of file
+}

From 7c49466c79a5e80d793aca970cf80036cd2946a2 Mon Sep 17 00:00:00 2001
From: Alex Leitner <leitnersalex@gmail.com>
Date: Wed, 3 Apr 2024 01:28:15 +0000
Subject: [PATCH 259/289] GUACAMOLE-1289: Modify the Authentication Service to
 no longer explicitly compare state query string.

---
 doc/licenses/okhttp-3.14.9/NOTICE             |   2 +-
 doc/licenses/okhttp-3.14.9/README             |   1 -
 .../okhttp-3.14.9/dep-coordinates.txt         |   2 +-
 doc/licenses/okhttp-4.9.1/LICENSE.txt         | 201 +++++++++++++++++
 doc/licenses/okhttp-4.9.1/NOTICE              |  13 ++
 doc/licenses/okhttp-4.9.1/README              |   7 +
 doc/licenses/okhttp-4.9.1/dep-coordinates.txt |   1 +
 doc/licenses/okio-1.17.2/README               |   1 -
 doc/licenses/okio-1.17.2/dep-coordinates.txt  |   2 +-
 doc/licenses/okio-2.8.0/LICENSE.txt           | 201 +++++++++++++++++
 doc/licenses/okio-2.8.0/NOTICE                |  13 ++
 doc/licenses/okio-2.8.0/README                |   7 +
 doc/licenses/okio-2.8.0/dep-coordinates.txt   |   1 +
 doc/licenses/spring-web-5.3.25/LICENSE        | 202 ++++++++++++++++++
 doc/licenses/spring-web-5.3.25/README         |   7 +
 .../spring-web-5.3.25/dep-coordinates.txt     |   4 +
 extensions/guacamole-auth-duo/pom.xml         |  34 ++-
 .../auth/duo/DuoAuthenticationProvider.java   |   9 +-
 .../duo/DuoAuthenticationProviderModule.java  |   1 -
 .../auth/duo/UserVerificationService.java     |  19 +-
 ...amoleInsufficientCredentialsException.java |  14 +-
 .../guacamole/net/auth/Credentials.java       |  10 +
 ...amoleInsufficientCredentialsException.java |  67 +++++-
 .../rest/auth/AuthenticationService.java      | 107 ++++++++--
 .../auth/ResumableAuthenticationState.java    |  49 ++++-
 25 files changed, 933 insertions(+), 42 deletions(-)
 create mode 100644 doc/licenses/okhttp-4.9.1/LICENSE.txt
 create mode 100644 doc/licenses/okhttp-4.9.1/NOTICE
 create mode 100644 doc/licenses/okhttp-4.9.1/README
 create mode 100644 doc/licenses/okhttp-4.9.1/dep-coordinates.txt
 create mode 100644 doc/licenses/okio-2.8.0/LICENSE.txt
 create mode 100644 doc/licenses/okio-2.8.0/NOTICE
 create mode 100644 doc/licenses/okio-2.8.0/README
 create mode 100644 doc/licenses/okio-2.8.0/dep-coordinates.txt
 create mode 100644 doc/licenses/spring-web-5.3.25/LICENSE
 create mode 100644 doc/licenses/spring-web-5.3.25/README
 create mode 100644 doc/licenses/spring-web-5.3.25/dep-coordinates.txt

diff --git a/doc/licenses/okhttp-3.14.9/NOTICE b/doc/licenses/okhttp-3.14.9/NOTICE
index d8bff2eef..48164b3fc 100644
--- a/doc/licenses/okhttp-3.14.9/NOTICE
+++ b/doc/licenses/okhttp-3.14.9/NOTICE
@@ -10,4 +10,4 @@ Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
-limitations under the License.
\ No newline at end of file
+limitations under the License.
diff --git a/doc/licenses/okhttp-3.14.9/README b/doc/licenses/okhttp-3.14.9/README
index 7f343e7bd..ed470799c 100644
--- a/doc/licenses/okhttp-3.14.9/README
+++ b/doc/licenses/okhttp-3.14.9/README
@@ -5,4 +5,3 @@ okhttp (https://square.github.io/okhttp/)
     From: 'Square Inc'
     License(s):
         Apache 2.0
-
diff --git a/doc/licenses/okhttp-3.14.9/dep-coordinates.txt b/doc/licenses/okhttp-3.14.9/dep-coordinates.txt
index ea402ee6b..eb6c3831b 100644
--- a/doc/licenses/okhttp-3.14.9/dep-coordinates.txt
+++ b/doc/licenses/okhttp-3.14.9/dep-coordinates.txt
@@ -1 +1 @@
-com.squareup.okhttp3:okhttp:jar:3.14.9
\ No newline at end of file
+com.squareup.okhttp3:okhttp:jar:3.14.9
diff --git a/doc/licenses/okhttp-4.9.1/LICENSE.txt b/doc/licenses/okhttp-4.9.1/LICENSE.txt
new file mode 100644
index 000000000..f49a4e16e
--- /dev/null
+++ b/doc/licenses/okhttp-4.9.1/LICENSE.txt
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okhttp-4.9.1/NOTICE b/doc/licenses/okhttp-4.9.1/NOTICE
new file mode 100644
index 000000000..7ab6fba62
--- /dev/null
+++ b/doc/licenses/okhttp-4.9.1/NOTICE
@@ -0,0 +1,13 @@
+Copyright 2021 Square, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/doc/licenses/okhttp-4.9.1/README b/doc/licenses/okhttp-4.9.1/README
new file mode 100644
index 000000000..427724260
--- /dev/null
+++ b/doc/licenses/okhttp-4.9.1/README
@@ -0,0 +1,7 @@
+okhttp (https://square.github.io/okhttp/)
+---------------------------------------------
+
+    Version: 4.9.1
+    From: 'Square Inc'
+    License(s):
+        Apache 2.0
diff --git a/doc/licenses/okhttp-4.9.1/dep-coordinates.txt b/doc/licenses/okhttp-4.9.1/dep-coordinates.txt
new file mode 100644
index 000000000..0215ca270
--- /dev/null
+++ b/doc/licenses/okhttp-4.9.1/dep-coordinates.txt
@@ -0,0 +1 @@
+com.squareup.okhttp3:okhttp:jar:4.9.1
diff --git a/doc/licenses/okio-1.17.2/README b/doc/licenses/okio-1.17.2/README
index 74976b808..a8723ed5a 100644
--- a/doc/licenses/okio-1.17.2/README
+++ b/doc/licenses/okio-1.17.2/README
@@ -5,4 +5,3 @@ okio (https://square.github.io/okio/)
     From: 'Square Inc'
     License(s):
         Apache 2.0 (bundled/retrofit-2.9.0/LICENSE.txt)
-
diff --git a/doc/licenses/okio-1.17.2/dep-coordinates.txt b/doc/licenses/okio-1.17.2/dep-coordinates.txt
index 566082a42..54ab8297c 100644
--- a/doc/licenses/okio-1.17.2/dep-coordinates.txt
+++ b/doc/licenses/okio-1.17.2/dep-coordinates.txt
@@ -1 +1 @@
-com.squareup.okio:okio:jar:1.17.2
\ No newline at end of file
+com.squareup.okio:okio:jar:1.17.2
diff --git a/doc/licenses/okio-2.8.0/LICENSE.txt b/doc/licenses/okio-2.8.0/LICENSE.txt
new file mode 100644
index 000000000..f49a4e16e
--- /dev/null
+++ b/doc/licenses/okio-2.8.0/LICENSE.txt
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okio-2.8.0/NOTICE b/doc/licenses/okio-2.8.0/NOTICE
new file mode 100644
index 000000000..9004e5d83
--- /dev/null
+++ b/doc/licenses/okio-2.8.0/NOTICE
@@ -0,0 +1,13 @@
+Copyright 2020 Square, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/doc/licenses/okio-2.8.0/README b/doc/licenses/okio-2.8.0/README
new file mode 100644
index 000000000..cf4693dbd
--- /dev/null
+++ b/doc/licenses/okio-2.8.0/README
@@ -0,0 +1,7 @@
+okio (https://square.github.io/okio/)
+---------------------------------------------
+
+    Version: 2.8.0
+    From: 'Square Inc'
+    License(s):
+        Apache 2.0 (bundled/retrofit-2.9.0/LICENSE.txt)
diff --git a/doc/licenses/okio-2.8.0/dep-coordinates.txt b/doc/licenses/okio-2.8.0/dep-coordinates.txt
new file mode 100644
index 000000000..88c8776ad
--- /dev/null
+++ b/doc/licenses/okio-2.8.0/dep-coordinates.txt
@@ -0,0 +1 @@
+com.squareup.okio:okio:jar:2.8.0
diff --git a/doc/licenses/spring-web-5.3.25/LICENSE b/doc/licenses/spring-web-5.3.25/LICENSE
new file mode 100644
index 000000000..ff7737963
--- /dev/null
+++ b/doc/licenses/spring-web-5.3.25/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/doc/licenses/spring-web-5.3.25/README b/doc/licenses/spring-web-5.3.25/README
new file mode 100644
index 000000000..f719e88ff
--- /dev/null
+++ b/doc/licenses/spring-web-5.3.25/README
@@ -0,0 +1,7 @@
+Spring Framework (https://spring.io/projects/spring-framework)
+--------------------------------------------------------------
+
+    Version: 5.3.25
+    From: 'Spring' (https://spring.io/)
+    License(s):
+        Apache v2.0
diff --git a/doc/licenses/spring-web-5.3.25/dep-coordinates.txt b/doc/licenses/spring-web-5.3.25/dep-coordinates.txt
new file mode 100644
index 000000000..0670c0fa8
--- /dev/null
+++ b/doc/licenses/spring-web-5.3.25/dep-coordinates.txt
@@ -0,0 +1,4 @@
+org.springframework:spring-web:jar:5.3.25
+org.springframework:spring-beans:jar:5.3.25
+org.springframework:spring-core:jar:5.3.25
+org.springframework:spring-jcl:jar:5.3.25
diff --git a/extensions/guacamole-auth-duo/pom.xml b/extensions/guacamole-auth-duo/pom.xml
index 0614cb47d..f7f49563c 100644
--- a/extensions/guacamole-auth-duo/pom.xml
+++ b/extensions/guacamole-auth-duo/pom.xml
@@ -39,9 +39,33 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <enforcer.skip>true</enforcer.skip>
     </properties>
 
+    <dependencyManagement>
+        <dependencies>
+            <!-- Define okhttp version to use everywhere to resolve conflict -->
+            <dependency>
+                <groupId>com.squareup.okhttp3</groupId>
+                <artifactId>okhttp</artifactId>
+                <version>4.9.1</version> <!-- Specify the desired version -->
+            </dependency>
+
+            <!-- Force the use of a consistent version of Kotlin standard library common -->
+            <dependency>
+                <groupId>org.jetbrains.kotlin</groupId>
+                <artifactId>kotlin-stdlib-common</artifactId>
+                <version>1.4.10</version>
+            </dependency>
+
+            <dependency>
+                <groupId>org.jetbrains.kotlin</groupId>
+                <artifactId>kotlin-stdlib</artifactId>
+                <version>1.4.10</version>
+            </dependency>
+
+        </dependencies>
+    </dependencyManagement>
+
     <dependencies>
 
        <!-- Guacamole Extension API -->
@@ -79,11 +103,11 @@
             <version>1.1.3</version>
         </dependency>
         
-        <!-- kotlin-stdlib-common -->
+        <!-- spring-web -->
         <dependency>
-            <groupId>org.jetbrains.kotlin</groupId>
-            <artifactId>kotlin-stdlib-common</artifactId>
-            <version>1.4.10</version>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-web</artifactId>
+            <version>5.3.25</version>
         </dependency>
 
     </dependencies>
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProvider.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProvider.java
index 0b1a33dfb..dc9999c98 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProvider.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProvider.java
@@ -33,6 +33,13 @@ import org.apache.guacamole.net.auth.UserContext;
  */
 public class DuoAuthenticationProvider extends AbstractAuthenticationProvider {
 
+    /**
+     * The unique identifier for this authentication provider. This is used in
+     * various parts of the Guacamole client to distinguish this provider from
+     * others, particularly when multiple authentication providers are used.
+     */
+    public static String PROVIDER_IDENTIFER = "duo";
+
     /**
      * Injector which will manage the object graph of this authentication
      * provider.
@@ -58,7 +65,7 @@ public class DuoAuthenticationProvider extends AbstractAuthenticationProvider {
 
     @Override
     public String getIdentifier() {
-        return "duo";
+        return PROVIDER_IDENTIFER;
     }
 
     @Override
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
index b9a37b070..372bbcc39 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProviderModule.java
@@ -73,7 +73,6 @@ public class DuoAuthenticationProviderModule extends AbstractModule {
         // Bind Duo-specific services
         bind(ConfigurationService.class);
         bind(UserVerificationService.class);
-        
     }
 
 }
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
index 560683686..efd8a4357 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
@@ -39,6 +39,7 @@ import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.web.util.UriComponentsBuilder;
 
 /**
  * Service for verifying the identity of a user against Duo.
@@ -51,13 +52,13 @@ public class UserVerificationService {
      * The name of the parameter which Duo will return in it's GET call-back
      * that contains the code that the client will use to generate a token.
      */
-    private static final String DUO_CODE_PARAMETER_NAME = "duo_code";
+    public static final String DUO_CODE_PARAMETER_NAME = "duo_code";
     
     /**
      * The name of the parameter that will be used in the GET call-back that
      * contains the session state.
      */
-    private static final String DUO_STATE_PARAMETER_NAME = "state";
+    public static final String DUO_STATE_PARAMETER_NAME = "state";
     
     /**
      * The value that will be returned in the token if Duo authentication
@@ -101,12 +102,20 @@ public class UserVerificationService {
 
         try {
 
+        String redirectUrl = confService.getRedirectUrl().toString();
+
+        String builtUrl = UriComponentsBuilder
+                .fromUriString(redirectUrl)
+                .queryParam(Credentials.RESUME_QUERY, DuoAuthenticationProvider.PROVIDER_IDENTIFER)
+                .build()
+                .toUriString();
+
         // Set up the Duo Client
         Client duoClient = new Client.Builder(
                 confService.getClientId(),
                 confService.getClientSecret(),
                 confService.getAPIHostname(),
-                confService.getRedirectUrl().toString())
+                builtUrl)
                 .build();
         
         duoClient.healthCheck();
@@ -133,8 +142,8 @@ public class UserVerificationService {
                             new TranslatableMessage("LOGIN.INFO_DUO_REDIRECT_PENDING")
                     )
                 )),
-                duoState,
-                expirationTimestamp
+                duoState, DuoAuthenticationProvider.PROVIDER_IDENTIFER, 
+                DUO_STATE_PARAMETER_NAME, expirationTimestamp
             );
 
         }
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java b/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java
index 648e15007..f0c27bc36 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java
@@ -157,15 +157,23 @@ public class TranslatableGuacamoleInsufficientCredentialsException
      * @param state
      *     An opaque value that may be used by a client to maintain state across requests which are part
      *     of the same authentication transaction.
+     * 
+     * @param providerIdentifier
+     *     The identifier of the authentication provider that this exception pertains to.
+     *
+     * @param queryIdentifier
+     *     The identifier of the specific query parameter within the
+     *     authentication process that this exception pertains to.
      *
      * @param expires
      *     The timestamp after which the state token associated with the authentication process expires,
      *     specified as the number of milliseconds since the UNIX epoch.
      */
     public TranslatableGuacamoleInsufficientCredentialsException(String message,
-            String key, CredentialsInfo credentialsInfo, String state, long expires) {
-                super(message, credentialsInfo, state, expires);
-                this.translatableMessage = new TranslatableMessage(key);
+            String key, CredentialsInfo credentialsInfo, String state, String providerIdentifier, 
+            String queryIdentifier, long expires) {
+        super(message, credentialsInfo, state, providerIdentifier, queryIdentifier, expires);
+        this.translatableMessage = new TranslatableMessage(key);
     }
 
     @Override
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java
index 6ad0e240b..45eebe80d 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java
@@ -34,6 +34,16 @@ import javax.servlet.http.HttpSession;
  */
 public class Credentials implements Serializable {
 
+    /**
+     * The RESUME_QUERY is a query parameter key used to determine which
+     * authentication provider's process should be resumed during multi-step
+     * authentication. The auth provider will set this parameter before 
+     * redirecting to an external service, and it is checked upon return to 
+     * Guacamole to ensure the correct authentication state is continued 
+     * without starting over.
+     */
+    public static final String RESUME_QUERY = "provider_id";
+
     /**
      * Unique identifier associated with this specific version of Credentials.
      */
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
index c7a903c95..def5350b6 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
@@ -33,6 +33,20 @@ public class GuacamoleInsufficientCredentialsException extends GuacamoleCredenti
  */
 private static final String DEFAULT_STATE = "";
 
+/**
+ * The default provider identifier to use when no specific provider is identified.
+ * This serves as a placeholder indicating that either no specific provider is
+ * responsible for the exception or the responsible provider has not been identified.
+ */
+private static final String DEFAULT_PROVIDER_IDENTIFIER = "";
+
+/**
+ * The default query identifier to use when no specific query is identified.
+ * This serves as a placeholder and indicates that the specific query related to
+ * the provider's state resume operation has not been provided.
+ */
+private static final String DEFAULT_QUERY_IDENTIFIER = "";
+
 /**
  * The default expiration timestamp to use when no specific expiration is provided,
  * effectively indicating that the state token does not expire.
@@ -45,6 +59,20 @@ private static final long DEFAULT_EXPIRES = -1L;
  */
 protected final String state;
 
+    /**
+     * The identifier for the authentication provider that threw this exception.
+     * This is used to link the exception back to the originating source of the
+     * authentication attempt, allowing clients to determine which provider's
+     * authentication process should be resumed.
+     */
+    protected final String providerIdentifier;
+
+    /**
+     * An identifier for the specific query within the URL for this provider that can
+     * be checked to resume the authentication state.
+     */
+    protected final String queryIdentifier;
+
 /**
  * The timestamp after which the state token associated with the authentication process
  * should no longer be considered valid, expressed as the number of milliseconds since
@@ -67,15 +95,25 @@ protected final long expires;
      *     An opaque value that may be used by a client to maintain state
      *     across requests which are part of the same authentication transaction.
      *
+     * @param providerIdentifier
+     *     The identifier of the authentication provider that this exception pertains to.
+     *
+     * @param queryIdentifier
+     *     The identifier of the specific query parameter within the
+     *     authentication process that this exception pertains to.
+     * 
      * @param expires
      *     The timestamp after which the state token associated with the
      *     authentication process should no longer be considered valid, expressed
      *     as the number of milliseconds since UNIX epoch.
      */
    public GuacamoleInsufficientCredentialsException(String message,
-            CredentialsInfo credentialsInfo, String state, long expires) {
+            CredentialsInfo credentialsInfo, String state, String providerIdentifier, String queryIdentifier, 
+            long expires) {
         super(message, credentialsInfo);
         this.state = state;
+        this.providerIdentifier = providerIdentifier;
+        this.queryIdentifier = queryIdentifier;
         this.expires = expires;
     }
 
@@ -96,6 +134,8 @@ protected final long expires;
             CredentialsInfo credentialsInfo) {
         super(message, cause, credentialsInfo);
         this.state = DEFAULT_STATE;
+        this.providerIdentifier = DEFAULT_PROVIDER_IDENTIFIER;
+        this.queryIdentifier = DEFAULT_QUERY_IDENTIFIER;
         this.expires = DEFAULT_EXPIRES;
     }
 
@@ -112,6 +152,8 @@ protected final long expires;
     public GuacamoleInsufficientCredentialsException(String message, CredentialsInfo credentialsInfo) {
         super(message, credentialsInfo);
         this.state = DEFAULT_STATE;
+        this.providerIdentifier = DEFAULT_PROVIDER_IDENTIFIER;
+        this.queryIdentifier = DEFAULT_QUERY_IDENTIFIER;
         this.expires = DEFAULT_EXPIRES;
     }
 
@@ -128,6 +170,8 @@ protected final long expires;
     public GuacamoleInsufficientCredentialsException(Throwable cause, CredentialsInfo credentialsInfo) {
         super(cause, credentialsInfo);
         this.state = DEFAULT_STATE;
+        this.providerIdentifier = DEFAULT_PROVIDER_IDENTIFIER;
+        this.queryIdentifier = DEFAULT_QUERY_IDENTIFIER;
         this.expires = DEFAULT_EXPIRES;
     }
 
@@ -141,6 +185,27 @@ protected final long expires;
         return state;
     }
 
+    /**
+     * Retrieves the identifier of the authentication provider responsible for this exception.
+     *
+     * @return The identifier of the authentication provider, allowing clients to know
+     *         which provider's process should be resumed in response to this exception.
+     */
+    public String getProviderIdentifier() {
+        return providerIdentifier;
+    }
+
+    /**
+     * Retrieves the specific query identifier associated with the URL for the provider
+     * that can be checked to resume the authentication state.
+     *
+     * @return The query identifier that serves as a reference to a specific point or
+     *         transaction within the provider's authentication process.
+     */
+    public String getQueryIdentifier() {
+        return queryIdentifier;
+    }
+
     /**
      * Retrieves the expiration timestamp of the state token, specified as the
      * number of milliseconds since the UNIX epoch.
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
index 2946b1276..1fafa4a30 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
@@ -47,6 +47,7 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import com.google.inject.Singleton;
+import java.util.Iterator;
 
 /**
  * A service for performing authentication checks in REST endpoints.
@@ -325,12 +326,15 @@ public class AuthenticationService {
                     // Store state and expiration
                     String state = e.getState();
                     long expiration = e.getExpires();
+                    String queryIdentifier = e.getQueryIdentifier();
+                    String providerIdentifier = e.getProviderIdentifier();
 
-                    resumableStateMap.put(state, new ResumableAuthenticationState(expiration, credentials));
+                    resumableStateMap.put(state, new ResumableAuthenticationState(providerIdentifier, 
+                            queryIdentifier, expiration, credentials));
 
                     throw new GuacamoleAuthenticationProcessException("User "
-                    + "authentication aborted during initial "
-                    + "UserContext creation.", authProvider, e);
+                            + "authentication aborted during initial "
+                            + "UserContext creation.", authProvider, e);
                 }
                 catch (GuacamoleException | RuntimeException | Error e) {
                     throw new GuacamoleAuthenticationProcessException("User "
@@ -350,6 +354,82 @@ public class AuthenticationService {
         return userContexts;
 
     }
+    
+    /**
+     * Resumes authentication using given credentials if a matching resumable 
+     * state is found.
+     *
+     * @param credentials 
+     *     The initial credentials containing the request object.
+     *
+     * @return 
+     *     Resumed credentials if a valid resumable state is found; otherwise, 
+     *     returns {@code null}.
+     */
+    private Credentials resumeAuthentication(Credentials credentials) {
+        
+        Credentials resumedCredentials = null;
+
+        // Retrieve signed State from the request
+        HttpServletRequest request = credentials.getRequest();
+        
+        // Retrieve the provider id from the query parameters.
+        String resumableProviderId = request.getParameter(Credentials.RESUME_QUERY);
+        // Check if a provider id is set.
+        if (resumableProviderId == null || resumableProviderId.isEmpty()) {
+            // return if a provider id is not set.
+            return null;
+        }
+
+        // Use an iterator to safely remove entries while iterating
+        Iterator<Map.Entry<String, ResumableAuthenticationState>> iterator = resumableStateMap.entrySet().iterator();
+        while (iterator.hasNext()) {
+            Map.Entry<String, ResumableAuthenticationState> entry = iterator.next();
+            ResumableAuthenticationState resumableState = entry.getValue();
+
+            // Check if the provider ID from the request matches the one in the map entry.
+            boolean providerMatches = resumableProviderId.equals(resumableState.getProviderIdentifier());
+            if (!providerMatches) {
+                // If the provider doesn't match, skip to the next entry.
+                continue;
+            }
+
+            // Use the query identifier from the entry to retrieve the corresponding state parameter.
+            String stateQueryParameter = resumableState.getQueryIdentifier();
+            String stateFromParameter = request.getParameter(stateQueryParameter);
+
+            // Check if the `state` parameter is set.
+            if (stateFromParameter == null || stateFromParameter.isEmpty()) {
+                // Remove and continue if `state` is not provided or is empty.
+                iterator.remove(); 
+                continue;
+            }
+
+            // If the key in the entry (state) matches the state parameter provided in the request.
+            if (entry.getKey().equals(stateFromParameter)) {
+
+                // Remove the current entry from the map.
+                iterator.remove();                
+
+                // Check if the resumableState has expired
+                if (!resumableState.isExpired()) {
+
+                    // Set the actualCredentials to the credentials from the matched entry.
+                    resumedCredentials = resumableState.getCredentials();
+
+                    if (resumedCredentials != null) {
+                        resumedCredentials.setRequest(request);
+                    }
+
+                }
+
+                // Exit the loop since we've found the matching state and it's unique.
+                break;
+            }
+        }
+
+        return resumedCredentials;
+    }
 
     /**
      * Authenticates a user using the given credentials and optional
@@ -388,24 +468,11 @@ public class AuthenticationService {
 
         AuthenticatedUser authenticatedUser;
         String authToken;
-        Credentials actualCredentials = credentials;
-        String state;
-        ResumableAuthenticationState resumableState = null;
 
-        // Retrieve signed State from the request
-        HttpServletRequest request = credentials.getRequest();
-
-        // If state is provided, attempt to resume authentication
-        if ((state = request.getParameter("state")) != null && (resumableState = resumableStateMap.get(state)) != null) {
-            // The resumableState is removed as it should be a single-use token
-            resumableStateMap.remove(state);
-
-            // Check if the resumableState has expired
-            if (!resumableState.isExpired()) {
-                actualCredentials = resumableState.getCredentials();
-                actualCredentials.setRequest(request);
-            }
-        }
+        // Retrieve credentials if resuming authentication
+        Credentials actualCredentials = resumeAuthentication(credentials);
+        if (actualCredentials == null)
+            actualCredentials = credentials;
 
         try {
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java
index 3e24f4f04..f295a8208 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java
@@ -39,10 +39,31 @@ public class ResumableAuthenticationState {
      */
     private Credentials credentials;
 
+    /**
+     * A unique string identifying the authentication provider related to the state.
+     * This field allows the client to know which provider's authentication process
+     * should be resumed using this state.
+     */
+    private String providerIdentifier;
+
+    /**
+     * A unique string that can be used to identify a specific query within the
+     * authentication process for the identified provider. This identifier can
+     * help the resumption of an authentication process.
+     */
+    private String queryIdentifier;
+
     /**
      * Constructs a new ResumableAuthenticationState object with the specified
      * expiration timestamp and user credentials.
      *
+     * @param providerIdentifier
+     *     The identifier of the authentication provider to which this resumable state pertains.
+     *
+     * @param queryIdenifier
+     *     The identifier of the specific query within the provider's
+     *     authentication process that this state corresponds to.
+     *
      * @param expirationTimestamp
      *     The timestamp in milliseconds since the Unix epoch when this state
      *     expires and can no longer be used to resume authentication.
@@ -51,9 +72,12 @@ public class ResumableAuthenticationState {
      *     The Credentials object initially submitted by the user and associated
      *     with this resumable state.
      */
-    public ResumableAuthenticationState(long expirationTimestamp, Credentials credentials) {
+    public ResumableAuthenticationState(String providerIdentifier, String queryIdentifier, 
+            long expirationTimestamp, Credentials credentials) {
         this.expirationTimestamp = expirationTimestamp;
         this.credentials = credentials;
+        this.providerIdentifier = providerIdentifier;
+        this.queryIdentifier = queryIdentifier;
     }
 
     /**
@@ -78,4 +102,27 @@ public class ResumableAuthenticationState {
     public Credentials getCredentials() {
         return this.credentials;
     }
+
+    /**
+     * Retrieves the identifier of the authentication provider associated with this state.
+     *
+     * @return 
+     *     The identifier of the authentication provider, providing context for this state
+     *     within the overall authentication sequence.
+     */
+    public String getProviderIdentifier() {
+        return this.providerIdentifier;
+    }
+
+    /**
+     * Retrieves the identifier for a specific query in the authentication
+     * process that is associated with this state.
+     *
+     * @return 
+     *     The query identifier used for retrieving a value representing the state within
+     *     the provider's authentication process that should be resumed.
+     */
+    public String getQueryIdentifier() {
+        return this.queryIdentifier;
+    }
 }

From 732a4c5762557b8ce12c47b0939401f98e352d24 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Sun, 3 Dec 2023 08:42:56 -0500
Subject: [PATCH 260/289] GUACAMOLE-1479: Move disabled methods up to new
 Disableable interface.

---
 .../auth/jdbc/sharing/user/SharedUser.java    | 22 ---------
 .../guacamole/net/auth/Disableable.java       | 48 +++++++++++++++++++
 .../org/apache/guacamole/net/auth/User.java   | 19 +-------
 .../apache/guacamole/net/auth/UserGroup.java  | 21 +-------
 .../guacamole/net/auth/simple/SimpleUser.java | 22 ---------
 .../net/auth/simple/SimpleUserGroup.java      | 22 ---------
 6 files changed, 50 insertions(+), 104 deletions(-)
 create mode 100644 guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Disableable.java

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/user/SharedUser.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/user/SharedUser.java
index 5dcd8740d..80d22198c 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/user/SharedUser.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/sharing/user/SharedUser.java
@@ -78,28 +78,6 @@ public class SharedUser implements User {
     public void setIdentifier(String identifier) {
         throw new UnsupportedOperationException("Users authenticated via share keys are immutable.");
     }
-    
-    /**
-     * {@inheritDoc}
-     * 
-     * <p>SharedUser accounts are always enabled, as access is controlled via
-     * the shared token.
-     */
-    @Override
-    public boolean isDisabled() {
-        return false;
-    }
-    
-    /**
-     * {@inheritDoc}
-     * 
-     * <p>This method silently ignores the value passed in the disabled parameter,
-     * as disabling the account is done by invalidating the sharing token.
-     */
-    @Override
-    public void setDisabled(boolean disabled) {
-        // Silently ignore the parameter
-    }
 
     @Override
     public Map<String, String> getAttributes() {
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Disableable.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Disableable.java
new file mode 100644
index 000000000..e515bc8ca
--- /dev/null
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Disableable.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.net.auth;
+
+/**
+ * An interface that defines items that can be enabled or disabled.
+ */
+public interface Disableable {
+    
+    /**
+     * Returns true if this object is disabled, otherwise false.
+     * 
+     * @return 
+     *     True if this object is disabled, otherwise false.
+     */
+    default public boolean isDisabled() {
+        return false;
+    }
+    
+    /**
+     * Set the disabled status of this object to the boolean value provided,
+     * true if the object should be disabled, otherwise false.
+     * 
+     * @param disabled 
+     *     True if the object should be disabled, otherwise false.
+     */
+    default public void setDisabled(boolean disabled) {
+        // Default implementation takes no action.
+    }
+    
+}
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/User.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/User.java
index 9cdec2a07..d658bb08c 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/User.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/User.java
@@ -29,7 +29,7 @@ import org.apache.guacamole.GuacamoleUnsupportedException;
 /**
  * A user of the Guacamole web application.
  */
-public interface User extends Identifiable, Attributes, Permissions {
+public interface User extends Disableable, Identifiable, Attributes, Permissions {
 
     /**
      * All standard attribute names with semantics defined by the Guacamole web
@@ -79,23 +79,6 @@ public interface User extends Identifiable, Attributes, Permissions {
      * @param password The password to set.
      */
     public void setPassword(String password);
-    
-    /**
-     * Returns true if this user account is disabled, otherwise false.
-     * 
-     * @return 
-     *     True if this user account is disabled, otherwise false.
-     */
-    public boolean isDisabled();
-    
-    /**
-     * Set the disabled status of this account to the boolean parameter as
-     * provided, true if the account should be disabled, otherwise false.
-     * 
-     * @param disabled 
-     *     True if the account should be disabled, otherwise false.
-     */
-    public void setDisabled(boolean disabled);
 
     /**
      * Returns the date and time that this user was last active. If the user
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserGroup.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserGroup.java
index cbb26a9e8..840c386f3 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserGroup.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/UserGroup.java
@@ -26,27 +26,8 @@ import org.apache.guacamole.GuacamoleException;
  * any number of Guacamole users and other user groups, and defines the
  * permissions implicitly granted to its members.
  */
-public interface UserGroup extends Identifiable, Attributes, Permissions {
+public interface UserGroup extends Disableable, Identifiable, Attributes, Permissions {
 
-    /**
-     * Returns true if the user group is disabled, making membership in the group
-     * ineffective, meaning that any permissions or other group membership
-     * assigned to this group will not apply to member groups and users.
-     * 
-     * @return 
-     *     True if the group is disabled, otherwise false.
-     */
-    public boolean isDisabled();
-    
-    /**
-     * Set the disabled status of the user group, passing a boolean true value
-     * if the user group should be disabled, otherwise false.
-     * 
-     * @param disabled 
-     *     True if the user group should be disabled, otherwise false.
-     */
-    public void setDisabled(boolean disabled);
-    
     /**
      * Returns a set of all readable user groups of which this user group is a
      * member. If permission is granted for the current user to modify the
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUser.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUser.java
index 9274ea23f..8e349e27c 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUser.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUser.java
@@ -64,28 +64,6 @@ public class SimpleUser extends AbstractUser {
     public SimpleUser(String username) {
         super.setIdentifier(username);
     }
-    
-    /**
-     * {@inheritDoc}
-     * 
-     * <p>This User implementation is always enabled, so this method will
-     * always return false.
-     */
-    @Override
-    public boolean isDisabled() {
-        return false;
-    }
-    
-    /**
-     * {@inheritDoc}
-     * 
-     * <p>This User implementation is always enabled, so this method will
-     * silently ignore the value passed in under the disabled parameter.
-     */
-    @Override
-    public void setDisabled(boolean disabled) {
-        // Silently ignore disabled value
-    }
 
     /**
      * Adds a new READ permission to the given set of permissions for each of
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUserGroup.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUserGroup.java
index f06eabfe1..be52d1642 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUserGroup.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleUserGroup.java
@@ -43,27 +43,5 @@ public class SimpleUserGroup extends AbstractUserGroup {
     public SimpleUserGroup(String identifier) {
         super.setIdentifier(identifier);
     }
-    
-    /**
-     * {@inheritDoc}
-     * 
-     * <p>This implementation of UserGroup is always enabled, so this will
-     * always return false.
-     */
-    @Override
-    public boolean isDisabled() {
-        return false;
-    }
-    
-    /**
-     * {@inheritDoc}
-     * 
-     * <p>This implementation of UserGroup is always enabled, so this method
-     * will silently ignore the value passed in the disabled parameter.
-     */
-    @Override
-    public void setDisabled(boolean disabled) {
-        // Silently ignore as the UserGroup implementation is always enabled.
-    }
 
 }

From 9f1a8e66862e319256917c347b249a11ff19cc97 Mon Sep 17 00:00:00 2001
From: Alex Leitner <leitnersalex@gmail.com>
Date: Thu, 4 Apr 2024 01:32:48 +0000
Subject: [PATCH 261/289] GUACAMOLE-1289: Add new translations and guacamole
 properties.

---
 .../auth/duo/UserVerificationService.java     | 96 +++++++++----------
 .../auth/duo/conf/ConfigurationService.java   | 32 +++----
 .../src/main/resources/translations/en.json   |  3 +-
 .../src/main/resources/translations/ja.json   |  3 +-
 guacamole-docker/bin/start.sh                 | 22 ++---
 ...amoleInsufficientCredentialsException.java | 70 +++++++-------
 .../rest/auth/AuthenticationService.java      | 26 ++---
 .../auth/ResumableAuthenticationState.java    |  2 +-
 8 files changed, 127 insertions(+), 127 deletions(-)

diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
index efd8a4357..26ab71221 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
@@ -102,60 +102,60 @@ public class UserVerificationService {
 
         try {
 
-        String redirectUrl = confService.getRedirectUrl().toString();
+            String redirectUrl = confService.getRedirectUri().toString();
 
-        String builtUrl = UriComponentsBuilder
-                .fromUriString(redirectUrl)
-                .queryParam(Credentials.RESUME_QUERY, DuoAuthenticationProvider.PROVIDER_IDENTIFER)
-                .build()
-                .toUriString();
+            String builtUrl = UriComponentsBuilder
+                    .fromUriString(redirectUrl)
+                    .queryParam(Credentials.RESUME_QUERY, DuoAuthenticationProvider.PROVIDER_IDENTIFER)
+                    .build()
+                    .toUriString();
 
-        // Set up the Duo Client
-        Client duoClient = new Client.Builder(
-                confService.getClientId(),
-                confService.getClientSecret(),
-                confService.getAPIHostname(),
-                builtUrl)
-                .build();
-        
-        duoClient.healthCheck();
-        
-        // Retrieve signed Duo Code and State from the request
-        String duoCode = request.getParameter(DUO_CODE_PARAMETER_NAME);
-        String duoState = request.getParameter(DUO_STATE_PARAMETER_NAME);
+            // Set up the Duo Client
+            Client duoClient = new Client.Builder(
+                    confService.getClientId(),
+                    confService.getClientSecret(),
+                    confService.getAPIHostname(),
+                    builtUrl)
+                    .build();
 
-        // If no code or state is received, assume Duo MFA redirect has not occured and do it.
-        if (duoCode == null || duoState == null) {
+            duoClient.healthCheck();
 
-            // Get a new session state from the Duo client
-            duoState = duoClient.generateState();
-            long expirationTimestamp = System.currentTimeMillis() + (confService.getAuthTimeout() * 1000L);
+            // Retrieve signed Duo Code and State from the request
+            String duoCode = request.getParameter(DUO_CODE_PARAMETER_NAME);
+            String duoState = request.getParameter(DUO_STATE_PARAMETER_NAME);
 
-            // Request additional credentials
-            throw new TranslatableGuacamoleInsufficientCredentialsException(
-                "Verification using Duo is required before authentication "
-                + "can continue.", "LOGIN.INFO_DUO_AUTH_REQUIRED",
-                new CredentialsInfo(Collections.singletonList(
-                    new RedirectField(
-                            DUO_CODE_PARAMETER_NAME,
-                            new URI(duoClient.createAuthUrl(username, duoState)),
-                            new TranslatableMessage("LOGIN.INFO_DUO_REDIRECT_PENDING")
-                    )
-                )),
-                duoState, DuoAuthenticationProvider.PROVIDER_IDENTIFER, 
-                DUO_STATE_PARAMETER_NAME, expirationTimestamp
-            );
+            // If no code or state is received, assume Duo MFA redirect has not occured and do it
+            if (duoCode == null || duoState == null) {
 
-        }
-        
-        // Get the token from the DuoClient using the code and username, and check status
-        Token token = duoClient.exchangeAuthorizationCodeFor2FAResult(duoCode, username);
-        if (token == null 
-                || token.getAuth_result() == null 
-                || !DUO_TOKEN_SUCCESS_VALUE.equals(token.getAuth_result().getStatus()))
-            throw new TranslatableGuacamoleClientException("Provided Duo "
-                    + "validation code is incorrect.",
-                    "LOGIN.INFO_DUO_VALIDATION_CODE_INCORRECT");
+                // Get a new session state from the Duo client
+                duoState = duoClient.generateState();
+                long expirationTimestamp = System.currentTimeMillis() + (confService.getAuthTimeout() * 1000L);
+
+                // Request additional credentials
+                throw new TranslatableGuacamoleInsufficientCredentialsException(
+                    "Verification using Duo is required before authentication "
+                    + "can continue.", "LOGIN.INFO_DUO_AUTH_REQUIRED",
+                    new CredentialsInfo(Collections.singletonList(
+                        new RedirectField(
+                                DUO_CODE_PARAMETER_NAME,
+                                new URI(duoClient.createAuthUrl(username, duoState)),
+                                new TranslatableMessage("LOGIN.INFO_DUO_REDIRECT_PENDING")
+                        )
+                    )),
+                    duoState, DuoAuthenticationProvider.PROVIDER_IDENTIFER, 
+                    DUO_STATE_PARAMETER_NAME, expirationTimestamp
+                );
+
+            }
+
+            // Get the token from the DuoClient using the code and username, and check status
+            Token token = duoClient.exchangeAuthorizationCodeFor2FAResult(duoCode, username);
+            if (token == null 
+                    || token.getAuth_result() == null 
+                    || !DUO_TOKEN_SUCCESS_VALUE.equals(token.getAuth_result().getStatus()))
+                throw new TranslatableGuacamoleClientException("Provided Duo "
+                        + "validation code is incorrect.",
+                        "LOGIN.INFO_DUO_VALIDATION_CODE_INCORRECT");
         }
         catch (DuoException e) {
             throw new GuacamoleServerException("Duo Client error.", e);
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java
index 212b4a618..f6bed8073 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java
@@ -55,8 +55,8 @@ public class ConfigurationService {
     };
 
     /**
-     * The property within guacamole.properties which defines the integration
-     * key received from Duo for verifying Guacamole users. This value MUST be
+     * The property within guacamole.properties which defines the client id
+     * received from Duo for verifying Guacamole users. This value MUST be
      * exactly 20 characters.
      */
     private static final StringGuacamoleProperty DUO_CLIENT_ID =
@@ -79,17 +79,17 @@ public class ConfigurationService {
         public String getName() { return "duo-client-secret"; }
 
     };
-    
+
     /**
-     * The property within guacamole.properties which defines the redirect URL
+     * The property within guacamole.properties which defines the redirect URI
      * that Duo will call after the second factor has been completed. This
-     * should be the URL used to access Guacamole.
+     * should be the URI used to access Guacamole.
      */
-    private static final URIGuacamoleProperty DUO_REDIRECT_URL =
+    private static final URIGuacamoleProperty DUO_REDIRECT_URI =
             new URIGuacamoleProperty() {
-    
+
         @Override
-        public String getName() { return "duo-redirect-url"; }
+        public String getName() { return "duo-redirect-uri"; }
                 
     };
     
@@ -140,8 +140,8 @@ public class ConfigurationService {
     }
 
     /**
-     * Returns the client secert received from Duo for verifying Guacamole users,
-     * as defined in guacamole.properties by the "duo-client-secert" property.
+     * Returns the client secret received from Duo for verifying Guacamole users,
+     * as defined in guacamole.properties by the "duo-client-secret" property.
      * This value MUST be exactly 20 characters.
      *
      * @return
@@ -153,11 +153,11 @@ public class ConfigurationService {
     public String getClientSecret() throws GuacamoleException {
         return environment.getRequiredProperty(DUO_CLIENT_SECRET);
     }
-    
+
     /**
-     * Return the callback URL that will be called by Duo after authentication
-     * with Duo has been completed. This should be the URL to return the user
-     * to the Guacamole interface, and will be a full URL.
+     * Return the callback URI that will be called by Duo after authentication
+     * with Duo has been completed. This should be the URI to return the user
+     * to the Guacamole interface, and will be a full URI.
      * 
      * @return
      *     The URL for Duo to use to callback to the Guacamole interface after
@@ -167,8 +167,8 @@ public class ConfigurationService {
      *     If guacamole.properties cannot be read, or if the property is not
      *     defined.
      */
-    public URI getRedirectUrl() throws GuacamoleException {
-        return environment.getRequiredProperty(DUO_REDIRECT_URL);
+    public URI getRedirectUri() throws GuacamoleException {
+        return environment.getRequiredProperty(DUO_REDIRECT_URI);
     }
     
     /**
diff --git a/extensions/guacamole-auth-duo/src/main/resources/translations/en.json b/extensions/guacamole-auth-duo/src/main/resources/translations/en.json
index 8682cba35..877f538b6 100644
--- a/extensions/guacamole-auth-duo/src/main/resources/translations/en.json
+++ b/extensions/guacamole-auth-duo/src/main/resources/translations/en.json
@@ -7,7 +7,8 @@
     "LOGIN" : {
         "FIELD_HEADER_GUAC_DUO_SIGNED_RESPONSE" : "",
         "INFO_DUO_VALIDATION_CODE_INCORRECT"    : "Duo validation code incorrect.",
-        "INFO_DUO_AUTH_REQUIRED"                : "Please authenticate with Duo to continue."
+        "INFO_DUO_AUTH_REQUIRED"                : "Please authenticate with Duo to continue.",
+        "INFO_DUO_REDIRECT_PENDING"             : "Please wait, redirecting to Duo..."
     }
 
 }
diff --git a/extensions/guacamole-auth-duo/src/main/resources/translations/ja.json b/extensions/guacamole-auth-duo/src/main/resources/translations/ja.json
index 37ddde234..d3acef824 100644
--- a/extensions/guacamole-auth-duo/src/main/resources/translations/ja.json
+++ b/extensions/guacamole-auth-duo/src/main/resources/translations/ja.json
@@ -2,7 +2,8 @@
 
     "LOGIN" : {
         "INFO_DUO_VALIDATION_CODE_INCORRECT"    : "Duoの認証コードが間違っています。",
-        "INFO_DUO_AUTH_REQUIRED"                : "Duoで認証してください。"
+        "INFO_DUO_AUTH_REQUIRED"                : "Duoで認証してください。",
+        "INFO_DUO_REDIRECT_PENDING"             : "Duoへリダイレクトしています。"
     }
 
 }
diff --git a/guacamole-docker/bin/start.sh b/guacamole-docker/bin/start.sh
index 02687d861..4588c0eb4 100755
--- a/guacamole-docker/bin/start.sh
+++ b/guacamole-docker/bin/start.sh
@@ -845,14 +845,13 @@ associate_totp() {
 
 ##
 ## Adds properties to guacamole.properties which configure the Duo two-factor
-## authentication service. Checks to see if all variables are defined and makes sure
-## DUO_APPLICATION_KEY is >= 40 characters.
+## authentication service. Checks to see if all variables are defined
 ##
 associate_duo() {
     # Verify required parameters are present
-    if [ -z "$DUO_INTEGRATION_KEY" ]      || \
-       [ -z "$DUO_SECRET_KEY" ]           || \
-       [ ${#DUO_APPLICATION_KEY} -lt 40 ]
+    if [ -z "$DUO_CLIENT_ID" ]            || \
+       [ -z "$DUO_CLIENT_SECRET" ]        || \
+       [ -z "$DUO_REDIRECT_URI" ]
     then
         cat <<END
 FATAL: Missing required environment variables
@@ -862,21 +861,20 @@ following environment variables:
 
     DUO_API_HOSTNAME        The hostname of the Duo API endpoint.
 
-    DUO_INTEGRATION_KEY     The integration key provided for Guacamole by Duo.
+    DUO_CLIENT_ID           The client id (or integration key) provided for Guacamole by Duo.
 
-    DUO_SECRET_KEY          The secret key provided for Guacamole by Duo.
+    DUO_CLIENT_SECRET       The secret key provided for Guacamole by Duo.
 
-    DUO_APPLICATION_KEY     An arbitrary, random key.
-                            This value must be at least 40 characters.
+    DUO_REDIRECT_URI        The URI to redirect back to upon successful authentication.
 END
         exit 1;
     fi
 
     # Update config file
     set_property "duo-api-hostname"                 "$DUO_API_HOSTNAME"
-    set_property "duo-integration-key"              "$DUO_INTEGRATION_KEY"
-    set_property "duo-secret-key"                   "$DUO_SECRET_KEY"
-    set_property "duo-application-key"              "$DUO_APPLICATION_KEY"
+    set_property "duo-client-id"                    "$DUO_CLIENT_ID"
+    set_property "duo-client-secret"                "$DUO_CLIENT_SECRET"
+    set_property "duo-redirect-uri"                 "$DUO_REDIRECT_URI"
 
     # Add required .jar files to GUACAMOLE_EXT
     ln -s /opt/guacamole/duo/guacamole-auth-*.jar   "$GUACAMOLE_EXT"
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
index def5350b6..8c7669474 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
@@ -28,36 +28,36 @@ package org.apache.guacamole.net.auth.credentials;
  */
 public class GuacamoleInsufficientCredentialsException extends GuacamoleCredentialsException {
 
-/**
- * The default state token to use when no specific state information is provided.
- */
-private static final String DEFAULT_STATE = "";
+    /**
+     * The default state token to use when no specific state information is provided.
+     */
+    private static final String DEFAULT_STATE = "";
 
-/**
- * The default provider identifier to use when no specific provider is identified.
- * This serves as a placeholder indicating that either no specific provider is
- * responsible for the exception or the responsible provider has not been identified.
- */
-private static final String DEFAULT_PROVIDER_IDENTIFIER = "";
+    /**
+     * The default provider identifier to use when no specific provider is identified.
+     * This serves as a placeholder indicating that either no specific provider is
+     * responsible for the exception or the responsible provider has not been identified.
+     */
+    private static final String DEFAULT_PROVIDER_IDENTIFIER = "";
 
-/**
- * The default query identifier to use when no specific query is identified.
- * This serves as a placeholder and indicates that the specific query related to
- * the provider's state resume operation has not been provided.
- */
-private static final String DEFAULT_QUERY_IDENTIFIER = "";
+    /**
+     * The default query identifier to use when no specific query is identified.
+     * This serves as a placeholder and indicates that the specific query related to
+     * the provider's state resume operation has not been provided.
+     */
+    private static final String DEFAULT_QUERY_IDENTIFIER = "";
 
-/**
- * The default expiration timestamp to use when no specific expiration is provided,
- * effectively indicating that the state token does not expire.
- */
-private static final long DEFAULT_EXPIRES = -1L;
+    /**
+     * The default expiration timestamp to use when no specific expiration is provided,
+     * effectively indicating that the state token does not expire.
+     */
+    private static final long DEFAULT_EXPIRES = -1L;
 
-/**
- * An opaque value that may be used by a client to maintain state across requests
- * which are part of the same authentication transaction.
- */
-protected final String state;
+    /**
+     * An opaque value that may be used by a client to maintain state across requests
+     * which are part of the same authentication transaction.
+     */
+    protected final String state;
 
     /**
      * The identifier for the authentication provider that threw this exception.
@@ -73,12 +73,12 @@ protected final String state;
      */
     protected final String queryIdentifier;
 
-/**
- * The timestamp after which the state token associated with the authentication process
- * should no longer be considered valid, expressed as the number of milliseconds since
- * UNIX epoch.
- */
-protected final long expires;
+    /**
+     * The timestamp after which the state token associated with the authentication process
+     * should no longer be considered valid, expressed as the number of milliseconds since
+     * UNIX epoch.
+     */
+    protected final long expires;
 
     /**
      * Creates a new GuacamoleInsufficientCredentialsException with the specified
@@ -107,9 +107,9 @@ protected final long expires;
      *     authentication process should no longer be considered valid, expressed
      *     as the number of milliseconds since UNIX epoch.
      */
-   public GuacamoleInsufficientCredentialsException(String message,
-            CredentialsInfo credentialsInfo, String state, String providerIdentifier, String queryIdentifier, 
-            long expires) {
+    public GuacamoleInsufficientCredentialsException(String message,
+            CredentialsInfo credentialsInfo, String state, 
+            String providerIdentifier, String queryIdentifier, long expires) {
         super(message, credentialsInfo);
         this.state = state;
         this.providerIdentifier = providerIdentifier;
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
index 1fafa4a30..dc8d3bb7d 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
@@ -364,7 +364,7 @@ public class AuthenticationService {
      *
      * @return 
      *     Resumed credentials if a valid resumable state is found; otherwise, 
-     *     returns {@code null}.
+     *     returns null.
      */
     private Credentials resumeAuthentication(Credentials credentials) {
         
@@ -373,11 +373,11 @@ public class AuthenticationService {
         // Retrieve signed State from the request
         HttpServletRequest request = credentials.getRequest();
         
-        // Retrieve the provider id from the query parameters.
+        // Retrieve the provider id from the query parameters
         String resumableProviderId = request.getParameter(Credentials.RESUME_QUERY);
-        // Check if a provider id is set.
+        // Check if a provider id is set
         if (resumableProviderId == null || resumableProviderId.isEmpty()) {
-            // return if a provider id is not set.
+            // Return if a provider id is not set
             return null;
         }
 
@@ -387,34 +387,34 @@ public class AuthenticationService {
             Map.Entry<String, ResumableAuthenticationState> entry = iterator.next();
             ResumableAuthenticationState resumableState = entry.getValue();
 
-            // Check if the provider ID from the request matches the one in the map entry.
+            // Check if the provider ID from the request matches the one in the map entry
             boolean providerMatches = resumableProviderId.equals(resumableState.getProviderIdentifier());
             if (!providerMatches) {
-                // If the provider doesn't match, skip to the next entry.
+                // If the provider doesn't match, skip to the next entry
                 continue;
             }
 
-            // Use the query identifier from the entry to retrieve the corresponding state parameter.
+            // Use the query identifier from the entry to retrieve the corresponding state parameter
             String stateQueryParameter = resumableState.getQueryIdentifier();
             String stateFromParameter = request.getParameter(stateQueryParameter);
 
-            // Check if the `state` parameter is set.
+            // Check if a state parameter is set
             if (stateFromParameter == null || stateFromParameter.isEmpty()) {
-                // Remove and continue if `state` is not provided or is empty.
+                // Remove and continue if`state is not provided or is empty
                 iterator.remove(); 
                 continue;
             }
 
-            // If the key in the entry (state) matches the state parameter provided in the request.
+            // If the key in the entry (state) matches the state parameter provided in the request
             if (entry.getKey().equals(stateFromParameter)) {
 
-                // Remove the current entry from the map.
+                // Remove the current entry from the map
                 iterator.remove();                
 
                 // Check if the resumableState has expired
                 if (!resumableState.isExpired()) {
 
-                    // Set the actualCredentials to the credentials from the matched entry.
+                    // Set the actualCredentials to the credentials from the matched entry
                     resumedCredentials = resumableState.getCredentials();
 
                     if (resumedCredentials != null) {
@@ -423,7 +423,7 @@ public class AuthenticationService {
 
                 }
 
-                // Exit the loop since we've found the matching state and it's unique.
+                // Exit the loop since we've found the matching state and it's unique
                 break;
             }
         }
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java
index f295a8208..1aaa7ea57 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java
@@ -89,7 +89,7 @@ public class ResumableAuthenticationState {
      *     indicating that the state is expired; false otherwise.
      */
     public boolean isExpired() {
-        return System.currentTimeMillis() > expirationTimestamp;
+        return System.currentTimeMillis() >= expirationTimestamp;
     }
 
     /**

From 3b76865eecd949c20ddafb47d172c3e36cb7ee84 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Wed, 3 Apr 2024 16:47:48 -0400
Subject: [PATCH 262/289] GUACAMOLE-1916: Jump to top of page after clone.

---
 .../src/app/manage/controllers/manageConnectionController.js    | 2 ++
 .../app/manage/controllers/manageConnectionGroupController.js   | 2 ++
 .../app/manage/controllers/manageSharingProfileController.js    | 2 ++
 .../frontend/src/app/manage/controllers/manageUserController.js | 2 ++
 .../src/app/manage/controllers/manageUserGroupController.js     | 2 ++
 5 files changed, 10 insertions(+)

diff --git a/guacamole/src/main/frontend/src/app/manage/controllers/manageConnectionController.js b/guacamole/src/main/frontend/src/app/manage/controllers/manageConnectionController.js
index 06cbeae1c..5635def0d 100644
--- a/guacamole/src/main/frontend/src/app/manage/controllers/manageConnectionController.js
+++ b/guacamole/src/main/frontend/src/app/manage/controllers/manageConnectionController.js
@@ -36,6 +36,7 @@ angular.module('manage').controller('manageConnectionController', ['$scope', '$i
     var $q                       = $injector.get('$q');
     var $routeParams             = $injector.get('$routeParams');
     var $translate               = $injector.get('$translate');
+    var $window                  = $injector.get('$window');
     var authenticationService    = $injector.get('authenticationService');
     var connectionService        = $injector.get('connectionService');
     var connectionGroupService   = $injector.get('connectionGroupService');
@@ -318,6 +319,7 @@ angular.module('manage').controller('manageConnectionController', ['$scope', '$i
      */
     $scope.cloneConnection = function cloneConnection() {
         $location.path('/manage/' + encodeURIComponent($scope.selectedDataSource) + '/connections').search('clone', identifier);
+        $window.scrollTo(0,0);
     };
             
     /**
diff --git a/guacamole/src/main/frontend/src/app/manage/controllers/manageConnectionGroupController.js b/guacamole/src/main/frontend/src/app/manage/controllers/manageConnectionGroupController.js
index b05827098..e0029cb15 100644
--- a/guacamole/src/main/frontend/src/app/manage/controllers/manageConnectionGroupController.js
+++ b/guacamole/src/main/frontend/src/app/manage/controllers/manageConnectionGroupController.js
@@ -32,6 +32,7 @@ angular.module('manage').controller('manageConnectionGroupController', ['$scope'
     var $location              = $injector.get('$location');
     var $q                     = $injector.get('$q');
     var $routeParams           = $injector.get('$routeParams');
+    var $window                = $injector.get('$window');
     var authenticationService  = $injector.get('authenticationService');
     var connectionGroupService = $injector.get('connectionGroupService');
     var permissionService      = $injector.get('permissionService');
@@ -262,6 +263,7 @@ angular.module('manage').controller('manageConnectionGroupController', ['$scope'
      */
     $scope.cloneConnectionGroup = function cloneConnectionGRoup() {
         $location.path('/manage/' + encodeURIComponent($scope.selectedDataSource) + '/connectionGroups').search('clone', identifier);
+        $window.scrollTo(0,0);
     };
 
     /**
diff --git a/guacamole/src/main/frontend/src/app/manage/controllers/manageSharingProfileController.js b/guacamole/src/main/frontend/src/app/manage/controllers/manageSharingProfileController.js
index e3c9ca17d..139eaf893 100644
--- a/guacamole/src/main/frontend/src/app/manage/controllers/manageSharingProfileController.js
+++ b/guacamole/src/main/frontend/src/app/manage/controllers/manageSharingProfileController.js
@@ -33,6 +33,7 @@ angular.module('manage').controller('manageSharingProfileController', ['$scope',
     var $location                = $injector.get('$location');
     var $q                       = $injector.get('$q');
     var $routeParams             = $injector.get('$routeParams');
+    var $window                  = $injector.get('$window');
     var authenticationService    = $injector.get('authenticationService');
     var connectionService        = $injector.get('connectionService');
     var permissionService        = $injector.get('permissionService');
@@ -299,6 +300,7 @@ angular.module('manage').controller('manageSharingProfileController', ['$scope',
      */
     $scope.cloneSharingProfile = function cloneSharingProfile() {
         $location.path('/manage/' + encodeURIComponent($scope.selectedDataSource) + '/sharingProfiles').search('clone', identifier);
+        $window.scrollTo(0,0);
     };
 
     /**
diff --git a/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js b/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js
index f7ead136a..d1bbbb52f 100644
--- a/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js
+++ b/guacamole/src/main/frontend/src/app/manage/controllers/manageUserController.js
@@ -34,6 +34,7 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
     var $location                = $injector.get('$location');
     var $routeParams             = $injector.get('$routeParams');
     var $q                       = $injector.get('$q');
+    var $window                  = $injector.get('$window');
     var authenticationService    = $injector.get('authenticationService');
     var dataSourceService        = $injector.get('dataSourceService');
     var membershipService        = $injector.get('membershipService');
@@ -431,6 +432,7 @@ angular.module('manage').controller('manageUserController', ['$scope', '$injecto
      */
     $scope.cloneUser = function cloneUser() {
         $location.path('/manage/' + encodeURIComponent($scope.dataSource) + '/users').search('clone', username);
+        $window.scrollTo(0,0);
     };
             
     /**
diff --git a/guacamole/src/main/frontend/src/app/manage/controllers/manageUserGroupController.js b/guacamole/src/main/frontend/src/app/manage/controllers/manageUserGroupController.js
index b1b04d35f..b58fe283e 100644
--- a/guacamole/src/main/frontend/src/app/manage/controllers/manageUserGroupController.js
+++ b/guacamole/src/main/frontend/src/app/manage/controllers/manageUserGroupController.js
@@ -33,6 +33,7 @@ angular.module('manage').controller('manageUserGroupController', ['$scope', '$in
     var $location             = $injector.get('$location');
     var $routeParams          = $injector.get('$routeParams');
     var $q                    = $injector.get('$q');
+    var $window               = $injector.get('$window');
     var authenticationService = $injector.get('authenticationService');
     var dataSourceService     = $injector.get('dataSourceService');
     var membershipService     = $injector.get('membershipService');
@@ -505,6 +506,7 @@ angular.module('manage').controller('manageUserGroupController', ['$scope', '$in
      */
     $scope.cloneUserGroup = function cloneUserGroup() {
         $location.path('/manage/' + encodeURIComponent($scope.dataSource) + '/userGroups').search('clone', identifier);
+        $window.scrollTo(0,0);
     };
 
     /**

From 462022e3f1b646666e8de1d821f2368ff95b5e20 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Fri, 12 Apr 2024 17:50:26 -0400
Subject: [PATCH 263/289] GUACAMOLE-1068: Generate random key at each login if
 key is unconfirmed.

---
 .../totp/user/UserVerificationService.java    | 51 ++++++++++++++-----
 1 file changed, 39 insertions(+), 12 deletions(-)

diff --git a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/UserVerificationService.java b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/UserVerificationService.java
index 027a228cd..30573fcbf 100644
--- a/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/UserVerificationService.java
+++ b/extensions/guacamole-auth-totp/src/main/java/org/apache/guacamole/auth/totp/user/UserVerificationService.java
@@ -112,18 +112,9 @@ public class UserVerificationService {
 
         // If no key is defined, attempt to generate a new key
         String secret = attributes.get(TOTPUser.TOTP_KEY_SECRET_ATTRIBUTE_NAME);
-        if (secret == null || secret.isEmpty()) {
-
-            // Generate random key for user
-            TOTPGenerator.Mode mode = confService.getMode();
-            UserTOTPKey generated = new UserTOTPKey(username,mode.getRecommendedKeyLength());
-            if (setKey(context, generated))
-                return generated;
-
-            // Fail if key cannot be set
-            return null;
-
-        }
+        
+        if (secret == null || secret.isEmpty()) 
+            return generateKey(context, username);
 
         // Parse retrieved base32 key value
         byte[] key;
@@ -144,6 +135,38 @@ public class UserVerificationService {
         return new UserTOTPKey(username, key, confirmed);
 
     }
+    
+    /**
+     * Generate and set a new key for the specified user and context, returning
+     * the key if the set successfully or null if it fails.
+     * 
+     * @param context
+     *     The UserContext of the user whose TOTP key should be generated and set.
+     *
+     * @param username
+     *     The username of the user associated with the given UserContext.
+     * 
+     * @return
+     *     The generated and set key, or null if the operation failed.
+     * 
+     * @throws GuacamoleException
+     *     If a new key is generated, but the extension storing the associated
+     *     user fails while updating the user account, or if the configuration
+     *     cannot be retrieved.
+     */
+    private UserTOTPKey generateKey(UserContext context, String username)
+            throws GuacamoleException {
+        
+        // Generate random key for user
+        TOTPGenerator.Mode mode = confService.getMode();
+        UserTOTPKey generated = new UserTOTPKey(username,mode.getRecommendedKeyLength());
+        if (setKey(context, generated))
+            return generated;
+
+        // Fail if key cannot be set
+        return null;
+        
+    }
 
     /**
      * Attempts to store the given TOTP key within the user account of the user
@@ -316,6 +339,10 @@ public class UserVerificationService {
 
             // If the user hasn't completed enrollment, request that they do
             if (!key.isConfirmed()) {
+                
+                // If the key has not yet been confirmed, generate a new one.
+                key = generateKey(context, username);
+                
                 field.exposeKey(key);
                 throw new TranslatableGuacamoleInsufficientCredentialsException(
                         "TOTP enrollment must be completed before "

From a909f23d4ce03a5816185e3d5d917f893a20764a Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Tue, 16 Apr 2024 20:52:19 -0400
Subject: [PATCH 264/289] GUACAMOLE-1760: Add client-side options for
 compression and quality levels.

---
 .../org/apache/guacamole/protocols/vnc.json   | 10 +++++++
 .../main/frontend/src/translations/en.json    | 26 +++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
index c80dcdf27..3c87f99e1 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
@@ -58,6 +58,16 @@
                     "type"    : "BOOLEAN",
                     "options" : [ "true" ]
                 },
+                {
+                    "name"    : "compress-level",
+                    "type"    : "ENUM",
+                    "options" : [ "", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9" ]
+                },
+                {
+                    "name"    : "quality-level",
+                    "type"    : "ENUM",
+                    "options" : [ "", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9" ]
+                },
                 {
                     "name" : "encodings",
                     "type" : "TEXT"
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 6793c4737..76b22d3c3 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -899,6 +899,7 @@
         "FIELD_HEADER_AUDIO_SERVERNAME" : "Audio server name:",
         "FIELD_HEADER_CLIPBOARD_ENCODING" : "Encoding:",
         "FIELD_HEADER_COLOR_DEPTH"      : "Color depth:",
+        "FIELD_HEADER_COMPRESS_LEVEL"   : "Compression level:",
         "FIELD_HEADER_CREATE_RECORDING_PATH" : "Automatically create recording path:",
         "FIELD_HEADER_CURSOR"           : "Cursor:",
         "FIELD_HEADER_DEST_HOST"        : "Destination host:",
@@ -912,6 +913,7 @@
         "FIELD_HEADER_USERNAME"         : "Username:",
         "FIELD_HEADER_PASSWORD"         : "Password:",
         "FIELD_HEADER_PORT"             : "Port:",
+        "FIELD_HEADER_QUALITY_LEVEL"    : "Display quality:",
         "FIELD_HEADER_READ_ONLY"        : "Read-only:",
         "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "@:APP.FIELD_HEADER_RECORDING_WRITE_EXISTING",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Exclude mouse:",
@@ -944,6 +946,18 @@
         "FIELD_OPTION_COLOR_DEPTH_32"    : "True color (32-bit)",
         "FIELD_OPTION_COLOR_DEPTH_EMPTY" : "",
 
+        "FIELD_OPTION_COMPRESS_LEVEL_0"     : "0",
+        "FIELD_OPTION_COMPRESS_LEVEL_1"     : "1",
+        "FIELD_OPTION_COMPRESS_LEVEL_2"     : "2",
+        "FIELD_OPTION_COMPRESS_LEVEL_3"     : "3",
+        "FIELD_OPTION_COMPRESS_LEVEL_4"     : "4",
+        "FIELD_OPTION_COMPRESS_LEVEL_5"     : "5",
+        "FIELD_OPTION_COMPRESS_LEVEL_6"     : "6",
+        "FIELD_OPTION_COMPRESS_LEVEL_7"     : "7",
+        "FIELD_OPTION_COMPRESS_LEVEL_8"     : "8",
+        "FIELD_OPTION_COMPRESS_LEVEL_9"     : "9",
+        "FIELD_OPTION_COMPRESS_LEVEL_EMPTY" : "",
+
         "FIELD_OPTION_CURSOR_EMPTY"  : "",
         "FIELD_OPTION_CURSOR_LOCAL"  : "Local",
         "FIELD_OPTION_CURSOR_REMOTE" : "Remote",
@@ -954,6 +968,18 @@
         "FIELD_OPTION_CLIPBOARD_ENCODING_UTF_8"     : "UTF-8",
         "FIELD_OPTION_CLIPBOARD_ENCODING_UTF_16"    : "UTF-16",
 
+        "FIELD_OPTION_QUALITY_LEVEL_0"     : "0",
+        "FIELD_OPTION_QUALITY_LEVEL_1"     : "1",
+        "FIELD_OPTION_QUALITY_LEVEL_2"     : "2",
+        "FIELD_OPTION_QUALITY_LEVEL_3"     : "3",
+        "FIELD_OPTION_QUALITY_LEVEL_4"     : "4",
+        "FIELD_OPTION_QUALITY_LEVEL_5"     : "5",
+        "FIELD_OPTION_QUALITY_LEVEL_6"     : "6",
+        "FIELD_OPTION_QUALITY_LEVEL_7"     : "7",
+        "FIELD_OPTION_QUALITY_LEVEL_8"     : "8",
+        "FIELD_OPTION_QUALITY_LEVEL_9"     : "9",
+        "FIELD_OPTION_QUALITY_LEVEL_EMPTY" : "",
+
         "NAME" : "VNC",
 
         "SECTION_HEADER_AUDIO"          : "Audio",

From 4d7a54b463334d0b4507203064a9251f5c3ed713 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Sat, 6 Apr 2024 20:34:14 -0400
Subject: [PATCH 265/289] GUACAMOLE-1866: Allow recent connections to be
 removed.

---
 .../src/app/history/services/guacHistory.js   | 16 ++++++++++
 .../home/directives/guacRecentConnections.js  | 15 ++++++++++
 .../frontend/src/app/home/styles/home.css     | 30 ++++++++++++++++++-
 .../home/templates/guacRecentConnections.html |  4 ++-
 4 files changed, 63 insertions(+), 2 deletions(-)

diff --git a/guacamole/src/main/frontend/src/app/history/services/guacHistory.js b/guacamole/src/main/frontend/src/app/history/services/guacHistory.js
index e47cb29e9..d5dcbfe07 100644
--- a/guacamole/src/main/frontend/src/app/history/services/guacHistory.js
+++ b/guacamole/src/main/frontend/src/app/history/services/guacHistory.js
@@ -42,6 +42,22 @@ angular.module('history').factory('guacHistory', ['$injector',
      */
     service.recentConnections = [];
 
+    /**
+     * Remove from the list of connection history the item having the given
+     * identfier.
+     * 
+     * @param {String} id
+     *     The identifier of the item to remove from the history list.
+     *     
+     * @returns {boolean}
+     *     True if the removal was successful, otherwise false.
+     */
+    service.removeEntry = function removeEntry(id) {
+    
+        return _.remove(service.recentConnections, entry => entry.id === id).length > 0;
+    
+    };
+
     /**
      * Updates the thumbnail and access time of the history entry for the
      * connection with the given ID.
diff --git a/guacamole/src/main/frontend/src/app/home/directives/guacRecentConnections.js b/guacamole/src/main/frontend/src/app/home/directives/guacRecentConnections.js
index 1f16e036e..57f141f3f 100644
--- a/guacamole/src/main/frontend/src/app/home/directives/guacRecentConnections.js
+++ b/guacamole/src/main/frontend/src/app/home/directives/guacRecentConnections.js
@@ -59,6 +59,21 @@ angular.module('home').directive('guacRecentConnections', [function guacRecentCo
              */
             $scope.recentConnections = [];
             
+            /**
+             * Remove the connection from the recent connection list having the
+             * given identifier.
+             * 
+             * @param {!RecentConnection} recentConnection
+             *     The recent connection to remove from the history list.
+             *     
+             * @returns {boolean}
+             *     True if the removal was successful, otherwise false.
+             */
+            $scope.removeRecentConnection = function removeRecentConnection(recentConnection) {
+                return ($scope.recentConnections.splice($scope.recentConnections.indexOf(recentConnection), 1) 
+                        && guacHistory.removeEntry(recentConnection.entry.id));
+            };
+            
             /**
              * Returns whether or not recent connections should be displayed.
              * 
diff --git a/guacamole/src/main/frontend/src/app/home/styles/home.css b/guacamole/src/main/frontend/src/app/home/styles/home.css
index e6837f45c..7699fe87e 100644
--- a/guacamole/src/main/frontend/src/app/home/styles/home.css
+++ b/guacamole/src/main/frontend/src/app/home/styles/home.css
@@ -49,6 +49,7 @@ div.recent-connections div.connection {
     text-align: center;
     max-width: 75%;
     overflow: hidden;
+    position: relative;
 }
 
 a.home-connection, .empty.balancer a.home-connection-group {
@@ -79,4 +80,31 @@ a.home-connection, .empty.balancer a.home-connection-group {
 .header-app-name {
     font-size: 0.85em;
     box-shadow: none;
-}
\ No newline at end of file
+}
+
+.recent-connections .connection .remove-recent::after {
+    content: '';
+    display: block;
+    height: 100%;
+    width: 100%;
+    background-repeat: no-repeat;
+    background-size: contain;
+    background-position: center center;
+    background-image: url('images/x.svg');
+}
+
+.recent-connections .connection .remove-recent {
+    background-color: red;
+    height: 1em;
+    width: 1em;
+    position: absolute;
+    top: 10px;
+    z-index: 10;
+    float: right;
+    right: 10px;
+    opacity: .2;
+}
+
+.recent-connections .connection .remove-recent:hover {
+    opacity: 1.0;
+}
diff --git a/guacamole/src/main/frontend/src/app/home/templates/guacRecentConnections.html b/guacamole/src/main/frontend/src/app/home/templates/guacRecentConnections.html
index 96c75ec71..d24397445 100644
--- a/guacamole/src/main/frontend/src/app/home/templates/guacRecentConnections.html
+++ b/guacamole/src/main/frontend/src/app/home/templates/guacRecentConnections.html
@@ -9,7 +9,7 @@
 
             <!-- Connection thumbnail -->
             <div class="thumbnail">
-                <img alt="{{recentConnection.name}}" ng-src="{{recentConnection.entry.thumbnail}}">
+                <img alt="{{recentConnection.name}}" ng-src="{{recentConnection.entry.thumbnail}}"/>
             </div>
 
             <!-- Connection name -->
@@ -18,6 +18,8 @@
             </div>
 
         </a>
+        <!-- Remove thumbnail -->
+        <div class="remove-recent" ng-click="removeRecentConnection(recentConnection)" />
     </div>
 
 </div>

From 45c5afbf1e388509412c1df5108c6f178f5bbf15 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Fri, 19 Apr 2024 21:32:59 +0000
Subject: [PATCH 266/289] GUACAMOLE-1946: Disable autofill on TOTP verification
 code field.

---
 .../src/main/resources/templates/authenticationCodeField.html   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/guacamole-auth-totp/src/main/resources/templates/authenticationCodeField.html b/extensions/guacamole-auth-totp/src/main/resources/templates/authenticationCodeField.html
index 7f2a3c485..7d9fc7a74 100644
--- a/extensions/guacamole-auth-totp/src/main/resources/templates/authenticationCodeField.html
+++ b/extensions/guacamole-auth-totp/src/main/resources/templates/authenticationCodeField.html
@@ -42,7 +42,7 @@
         <input type="text"
                placeholder="{{'TOTP.FIELD_PLACEHOLDER_CODE' |translate}}"
                ng-attr-name="{{ field.name }}"
-               ng-model="model" autocorrect="off" autocapitalize="off" autofocus>
+               ng-model="model" autocomplete="off" autocorrect="off" autocapitalize="off" autofocus>
     </div>
 
 </div>

From 9580dd4f82daf10adcdc89fd25155c78c90a68bd Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Sun, 18 Feb 2024 00:43:21 -0800
Subject: [PATCH 267/289] GUACAMOLE-374: Support absolutely all properties and
 extensions.

---
 Dockerfile                                    |   10 +-
 guacamole-docker/bin/build-guacamole.sh       |  186 +--
 guacamole-docker/bin/entrypoint.sh            |   39 +
 guacamole-docker/bin/start.sh                 | 1251 -----------------
 .../000-build-and-install-guacamole.sh        |   62 +
 .../build.d/010-map-guacamole-extensions.sh   |  118 ++
 .../build.d/020-download-drivers.sh           |   99 ++
 guacamole-docker/build.d/999-verify-sanity.sh |   47 +
 .../000-migrate-legacy-variables.sh           |  105 ++
 .../100-generate-guacamole-home.sh            |  111 ++
 .../110-configure-guacamole-logging.sh        |   33 +
 .../500-generate-tomcat-catalina-base.sh      |   50 +
 .../entrypoint.d/700-configure-features.sh    |   88 ++
 .../entrypoint.d/999-start-tomcat.sh          |   30 +
 .../environment/REMOTE_IP_VALVE_/configure.sh |   72 +
 15 files changed, 887 insertions(+), 1414 deletions(-)
 create mode 100755 guacamole-docker/bin/entrypoint.sh
 delete mode 100755 guacamole-docker/bin/start.sh
 create mode 100644 guacamole-docker/build.d/000-build-and-install-guacamole.sh
 create mode 100644 guacamole-docker/build.d/010-map-guacamole-extensions.sh
 create mode 100644 guacamole-docker/build.d/020-download-drivers.sh
 create mode 100644 guacamole-docker/build.d/999-verify-sanity.sh
 create mode 100644 guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh
 create mode 100644 guacamole-docker/entrypoint.d/100-generate-guacamole-home.sh
 create mode 100644 guacamole-docker/entrypoint.d/110-configure-guacamole-logging.sh
 create mode 100644 guacamole-docker/entrypoint.d/500-generate-tomcat-catalina-base.sh
 create mode 100644 guacamole-docker/entrypoint.d/700-configure-features.sh
 create mode 100644 guacamole-docker/entrypoint.d/999-start-tomcat.sh
 create mode 100644 guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh

diff --git a/Dockerfile b/Dockerfile
index 29231f363..b37a9d913 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -61,6 +61,9 @@ ENV \
 
 # Add configuration scripts
 COPY guacamole-docker/bin/ /opt/guacamole/bin/
+COPY guacamole-docker/build.d/ /opt/guacamole/build.d/
+COPY guacamole-docker/entrypoint.d/ /opt/guacamole/entrypoint.d/
+COPY guacamole-docker/environment/ /opt/guacamole/environment/
 
 # Copy source to container for sake of build
 COPY . "$BUILD_DIR"
@@ -68,6 +71,8 @@ COPY . "$BUILD_DIR"
 # Run the build itself
 RUN /opt/guacamole/bin/build-guacamole.sh "$BUILD_DIR" /opt/guacamole
 
+RUN rm -rf /opt/guacamole/build.d /opt/guacamole/bin/build-guacamole.sh
+
 # For the runtime image, we start with the official Tomcat distribution
 FROM tomcat:${TOMCAT_VERSION}-${TOMCAT_JRE}
 
@@ -91,6 +96,9 @@ RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --gid $G
 # Run with user guacamole
 USER guacamole
 
+# Environment variable defaults
+ENV GUACAMOLE_HOME=/etc/guacamole
+
 # Start Guacamole under Tomcat, listening on 0.0.0.0:8080
 EXPOSE 8080
-CMD ["/opt/guacamole/bin/start.sh" ]
+CMD ["/opt/guacamole/bin/entrypoint.sh" ]
diff --git a/guacamole-docker/bin/build-guacamole.sh b/guacamole-docker/bin/build-guacamole.sh
index 2fc6c9582..595bd70d9 100755
--- a/guacamole-docker/bin/build-guacamole.sh
+++ b/guacamole-docker/bin/build-guacamole.sh
@@ -1,4 +1,4 @@
-#!/bin/sh -e
+#!/bin/bash -e
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
@@ -23,10 +23,15 @@
 ##
 ## Builds Guacamole, saving "guacamole.war" and all applicable extension .jars
 ## using the guacamole-client source contained within the given directory.
-## Extension files will be grouped by their associated type, with all MySQL
-## files being placed within the "mysql/" subdirectory of the destination, all
-## PostgreSQL files being placed within the "postgresql/" subdirectory of the
-## destination, etc.
+## Extension files will be grouped by their associated type, identical to
+## extracting the .tar.gz files included with each Guacamole release except
+## that version numbers are stripped from directory and .jar file names.
+##
+## The build process is split across multiple scripts within the
+## /opt/guacamole/build.d directory. Additional steps may be added to the
+## build process by adding .sh scripts to this directory. Any such scripts MUST
+## be shell scripts ending with a ".sh" extension and MUST be written for bash
+## (the shell used by this entrypoint).
 ##
 ## @param BUILD_DIR
 ##     The directory which currently contains the guacamole-client source and
@@ -39,164 +44,21 @@
 ##     extension type.
 ##
 
+##
+## The directory which currently contains the guacamole-client source and in
+## which the build should be performed.
+##
 BUILD_DIR="$1"
+
+##
+## The directory to save guacamole.war within, along with all extension .jars.
+## Note that this script will create extension-specific subdirectories within
+## this directory, and files will thus be grouped by extension type.
+##
 DESTINATION="$2"
 
-#
-# Create destination, if it does not yet exist
-#
+# Run all scripts within the "build.d" directory
+for SCRIPT in /opt/guacamole/build.d/*.sh; do
+    source "$SCRIPT"
+done
 
-mkdir -p "$DESTINATION"
-
-#
-# Build guacamole.war and all extensions
-#
-
-cd "$BUILD_DIR"
-
-#
-# Run the maven build, applying any arbitrary provided maven arguments.
-#
-
-mvn $MAVEN_ARGUMENTS package
-
-#
-# Copy guacamole.war to destination
-#
-
-cp guacamole/target/*.war "$DESTINATION/guacamole.war"
-
-#
-# Copy JDBC auth extensions and SQL scripts
-#
-
-tar -xzf extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-dist/target/*.tar.gz \
-    -C "$DESTINATION"                                   \
-    --wildcards                                         \
-    --no-anchored                                       \
-    --strip-components=1                                \
-    "*.jar"                                             \
-    "*.sql"
-
-#
-# Download MySQL JDBC driver
-#
-
-echo "Downloading MySQL Connector/J ..."
-curl -L "https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-$MYSQL_JDBC_VERSION.tar.gz" | \
-tar -xz                        \
-    -C "$DESTINATION/mysql/"   \
-    --wildcards                \
-    --no-anchored              \
-    --no-wildcards-match-slash \
-    --strip-components=1       \
-    "mysql-connector-*.jar"
-
-#
-# Download PostgreSQL JDBC driver
-#
-
-echo "Downloading PostgreSQL JDBC driver ..."
-curl -L "https://jdbc.postgresql.org/download/postgresql-$PGSQL_JDBC_VERSION.jar" \
-    > "$DESTINATION/postgresql/postgresql-$PGSQL_JDBC_VERSION.jar"
-
-#
-# Copy SSO auth extensions
-#
-
-tar -xzf extensions/guacamole-auth-sso/modules/guacamole-auth-sso-dist/target/*.tar.gz \
-    -C "$DESTINATION"                                   \
-    --wildcards                                         \
-    --no-anchored                                       \
-    --strip-components=1                                \
-    "*.jar"
-
-#
-# Download SQL Server JDBC driver
-#
-
-echo "Downloading SQL Server JDBC driver ..."
-curl -L "https://github.com/microsoft/mssql-jdbc/releases/download/v$MSSQL_JDBC_VERSION/mssql-jdbc-$MSSQL_JDBC_VERSION.jre8.jar" \
-    > "$DESTINATION/sqlserver/mssql-jdbc-$MSSQL_JDBC_VERSION.jre8.jar"   \
-
-#
-# Copy LDAP auth extension and schema modifications
-#
-
-mkdir -p "$DESTINATION/ldap"
-tar -xzf extensions/guacamole-auth-ldap/target/*.tar.gz \
-    -C "$DESTINATION/ldap"                              \
-    --wildcards                                         \
-    --no-anchored                                       \
-    --xform="s#.*/##"                                   \
-    "*.jar"                                             \
-    "*.ldif"
-
-#
-# Copy Radius auth extension if it was build
-#
-
-if [ -f extensions/guacamole-auth-radius/target/guacamole-auth-radius*.jar ]; then
-    mkdir -p "$DESTINATION/radius"
-    cp extensions/guacamole-auth-radius/target/guacamole-auth-radius*.jar "$DESTINATION/radius"
-fi
-
-#
-# Copy TOTP auth extension if it was built
-#
-
-if [ -f extensions/guacamole-auth-totp/target/guacamole-auth-totp*.jar ]; then
-    mkdir -p "$DESTINATION/totp"
-    cp extensions/guacamole-auth-totp/target/guacamole-auth-totp*.jar "$DESTINATION/totp"
-fi
-
-#
-# Copy Duo auth extension if it was built
-#
-
-if [ -f extensions/guacamole-auth-duo/target/*.tar.gz ]; then
-    mkdir -p "$DESTINATION/duo"
-    tar -xzf extensions/guacamole-auth-duo/target/*.tar.gz \
-        -C "$DESTINATION/duo/"                             \
-        --wildcards                                        \
-        --no-anchored                                      \
-        --no-wildcards-match-slash                         \
-        --strip-components=1                               \
-        "*.jar"
-fi
-
-#
-# Copy header auth extension if it was built
-#
-
-if [ -f extensions/guacamole-auth-header/target/guacamole-auth-header*.jar ]; then
-    mkdir -p "$DESTINATION/header"
-    cp extensions/guacamole-auth-header/target/guacamole-auth-header*.jar "$DESTINATION/header"
-fi
-
-#
-# Copy json auth extension if it was built
-#
-
-if [ -f extensions/guacamole-auth-json/target/guacamole-auth-json*.jar ]; then
-    mkdir -p "$DESTINATION/json"
-    cp extensions/guacamole-auth-json/target/guacamole-auth-json*.jar "$DESTINATION/json"
-fi
-
-#
-# Copy automatic brute-force banning auth extension if it was built
-#
-
-if [ -f extensions/guacamole-auth-ban/target/guacamole-auth-ban*.jar ]; then
-    mkdir -p "$DESTINATION/ban"
-    cp extensions/guacamole-auth-ban/target/guacamole-auth-ban*.jar "$DESTINATION/ban"
-fi
-
-#
-# Copy history recording storage extension if it was built
-#
-
-if [ -f extensions/guacamole-history-recording-storage/target/guacamole-history-recording-storage*.jar ]; then
-    mkdir -p "$DESTINATION/recordings"
-    cp extensions/guacamole-history-recording-storage/target/guacamole-history-recording-storage*.jar "$DESTINATION/recordings"
-fi
diff --git a/guacamole-docker/bin/entrypoint.sh b/guacamole-docker/bin/entrypoint.sh
new file mode 100755
index 000000000..509332f85
--- /dev/null
+++ b/guacamole-docker/bin/entrypoint.sh
@@ -0,0 +1,39 @@
+#!/bin/bash -e
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+##
+## @fn entrypoint.sh
+##
+## (Re-)configures the Apache Guacamole web application based on the values of
+## environment variables, deploys the web application beneath a bundled copy of
+## Apache Tomcat, and starts Tomcat.
+##
+## The startup process is split across multiple scripts within the
+## /opt/guacamole/entrypoint.d directory. Additional steps may be added to the
+## startup process by adding .sh scripts to this directory. Any such scripts
+## MUST be shell scripts ending with a ".sh" extension and MUST be written for
+## bash (the shell used by this entrypoint).
+##
+
+# Run all scripts within the "entrypoint.d" directory
+for SCRIPT in /opt/guacamole/entrypoint.d/*.sh; do
+    source "$SCRIPT"
+done
+
diff --git a/guacamole-docker/bin/start.sh b/guacamole-docker/bin/start.sh
deleted file mode 100755
index 4588c0eb4..000000000
--- a/guacamole-docker/bin/start.sh
+++ /dev/null
@@ -1,1251 +0,0 @@
-#!/bin/bash -e
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-##
-## @fn start.sh
-##
-## Automatically configures and starts Guacamole under Tomcat. Guacamole's
-## guacamole.properties file will be automatically generated based on the
-## linked database container (either MySQL, PostgreSQL or SQLServer) and the linked guacd
-## container. The Tomcat process will ultimately replace the process of this
-## script, running in the foreground until terminated.
-##
-
-GUACAMOLE_HOME_TEMPLATE="$GUACAMOLE_HOME"
-
-GUACAMOLE_HOME="$HOME/.guacamole"
-GUACAMOLE_EXT="$GUACAMOLE_HOME/extensions"
-GUACAMOLE_LIB="$GUACAMOLE_HOME/lib"
-GUACAMOLE_PROPERTIES="$GUACAMOLE_HOME/guacamole.properties"
-
-##
-## Sets the given property to the given value within guacamole.properties,
-## creating guacamole.properties first if necessary.
-##
-## @param NAME
-##     The name of the property to set.
-##
-## @param VALUE
-##     The value to set the property to.
-##
-set_property() {
-
-    NAME="$1"
-    VALUE="$2"
-
-    # Ensure guacamole.properties exists
-    if [ ! -e "$GUACAMOLE_PROPERTIES" ]; then
-        mkdir -p "$GUACAMOLE_HOME"
-        echo "# guacamole.properties - generated `date`" > "$GUACAMOLE_PROPERTIES"
-    fi
-
-    # Set property
-    echo "$NAME: $VALUE" >> "$GUACAMOLE_PROPERTIES"
-
-}
-
-##
-## Sets the given property to the given value within guacamole.properties only
-## if a value is provided, creating guacamole.properties first if necessary.
-##
-## @param NAME
-##     The name of the property to set.
-##
-## @param VALUE
-##     The value to set the property to, if any. If omitted or empty, the
-##     property will not be set.
-##
-set_optional_property() {
-
-    NAME="$1"
-    VALUE="$2"
-
-    # Set the property only if a value is provided
-    if [ -n "$VALUE" ]; then
-        set_property "$NAME" "$VALUE"
-    fi
-
-}
-
-# Print error message regarding missing required variables for MySQL authentication
-mysql_missing_vars() {
-   cat <<END
-FATAL: Missing required environment variables
--------------------------------------------------------------------------------
-If using a MySQL database, you must provide each of the following
-environment variables or their corresponding Docker secrets by appending _FILE
-to the environment variable, and setting the value to the path of the
-corresponding secret:
-
-    MYSQL_USER         The user to authenticate as when connecting to
-                       MySQL.
-
-    MYSQL_PASSWORD     The password to use when authenticating with MySQL as
-                       MYSQL_USER.
-
-    MYSQL_DATABASE     The name of the MySQL database to use for Guacamole
-                       authentication.
-END
-    exit 1;
-}
-
-
-##
-## Adds properties to guacamole.properties which select the MySQL
-## authentication provider, and configure it to connect to the linked MySQL
-## container. If a MySQL database is explicitly specified using the
-## MYSQL_HOSTNAME and MYSQL_PORT environment variables, that will be used
-## instead of a linked container.
-##
-associate_mysql() {
-
-    # Use linked container if specified
-    if [ -n "$MYSQL_NAME" ]; then
-        MYSQL_HOSTNAME="$MYSQL_PORT_3306_TCP_ADDR"
-        MYSQL_PORT="$MYSQL_PORT_3306_TCP_PORT"
-    fi
-
-    # Use default port if none specified
-    MYSQL_PORT="${MYSQL_PORT-3306}"
-
-    # Verify required connection information is present
-    if [ -z "$MYSQL_HOSTNAME" -o -z "$MYSQL_PORT" ]; then
-        cat <<END
-FATAL: Missing MYSQL_HOSTNAME or "mysql" link.
--------------------------------------------------------------------------------
-If using a MySQL database, you must either:
-
-(a) Explicitly link that container with the link named "mysql".
-
-(b) If not using a Docker container for MySQL, explicitly specify the TCP
-    connection to your database using the following environment variables:
-
-    MYSQL_HOSTNAME     The hostname or IP address of the MySQL server. If not
-                       using a MySQL Docker container and corresponding link,
-                       this environment variable is *REQUIRED*.
-
-    MYSQL_PORT         The port on which the MySQL server is listening for TCP
-                       connections. This environment variable is option. If
-                       omitted, the standard MySQL port of 3306 will be used.
-END
-        exit 1;
-    fi
-
-
-    # Verify that the required Docker secrets are present, else, default to their normal environment variables
-    if [ -n "$MYSQL_USER_FILE" ]; then
-        set_property "mysql-username" "`cat "$MYSQL_USER_FILE"`"
-    elif [ -n "$MYSQL_USER" ]; then
-        set_property "mysql-username" "$MYSQL_USER"
-    else
-        mysql_missing_vars
-        exit 1;
-    fi
-
-    if [ -n "$MYSQL_PASSWORD_FILE" ]; then
-        set_property "mysql-password" "`cat "$MYSQL_PASSWORD_FILE"`"
-    elif [ -n "$MYSQL_PASSWORD" ]; then
-        set_property "mysql-password" "$MYSQL_PASSWORD"
-    else
-        mysql_missing_vars
-        exit 1;
-    fi
-
-    if [ -n "$MYSQL_DATABASE_FILE" ]; then
-        set_property "mysql-database" "`cat "$MYSQL_DATABASE_FILE"`"
-    elif [ -n "$MYSQL_DATABASE" ]; then
-        set_property "mysql-database" "$MYSQL_DATABASE"
-    else
-        mysql_missing_vars
-        exit 1;
-    fi
-
-    # Update config file
-    set_property "mysql-hostname" "$MYSQL_HOSTNAME"
-    set_property "mysql-port"     "$MYSQL_PORT"
-
-    set_optional_property               \
-        "mysql-absolute-max-connections" \
-        "$MYSQL_ABSOLUTE_MAX_CONNECTIONS"
-
-    set_optional_property               \
-        "mysql-default-max-connections" \
-        "$MYSQL_DEFAULT_MAX_CONNECTIONS"
-
-    set_optional_property                     \
-        "mysql-default-max-group-connections" \
-        "$MYSQL_DEFAULT_MAX_GROUP_CONNECTIONS"
-
-    set_optional_property                        \
-        "mysql-default-max-connections-per-user" \
-        "$MYSQL_DEFAULT_MAX_CONNECTIONS_PER_USER"
-
-    set_optional_property                              \
-        "mysql-default-max-group-connections-per-user" \
-        "$MYSQL_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER"
-
-    set_optional_property     \
-        "mysql-user-required" \
-        "$MYSQL_USER_REQUIRED"
-
-    set_optional_property \
-        "mysql-ssl-mode"  \
-        "$MYSQL_SSL_MODE"
-
-    set_optional_property        \
-        "mysql-ssl-trust-store"  \
-        "$MYSQL_SSL_TRUST_STORE"
-
-    # For SSL trust store password, check secrets, first, then standard env variable
-    if [ -n "$MYSQL_SSL_TRUST_PASSWORD_FILE" ]; then
-        set_property "mysql-ssl-trust-password" "`cat "$MYSQL_SSL_TRUST_PASSWORD_FILE"`"
-    elif [ -n "$MYSQL_SSL_TRUST_PASSWORD" ]; then
-        set_property "mysql-ssl-trust-password" "$MYSQL_SSL_TRUST_PASSWORD"
-    fi
-
-    set_optional_property         \
-        "mysql-ssl-client-store"  \
-        "$MYSQL_SSL_CLIENT_STORE"
-
-    # For SSL trust store password, check secrets, first, then standard env variable
-    if [ -n "$MYSQL_SSL_CLIENT_PASSWORD_FILE" ]; then
-        set_property "mysql-ssl-client-password" "`cat "$MYSQL_SSL_CLIENT_PASSWORD_FILE"`"
-    elif [ -n "$MYSQL_SSL_CLIENT_PASSWORD" ]; then
-        set_property "mysql-ssl-client-password" "$MYSQL_SSL_CLIENT_PASSWORD"
-    fi
-
-    set_optional_property             \
-        "mysql-auto-create-accounts"  \
-        "$MYSQL_AUTO_CREATE_ACCOUNTS"
-
-    # Add required .jar files to GUACAMOLE_LIB and GUACAMOLE_EXT
-    ln -s /opt/guacamole/mysql/mysql-connector-*.jar "$GUACAMOLE_LIB"
-    ln -s /opt/guacamole/mysql/guacamole-auth-*.jar "$GUACAMOLE_EXT"
-
-}
-
-# Print error message regarding missing required variables for PostgreSQL authentication
-postgresql_missing_vars() {
-    cat <<END
-FATAL: Missing required environment variables
--------------------------------------------------------------------------------
-If using a PostgreSQL database, you must provide each of the following
-environment variables or their corresponding Docker secrets by appending _FILE
-to the environment variable, and setting the value to the path of the
-corresponding secret:
-
-    POSTGRESQL_USER      The user to authenticate as when connecting to
-                         PostgreSQL.
-
-    POSTGRESQL_PASSWORD  The password to use when authenticating with PostgreSQL
-                         as POSTGRESQL_USER.
-
-    POSTGRESQL_DATABASE  The name of the PostgreSQL database to use for Guacamole
-                         authentication.
-END
-    exit 1;
-}
-
-## Provide backward compatibility on POSTGRES_* environment variables
-## In case of new deployment, please use POSTGRESQL_* equivalent variables.
-for VAR_BASE in \
-    HOSTNAME PORT \
-    DATABASE USER PASSWORD \
-    DATABASE_FILE USER_FILE PASSWORD_FILE \
-    ABSOLUTE_MAX_CONNECTIONS DEFAULT_MAX_CONNECTIONS \
-    DEFAULT_MAX_GROUP_CONNECTIONS DEFAULT_MAX_CONNECTIONS_PER_USER \
-    DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER \
-    DEFAULT_STATEMENT_TIMEOUT SOCKET_TIMEOUT \
-    USER_REQUIRED \
-    SSL_KEY_PASSWORD_FILE SSL_KEY_PASSWORD; do
-
-        OLD_VAR="POSTGRES_$VAR_BASE"
-        NEW_VAR="POSTGRESQL_$VAR_BASE"
-
-        if [ -n "${!OLD_VAR}" ]; then
-            printf -v "$NEW_VAR" "%s" "${!OLD_VAR}"
-            echo "WARNING: ${OLD_VAR} detected, please use ${NEW_VAR} for further deployments."
-        fi
-
-done
-
-##
-## Adds properties to guacamole.properties which select the PostgreSQL
-## authentication provider, and configure it to connect to the linked
-## PostgreSQL container. If a PostgreSQL database is explicitly specified using
-## the POSTGRESQL_HOSTNAME and POSTGRESQL_PORT environment variables, that will be
-## used instead of a linked container.
-##
-associate_postgresql() {
-
-    # Use linked container if specified
-    if [ -n "$POSTGRES_NAME" ]; then
-        POSTGRESQL_HOSTNAME="$POSTGRES_PORT_5432_TCP_ADDR"
-        POSTGRESQL_PORT="$POSTGRES_PORT_5432_TCP_PORT"
-    fi
-
-    # Use default port if none specified
-    POSTGRESQL_PORT="${POSTGRESQL_PORT-5432}"
-
-    # Verify required connection information is present
-    if [ -z "$POSTGRESQL_HOSTNAME" -o -z "$POSTGRESQL_PORT" ]; then
-        cat <<END
-FATAL: Missing POSTGRESQL_HOSTNAME or "postgres" link.
--------------------------------------------------------------------------------
-If using a PostgreSQL database, you must either:
-
-(a) Explicitly link that container with the link named "postgres".
-
-(b) If not using a Docker container for PostgreSQL, explicitly specify the TCP
-    connection to your database using the following environment variables:
-
-    POSTGRESQL_HOSTNAME  The hostname or IP address of the PostgreSQL server. If
-                         not using a PostgreSQL Docker container and
-                         corresponding link, this environment variable is
-                         *REQUIRED*.
-
-    POSTGRESQL_PORT      The port on which the PostgreSQL server is listening for
-                         TCP connections. This environment variable is option. If
-                         omitted, the standard PostgreSQL port of 5432 will be
-                         used.
-END
-        exit 1;
-    fi
-
-    # Verify that the required Docker secrets are present, else, default to their normal environment variables
-    if [ -n "$POSTGRESQL_USER_FILE" ]; then
-        set_property "postgresql-username" "`cat "$POSTGRESQL_USER_FILE"`"
-    elif [ -n "$POSTGRESQL_USER" ]; then
-        set_property "postgresql-username" "$POSTGRESQL_USER"
-    else
-        postgresql_missing_vars
-        exit 1;
-    fi
-
-    if [ -n "$POSTGRESQL_PASSWORD_FILE" ]; then
-        set_property "postgresql-password" "`cat "$POSTGRESQL_PASSWORD_FILE"`"
-    elif [ -n "$POSTGRESQL_PASSWORD" ]; then
-        set_property "postgresql-password" "$POSTGRESQL_PASSWORD"
-    else
-        postgresql_missing_vars
-        exit 1;
-    fi
-
-    if [ -n "$POSTGRESQL_DATABASE_FILE" ]; then
-        set_property "postgresql-database" "`cat "$POSTGRESQL_DATABASE_FILE"`"
-    elif [ -n "$POSTGRESQL_DATABASE" ]; then
-        set_property "postgresql-database" "$POSTGRESQL_DATABASE"
-    else
-        postgresql_missing_vars
-        exit 1;
-    fi
-
-    # Update config file
-    set_property "postgresql-hostname" "$POSTGRESQL_HOSTNAME"
-    set_property "postgresql-port"     "$POSTGRESQL_PORT"
-
-    set_optional_property               \
-        "postgresql-absolute-max-connections" \
-        "$POSTGRESQL_ABSOLUTE_MAX_CONNECTIONS"
-
-    set_optional_property                    \
-        "postgresql-default-max-connections" \
-        "$POSTGRESQL_DEFAULT_MAX_CONNECTIONS"
-
-    set_optional_property                          \
-        "postgresql-default-max-group-connections" \
-        "$POSTGRESQL_DEFAULT_MAX_GROUP_CONNECTIONS"
-
-    set_optional_property                             \
-        "postgresql-default-max-connections-per-user" \
-        "$POSTGRESQL_DEFAULT_MAX_CONNECTIONS_PER_USER"
-
-    set_optional_property                                   \
-        "postgresql-default-max-group-connections-per-user" \
-        "$POSTGRESQL_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER"
-
-    set_optional_property                      \
-        "postgresql-default-statement-timeout" \
-        "$POSTGRESQL_DEFAULT_STATEMENT_TIMEOUT"
-
-    set_optional_property          \
-        "postgresql-user-required" \
-        "$POSTGRESQL_USER_REQUIRED"
-
-    set_optional_property           \
-        "postgresql-socket-timeout" \
-        "$POSTGRESQL_SOCKET_TIMEOUT"
-
-    set_optional_property      \
-        "postgresql-ssl-mode"  \
-        "$POSTGRESQL_SSL_MODE"
-
-    set_optional_property           \
-        "postgresql-ssl-cert-file"  \
-        "$POSTGRESQL_SSL_CERT_FILE"
-
-    set_optional_property          \
-        "postgresql-ssl-key-file"  \
-        "$POSTGRESQL_SSL_KEY_FILE"
-
-    set_optional_property                \
-        "postgresql-ssl-root-cert-file"  \
-        "$POSTGRESQL_SSL_ROOT_CERT_FILE"
-
-    # For SSL key password, check secrets, first, then standard env variable
-    if [ -n "$POSTGRESQL_SSL_KEY_PASSWORD_FILE" ]; then
-        set_property "postgresql-ssl-key-password" "`cat "$POSTGRESQL_SSL_KEY_PASSWORD_FILE"`"
-    elif [ -n "$POSTGRESQL_SSL_KEY_PASSWORD" ]; then
-        set_property "postgresql-ssl-key-password" "$POSTGRESQL_SSL_KEY_PASSWORD"
-    fi
-
-    set_optional_property                  \
-        "postgresql-auto-create-accounts"  \
-        "$POSTGRESQL_AUTO_CREATE_ACCOUNTS"
-
-    # Add required .jar files to GUACAMOLE_LIB and GUACAMOLE_EXT
-    ln -s /opt/guacamole/postgresql/postgresql-*.jar "$GUACAMOLE_LIB"
-    ln -s /opt/guacamole/postgresql/guacamole-auth-*.jar "$GUACAMOLE_EXT"
-
-}
-
-# Print error message regarding missing required variables for SQLServer authentication
-sqlserver_missing_vars() {
-    cat <<END
-FATAL: Missing required environment variables
--------------------------------------------------------------------------------
-If using a SQLServer database, you must provide each of the following
-environment variables:
-
-    SQLSERVER_USER     The user to authenticate as when connecting to
-                       SQLServer.
-
-    SQLSERVER_PASSWORD The password to use when authenticating with SQLServer
-                       as SQLSERVER_USER.
-
-    SQLSERVER_DATABASE The name of the SQLServer database to use for Guacamole
-                       authentication.
-
-Alternatively, if you want to store database credentials using Docker secrets,
-set the path of the corresponding secrets in the following three variables:
-
-    SQLSERVER_DATABASE_FILE   The path of the docker secret containing the name
-                              of database to use for Guacamole authentication.
-
-    SQLSERVER_USER_FILE       The path of the docker secret containing the name of
-                              the user that Guacamole will use to connect to SQLServer.
-
-    SQLSERVER_PASSWORD_FILE   The path of the docker secret containing the
-                              password that Guacamole will provide when connecting to
-                              SQLServer as SQLSERVER_USER.
-
-END
-    exit 1;
-}
-
-##
-## Adds properties to guacamole.properties which select the SQLServer
-## authentication provider, and configure it to connect to the linked
-## SQLServer container. If a SQLServer database is explicitly specified using
-## the SQLSERVER_HOSTNAME and SQLSERVER_PORT environment variables, that will
-## be used instead of a linked container.
-##
-associate_sqlserver() {
-
-    # Use linked container if specified
-    if [ -n "$SQLSERVER_NAME" ]; then
-        SQLSERVER_HOSTNAME="$SQLSERVER_PORT_1433_TCP_ADDR"
-        SQLSERVER_PORT="$SQLSERVER_PORT_1433_TCP_PORT"
-    fi
-
-    # Use default port if none specified
-    SQLSERVER_PORT="${SQLSERVER_PORT-1433}"
-
-    # Verify required connection information is present
-    if [ -z "$SQLSERVER_HOSTNAME" -o -z "$SQLSERVER_PORT" ]; then
-        cat <<END
-FATAL: Missing SQLSERVER_HOSTNAME or "sqlserver" link.
--------------------------------------------------------------------------------
-If using a SQLServer database, you must either:
-
-(a) Explicitly link that container with the link named "sqlserver".
-
-(b) If not using a Docker container for SQLServer, explicitly specify the TCP
-    connection to your database using the following environment variables:
-
-    SQLSERVER_HOSTNAME The hostname or IP address of the SQLServer server. If
-                       not using a SQLServer Docker container and
-                       corresponding link, this environment variable is
-                       *REQUIRED*.
-
-    SQLSERVER_PORT     The port on which the SQLServer server is listening for
-                       TCP connections. This environment variable is option. If
-                       omitted, the standard SQLServer port of 1433 will be
-                       used.
-END
-        exit 1;
-    fi
-
-    # Verify that the required Docker secrets are present, else, default to their normal environment variables
-    if [ -n "$SQLSERVER_USER_FILE" ]; then
-        set_property "sqlserver-username" "`cat "$SQLSERVER_USER_FILE"`"
-    elif [ -n "$SQLSERVER_USER" ]; then
-        set_property "sqlserver-username" "$SQLSERVER_USER"
-    else
-        sqlserver_missing_vars
-        exit 1;
-    fi
-
-    if [ -n "$SQLSERVER_PASSWORD_FILE" ]; then
-        set_property "sqlserver-password" "`cat "$SQLSERVER_PASSWORD_FILE"`"
-    elif [ -n "$SQLSERVER_PASSWORD" ]; then
-        set_property "sqlserver-password" "$SQLSERVER_PASSWORD"
-    else
-        sqlserver_missing_vars
-        exit 1;
-    fi
-
-    if [ -n "$SQLSERVER_DATABASE_FILE" ]; then
-        set_property "sqlserver-database" "`cat "$SQLSERVER_DATABASE_FILE"`"
-    elif [ -n "$SQLSERVER_DATABASE" ]; then
-        set_property "sqlserver-database" "$SQLSERVER_DATABASE"
-    else
-        sqlserver_missing_vars
-        exit 1;
-    fi
-
-    # Update config file
-    set_property "sqlserver-hostname" "$SQLSERVER_HOSTNAME"
-    set_property "sqlserver-port"     "$SQLSERVER_PORT"
-    set_property "sqlserver-driver"   "microsoft2005"
-
-    set_optional_property               \
-        "sqlserver-absolute-max-connections" \
-        "$SQLSERVER_ABSOLUTE_MAX_CONNECTIONS"
-
-    set_optional_property                    \
-        "sqlserver-default-max-connections" \
-        "$SQLSERVER_DEFAULT_MAX_CONNECTIONS"
-
-    set_optional_property                          \
-        "sqlserver-default-max-group-connections" \
-        "$SQLSERVER_DEFAULT_MAX_GROUP_CONNECTIONS"
-
-    set_optional_property                             \
-        "sqlserver-default-max-connections-per-user" \
-        "$SQLSERVER_DEFAULT_MAX_CONNECTIONS_PER_USER"
-
-    set_optional_property                                   \
-        "sqlserver-default-max-group-connections-per-user" \
-        "$SQLSERVER_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER"
-
-    set_optional_property          \
-        "sqlserver-user-required" \
-        "$SQLSERVER_USER_REQUIRED"
-
-    set_optional_property                  \
-        "sqlserver-auto-create-accounts"  \
-        "$SQLSERVER_AUTO_CREATE_ACCOUNTS"
-
-    set_optional_property      \
-        "sqlserver-instance"  \
-        "$SQLSERVER_INSTANCE"
-
-    # Add required .jar files to GUACAMOLE_LIB and GUACAMOLE_EXT
-    ln -s /opt/guacamole/sqlserver/mssql-jdbc-*.jar "$GUACAMOLE_LIB"
-    ln -s /opt/guacamole/sqlserver/guacamole-auth-*.jar "$GUACAMOLE_EXT"
-
-}
-
-##
-## Adds properties to guacamole.properties which select the LDAP
-## authentication provider, and configure it to connect to the specified LDAP
-## directory.
-##
-associate_ldap() {
-
-    # Verify required parameters are present
-    if [ -z "$LDAP_HOSTNAME" -o -z "$LDAP_USER_BASE_DN" ]; then
-        cat <<END
-FATAL: Missing required environment variables
--------------------------------------------------------------------------------
-If using an LDAP directory, you must provide each of the following environment
-variables:
-
-    LDAP_HOSTNAME      The hostname or IP address of your LDAP server.
-
-    LDAP_USER_BASE_DN  The base DN under which all Guacamole users will be
-                       located. Absolutely all Guacamole users that will
-                       authenticate via LDAP must exist within the subtree of
-                       this DN.
-END
-        exit 1;
-    fi
-
-    # Update config file
-    set_property          "ldap-hostname"                   "$LDAP_HOSTNAME"
-    set_property          "ldap-user-base-dn"               "$LDAP_USER_BASE_DN"
-
-    set_optional_property "ldap-port"                       "$LDAP_PORT"
-    set_optional_property "ldap-encryption-method"          "$LDAP_ENCRYPTION_METHOD"
-    set_optional_property "ldap-max-search-results"         "$LDAP_MAX_SEARCH_RESULTS"
-    set_optional_property "ldap-search-bind-dn"             "$LDAP_SEARCH_BIND_DN"
-    set_optional_property "ldap-user-attributes"            "$LDAP_USER_ATTRIBUTES"
-    set_optional_property "ldap-search-bind-password"       "$LDAP_SEARCH_BIND_PASSWORD"
-    set_optional_property "ldap-username-attribute"         "$LDAP_USERNAME_ATTRIBUTE"
-    set_optional_property "ldap-member-attribute"           "$LDAP_MEMBER_ATTRIBUTE"
-    set_optional_property "ldap-user-search-filter"         "$LDAP_USER_SEARCH_FILTER"
-    set_optional_property "ldap-config-base-dn"             "$LDAP_CONFIG_BASE_DN"
-    set_optional_property "ldap-group-base-dn"              "$LDAP_GROUP_BASE_DN"
-    set_optional_property "ldap-group-search-filter"        "$LDAP_GROUP_SEARCH_FILTER"
-    set_optional_property "ldap-member-attribute-type"      "$LDAP_MEMBER_ATTRIBUTE_TYPE"
-    set_optional_property "ldap-group-name-attribute"       "$LDAP_GROUP_NAME_ATTRIBUTE"
-    set_optional_property "ldap-dereference-aliases"        "$LDAP_DEREFERENCE_ALIASES"
-    set_optional_property "ldap-follow-referrals"           "$LDAP_FOLLOW_REFERRALS"
-    set_optional_property "ldap-max-referral-hops"          "$LDAP_MAX_REFERRAL_HOPS"
-    set_optional_property "ldap-operation-timeout"          "$LDAP_OPERATION_TIMEOUT"
-
-    # Add required .jar files to GUACAMOLE_EXT
-    ln -s /opt/guacamole/ldap/guacamole-auth-*.jar "$GUACAMOLE_EXT"
-
-}
-
-##
-## Adds properties to guacamole.properties which select the LDAP
-## authentication provider, and configure it to connect to the specified LDAP
-## directory.
-##
-associate_radius() {
-
-    # Verify required parameters are present
-    if [ -z "$RADIUS_SHARED_SECRET" -o -z "$RADIUS_AUTH_PROTOCOL" ]; then
-        cat <<END
-FATAL: Missing required environment variables
--------------------------------------------------------------------------------
-If using RADIUS server, you must provide each of the following environment
-variables:
-
-    RADIUS_SHARED_SECRET   The shared secret to use when talking to the
-                           RADIUS server.
-
-    RADIUS_AUTH_PROTOCOL   The authentication protocol to use when talking
-                           to the RADIUS server.
-                           Supported values are:
-                             pap, chap, mschapv1, mschapv2, eap-md5,
-                             eap-tls and eap-ttls.
-END
-        exit 1;
-    fi
-
-    # Verify provided files do exist and are readable
-    if [ -n "$RADIUS_KEY_FILE" -a ! -r "$RADIUS_KEY_FILE" ]; then
-       cat <<END
-FATAL: Provided file RADIUS_KEY_FILE=$RADIUS_KEY_FILE does not exist
-       or is not readable!
--------------------------------------------------------------------------------
-If you provide key or CA files you need to mount those into the container and
-make sure they are readable for the user in the container.
-END
-        exit 1;
-    fi
-    if [ -n "$RADIUS_CA_FILE" -a ! -r "$RADIUS_CA_FILE" ]; then
-       cat <<END
-FATAL: Provided file RADIUS_CA_FILE=$RADIUS_CA_FILE does not exist
-       or is not readable!
--------------------------------------------------------------------------------
-If you provide key or CA files you need to mount those into the container and
-make sure they are readable for the user in the container.
-END
-        exit 1;
-    fi
-    if [ "$RADIUS_AUTH_PROTOCOL" = "eap-ttls" -a -z "$RADIUS_EAP_TTLS_INNER_PROTOCOL" ]; then
-       cat <<END
-FATAL: Authentication protocol "eap-ttls" specified but
-       RADIUS_EAP_TTLS_INNER_PROTOCOL is not set!
--------------------------------------------------------------------------------
-When EAP-TTLS is used, this parameter specifies the inner (tunneled)
-protocol to use talking to the RADIUS server.
-END
-        exit 1;
-    fi
-
-    # Update config file
-    set_optional_property "radius-hostname"                 "$RADIUS_HOSTNAME"
-    set_optional_property "radius-auth-port"                "$RADIUS_AUTH_PORT"
-    set_property          "radius-shared-secret"            "$RADIUS_SHARED_SECRET"
-    set_property          "radius-auth-protocol"            "$RADIUS_AUTH_PROTOCOL"
-    set_optional_property "radius-key-file"                 "$RADIUS_KEY_FILE"
-    set_optional_property "radius-key-type"                 "$RADIUS_KEY_TYPE"
-    set_optional_property "radius-key-password"             "$RADIUS_KEY_PASSWORD"
-    set_optional_property "radius-ca-file"                  "$RADIUS_CA_FILE"
-    set_optional_property "radius-ca-type"                  "$RADIUS_CA_TYPE"
-    set_optional_property "radius-ca-password"              "$RADIUS_CA_PASSWORD"
-    set_optional_property "radius-trust-all"                "$RADIUS_TRUST_ALL"
-    set_optional_property "radius-retries"                  "$RADIUS_RETRIES"
-    set_optional_property "radius-timeout"                  "$RADIUS_TIMEOUT"
-    set_optional_property "radius-eap-ttls-inner-protocol"  "$RADIUS_EAP_TTLS_INNER_PROTOCOL"
-    set_optional_property "radius-nas-ip"                   "$RADIUS_NAS_IP"
-
-    set_optional_property \
-       "radius-eap-ttls-inner-protocol" \
-       "$RADIUS_EAP_TTLS_INNER_PROTOCOL"
-
-    # Add required .jar files to GUACAMOLE_EXT
-    ln -s /opt/guacamole/radius/guacamole-auth-*.jar "$GUACAMOLE_EXT"
-}
-
-## Adds properties to guacamole.properties which select the OPENID
-## authentication provider, and configure it to connect to the specified OPENID
-## provider.
-##
-associate_openid() {
-
-    # Verify required parameters are present
-    if [ -z "$OPENID_AUTHORIZATION_ENDPOINT" ] || \
-       [ -z "$OPENID_JWKS_ENDPOINT" ]          || \
-       [ -z "$OPENID_ISSUER" ]                 || \
-       [ -z "$OPENID_CLIENT_ID" ]              || \
-       [ -z "$OPENID_REDIRECT_URI" ]
-    then
-        cat <<END
-FATAL: Missing required environment variables
--------------------------------------------------------------------------------
-If using an openid authentication, you must provide each of the following
-environment variables:
-
-    OPENID_AUTHORIZATION_ENDPOINT   The authorization endpoint (URI) of the OpenID service.
-
-    OPENID_JWKS_ENDPOINT            The endpoint (URI) of the JWKS service which defines
-                                    how received ID tokens (JSON Web Tokens or JWTs)
-                                    shall be validated.
-
-    OPENID_ISSUER                   The issuer to expect for all received ID tokens.
-
-    OPENID_CLIENT_ID                The OpenID client ID which should be submitted
-                                    to the OpenID service when necessary.
-                                    This value is typically provided to you by the OpenID
-                                    service when OpenID credentials are generated for your application.
-
-    OPENID_REDIRECT_URI             The URI that should be submitted to the OpenID service such that
-                                    they can redirect the authenticated user back to Guacamole after
-                                    the authentication process is complete. This must be the full URL
-                                    that a user would enter into their browser to access Guacamole.
-END
-        exit 1;
-    fi
-
-    # Update config file
-    set_property          "openid-authorization-endpoint"    "$OPENID_AUTHORIZATION_ENDPOINT"
-    set_property          "openid-jwks-endpoint"             "$OPENID_JWKS_ENDPOINT"
-    set_property          "openid-issuer"                    "$OPENID_ISSUER"
-    set_property          "openid-client-id"                 "$OPENID_CLIENT_ID"
-    set_property          "openid-redirect-uri"              "$OPENID_REDIRECT_URI"
-    set_optional_property "openid-username-claim-type"       "$OPENID_USERNAME_CLAIM_TYPE"
-    set_optional_property "openid-groups-claim-type"         "$OPENID_GROUPS_CLAIM_TYPE"
-    set_optional_property "openid-scope"                     "$OPENID_SCOPE"
-    set_optional_property "openid-allowed-clock-skew"        "$OPENID_ALLOWED_CLOCK_SKEW"
-    set_optional_property "openid-max-token-validity"        "$OPENID_MAX_TOKEN_VALIDITY"
-    set_optional_property "openid-max-nonce-validity"        "$OPENID_MAX_NONCE_VALIDITY"
-
-    # Add required .jar files to GUACAMOLE_EXT
-    # "1-{}" make it sorted as a first provider (only authentication)
-    # so it can work together with the database providers (authorization)
-    find /opt/guacamole/openid/ -name "*.jar" | awk -F/ '{print $NF}' | \
-    xargs -I '{}' ln -s "/opt/guacamole/openid/{}" "${GUACAMOLE_EXT}/1-{}"
-
-}
-
-##
-## Adds properties to guacamole.properties which select the SAML
-## authentication provider, and configure it to connect to the specified SAML
-## provider.
-##
-
-associate_saml() {
-
-    # Verify required parameters are present
-    if [ -z "$SAML_IDP_METADATA_URL" ] && \
-       [ -z "$SAML_ENTITY_ID" -o -z "$SAML_CALLBACK_URL" -o -z "$SAML_IDP_URL" ]
-    then
-        cat <<END
-FATAL: Missing required environment variables
--------------------------------------------------------------------------------
-If using a SAML authentication, you must provide either SAML_IDP_METADATA_URL
-or SAML_IDP_URL,  SAML_ENTITY_ID and SAML_CALLBACK_URL environment variables:
-
-    SAML_IDP_METADATA_URL   The URI of the XML metadata file that from the SAML Identity
-                            Provider that contains all of the information the SAML
-                            extension needs in order to know how to authenticate with
-                            the IdP. This URI can either be a remote server (e.g. https://)
-                            or a local file on the filesystem (e.g. file://).
-
-    SAML_IDP_URL            The URL of the Identity Provider (IdP), which the user
-                            will be redirected to in order to authenticate.
-
-    SAML_ENTITY_ID          The entity ID of the Guacamole SAML client, which is
-                            generally the URL of the Guacamole server.
-
-    SAML_CALLBACK_URL       The URL that the IdP will use once authentication has
-                            succeeded to return to the Guacamole web application and
-                            provide the authentication details to the SAML extension.
-END
-        exit 1;
-    fi
-
-    # Update config file
-    set_optional_property "saml-idp-metadata-url"            "$SAML_IDP_METADATA_URL"
-    set_optional_property "saml-idp-url"                     "$SAML_IDP_URL"
-    set_optional_property "saml-entity-id"                   "$SAML_ENTITY_ID"
-    set_optional_property "saml-callback-url"                "$SAML_CALLBACK_URL"
-    set_optional_property "saml-strict"                      "$SAML_STRICT"
-    set_optional_property "saml-debug"                       "$SAML_DEBUG"
-    set_optional_property "saml-compress-request"            "$SAML_COMPRESS_REQUEST"
-    set_optional_property "saml-compress-response"           "$SAML_COMPRESS_RESPONSE"
-    set_optional_property "saml-group-attribute"             "$SAML_GROUP_ATTRIBUTE"
-
-    # Add required .jar files to GUACAMOLE_EXT
-    # "1-{}" make it sorted as a first provider (only authentication)
-    # so it can work together with the database providers (authorization)
-    find /opt/guacamole/saml/ -name "*.jar" | awk -F/ '{print $NF}' | \
-    xargs -I '{}' ln -s "/opt/guacamole/saml/{}" "${GUACAMOLE_EXT}/1-{}"
-
-}
-
-##
-## Adds properties to guacamole.properties which configure the TOTP two-factor
-## authentication mechanism.
-##
-associate_totp() {
-    # Update config file
-    set_optional_property "totp-issuer"    "$TOTP_ISSUER"
-    set_optional_property "totp-digits"    "$TOTP_DIGITS"
-    set_optional_property "totp-period"    "$TOTP_PERIOD"
-    set_optional_property "totp-mode"      "$TOTP_MODE"
-
-    # Add required .jar files to GUACAMOLE_EXT
-    ln -s /opt/guacamole/totp/guacamole-auth-*.jar   "$GUACAMOLE_EXT"
-}
-
-##
-## Adds properties to guacamole.properties which configure the Duo two-factor
-## authentication service. Checks to see if all variables are defined
-##
-associate_duo() {
-    # Verify required parameters are present
-    if [ -z "$DUO_CLIENT_ID" ]            || \
-       [ -z "$DUO_CLIENT_SECRET" ]        || \
-       [ -z "$DUO_REDIRECT_URI" ]
-    then
-        cat <<END
-FATAL: Missing required environment variables
--------------------------------------------------------------------------------
-If using the Duo authentication extension, you must provide each of the
-following environment variables:
-
-    DUO_API_HOSTNAME        The hostname of the Duo API endpoint.
-
-    DUO_CLIENT_ID           The client id (or integration key) provided for Guacamole by Duo.
-
-    DUO_CLIENT_SECRET       The secret key provided for Guacamole by Duo.
-
-    DUO_REDIRECT_URI        The URI to redirect back to upon successful authentication.
-END
-        exit 1;
-    fi
-
-    # Update config file
-    set_property "duo-api-hostname"                 "$DUO_API_HOSTNAME"
-    set_property "duo-client-id"                    "$DUO_CLIENT_ID"
-    set_property "duo-client-secret"                "$DUO_CLIENT_SECRET"
-    set_property "duo-redirect-uri"                 "$DUO_REDIRECT_URI"
-
-    # Add required .jar files to GUACAMOLE_EXT
-    ln -s /opt/guacamole/duo/guacamole-auth-*.jar   "$GUACAMOLE_EXT"
-}
-
-##
-## Adds properties to guacamole.properties which configure the header
-## authentication provider.
-##
-associate_header() {
-    # Update config file
-    set_optional_property "http-auth-header"         "$HTTP_AUTH_HEADER"
-
-    # Add required .jar files to GUACAMOLE_EXT
-    ln -s /opt/guacamole/header/guacamole-auth-*.jar "$GUACAMOLE_EXT"
-}
-
-##
-## Adds properties to guacamole.properties witch configure the CAS
-## authentication service.
-##
-associate_cas() {
-    # Verify required parameters are present
-    if [ -z "$CAS_AUTHORIZATION_ENDPOINT" ] || \
-       [ -z "$CAS_REDIRECT_URI" ]
-    then
-        cat <<END
-FATAL: Missing required environment variables
------------------------------------------------------------------------------------
-If using the CAS authentication extension, you must provide each of the
-following environment variables:
-
-    CAS_AUTHORIZATION_ENDPOINT      The URL of the CAS authentication server.
-
-    CAS_REDIRECT_URI                The URI to redirect back to upon successful authentication.
-
-END
-        exit 1;
-    fi
-
-    # Update config file
-    set_property            "cas-authorization-endpoint"       "$CAS_AUTHORIZATION_ENDPOINT"
-    set_property            "cas-redirect-uri"                 "$CAS_REDIRECT_URI"
-    set_optional_property   "cas-clearpass-key"                "$CAS_CLEARPASS_KEY"
-    set_optional_property   "cas-group-attribute"              "$CAS_GROUP_ATTRIBUTE"
-    set_optional_property   "cas-group-format"                 "$CAS_GROUP_FORMAT"
-    set_optional_property   "cas-group-ldap-base-dn"           "$CAS_GROUP_LDAP_BASE_DN"
-    set_optional_property   "cas-group-ldap-attribute"         "$CAS_GROUP_LDAP_ATTRIBUTE"
-
-    # Add required .jar files to GUACAMOLE_EXT
-    ln -s /opt/guacamole/cas/guacamole-auth-*.jar   "$GUACAMOLE_EXT"
-}
-
-##
-## Adds properties to guacamole.properties which configure the json
-## authentication provider.
-##
-associate_json() {
-    # Update config file
-    set_property          "json-secret-key"        "$JSON_SECRET_KEY"
-    set_optional_property "json-trusted-networks"  "$JSON_TRUSTED_NETWORKS"
-
-    # Add required .jar files to GUACAMOLE_EXT
-    ln -s /opt/guacamole/json/guacamole-auth-*.jar "$GUACAMOLE_EXT"
-}
-
-##  
-## Adds properties to guacamole.properties which configure the recording
-## storage extension.
-##  
-associate_recordings() {
-    # Update config file
-    set_property "recording-search-path" "$RECORDING_SEARCH_PATH"
-    
-    # Add required .jar files to GUACAMOLE_EXT
-    ln -s /opt/guacamole/recordings/guacamole-history-recording-storage-*.jar "$GUACAMOLE_EXT"
-}
-
-##
-## Sets up Tomcat's remote IP valve that allows gathering the remote IP
-## from headers set by a remote proxy
-## Upstream documentation: https://tomcat.apache.org/tomcat-8.5-doc/api/org/apache/catalina/valves/RemoteIpValve.html
-##
-enable_remote_ip_valve() {
-    # Add <Valve> element
-    xmlstarlet edit --inplace \
-        --insert '/Server/Service/Engine/Host/*' --type elem -n Valve \
-        --insert '/Server/Service/Engine/Host/Valve[not(@className)]' --type attr -n className -v org.apache.catalina.valves.RemoteIpValve \
-        $CATALINA_BASE/conf/server.xml
-
-    # Allowed IPs
-    if [ -z "$PROXY_ALLOWED_IPS_REGEX" ]; then
-        echo "Using default Tomcat allowed IPs regex"
-    else
-        xmlstarlet edit --inplace \
-            --insert '/Server/Service/Engine/Host/Valve[@className="org.apache.catalina.valves.RemoteIpValve"]' \
-            --type attr -n internalProxies -v "$PROXY_ALLOWED_IPS_REGEX" \
-            $CATALINA_BASE/conf/server.xml
-    fi
-
-    # X-Forwarded-For
-    if [ -z "$PROXY_IP_HEADER" ]; then
-        echo "Using default Tomcat proxy IP header"
-    else
-        xmlstarlet edit --inplace \
-            --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \
-            --type attr -n remoteIpHeader -v "$PROXY_IP_HEADER" \
-            $CATALINA_BASE/conf/server.xml
-    fi
-
-    # X-Forwarded-Proto
-    if [ -z "$PROXY_PROTOCOL_HEADER" ]; then
-        echo "Using default Tomcat proxy protocol header"
-    else
-        xmlstarlet edit --inplace \
-            --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \
-            --type attr -n protocolHeader -v "$PROXY_PROTOCOL_HEADER" \
-            $CATALINA_BASE/conf/server.xml
-    fi
-
-    # X-Forwarded-By
-    if [ -z "$PROXY_BY_HEADER" ]; then
-        echo "Using default Tomcat proxy forwarded by header"
-    else
-        xmlstarlet edit --inplace \
-            --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \
-            --type attr -n remoteIpProxiesHeader -v "$PROXY_BY_HEADER" \
-            $CATALINA_BASE/conf/server.xml
-    fi
-}
-
-##
-## Adds api-session-timeout to guacamole.properties
-##
-associate_apisessiontimeout() {
-    set_optional_property "api-session-timeout" "$API_SESSION_TIMEOUT"
-}
-
-##
-## Starts Guacamole under Tomcat, replacing the current process with the
-## Tomcat process. As the current process will be replaced, this MUST be the
-## last function run within the script.
-##
-start_guacamole() {
-
-    # User-only writable CATALINA_BASE
-    export CATALINA_BASE=$HOME/tomcat
-    for dir in logs temp webapps work; do
-        mkdir -p $CATALINA_BASE/$dir
-    done
-    cp -R /usr/local/tomcat/conf $CATALINA_BASE
-
-    # Set up Tomcat RemoteIPValve
-    if [ "$REMOTE_IP_VALVE_ENABLED" = "true" ]; then
-        enable_remote_ip_valve
-    fi
-
-    # Install webapp
-    ln -sf /opt/guacamole/guacamole.war $CATALINA_BASE/webapps/${WEBAPP_CONTEXT:-guacamole}.war
-
-    # Start tomcat
-    cd /usr/local/tomcat
-    exec catalina.sh run
-
-}
-
-#
-# Start with a fresh GUACAMOLE_HOME
-#
-
-rm -Rf "$GUACAMOLE_HOME"
-
-#
-# Copy contents of provided GUACAMOLE_HOME template, if any
-#
-
-if [ -n "$GUACAMOLE_HOME_TEMPLATE" ]; then
-    cp -a "$GUACAMOLE_HOME_TEMPLATE/." "$GUACAMOLE_HOME/"
-fi
-
-#
-# Create and define Guacamole lib and extensions directories
-#
-
-mkdir -p "$GUACAMOLE_EXT"
-mkdir -p "$GUACAMOLE_LIB"
-
-#
-# Point to associated guacd
-#
-
-# Use linked container for guacd if specified
-if [ -n "$GUACD_NAME" ]; then
-    GUACD_HOSTNAME="$GUACD_PORT_4822_TCP_ADDR"
-    GUACD_PORT="$GUACD_PORT_4822_TCP_PORT"
-fi
-
-# Use default guacd port if none specified
-GUACD_PORT="${GUACD_PORT-4822}"
-
-# Verify required guacd connection information is present
-if [ -z "$GUACD_HOSTNAME" -o -z "$GUACD_PORT" ]; then
-    cat <<END
-FATAL: Missing GUACD_HOSTNAME or "guacd" link.
--------------------------------------------------------------------------------
-Every Guacamole instance needs a corresponding copy of guacd running. To
-provide this, you must either:
-
-(a) Explicitly link that container with the link named "guacd".
-
-(b) If not using a Docker container for guacd, explicitly specify the TCP
-    connection information using the following environment variables:
-
-GUACD_HOSTNAME     The hostname or IP address of guacd. If not using a guacd
-                   Docker container and corresponding link, this environment
-                   variable is *REQUIRED*.
-
-GUACD_PORT         The port on which guacd is listening for TCP connections.
-                   This environment variable is optional. If omitted, the
-                   standard guacd port of 4822 will be used.
-END
-    exit 1;
-fi
-
-# Update config file
-set_property "guacd-hostname" "$GUACD_HOSTNAME"
-set_property "guacd-port"     "$GUACD_PORT"
-
-# A comma-separated list of the identifiers of authentication providers that
-# should be allowed to fail internally without aborting the authentication process
-set_optional_property "skip-if-unavailable"     "$SKIP_IF_UNAVAILABLE"
-
-
-#
-# Track which authentication backends are installed
-#
-
-INSTALLED_AUTH=""
-
-# Use MySQL if database specified
-if [ -n "$MYSQL_DATABASE" -o -n "$MYSQL_DATABASE_FILE" ]; then
-    associate_mysql
-    INSTALLED_AUTH="$INSTALLED_AUTH mysql"
-fi
-
-# Use PostgreSQL if database specified
-if [ -n "$POSTGRESQL_DATABASE" -o -n "$POSTGRESQL_DATABASE_FILE" ]; then
-    associate_postgresql
-    INSTALLED_AUTH="$INSTALLED_AUTH postgresql"
-fi
-
-# Use SQLServer if database specified
-if [ -n "$SQLSERVER_DATABASE" -o -n "$SQLSERVER_DATABASE_FILE" ]; then
-    associate_sqlserver
-    INSTALLED_AUTH="$INSTALLED_AUTH sqlserver"
-fi
-
-# Use LDAP directory if specified
-if [ -n "$LDAP_HOSTNAME" ]; then
-    associate_ldap
-    INSTALLED_AUTH="$INSTALLED_AUTH ldap"
-fi
-
-# Use RADIUS server if specified
-if [ -n "$RADIUS_SHARED_SECRET" ]; then
-    associate_radius
-    INSTALLED_AUTH="$INSTALLED_AUTH radius"
-fi
-
-# Use OPENID if specified
-if [ -n "$OPENID_AUTHORIZATION_ENDPOINT" ]; then
-    associate_openid
-    INSTALLED_AUTH="$INSTALLED_AUTH openid"
-fi
-
-# Use SAML if specified
-if [ -n "$SAML_IDP_METADATA_URL" ] || [ -n "$SAML_ENTITY_ID" -a -n "$SAML_CALLBACK_URL" ]; then
-    associate_saml
-    INSTALLED_AUTH="$INSTALLED_AUTH saml"
-fi
-
-# Use TOTP if specified.
-if [ "$TOTP_ENABLED" = "true" ]; then
-    associate_totp
-fi
-
-# Use Duo if specified.
-if [ -n "$DUO_API_HOSTNAME" ]; then
-    associate_duo
-fi
-
-# Use header if specified.
-if [ "$HEADER_ENABLED" = "true" ]; then
-    associate_header
-fi
-
-# Use CAS if specified.
-if [ -n "$CAS_AUTHORIZATION_ENDPOINT" ]; then
-    associate_cas
-fi
-
-# Use json-auth if specified.
-if [ -n "$JSON_SECRET_KEY" ]; then
-    associate_json
-    INSTALLED_AUTH="$INSTALLED_AUTH json"
-fi
-
-# Add in the history recording storage extension if configured
-if [ -n "$RECORDING_SEARCH_PATH" ]; then
-    associate_recordings
-fi
-
-#
-# Validate that at least one authentication backend is installed
-#
-
-if [ -z "$INSTALLED_AUTH" -a -z "$GUACAMOLE_HOME_TEMPLATE" ]; then
-    cat <<END
-FATAL: No authentication configured
--------------------------------------------------------------------------------
-The Guacamole Docker container needs at least one authentication mechanism in
-order to function, such as a MySQL database, PostgreSQL database, SQLServer
-database, LDAP directory or RADIUS server. Please specify at least the
-MYSQL_DATABASE or POSTGRESQL_DATABASE or SQLSERVER_DATABASE environment variables,
-or check Guacamole's Docker documentation regarding configuring LDAP and/or
-custom extensions.
-END
-    exit 1;
-fi
-
-# Set extension priority if specified
-set_optional_property "extension-priority" "$EXTENSION_PRIORITY"
-
-# Use api-session-timeout if specified.
-if [ -n "$API_SESSION_TIMEOUT" ]; then
-    associate_apisessiontimeout
-fi
-
-# Maximum number of bytes to accept within the entity body of any particular HTTP request
-set_optional_property "api-max-request-size" "$API_MAX_REQUEST_SIZE"
-
-# A comma-separated list of language keys to allow as display language 
-# choices within the Guacamole interface
-set_optional_property "allowed-languages" "$ALLOWED_LANGUAGES"
-
-# If set to “true”, Guacamole will first evaluate its environment to obtain the value
-# for any given configuration property, before using a value specified in 
-# guacamole.properties or falling back to a default value
-set_optional_property "enable-environment-properties" "$ENABLE_ENVIRONMENT_PROPERTIES"
-
-
-# Apply any overrides for default address ban behavior
-set_optional_property "ban-address-duration" "$BAN_ADDRESS_DURATION"
-set_optional_property "ban-max-addresses" "$BAN_MAX_ADDRESSES"
-set_optional_property "ban-max-invalid-attempts" "$BAN_MAX_INVALID_ATTEMPTS"
-
-# Always load guacamole-auth-ban extension (automatic banning can be disabled
-# through seting BAN_ADDRESS_DURATION to 0). As guacamole-auth-ban performs
-# its banning by handling a pre-authentication event, it is guaranteed to
-# perform its checks before all other auth processing and load order does not
-# matter.
-ln -s /opt/guacamole/ban/guacamole-auth-*.jar "$GUACAMOLE_EXT"
-
-# Set logback level if specified
-if [ -n "$LOGBACK_LEVEL" ]; then
-    unzip -o -j /opt/guacamole/guacamole.war WEB-INF/classes/logback.xml -d $GUACAMOLE_HOME
-    sed -i "s/level=\"info\"/level=\"$LOGBACK_LEVEL\"/" $GUACAMOLE_HOME/logback.xml
-fi
-
-#
-# Finally start Guacamole (under Tomcat)
-#
-
-start_guacamole
diff --git a/guacamole-docker/build.d/000-build-and-install-guacamole.sh b/guacamole-docker/build.d/000-build-and-install-guacamole.sh
new file mode 100644
index 000000000..8c9c77203
--- /dev/null
+++ b/guacamole-docker/build.d/000-build-and-install-guacamole.sh
@@ -0,0 +1,62 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+## 
+## @fn 010-build-and-install-guacamole.sh
+##
+## Builds the Guacamole web application and all main extensions, installing the
+## resulting binaries to standard locations within the Docker image. After the
+## build and install process, the resulting binaries can be found beneath:
+##
+## /opt/guacamole/webapp:
+##   The web application, "guacamole.war".
+##
+## /opt/guacamole/extensions:
+##   All extensions, each within their own subdirectory and identical to the
+##   result of extracting a released .tar.gz except that version numbers of been
+##   stripped.
+##
+
+#
+# Build guacamole.war and all extensions, applying any provided Maven build
+# arguments
+#
+
+cd "$BUILD_DIR"
+mvn $MAVEN_ARGUMENTS package
+
+#
+# Copy built web application (guacamole.war) to destination location
+#
+
+mkdir -p "$DESTINATION/webapp"
+cp guacamole/target/*.war "$DESTINATION/webapp/guacamole.war"
+
+#
+# Extract all extensions to destination location, stripping version number
+# suffix from .jar files and top-level directory name
+#
+
+mkdir -p "$DESTINATION/extensions"
+find extensions/ -path "**/target/*.tar.gz" -exec tar -xzf "{}" \
+    -C "$DESTINATION/extensions"                                \
+    --xform='s#^\([^/]*\)-[0-9]\+\.[0-9]\+\.[0-9]\+#\1#g'       \
+    --xform='s#-[0-9]\+\.[0-9]\+\.[0-9]\+\(\.jar$\)#\1#g'       \
+    ";"
+
diff --git a/guacamole-docker/build.d/010-map-guacamole-extensions.sh b/guacamole-docker/build.d/010-map-guacamole-extensions.sh
new file mode 100644
index 000000000..de12262ae
--- /dev/null
+++ b/guacamole-docker/build.d/010-map-guacamole-extensions.sh
@@ -0,0 +1,118 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+##
+## @fn 020-map-guacamole-extensions.sh
+##
+## Maps all installed Guacamole extensions (built in a previous step) to their
+## corresponding environment variable prefixes, adding symbolic links so that
+## the changes to the contents of GUACAMOLE_HOME can be easily made by the
+## container's entrypoint based on which environment variables are set, without
+## requiring that the entrypoint be specifically aware of all supported
+## environment variables.
+##
+
+##
+## Reads a mapping of Guacamole extension to environment variable prefix from
+## STDIN, creating a hierarchy of directories and symbolic links on the
+## filesystem that can be easily consumed by the container's entrypoint later.
+##
+## Each mapping consists of a single line with two values separated by
+## whitespace, where the first (leftmost) value is the path to the directory
+## containing the extension .jar file (relative to /opt/guacamole/extensions)
+## and the second (rightmost) value is the environment variable prefix used by
+## that extension. For readability, periods may be used in lieu of spaces.
+##
+## After mapping has occurred, the resulting mappings are located beneath
+## /opt/guacamole/environment. They consist of directories named after the
+## provided environment variable prefixes, where the contents of those
+## directories are subsets of the contents of GUACAMOLE_HOME that would need to
+## be added to the actual GUACAMOLE_HOME to enable that extension.
+##
+map_extensions() {
+
+    # Read through each provided path/prefix mapping pair
+    mkdir -p "$DESTINATION/environment"
+    tr . ' ' | while read -r EXT_PATH VAR_PREFIX; do
+
+        # Add mappings only for extensions that were actually built as part of
+        # the build process (some extensions, like the RADIUS support, will
+        # only be built if specific build arguments are provided)
+        if [ -d "$DESTINATION/extensions/$EXT_PATH/" ]; then
+            echo "Mapped: $EXT_PATH -> $VAR_PREFIX"
+            mkdir -p "$DESTINATION/environment/$VAR_PREFIX/extensions"
+            ln -s "$DESTINATION/extensions/$EXT_PATH"/*.jar "$DESTINATION/environment/$VAR_PREFIX/extensions/"
+        else
+            echo "Skipped: $EXT_PATH (not built)"
+        fi
+
+    done
+
+}
+
+#
+# This section is a mapping of all bundled extensions to their corresponding
+# variable prefixes. Each line consists of a whitespace-separated pair of
+# extension path (the relative directory containing the .jar file) to that
+# extension's variable prefix. For readability, a period may be used in lieu of
+# a space.
+#
+# NOTES:
+#
+# (1) The actual variables used by each extension are not determined here, but
+# rather by the transformation of their configuration properties to variables
+# ("lowercase-with-dashes" to "UPPERCASE_WITH_UNDERSCORES"). The variable
+# prefixes listed here should be chosen to match the prefixes resulting from
+# that transformation of the extensions' properties.
+#
+# (2) The paths on the left side of this mapping are the paths of the extension
+# .jar files relative to the "/opt/guacamole/extensions" directory used by the
+# container to store extensions prior to use. They are identical to the paths
+# used by the distribution .tar.gz files provided with each Guacamole release,
+# except that the version numbers have been stripped from the top-level path.
+#
+# (3) The script processing this file uses these prefixes to define and process
+# an additional "ENABLED" variable (ie: "BAN_ENABLED", "TOTP_ENABLED", etc.)
+# that can be used to enable/disable an extension entirely regardless of the
+# presence/absence of other variables with the prefix. This allows extensions
+# that need no configuration to be easily enabled. It also allows extensions
+# that already have configuration present to be easily disabled without
+# requiring that all other configuration be removed.
+#
+map_extensions <<'EOF'
+    guacamole-auth-ban..........................BAN_
+    guacamole-auth-duo..........................DUO_
+    guacamole-auth-header.......................HTTP_AUTH_
+    guacamole-auth-jdbc/mysql...................MYSQL_
+    guacamole-auth-jdbc/postgresql..............POSTGRESQL_
+    guacamole-auth-jdbc/sqlserver...............SQLSERVER_
+    guacamole-auth-json.........................JSON_
+    guacamole-auth-ldap.........................LDAP_
+    guacamole-auth-quickconnect.................QUICKCONNECT_
+    guacamole-auth-radius.......................RADIUS_
+    guacamole-auth-sso/cas......................CAS_
+    guacamole-auth-sso/openid...................OPENID_
+    guacamole-auth-sso/saml.....................SAML_
+    guacamole-auth-sso/ssl......................SSL_
+    guacamole-auth-totp.........................TOTP_
+    guacamole-display-statistics................DISPLAY_STATISTICS_
+    guacamole-history-recording-storage.........RECORDING_
+    guacamole-vault/ksm.........................KSM_
+EOF
+
diff --git a/guacamole-docker/build.d/020-download-drivers.sh b/guacamole-docker/build.d/020-download-drivers.sh
new file mode 100644
index 000000000..6613dc3a2
--- /dev/null
+++ b/guacamole-docker/build.d/020-download-drivers.sh
@@ -0,0 +1,99 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+##
+## @fn 030-download-drivers.sh
+##
+## Downloads all JDBC drivers required by the various supported databases. Each
+## downloaded driver is stored beneath /opt/guacamole/drivers, with symbolic
+## links added to the mappings beneath /opt/guacamole/environment to ensure any
+## required drivers are added to GUACAMOLE_HOME if necessary to support a
+## requested database.
+##
+
+##
+## Downloads the JDBC driver at the given URL, storing the driver's .jar file
+## under the given name and environment variable prefix. The downloaded .jar
+## file is stored such that it is pulled into GUACAMOLE_HOME automatically if
+## environment variables with that prefix are used.
+##
+## If the URL is for a .tar.gz file and not a .jar file, the .jar will be
+## automatically extracted from the .tar.gz as it is downloaded.
+##
+## @param VAR_PREFIX
+##     The environment variable prefix used by the extension that requires the
+##     driver.
+##
+## @param URL
+##     The URL that the driver should be downloaded from.
+##
+## @param DEST_JAR
+##     The filename to assign to the downloaded .jar file. This is mainly
+##     needed to ensure that the drivers bundled with the image have names that
+##     are predictable and reliable enough that they can be consumed by
+##     third-party use of this image.
+##
+download_driver() {
+
+    local VAR_PREFIX="$1"
+    local URL="$2"
+    local DEST_JAR="$3"
+
+    # Ensure primary destination path for .jar file exists
+    local DEST_PATH="$DESTINATION/drivers/"
+    mkdir -p "$DEST_PATH"
+
+    # Download requested .jar file, extracting from .tar.gz if necessary
+    if [[ "$URL" == *.tar.gz ]]; then
+        curl -L "$URL" | tar -xz       \
+            --wildcards                \
+            --no-anchored              \
+            --no-wildcards-match-slash \
+            --to-stdout                \
+            "*.jar" > "$DEST_PATH/$DEST_JAR"
+    else
+        curl -L "$URL" > "$DEST_PATH/$DEST_JAR"
+    fi
+
+    # Add any required link to ensure the .jar file is loaded along with the
+    # extension that requires it
+    mkdir -p "$DESTINATION/environment/$VAR_PREFIX/lib"
+    ln -s "$DEST_PATH/$DEST_JAR" "$DESTINATION/environment/$VAR_PREFIX/lib/"
+
+}
+
+#
+# Download and link any required JDBC drivers
+#
+
+# MySQL JDBC driver
+download_driver "MYSQL_" \
+    "https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-$MYSQL_JDBC_VERSION.tar.gz" \
+    "mysql-jdbc.jar"
+
+# PostgreSQL JDBC driver
+download_driver "POSTGRESQL_" \
+    "https://jdbc.postgresql.org/download/postgresql-$PGSQL_JDBC_VERSION.jar" \
+    "postgresql-jdbc.jar"
+
+# SQL Server JDBC driver
+download_driver "SQLSERVER_" \
+    "https://github.com/microsoft/mssql-jdbc/releases/download/v$MSSQL_JDBC_VERSION/mssql-jdbc-$MSSQL_JDBC_VERSION.jre8.jar" \
+    "mssql-jdbc.jar"
+
diff --git a/guacamole-docker/build.d/999-verify-sanity.sh b/guacamole-docker/build.d/999-verify-sanity.sh
new file mode 100644
index 000000000..48707da86
--- /dev/null
+++ b/guacamole-docker/build.d/999-verify-sanity.sh
@@ -0,0 +1,47 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+##
+## @fn 999-verify-sanity.sh
+##
+## Performs sanity checks on the results of the build that verify the image
+## contains everything it is expected to contain, including all built
+## extensions. If symbolic links were not correctly constructed, or some built
+## extensions were not mapped to environment variable prefixes, this script
+## will log errors and fail the build.
+##
+
+# Perform basic sanity checks that the symbolic links used to associated
+# environment variables with extensions/libraries have been correctly created,
+# bailing out if any problems are found.
+(
+
+    # Search for any broken symbolic links intended to map files for
+    # environment variables
+    find "$DESTINATION/environment/" -xtype l | sed 's/^/Broken link: /'
+
+    # Search for extensions that have not been mapped to any environment
+    # variables at all
+    comm -23 \
+        <(find "$DESTINATION/extensions/" -name "*.jar" -exec realpath "{}" ";" | sort -u) \
+        <(find "$DESTINATION/environment/" -path "**/extensions/*.jar" -exec realpath "{}" ";" | sort -u) \
+        | sed 's/^/Unmapped extension: /'
+
+) | sed 's/^/ERROR: /' | (! grep .) >&2 || exit 1
+
diff --git a/guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh b/guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh
new file mode 100644
index 000000000..077fb13ad
--- /dev/null
+++ b/guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh
@@ -0,0 +1,105 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+##
+## @fn 000-migrate-legacy-variables.sh
+##
+## Checks for usage of any environment variables that were formerly supported
+## but are now deprecated, warning when any deprecated variables are
+## encountered.  Until support for a deprecated variable is entirely removed,
+## the value provided for the deprecated variable is automatically assigned to
+## the currently-supported variable.
+##
+
+##
+## Checks for usage of the given deprecated environment variable, automatically
+## assigning its value to the given currently-supported environment variable.
+## If usage of the deprecated variable is found, a warning is printed to
+## STDERR.
+##
+## @param LEGACY_VAR_NAME
+##     The name of the environment variable that's deprecated.
+##
+## @param CURRENT_VAR_NAME
+##     The name of the environment variable that is currently supported and
+##     replaces the deprecated variable.
+##
+deprecate_variable() {
+
+    local LEGACY_VAR_NAME="$1"
+    local CURRENT_VAR_NAME="$2"
+
+    if [ -n "${!LEGACY_VAR_NAME}" ]; then
+        echo "WARNING: The \"$LEGACY_VAR_NAME\" environment variable has been deprecated in favor of \"$CURRENT_VAR_NAME\". Please migrate your configuration when possible, as support for the older name may be removed in future releases." >&2
+        export "$CURRENT_VAR_NAME"="${!LEGACY_VAR_NAME}"
+    fi
+
+}
+
+##
+## Checks for usage of any environment variables using the given deprecated
+## prefix, automatically assigning their values to corresponding environment
+## variables having the given currently-supported prefix. If usage of the
+## deprecated prefix is found, a warning is printed to STDERR.
+##
+## @param LEGACY_VAR_PREFIX
+##     The environment variable prefix that's deprecated.
+##
+## @param CURRENT_VAR_PREFIX
+##     The environment variable prefix that is currently supported and
+##     replaces the deprecated variable prefix.
+##
+deprecate_variable_prefix() {
+
+    local LEGACY_VAR_PREFIX="$1"
+    local CURRENT_VAR_PREFIX="$2"
+
+    local LEGACY_VAR_NAME
+    local CURRENT_VAR_NAME
+    local HAS_LEGACY_VARIABLES=0
+
+    # Automatically reassign all "POSTGRES_*" variables to "POSTGRESQL_*"
+    while read -r LEGACY_VAR_NAME; do
+        HAS_LEGACY_VARIABLES=1
+        CURRENT_VAR_NAME="$CURRENT_VAR_PREFIX${LEGACY_VAR_NAME#$LEGACY_VAR_PREFIX}"
+        export "$CURRENT_VAR_NAME"="${!LEGACY_VAR_NAME}"
+        unset "$LEGACY_VAR_NAME"
+    done < <(awk 'BEGIN{for(v in ENVIRON) print v}' | grep "^$LEGACY_VAR_PREFIX")
+
+    if [ "$HAS_LEGACY_VARIABLES" = "1" ]; then
+        echo "WARNING: The \"$LEGACY_VAR_PREFIX\" prefix for environment variables has been deprecated in favor of the \"$CURRENT_VAR_PREFIX\" prefix. Please migrate your configuration when possible, as support for the older prefix may be removed in future releases." >&2
+        export "$CURRENT_VAR_NAME"="$LEGACY_VAR_NAME"
+    fi
+
+}
+
+# The old "*_USER" style for configuring the user account to be used to access
+# the database is being replaced with "*_USERNAME" such that all environment
+# variables exactly correspond to the names of configuration properties from
+# guacamole.properties.
+deprecate_variable "MYSQL_USER"     "MYSQL_USERNAME"
+deprecate_variable "POSTGRES_USER"  "POSTGRESQL_USERNAME"
+deprecate_variable "SQLSERVER_USER" "SQLSERVER_USERNAME"
+
+# The old "POSTGRES_" prefix for configuring usage of PostgreSQL is being
+# replaced with "POSTGRESQL_" such that all environment variables exactly
+# correspond to the names of configuration properties from
+# guacamole.properties.
+deprecate_variable_prefix "POSTGRES_" "POSTGRESQL_"
+
diff --git a/guacamole-docker/entrypoint.d/100-generate-guacamole-home.sh b/guacamole-docker/entrypoint.d/100-generate-guacamole-home.sh
new file mode 100644
index 000000000..1db4d6086
--- /dev/null
+++ b/guacamole-docker/entrypoint.d/100-generate-guacamole-home.sh
@@ -0,0 +1,111 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+##
+## @fn 010-generate-guacamole-home.sh
+##
+## Automatically generates a temporary, skeleton GUACAMOLE_HOME to be used for
+## this run of the container. GUACAMOLE_HOMEs from previous runs are
+## automatically deleted prior to creating the new skeleton. A
+## randomly-generated temporary directory is used instead of a standard
+## directory like "/etc/guacamole" to allow users to use "/etc/guacamole" as a
+## basis for their own configuration.
+##
+
+##
+## The directory to copy/link over as a basis for the GUACAMOLE_HOME actually
+## used by the Guacamole web application. Any configuration generated by this
+## container will be overlaid on top of this configuration. To achieve the
+## overlay, symbolic links will be created for all files inside and beneath
+## this directory. Only the guacamole.properties file will be copied instead of
+## using symbolic links (to ensure property generation performed by the
+## container does not potentially modify an external file).
+##
+GUACAMOLE_HOME_TEMPLATE="$GUACAMOLE_HOME"
+
+##
+## Tests whether a given property is set within the guacamole.properties file
+## in GUACAMOLE_HOME.
+##
+## @param PROPERTY_NAME
+##     The name of the property to check.
+##
+## @returns
+##     Zero if the given property is set to any value within
+##     guacamole.properties, non-zero otherwise.
+##
+is_property_set() {
+    local PROPERTY_NAME="$1"
+    grep "^[[:space:]]*$PROPERTY_NAME\>" "$GUACAMOLE_HOME/guacamole.properties" &> /dev/null
+}
+
+#
+# Start with a fresh GUACAMOLE_HOME
+#
+
+rm -rf /tmp/guacamole-home.*
+GUACAMOLE_HOME="`mktemp -p /tmp -d guacamole-home.XXXXXXXXXX`"
+mkdir -p "$GUACAMOLE_HOME/"{lib,extensions}
+
+cat > "$GUACAMOLE_HOME/guacamole.properties" <<EOF
+# guacamole.properties - generated `date`
+EOF
+
+#
+# Copy contents of provided GUACAMOLE_HOME template, if any
+#
+
+if [ -e "$GUACAMOLE_HOME_TEMPLATE" ]; then
+
+    # Create links for any libraries provided in the template GUACAMOLE_HOME
+    find "$GUACAMOLE_HOME_TEMPLATE/lib" -mindepth 1 -maxdepth 1 \
+        -exec ln -sv "{}" "$GUACAMOLE_HOME/lib/" ";"
+
+    # Create links for any extensions provided in the template GUACAMOLE_HOME
+    find "$GUACAMOLE_HOME_TEMPLATE/extensions" -mindepth 1 -maxdepth 1 \
+        -exec ln -sv "{}" "$GUACAMOLE_HOME/extensions/" ";"
+
+    # Create links for all other files directly within the template
+    # GUACAMOLE_HOME
+    find "$GUACAMOLE_HOME_TEMPLATE" -mindepth 1 -maxdepth 1 \
+        -name guacamole.properties -o -name lib -o -name extensions -prune \
+        -o -exec ln -sv "{}" "$GUACAMOLE_HOME/" ";"
+
+    # Add any properties provided within template GUACAMOLE_HOME
+    if [ -e "$GUACAMOLE_HOME_TEMPLATE/guacamole.properties" ]; then
+        cat "$GUACAMOLE_HOME_TEMPLATE/guacamole.properties" >> "$GUACAMOLE_HOME/guacamole.properties"
+    fi
+
+fi
+
+# Enable reading of properties directly from environment variables unless
+# overridden
+if ! is_property_set "enable-environment-properties"; then
+    cat >> "$GUACAMOLE_HOME/guacamole.properties" <<'EOF'
+#
+# NOTE: The following was automatically added by the container entrypoint to
+# allow all Guacamole configuration properties to be automatically read from
+# environment variables. If this is not desired, you can override this behavior
+# by specifying the "enable-environment-properties" variable yourself in your
+# own guacamole.properties file.
+#
+enable-environment-properties: true
+EOF
+fi
+
diff --git a/guacamole-docker/entrypoint.d/110-configure-guacamole-logging.sh b/guacamole-docker/entrypoint.d/110-configure-guacamole-logging.sh
new file mode 100644
index 000000000..70a099976
--- /dev/null
+++ b/guacamole-docker/entrypoint.d/110-configure-guacamole-logging.sh
@@ -0,0 +1,33 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+##
+## @fn 030-configure-guacamole-logging.sh
+##
+## Checks the value of the LOGBACK_LEVEL environment variable, producing a
+## corresponding logback.xml file within GUACAMOLE_HOME if a log level has been
+## explicitly specified.
+##
+
+# Set logback level if specified
+if [ -n "$LOGBACK_LEVEL" ]; then
+    unzip -o -j /opt/guacamole/guacamole.war WEB-INF/classes/logback.xml -d $GUACAMOLE_HOME
+    sed -i "s/level=\"info\"/level=\"$LOGBACK_LEVEL\"/" $GUACAMOLE_HOME/logback.xml
+fi
+
diff --git a/guacamole-docker/entrypoint.d/500-generate-tomcat-catalina-base.sh b/guacamole-docker/entrypoint.d/500-generate-tomcat-catalina-base.sh
new file mode 100644
index 000000000..cd869511f
--- /dev/null
+++ b/guacamole-docker/entrypoint.d/500-generate-tomcat-catalina-base.sh
@@ -0,0 +1,50 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+##
+## 500-generate-tomcat-catalina-base.sh
+##
+## Automcatically generates a fresh, temporary CATALINA_BASE for Apache Tomcat.
+## This allows Tomcat to run as a reduced-privilege user, and allows its
+## configuration to be dynamically generated by the container entrypoint at
+## startup.
+##
+
+#
+# Start with a fresh CATALINA_BASE
+#
+
+rm -rf /tmp/catalina-base.*
+export CATALINA_BASE="`mktemp -p /tmp -d catalina-base.XXXXXXXXXX`"
+
+# User-only writable CATALINA_BASE
+for dir in logs temp webapps work; do
+    mkdir -p $CATALINA_BASE/$dir
+done
+cp -R /usr/local/tomcat/conf $CATALINA_BASE
+
+cat >> "$CATALINA_BASE/conf/catalina.properties" <<EOF
+
+# Point Guacamole at automatically-generated, temporary GUACAMOLE_HOME
+guacamole.home=$GUACAMOLE_HOME
+EOF
+
+# Install webapp
+ln -sf /opt/guacamole/webapp/guacamole.war $CATALINA_BASE/webapps/${WEBAPP_CONTEXT:-guacamole}.war
+
diff --git a/guacamole-docker/entrypoint.d/700-configure-features.sh b/guacamole-docker/entrypoint.d/700-configure-features.sh
new file mode 100644
index 000000000..f1a2b1a43
--- /dev/null
+++ b/guacamole-docker/entrypoint.d/700-configure-features.sh
@@ -0,0 +1,88 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+#
+
+##
+## @fn 800-configure-features.sh
+##
+## Automatically checks all environment variables currently set and performs
+## configuration tasks related to those variabels, including installing any
+## extensions and external libraries associated with those variables to
+## GUACAMOLE_HOME.  Only environment variable prefixes are considered; this
+## script is not aware of whether an extension actually uses an environment
+## variable.
+##
+
+##
+## Returns whether the feature associated with a particular environment
+## variable prefix has configuration values set. Only the presence of
+## environment variables having that prefix is checked. Features can also be
+## entirely enabled/disabled through setting the [PREFIX_]ENABLED variable to
+## true/false respectively, where "[PREFIX_]" is the specified environment
+## variable prefix (including trailing underscore).
+##
+## @param VAR_BASE
+##     The environment variable prefix to check, including trailing underscore.
+##
+## @returns
+##     Zero if the feature associated with the given environment variable
+##     prefix is enabled, non-zero otherwise.
+##
+is_feature_enabled() {
+
+    local VAR_BASE="$1"
+
+    # Allow any feature to be explicitly enabled/disabled using a
+    # [PREFIX_]ENABLED variable
+    local ENABLED_VAR="${VAR_BASE}ENABLED"
+    if [ "${!ENABLED_VAR}" = "true" ]; then
+        return 0
+    elif [ "${!ENABLED_VAR}" = "false" ]; then
+        return 1
+    fi
+
+    # Lacking an explicit request to enable/disable the feature, rely on
+    # implicit enable/disable via presence of any other variables having the
+    # given prefix
+    awk 'BEGIN{for(v in ENVIRON) print v}' | grep "^${VAR_BASE}" > /dev/null
+
+}
+
+# Search environment for enabled extensions/features based on environment
+# variable prefixes
+for VAR_BASE in /opt/guacamole/environment/*; do
+
+    # Skip any directories without at least one corresponding environment
+    # variable set
+    is_feature_enabled "$(basename "$VAR_BASE")" || continue
+
+    # Execute any associated configuration script
+    [ ! -e "$VAR_BASE/configure.sh" ] || source "$VAR_BASE/configure.sh"
+
+    # Add any required links for extensions/libraries associated with the
+    # configured extension
+    for SUBDIR in lib extensions; do
+        if [ -d "$VAR_BASE/$SUBDIR" ]; then
+            mkdir -p "$GUACAMOLE_HOME/$SUBDIR/"
+            ln -s "$VAR_BASE/$SUBDIR"/* "$GUACAMOLE_HOME/$SUBDIR/"
+        fi
+    done
+
+done
+
diff --git a/guacamole-docker/entrypoint.d/999-start-tomcat.sh b/guacamole-docker/entrypoint.d/999-start-tomcat.sh
new file mode 100644
index 000000000..e31b4e3ed
--- /dev/null
+++ b/guacamole-docker/entrypoint.d/999-start-tomcat.sh
@@ -0,0 +1,30 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+##
+## @fn 999-start-tomcat.sh
+##
+## Starts Tomcat. This script replaces the current process with the Tomcat
+## process and does not exit.
+##
+
+# Start tomcat
+cd /usr/local/tomcat
+exec catalina.sh run
+
diff --git a/guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh b/guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh
new file mode 100644
index 000000000..55596ad28
--- /dev/null
+++ b/guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh
@@ -0,0 +1,72 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+##
+## @fn REMOTE_IP_VALVE_/configure.sh
+##
+## Configures Tomcat to forward the IP addresses of clients behind a proxy if
+## the REMOTE_IP_VALVE_ENABLED environment variable is set to "true".
+##
+
+# Add <Valve> element
+xmlstarlet edit --inplace \
+    --insert '/Server/Service/Engine/Host/*' --type elem -n Valve \
+    --insert '/Server/Service/Engine/Host/Valve[not(@className)]' --type attr -n className -v org.apache.catalina.valves.RemoteIpValve \
+    $CATALINA_BASE/conf/server.xml
+
+# Allowed IPs
+if [ -z "$PROXY_ALLOWED_IPS_REGEX" ]; then
+    echo "Using default Tomcat allowed IPs regex"
+else
+    xmlstarlet edit --inplace \
+        --insert '/Server/Service/Engine/Host/Valve[@className="org.apache.catalina.valves.RemoteIpValve"]' \
+        --type attr -n internalProxies -v "$PROXY_ALLOWED_IPS_REGEX" \
+        $CATALINA_BASE/conf/server.xml
+fi
+
+# X-Forwarded-For
+if [ -z "$PROXY_IP_HEADER" ]; then
+    echo "Using default Tomcat proxy IP header"
+else
+    xmlstarlet edit --inplace \
+        --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \
+        --type attr -n remoteIpHeader -v "$PROXY_IP_HEADER" \
+        $CATALINA_BASE/conf/server.xml
+fi
+
+# X-Forwarded-Proto
+if [ -z "$PROXY_PROTOCOL_HEADER" ]; then
+    echo "Using default Tomcat proxy protocol header"
+else
+    xmlstarlet edit --inplace \
+        --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \
+        --type attr -n protocolHeader -v "$PROXY_PROTOCOL_HEADER" \
+        $CATALINA_BASE/conf/server.xml
+fi
+
+# X-Forwarded-By
+if [ -z "$PROXY_BY_HEADER" ]; then
+    echo "Using default Tomcat proxy forwarded by header"
+else
+    xmlstarlet edit --inplace \
+        --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \
+        --type attr -n remoteIpProxiesHeader -v "$PROXY_BY_HEADER" \
+        $CATALINA_BASE/conf/server.xml
+fi
+

From d6a491f933d6aeb8ab4b055fa1a45708305f4373 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Sun, 18 Feb 2024 23:18:43 -0800
Subject: [PATCH 268/289] GUACAMOLE-374: Automatically read properties from
 files pointed to by "*_FILE" environment variables.

---
 Dockerfile                                    |  3 +-
 .../GuacamoleServletContextListener.java      | 32 +++++++++-
 ...temFileEnvironmentGuacamoleProperties.java | 64 +++++++++++++++++++
 3 files changed, 97 insertions(+), 2 deletions(-)
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/SystemFileEnvironmentGuacamoleProperties.java

diff --git a/Dockerfile b/Dockerfile
index b37a9d913..80aa578ec 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -97,7 +97,8 @@ RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --gid $G
 USER guacamole
 
 # Environment variable defaults
-ENV GUACAMOLE_HOME=/etc/guacamole
+ENV GUACAMOLE_HOME=/etc/guacamole \
+    ENABLE_FILE_ENVIRONMENT_PROPERTIES=true
 
 # Start Guacamole under Tomcat, listening on 0.0.0.0:8080
 EXPOSE 8080
diff --git a/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java b/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java
index 1068477c4..df0766238 100644
--- a/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java
+++ b/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java
@@ -95,7 +95,7 @@ public class GuacamoleServletContextListener extends GuiceServletContextListener
 
     /**
      * A property that determines whether environment variables are evaluated
-     * to override properties specified in guacamole.properties.
+     * to supply properties not specified in guacamole.properties.
      */
     private static final BooleanGuacamoleProperty ENABLE_ENVIRONMENT_PROPERTIES =
         new BooleanGuacamoleProperty() {
@@ -105,6 +105,19 @@ public class GuacamoleServletContextListener extends GuiceServletContextListener
             }
         };
 
+    /**
+     * A property that determines whether environment variables of the form
+     * "*_FILE" are evaluated to supply properties not specified in
+     * guacamole.properties nor in environment variables.
+     */
+    private static final BooleanGuacamoleProperty ENABLE_FILE_ENVIRONMENT_PROPERTIES =
+        new BooleanGuacamoleProperty() {
+            @Override
+            public String getName() {
+                return "enable-file-environment-properties";
+            }
+        };
+
     /**
      * The Guacamole server environment.
      */
@@ -172,6 +185,23 @@ public class GuacamoleServletContextListener extends GuiceServletContextListener
             logger.debug("Error reading \"{}\" property from guacamole.properties.", ENABLE_ENVIRONMENT_PROPERTIES.getName(), e);
         }
 
+        // For any values not defined in GUACAMOLE_HOME/guacamole.properties
+        // nor in the system environment, read from files pointed to by
+        // corresponding "*_FILE" variables in the system environment if
+        // "enable-file-environment-properties" is set to "true"
+        try {
+            if (environment.getProperty(ENABLE_FILE_ENVIRONMENT_PROPERTIES, false)) {
+                environment.addGuacamoleProperties(new SystemFileEnvironmentGuacamoleProperties());
+                logger.info("Additional configuration parameters may be read "
+                        + "from files pointed to by \"*_FILE\" environment "
+                        + "variables.");
+            }
+        }
+        catch (GuacamoleException e) {
+            logger.error("Unable to configure support for file environment properties: {}", e.getMessage());
+            logger.debug("Error reading \"{}\" property from guacamole.properties.", ENABLE_FILE_ENVIRONMENT_PROPERTIES.getName(), e);
+        }
+
         // Now that at least the main guacamole.properties source of
         // configuration information is available, initialize the session map
         sessionMap = new HashTokenSessionMap(environment);
diff --git a/guacamole/src/main/java/org/apache/guacamole/SystemFileEnvironmentGuacamoleProperties.java b/guacamole/src/main/java/org/apache/guacamole/SystemFileEnvironmentGuacamoleProperties.java
new file mode 100644
index 000000000..8b0825292
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/SystemFileEnvironmentGuacamoleProperties.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole;
+
+import com.google.common.io.Files;
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import org.apache.guacamole.properties.GuacamoleProperties;
+import org.apache.guacamole.token.TokenName;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * GuacamoleProperties implementation which reads all properties from files
+ * whose filenames are stored in environment variables. The name of the
+ * environment variable corresponding to the filename is determined from the
+ * original property using {@link TokenName#canonicalize(java.lang.String)}
+ * with an additional "_FILE" suffix.
+ */
+public class SystemFileEnvironmentGuacamoleProperties implements GuacamoleProperties {
+
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(SystemFileEnvironmentGuacamoleProperties.class);
+
+    @Override
+    public String getProperty(String name) {
+
+        String filename = System.getenv(TokenName.canonicalize(name) + "_FILE");
+        if (filename != null) {
+            try {
+                return Files.asCharSource(new File(filename), StandardCharsets.UTF_8).read();
+            }
+            catch (IOException e) {
+                logger.error("Property \"{}\" could not be read from file \"{}\": {}", name, filename, e.getMessage());
+                logger.debug("Error reading property value from file.", e);
+            }
+        }
+
+        return null;
+
+    }
+
+}
+

From c818650ae0f59200fc3231333e7bb7857d310711 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 20 Feb 2024 23:55:06 -0800
Subject: [PATCH 269/289] GUACAMOLE-374: Switch to "REMOTE_IP_VALVE_*"
 environment variables for configuring RemoteIpValve.

---
 .../000-migrate-legacy-variables.sh           |  8 ++
 .../environment/REMOTE_IP_VALVE_/configure.sh | 75 ++++++++-----------
 2 files changed, 40 insertions(+), 43 deletions(-)

diff --git a/guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh b/guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh
index 077fb13ad..490827fee 100644
--- a/guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh
+++ b/guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh
@@ -103,3 +103,11 @@ deprecate_variable "SQLSERVER_USER" "SQLSERVER_USERNAME"
 # guacamole.properties.
 deprecate_variable_prefix "POSTGRES_" "POSTGRESQL_"
 
+# The old "PROXY_*" names for attributes supported by RemoteIpValve are being
+# replaced with "REMOTE_IP_VALVE_*" attributes that more closely and
+# predictably match their attribute names
+deprecate_variable "PROXY_ALLOWED_IPS_REGEX" "REMOTE_IP_VALVE_INTERNAL_PROXIES"
+deprecate_variable "PROXY_IP_HEADER"         "REMOTE_IP_VALVE_REMOTE_IP_HEADER"
+deprecate_variable "PROXY_PROTOCOL_HEADER"   "REMOTE_IP_VALVE_PROTOCOL_HEADER"
+# NOTE: PROXY_BY_HEADER never worked as there is no "remoteIpProxiesHeader" attribute for RemoteIpValve
+
diff --git a/guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh b/guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh
index 55596ad28..ad6e5ffb5 100644
--- a/guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh
+++ b/guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh
@@ -24,49 +24,38 @@
 ## the REMOTE_IP_VALVE_ENABLED environment variable is set to "true".
 ##
 
-# Add <Valve> element
+##
+## Array of all xmlstarlet command-line options necessary to add the
+## RemoteIpValve attributes that correspond to various "REMOTE_IP_VALVE_*"
+## environment variables.
+##
+declare -a VALVE_ATTRIBUTES=( --type attr -n className -v org.apache.catalina.valves.RemoteIpValve )
+
+# Translate all properties supported by RemoteIpValve into corresponding
+# environment variables
+for ATTRIBUTE in \
+    remoteIpHeader \
+    internalProxies \
+    proxiesHeader \
+    trustedProxies \
+    protocolHeader \
+    protocolHeaderHttpsValue \
+    httpServerPort \
+    httpsServerPort; do
+
+    VAR_NAME="REMOTE_IP_VALVE_$(echo "$ATTRIBUTE" | sed 's/\([a-z]\)\([A-Z]\)/\1_\2/g' | tr 'a-z' 'A-Z')"
+    if [ -n "${!VAR_NAME}" ]; then
+        VALVE_ATTRIBUTES+=( --type attr -n "$ATTRIBUTE" -v "${!VAR_NAME}" )
+    else
+        echo "Using default RemoteIpValve value for \"$ATTRIBUTE\" attribute."
+    fi
+
+done
+
+# Programmatically add requested RemoteIpValve entry
 xmlstarlet edit --inplace \
     --insert '/Server/Service/Engine/Host/*' --type elem -n Valve \
-    --insert '/Server/Service/Engine/Host/Valve[not(@className)]' --type attr -n className -v org.apache.catalina.valves.RemoteIpValve \
-    $CATALINA_BASE/conf/server.xml
-
-# Allowed IPs
-if [ -z "$PROXY_ALLOWED_IPS_REGEX" ]; then
-    echo "Using default Tomcat allowed IPs regex"
-else
-    xmlstarlet edit --inplace \
-        --insert '/Server/Service/Engine/Host/Valve[@className="org.apache.catalina.valves.RemoteIpValve"]' \
-        --type attr -n internalProxies -v "$PROXY_ALLOWED_IPS_REGEX" \
-        $CATALINA_BASE/conf/server.xml
-fi
-
-# X-Forwarded-For
-if [ -z "$PROXY_IP_HEADER" ]; then
-    echo "Using default Tomcat proxy IP header"
-else
-    xmlstarlet edit --inplace \
-        --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \
-        --type attr -n remoteIpHeader -v "$PROXY_IP_HEADER" \
-        $CATALINA_BASE/conf/server.xml
-fi
-
-# X-Forwarded-Proto
-if [ -z "$PROXY_PROTOCOL_HEADER" ]; then
-    echo "Using default Tomcat proxy protocol header"
-else
-    xmlstarlet edit --inplace \
-        --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \
-        --type attr -n protocolHeader -v "$PROXY_PROTOCOL_HEADER" \
-        $CATALINA_BASE/conf/server.xml
-fi
-
-# X-Forwarded-By
-if [ -z "$PROXY_BY_HEADER" ]; then
-    echo "Using default Tomcat proxy forwarded by header"
-else
-    xmlstarlet edit --inplace \
-        --insert "/Server/Service/Engine/Host/Valve[@className='org.apache.catalina.valves.RemoteIpValve']" \
-        --type attr -n remoteIpProxiesHeader -v "$PROXY_BY_HEADER" \
-        $CATALINA_BASE/conf/server.xml
-fi
+    --insert '/Server/Service/Engine/Host/Valve[not(@className)]' \
+    "${VALVE_ATTRIBUTES[@]}" \
+    "$CATALINA_BASE/conf/server.xml"
 

From acaee44a5353c5cab9f4ab738520f41ab89f2c1b Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Mon, 22 Apr 2024 15:40:34 -0700
Subject: [PATCH 270/289] GUACAMOLE-374: Allow multiple PropertyValue
 annotations to be associated with each enum value for EnumGuacamoleProperty.

---
 .../properties/EnumGuacamoleProperty.java     | 40 ++++++++++++++++++-
 .../properties/EnumGuacamolePropertyTest.java |  4 +-
 2 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/properties/EnumGuacamoleProperty.java b/guacamole-ext/src/main/java/org/apache/guacamole/properties/EnumGuacamoleProperty.java
index 255e4b09a..a55299365 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/properties/EnumGuacamoleProperty.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/properties/EnumGuacamoleProperty.java
@@ -20,6 +20,7 @@
 package org.apache.guacamole.properties;
 
 import java.lang.annotation.ElementType;
+import java.lang.annotation.Repeatable;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
@@ -45,8 +46,10 @@ public abstract class EnumGuacamoleProperty<T extends Enum<T>> implements Guacam
 
     /**
      * Defines the string value which should be accepted and parsed into the
-     * annotated enum constant.
+     * annotated enum constant. This annotation is repeatable, and each enum
+     * constant may be associated with any any number of string values.
      */
+    @Repeatable(PropertyValues.class)
     @Retention(RetentionPolicy.RUNTIME)
     @Target(ElementType.FIELD)
     public static @interface PropertyValue {
@@ -63,6 +66,29 @@ public abstract class EnumGuacamoleProperty<T extends Enum<T>> implements Guacam
 
     }
 
+    /**
+     * Defines the string values which should be accepted and parsed into the
+     * annotated enum constant. Each enum constant may be associated with any
+     * any number of string values.
+     */
+    @Retention(RetentionPolicy.RUNTIME)
+    @Target(ElementType.FIELD)
+    public static @interface PropertyValues {
+
+        /**
+         * Returns the {@link PropertyValue} annotations that represent the
+         * String values that should produce the annotated enum constant when
+         * parsed.
+         *
+         * @return
+         *     The {@link PropertyValue} annotations that represent the String
+         *     values that should produce the annotated enum constant when
+         *     parsed.
+         */
+        PropertyValue[] value();
+
+    }
+
     /**
      * Mapping of valid property values to the corresponding enum constants
      * that those values parse to.
@@ -103,7 +129,17 @@ public abstract class EnumGuacamoleProperty<T extends Enum<T>> implements Guacam
                         + "match declared values.", e);
             }
 
-            // Map enum constant only if PropertyValue annotation is present
+            // Map enum constant only if one or more PropertyValue annotations
+            // are present
+            PropertyValues valuesAnnotation = field.getAnnotation(PropertyValues.class);
+            if (valuesAnnotation != null) {
+                for (PropertyValue valueAnnotation : valuesAnnotation.value())
+                    valueMapping.put(valueAnnotation.value(), value);
+            }
+
+            // The PropertyValue annotation may appear as a separate, single
+            // annotation, or as a multi-valued annotation via PropertyValues
+            // (see above)
             PropertyValue valueAnnotation = field.getAnnotation(PropertyValue.class);
             if (valueAnnotation != null)
                 valueMapping.put(valueAnnotation.value(), value);
diff --git a/guacamole-ext/src/test/java/org/apache/guacamole/properties/EnumGuacamolePropertyTest.java b/guacamole-ext/src/test/java/org/apache/guacamole/properties/EnumGuacamolePropertyTest.java
index 5b9a3d742..f2f313c00 100644
--- a/guacamole-ext/src/test/java/org/apache/guacamole/properties/EnumGuacamolePropertyTest.java
+++ b/guacamole-ext/src/test/java/org/apache/guacamole/properties/EnumGuacamolePropertyTest.java
@@ -70,6 +70,7 @@ public class EnumGuacamolePropertyTest {
          * @see <a href="https://en.wikipedia.org/wiki/Tuna">Tuna (Wikipedia)</a>
          */
         @PropertyValue("tuna")
+        @PropertyValue("yellowfin")
         TUNA,
 
         /**
@@ -135,6 +136,7 @@ public class EnumGuacamolePropertyTest {
         assertEquals(Fish.TROUT,    FAVORITE_FISH.parseValue("trout"));
         assertEquals(Fish.MACKEREL, FAVORITE_FISH.parseValue("mackerel"));
         assertEquals(Fish.TUNA,     FAVORITE_FISH.parseValue("tuna"));
+        assertEquals(Fish.TUNA,     FAVORITE_FISH.parseValue("yellowfin"));
         assertEquals(Fish.SARDINE,  FAVORITE_FISH.parseValue("sardine"));
     }
 
@@ -164,7 +166,7 @@ public class EnumGuacamolePropertyTest {
         }
         catch (GuacamoleException e) {
             String message = e.getMessage();
-            assertTrue(message.contains("\"mackerel\", \"salmon\", \"sardine\", \"trout\", \"tuna\""));
+            assertTrue(message.contains("\"mackerel\", \"salmon\", \"sardine\", \"trout\", \"tuna\", \"yellowfin\""));
         }
     }
 

From 649492b412823744be0263b26c2adf6e6e4dfcdb Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 23 Apr 2024 10:11:16 -0700
Subject: [PATCH 271/289] GUACAMOLE-374: Allow log level to be configured
 easily with "log-level" property.

---
 Dockerfile                                    |   4 +-
 .../000-migrate-legacy-variables.sh           |   3 +
 .../110-configure-guacamole-logging.sh        |  33 ----
 .../GuacamoleServletContextListener.java      |  25 ++-
 .../org/apache/guacamole/log/LogLevel.java    | 163 ++++++++++++++++++
 .../org/apache/guacamole/log/LogModule.java   |  88 ++++++++--
 guacamole/src/main/resources/logback.xml      |  34 ----
 7 files changed, 257 insertions(+), 93 deletions(-)
 delete mode 100644 guacamole-docker/entrypoint.d/110-configure-guacamole-logging.sh
 create mode 100644 guacamole/src/main/java/org/apache/guacamole/log/LogLevel.java
 delete mode 100644 guacamole/src/main/resources/logback.xml

diff --git a/Dockerfile b/Dockerfile
index 80aa578ec..8a3226acb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -76,9 +76,9 @@ RUN rm -rf /opt/guacamole/build.d /opt/guacamole/bin/build-guacamole.sh
 # For the runtime image, we start with the official Tomcat distribution
 FROM tomcat:${TOMCAT_VERSION}-${TOMCAT_JRE}
 
-# Install XMLStarlet for server.xml alterations and unzip for LOGBACK_LEVEL case
+# Install XMLStarlet for server.xml alterations
 RUN apt-get update -qq \
-    && apt-get install -y xmlstarlet unzip\
+    && apt-get install -y xmlstarlet \
     && rm -rf /var/lib/apt/lists/* 
 
 # This is where the build artifacts go in the runtime image
diff --git a/guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh b/guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh
index 490827fee..cb56c4c9a 100644
--- a/guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh
+++ b/guacamole-docker/entrypoint.d/000-migrate-legacy-variables.sh
@@ -111,3 +111,6 @@ deprecate_variable "PROXY_IP_HEADER"         "REMOTE_IP_VALVE_REMOTE_IP_HEADER"
 deprecate_variable "PROXY_PROTOCOL_HEADER"   "REMOTE_IP_VALVE_PROTOCOL_HEADER"
 # NOTE: PROXY_BY_HEADER never worked as there is no "remoteIpProxiesHeader" attribute for RemoteIpValve
 
+# The old "LOGBACK_LEVEL" environment variable has been replaced with
+# "LOG_LEVEL" for consistency with the guacd image
+deprecate_variable "LOGBACK_LEVEL" "LOG_LEVEL"
diff --git a/guacamole-docker/entrypoint.d/110-configure-guacamole-logging.sh b/guacamole-docker/entrypoint.d/110-configure-guacamole-logging.sh
deleted file mode 100644
index 70a099976..000000000
--- a/guacamole-docker/entrypoint.d/110-configure-guacamole-logging.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-##
-## @fn 030-configure-guacamole-logging.sh
-##
-## Checks the value of the LOGBACK_LEVEL environment variable, producing a
-## corresponding logback.xml file within GUACAMOLE_HOME if a log level has been
-## explicitly specified.
-##
-
-# Set logback level if specified
-if [ -n "$LOGBACK_LEVEL" ]; then
-    unzip -o -j /opt/guacamole/guacamole.war WEB-INF/classes/logback.xml -d $GUACAMOLE_HOME
-    sed -i "s/level=\"info\"/level=\"$LOGBACK_LEVEL\"/" $GUACAMOLE_HOME/logback.xml
-fi
-
diff --git a/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java b/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java
index df0766238..d8e3f3d58 100644
--- a/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java
+++ b/guacamole/src/main/java/org/apache/guacamole/GuacamoleServletContextListener.java
@@ -240,13 +240,24 @@ public class GuacamoleServletContextListener extends GuiceServletContextListener
                 return current;
 
             // Create new injector if necessary
-            Injector injector = Guice.createInjector(Stage.PRODUCTION,
-                new EnvironmentModule(environment),
-                new LogModule(environment),
-                new ExtensionModule(environment),
-                new RESTServiceModule(sessionMap),
-                new TunnelModule()
-            );
+            Injector injector =
+
+                    // Ensure environment and logging are configured FIRST ...
+                    Guice.createInjector(Stage.PRODUCTION,
+                        new EnvironmentModule(environment),
+                        new LogModule(environment)
+                    )
+
+                    // ... before attempting configuration of any other modules
+                    // (logging within the constructors of other modules may
+                    // otherwise default to including messages from the "debug"
+                    // level, regardless of how the application log level is
+                    // actually configured)
+                    .createChildInjector(
+                        new ExtensionModule(environment),
+                        new RESTServiceModule(sessionMap),
+                        new TunnelModule()
+                    );
 
             return injector;
 
diff --git a/guacamole/src/main/java/org/apache/guacamole/log/LogLevel.java b/guacamole/src/main/java/org/apache/guacamole/log/LogLevel.java
new file mode 100644
index 000000000..27bf0fe88
--- /dev/null
+++ b/guacamole/src/main/java/org/apache/guacamole/log/LogLevel.java
@@ -0,0 +1,163 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.log;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import org.apache.guacamole.properties.EnumGuacamoleProperty.PropertyValue;
+
+/**
+ * All log levels supported by the Apache Guacamole web application. Each log
+ * level describes a different level of verbosity for the log messages included
+ * in web application logs.
+ */
+public enum LogLevel {
+
+    /**
+     * Errors that are fatal in the context of the operation being logged.
+     */
+    @PropertyValue("error")
+    ERROR("error"),
+
+    /**
+     * Non-fatal conditions that may indicate the presence of a problem.
+     */
+    @PropertyValue("warning")
+    @PropertyValue("warn")
+    WARNING("warning"),
+
+    /**
+     * Informational messages of general interest to users or administrators.
+     */
+    @PropertyValue("info")
+    INFO("info"),
+
+    /**
+     * Informational messages that are useful for debugging, but are generally
+     * not useful to users or administrators. It is expected that debug-level
+     * messages, while verbose, will not affect performance.
+     */
+    @PropertyValue("debug")
+    DEBUG("debug"),
+
+    /**
+     * Informational messages that may be useful for debugging, but which are
+     * so low-level that they may affect performance.
+     */
+    @PropertyValue("trace")
+    TRACE("trace");
+
+    /**
+     * Format string whose sole format argument is a String containing the
+     * name of the log level. As this configuration will be fed to Logback, the
+     * name used must be a name acceptable by Logback.
+     */
+    private static final String LOGBACK_XML_TEMPLATE =
+              "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
+            + "<configuration>\n"
+            + "\n"
+            + "    <!-- Default appender -->\n"
+            + "    <appender name=\"GUAC-DEFAULT\" class=\"ch.qos.logback.core.ConsoleAppender\">\n"
+            + "        <encoder>\n"
+            + "            <pattern>%%d{HH:mm:ss.SSS} [%%thread] %%-5level %%logger{36} - %%msg%%n</pattern>\n"
+            + "        </encoder>\n"
+            + "    </appender>\n"
+            + "\n"
+            + "    <!-- Log at level defined with \"log-level\" property -->\n"
+            + "    <root level=\"%s\">\n"
+            + "        <appender-ref ref=\"GUAC-DEFAULT\" />\n"
+            + "    </root>\n"
+            + "\n"
+            + "</configuration>\n";
+
+    /**
+     * The name that should be used to refer to this log level in the context
+     * of configuring Guacamole. This name should be both descriptive and
+     * acceptable as the value of the "log-level" property.
+     */
+    private final String canonicalName;
+
+    /**
+     * The raw contents of the "logback.xml" that configures Logback to log
+     * messages at this level, encoded as UTF-8.
+     */
+    private final byte[] logbackConfig;
+
+    /**
+     * Creates a new LogLevel with the given names. The pair of names provided
+     * correspond to the name used within Guacamole's configuration and the
+     * name used within Logback's configuration.
+     *
+     * @param canonicalName
+     *     The name that should be used for this log level when configuring
+     *     Guacamole to log at this level using the "log-level" property.
+     *
+     * @param logbackLogLevel
+     *     The name that would be provided to Logback to log at this level if
+     *     manually configuring Logback using "logback.xml".
+     */
+    private LogLevel(String canonicalName, String logbackLogLevel) {
+        this.canonicalName = canonicalName;
+        this.logbackConfig = String.format(LOGBACK_XML_TEMPLATE, logbackLogLevel).getBytes(StandardCharsets.UTF_8);
+    }
+
+    /**
+     * Creates a new LogLevel with the given name. The provided name corresponds
+     * to both the name used within Guacamole's configuration and the name used
+     * within Logback's configuration.
+     *
+     * @param logLevel
+     *     The name that should be used for this log level when configuring
+     *     Guacamole to log at this level using the "log-level" property AND
+     *     when manually configuring Logback to log at this level using a
+     *     "logback.xml" configuration file.
+     */
+    private LogLevel(String logLevel) {
+        this(logLevel, logLevel);
+    }
+
+    /**
+     * Returns a name that may be used to refer to this log level when
+     * configuring Guacamole using the "log-level" property.
+     *
+     * @return
+     *     A name that may be used to refer to this log level when
+     *     configuring Guacamole using the "log-level" property.
+     */
+    public String getCanonicalName() {
+        return canonicalName;
+    }
+
+    /**
+     * Returns a new InputStream that streams the contents of an XML
+     * configuration file that can be provided to Logback to configure logging
+     * at this log level.
+     *
+     * @return
+     *     A a new InputStream that streams the contents of an XML
+     *     configuration file that can be provided to Logback to configure
+     *     logging at this log level.
+     */
+    public InputStream getLogbackConfiguration() {
+        return new ByteArrayInputStream(logbackConfig);
+    }
+
+}
diff --git a/guacamole/src/main/java/org/apache/guacamole/log/LogModule.java b/guacamole/src/main/java/org/apache/guacamole/log/LogModule.java
index accc4a9dd..a9e4ac3bc 100644
--- a/guacamole/src/main/java/org/apache/guacamole/log/LogModule.java
+++ b/guacamole/src/main/java/org/apache/guacamole/log/LogModule.java
@@ -25,7 +25,13 @@ import ch.qos.logback.core.joran.spi.JoranException;
 import ch.qos.logback.core.util.StatusPrinter;
 import com.google.inject.AbstractModule;
 import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.io.InputStream;
+import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.environment.Environment;
+import org.apache.guacamole.properties.EnumGuacamoleProperty;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -44,6 +50,19 @@ public class LogModule extends AbstractModule {
      */
     private final Environment environment;
 
+    /**
+     * Property that specifies the highest level of verbosity that Guacamole
+     * should use for the messages in its logs.
+     */
+    private static final EnumGuacamoleProperty<LogLevel> LOG_LEVEL = new EnumGuacamoleProperty<LogLevel>(LogLevel.class) {
+
+        @Override
+        public String getName() {
+            return "log-level";
+        }
+
+    };
+
     /**
      * Creates a new LogModule which uses the given environment to determine
      * the logging configuration.
@@ -54,26 +73,57 @@ public class LogModule extends AbstractModule {
     public LogModule(Environment environment) {
         this.environment = environment;
     }
-    
+
+    /**
+     * Returns an InputStream that streams the contents of the "logback.xml"
+     * file that Logback should read to configure logging to Guacamole. If the
+     * user provided their own "logback.xml" within GUACAMOLE_HOME, this will
+     * be an InputStream that reads the contents of that file. The required
+     * "logback.xml" will otherwise be dynamically generated based on the value
+     * of the "log-level" property.
+     *
+     * @return
+     *     An InputStream that streams the contents of the "logback.xml" file
+     *     that Logback should read to configure logging to Guacamole.
+     */
+    private InputStream getLogbackConfiguration() {
+
+        // Check for custom logback.xml
+        File logbackFile = new File(environment.getGuacamoleHome(), "logback.xml");
+        if (logbackFile.exists()) {
+            try {
+                logger.info("Loading logback configuration from \"{}\".", logbackFile);
+                return new FileInputStream(logbackFile);
+            }
+            catch (FileNotFoundException e) {
+                logger.info("Logback configuration could not be read "
+                        + "from \"{}\": {}", logbackFile, e.getMessage());
+            }
+        }
+
+        // Default to generating an internal logback.xml based on a simple
+        // "log-level" property
+        LogLevel level;
+        try {
+            level = environment.getProperty(LOG_LEVEL, LogLevel.INFO);
+            logger.info("Logging will be at the \"{}\" level.", level.getCanonicalName());
+        }
+        catch (GuacamoleException e) {
+            level = LogLevel.INFO;
+            logger.error("Falling back to \"{}\" log level: {}", level.getCanonicalName(), e.getMessage());
+        }
+
+        return level.getLogbackConfiguration();
+
+    }
+
     @Override
     protected void configure() {
 
-        // Only load logback configuration if GUACAMOLE_HOME exists
-        File guacamoleHome = environment.getGuacamoleHome();
-        if (!guacamoleHome.isDirectory())
-            return;
+        try (InputStream logbackConfiguration = getLogbackConfiguration()) {
 
-        // Check for custom logback.xml
-        File logbackConfiguration = new File(guacamoleHome, "logback.xml");
-        if (!logbackConfiguration.exists())
-            return;
-
-        logger.info("Loading logback configuration from \"{}\".", logbackConfiguration);
-
-        LoggerContext context = (LoggerContext) LoggerFactory.getILoggerFactory();
-        context.reset();
-
-        try {
+            LoggerContext context = (LoggerContext) LoggerFactory.getILoggerFactory();
+            context.reset();
 
             // Initialize logback
             JoranConfigurator configurator = new JoranConfigurator();
@@ -86,7 +136,11 @@ public class LogModule extends AbstractModule {
         }
         catch (JoranException e) {
             logger.error("Initialization of logback failed: {}", e.getMessage());
-            logger.debug("Unable to load logback configuration..", e);
+            logger.debug("Unable to load logback configuration.", e);
+        }
+        catch (IOException e) {
+            logger.warn("Logback configuration file could not be cleanly closed: {}", e.getMessage());
+            logger.debug("Failed to close logback configuration file.", e);
         }
 
     }
diff --git a/guacamole/src/main/resources/logback.xml b/guacamole/src/main/resources/logback.xml
deleted file mode 100644
index 0b91a429f..000000000
--- a/guacamole/src/main/resources/logback.xml
+++ /dev/null
@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-    Licensed to the Apache Software Foundation (ASF) under one
-    or more contributor license agreements.  See the NOTICE file
-    distributed with this work for additional information
-    regarding copyright ownership.  The ASF licenses this file
-    to you under the Apache License, Version 2.0 (the
-    "License"); you may not use this file except in compliance
-    with the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing,
-    software distributed under the License is distributed on an
-    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-    KIND, either express or implied.  See the License for the
-    specific language governing permissions and limitations
-    under the License.
--->
-<configuration>
-
-    <!-- Default appender -->
-    <appender name="GUAC-DEFAULT" class="ch.qos.logback.core.ConsoleAppender">
-        <encoder>
-            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
-        </encoder>
-    </appender>
-
-    <!-- Log at INFO level -->
-    <root level="info">
-        <appender-ref ref="GUAC-DEFAULT" />
-    </root>
-
-</configuration>
\ No newline at end of file

From 1b271a2407279c56aa864c9de5b1c6490e032a36 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Tue, 23 Apr 2024 10:19:05 -0700
Subject: [PATCH 272/289] GUACAMOLE-374: Enable automatic IP banning
 (brute-force throttling) by default.

---
 Dockerfile | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 8a3226acb..f85e040d4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -97,8 +97,9 @@ RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --gid $G
 USER guacamole
 
 # Environment variable defaults
-ENV GUACAMOLE_HOME=/etc/guacamole \
-    ENABLE_FILE_ENVIRONMENT_PROPERTIES=true
+ENV BAN_ENABLED=true \
+    ENABLE_FILE_ENVIRONMENT_PROPERTIES=true \
+    GUACAMOLE_HOME=/etc/guacamole
 
 # Start Guacamole under Tomcat, listening on 0.0.0.0:8080
 EXPOSE 8080

From 6dd4766da4b3ec612e70c20189b6b856b174dd20 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 25 Apr 2024 12:52:27 -0700
Subject: [PATCH 273/289] GUACAMOLE-1289: Refactor Duo and
 authentication-resumption changes to instead leverage support for
 updating/replacing credentials prior to auth.

---
 .../auth/duo/DuoAuthenticationProvider.java   |  52 +++++-
 .../auth/duo/DuoAuthenticationSession.java    |  65 +++++++
 .../duo/DuoAuthenticationSessionManager.java  |  36 ++++
 .../auth/duo/UserVerificationService.java     | 168 +++++++++++-------
 ...amoleInsufficientCredentialsException.java |  40 -----
 .../auth/AbstractAuthenticationProvider.java  |  14 ++
 .../net/auth/AuthenticationProvider.java      |  27 +++
 .../guacamole/net/auth/Credentials.java       |  10 --
 ...amoleInsufficientCredentialsException.java | 143 ---------------
 .../AuthenticationProviderFacade.java         |  12 ++
 .../rest/auth/AuthenticationService.java      | 131 ++++----------
 .../auth/ResumableAuthenticationState.java    | 128 -------------
 12 files changed, 340 insertions(+), 486 deletions(-)
 create mode 100644 extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java
 create mode 100644 extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java
 delete mode 100644 guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java

diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProvider.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProvider.java
index dc9999c98..ff3555ca5 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProvider.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationProvider.java
@@ -21,9 +21,11 @@ package org.apache.guacamole.auth.duo;
 
 import com.google.inject.Guice;
 import com.google.inject.Injector;
+import javax.servlet.http.HttpServletRequest;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.net.auth.AbstractAuthenticationProvider;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
+import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.UserContext;
 
 /**
@@ -41,10 +43,16 @@ public class DuoAuthenticationProvider extends AbstractAuthenticationProvider {
     public static String PROVIDER_IDENTIFER = "duo";
 
     /**
-     * Injector which will manage the object graph of this authentication
-     * provider.
+     * Service for verifying the identity of users that Guacamole has otherwise
+     * already authenticated.
      */
-    private final Injector injector;
+    private final UserVerificationService verificationService;
+
+    /**
+     * Session manager for storing/retrieving the state of a user's
+     * authentication attempt while they are redirected to the Duo service.
+     */
+    private final DuoAuthenticationSessionManager sessionManager;
 
     /**
      * Creates a new DuoAuthenticationProvider that verifies users
@@ -57,10 +65,13 @@ public class DuoAuthenticationProvider extends AbstractAuthenticationProvider {
     public DuoAuthenticationProvider() throws GuacamoleException {
 
         // Set up Guice injector.
-        injector = Guice.createInjector(
+        Injector injector = Guice.createInjector(
             new DuoAuthenticationProviderModule(this)
         );
 
+        sessionManager = injector.getInstance(DuoAuthenticationSessionManager.class);
+        verificationService = injector.getInstance(UserVerificationService.class);
+
     }
 
     @Override
@@ -69,11 +80,33 @@ public class DuoAuthenticationProvider extends AbstractAuthenticationProvider {
     }
 
     @Override
-    public UserContext getUserContext(AuthenticatedUser authenticatedUser)
+    public Credentials updateCredentials(Credentials credentials)
             throws GuacamoleException {
 
-        UserVerificationService verificationService =
-                injector.getInstance(UserVerificationService.class);
+        // Ignore requests with no corresponding authentication session ID, as
+        // there are no credentials to reconstitute if the user has not yet
+        // attempted to authenticate
+        HttpServletRequest request = credentials.getRequest();
+        String duoState = request.getParameter(UserVerificationService.DUO_STATE_PARAMETER_NAME);
+        if (duoState == null)
+            return credentials;
+
+        // Ignore requests with invalid/expired authentication session IDs
+        DuoAuthenticationSession session = sessionManager.resume(duoState);
+        if (session == null)
+            return credentials;
+
+        // Reconstitute the originally-provided credentials from the users
+        // authentication attempt prior to being redirected to Duo
+        Credentials previousCredentials = session.getCredentials();
+        previousCredentials.setRequest(request);
+        return previousCredentials;
+
+    }
+
+    @Override
+    public UserContext getUserContext(AuthenticatedUser authenticatedUser)
+            throws GuacamoleException {
 
         // Verify user against Duo service
         verificationService.verifyAuthenticatedUser(authenticatedUser);
@@ -84,4 +117,9 @@ public class DuoAuthenticationProvider extends AbstractAuthenticationProvider {
 
     }
 
+    @Override
+    public void shutdown() {
+        sessionManager.shutdown();
+    }
+
 }
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java
new file mode 100644
index 000000000..6876cad12
--- /dev/null
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSession.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.duo;
+
+import org.apache.guacamole.net.auth.AuthenticationSession;
+import org.apache.guacamole.net.auth.Credentials;
+
+/**
+ * Representation of an in-progress Duo authentication attempt.
+ */
+public class DuoAuthenticationSession extends AuthenticationSession {
+
+    /**
+     * The credentials that the user originally provided to Guacamole prior to
+     * being redirected to the Duo service.
+     */
+    private final Credentials credentials;
+
+    /**
+     * Creates a new AuthenticationSession representing an in-progress Duo
+     * authentication attempt.
+     *
+     * @param credentials
+     *     The credentials that the user originally provided to Guacamole prior
+     *     to being redirected to the Duo service.
+     *
+     * @param expires
+     *     The number of milliseconds that may elapse before this session must
+     *     be considered invalid.
+     */
+    public DuoAuthenticationSession(Credentials credentials, long expires) {
+        super(expires);
+        this.credentials = credentials;
+    }
+
+    /**
+     * Returns the credentials that the user originally provided to Guacamole
+     * prior to being redirected to the Duo service.
+     *
+     * @return
+     *     The credentials that the user originally provided to Guacamole prior
+     *     to being redirected to the Duo service.
+     */
+    public Credentials getCredentials() {
+        return credentials;
+    }
+
+}
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java
new file mode 100644
index 000000000..f2f39da2e
--- /dev/null
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/DuoAuthenticationSessionManager.java
@@ -0,0 +1,36 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.duo;
+
+import com.google.inject.Singleton;
+import org.apache.guacamole.net.auth.AuthenticationSessionManager;
+
+/**
+ * Manager service that temporarily stores authentication attempts while
+ * the Duo authentication flow is underway.
+ */
+@Singleton
+public class DuoAuthenticationSessionManager
+        extends AuthenticationSessionManager<DuoAuthenticationSession> {
+
+    // Intentionally empty (the default functions inherited from the
+    // AuthenticationSessionManager base class are sufficient for our needs)
+
+}
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
index 26ab71221..6f36371f8 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
@@ -37,35 +37,45 @@ import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.web.util.UriComponentsBuilder;
 
 /**
  * Service for verifying the identity of a user against Duo.
  */
 public class UserVerificationService {
 
-    private static final Logger logger = LoggerFactory.getLogger(UserVerificationService.class);
-    
     /**
-     * The name of the parameter which Duo will return in it's GET call-back
-     * that contains the code that the client will use to generate a token.
+     * The name of the HTTP parameter that Duo will use to communicate the
+     * result of the user's attempt to authenticate with their service. This
+     * parameter is provided in the GET request received when Duo redirects the
+     * user back to Guacamole.
      */
     public static final String DUO_CODE_PARAMETER_NAME = "duo_code";
-    
+
     /**
-     * The name of the parameter that will be used in the GET call-back that
-     * contains the session state.
+     * The name of the HTTP parameter that we will be using to hold the opaque
+     * authentication session ID. This session ID is transmitted to Duo during
+     * the initial redirect and received back from Duo via this parameter in
+     * the GET request received when Duo redirects the user back to Guacamole.
+     * The session ID is ultimately used to reconstitute the original
+     * credentials received from the user by Guacamole such that parameter
+     * tokens like GUAC_USERNAME and GUAC_PASSWORD can continue to work as
+     * expected.
      */
     public static final String DUO_STATE_PARAMETER_NAME = "state";
-    
+
     /**
      * The value that will be returned in the token if Duo authentication
      * was successful.
      */
     private static final String DUO_TOKEN_SUCCESS_VALUE = "allow";
-    
+
+    /**
+     * Session manager for storing/retrieving the state of a user's
+     * authentication attempt while they are redirected to the Duo service.
+     */
+    @Inject
+    private DuoAuthenticationSessionManager sessionManager;
+
     /**
      * Service for retrieving Duo configuration information.
      */
@@ -90,79 +100,115 @@ public class UserVerificationService {
     public void verifyAuthenticatedUser(AuthenticatedUser authenticatedUser)
             throws GuacamoleException {
 
-        // Pull the original HTTP request used to authenticate
-        Credentials credentials = authenticatedUser.getCredentials();
-        HttpServletRequest request = credentials.getRequest();
-
-        // Ignore anonymous users
-        if (authenticatedUser.getIdentifier().equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
-            return;
-        
+        // Ignore anonymous users (unverifiable)
         String username = authenticatedUser.getIdentifier();
+        if (username.equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
+            return;
 
+        // Obtain a Duo client for redirecting the user to the Duo service and
+        // verifying any received authentication code
+        Client duoClient;
         try {
-
-            String redirectUrl = confService.getRedirectUri().toString();
-
-            String builtUrl = UriComponentsBuilder
-                    .fromUriString(redirectUrl)
-                    .queryParam(Credentials.RESUME_QUERY, DuoAuthenticationProvider.PROVIDER_IDENTIFER)
-                    .build()
-                    .toUriString();
-
-            // Set up the Duo Client
-            Client duoClient = new Client.Builder(
+            duoClient = new Client.Builder(
                     confService.getClientId(),
                     confService.getClientSecret(),
                     confService.getAPIHostname(),
-                    builtUrl)
+                    confService.getRedirectUri().toString())
                     .build();
+        }
+        catch (DuoException e) {
+            throw new GuacamoleServerException("Client for communicating with "
+                    + "the Duo authentication service could not be created.", e);
+        }
 
+        // Verify that the Duo service is healthy and available
+        try {
             duoClient.healthCheck();
+        }
+        catch (DuoException e) {
+            throw new GuacamoleServerException("Duo authentication service is "
+                    + "not currently available (failed health check).", e);
+        }
 
-            // Retrieve signed Duo Code and State from the request
-            String duoCode = request.getParameter(DUO_CODE_PARAMETER_NAME);
-            String duoState = request.getParameter(DUO_STATE_PARAMETER_NAME);
+        // Pull the original HTTP request used to authenticate, as well as any
+        // associated credentials
+        Credentials credentials = authenticatedUser.getCredentials();
+        HttpServletRequest request = credentials.getRequest();
 
-            // If no code or state is received, assume Duo MFA redirect has not occured and do it
-            if (duoCode == null || duoState == null) {
+        // Retrieve signed Duo authentication code and session state from the
+        // request (these will be absent if this is an initial authentication
+        // attempt and not a redirect back from Duo)
+        String duoCode = request.getParameter(DUO_CODE_PARAMETER_NAME);
+        String duoState = request.getParameter(DUO_STATE_PARAMETER_NAME);
 
-                // Get a new session state from the Duo client
-                duoState = duoClient.generateState();
-                long expirationTimestamp = System.currentTimeMillis() + (confService.getAuthTimeout() * 1000L);
+        // Redirect to Duo to obtain an authentication code if that redirect
+        // has not yet occurred
+        if (duoCode == null || duoState == null) {
 
-                // Request additional credentials
-                throw new TranslatableGuacamoleInsufficientCredentialsException(
-                    "Verification using Duo is required before authentication "
-                    + "can continue.", "LOGIN.INFO_DUO_AUTH_REQUIRED",
-                    new CredentialsInfo(Collections.singletonList(
-                        new RedirectField(
-                                DUO_CODE_PARAMETER_NAME,
-                                new URI(duoClient.createAuthUrl(username, duoState)),
-                                new TranslatableMessage("LOGIN.INFO_DUO_REDIRECT_PENDING")
-                        )
-                    )),
-                    duoState, DuoAuthenticationProvider.PROVIDER_IDENTIFER, 
-                    DUO_STATE_PARAMETER_NAME, expirationTimestamp
-                );
+            // Store received credentials for later retrieval leveraging Duo's
+            // opaque session state identifier (we need to maintain these
+            // credentials so that things like the GUAC_USERNAME and
+            // GUAC_PASSWORD tokens continue to work as expected despite the
+            // redirect to/from the external Duo service)
+            duoState = duoClient.generateState();
+            long expirationTimestamp = System.currentTimeMillis() + (confService.getAuthTimeout() * 1000L);
+            sessionManager.defer(new DuoAuthenticationSession(credentials, expirationTimestamp), duoState);
 
+            // Obtain authentication URL from Duo client
+            String duoAuthUrlString;
+            try {
+                duoAuthUrlString = duoClient.createAuthUrl(username, duoState);
+            }
+            catch (DuoException e) {
+                throw new GuacamoleServerException("Duo client failed to "
+                        + "generate the authentication URL necessary to "
+                        + "redirect the authenticating user to the Duo "
+                        + "service.", e);
             }
 
-            // Get the token from the DuoClient using the code and username, and check status
+            // Parse and validate URL obtained from Duo client
+            URI duoAuthUrl;
+            try {
+                duoAuthUrl = new URI(duoAuthUrlString);
+            }
+            catch (URISyntaxException e) {
+                throw new GuacamoleServerException("Authentication URL "
+                        + "generated by the Duo client is not actually a "
+                        + "valid URL and cannot be used to redirect the "
+                        + "authenticating user to the Duo service.", e);
+            }
+
+            // Request that user be redirected to the Duo service to obtain
+            // a Duo authentication code
+            throw new TranslatableGuacamoleInsufficientCredentialsException(
+                "Verification using Duo is required before authentication "
+                + "can continue.", "LOGIN.INFO_DUO_AUTH_REQUIRED",
+                new CredentialsInfo(Collections.singletonList(
+                    new RedirectField(
+                            DUO_CODE_PARAMETER_NAME, duoAuthUrl,
+                            new TranslatableMessage("LOGIN.INFO_DUO_REDIRECT_PENDING")
+                    )
+                ))
+            );
+
+        }
+
+        // Validate that the user has successfully verified their identify with
+        // the Duo service
+        try {
             Token token = duoClient.exchangeAuthorizationCodeFor2FAResult(duoCode, username);
-            if (token == null 
-                    || token.getAuth_result() == null 
+            if (token == null || token.getAuth_result() == null
                     || !DUO_TOKEN_SUCCESS_VALUE.equals(token.getAuth_result().getStatus()))
                 throw new TranslatableGuacamoleClientException("Provided Duo "
                         + "validation code is incorrect.",
                         "LOGIN.INFO_DUO_VALIDATION_CODE_INCORRECT");
         }
         catch (DuoException e) {
-            throw new GuacamoleServerException("Duo Client error.", e);
-        }
-        catch (URISyntaxException e) {
-            throw new GuacamoleServerException("Error creating URI from Duo Authentication URL.", e);
+            throw new GuacamoleServerException("Duo client refused to verify "
+                    + "the identity of the authenticating user due to an "
+                    + "underlying error condition.", e);
         }
+
     }
 
 }
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java b/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java
index f0c27bc36..5b51d2ce9 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/language/TranslatableGuacamoleInsufficientCredentialsException.java
@@ -136,46 +136,6 @@ public class TranslatableGuacamoleInsufficientCredentialsException
         this(message, new TranslatableMessage(key), credentialsInfo);
     }
 
-    /**
-     * Creates a new TranslatableGuacamoleInsufficientCredentialsException with the specified message,
-     * translation key, the credential information required for authentication, the state token, and
-     * an expiration timestamp for the state token. The message is provided in both a non-translatable
-     * form and as a translatable key which can be used to retrieve the localized message.
-     *
-     * @param message
-     *     A human-readable description of the exception that occurred. This
-     *     message should be readable on its own and as-written, without
-     *     requiring a translation service.
-     *
-     * @param key
-     *     The arbitrary key which can be used to look up the message to be
-     *     displayed in the user's native language.
-     *
-     * @param credentialsInfo
-     *     Information describing the form of valid credentials.
-     *
-     * @param state
-     *     An opaque value that may be used by a client to maintain state across requests which are part
-     *     of the same authentication transaction.
-     * 
-     * @param providerIdentifier
-     *     The identifier of the authentication provider that this exception pertains to.
-     *
-     * @param queryIdentifier
-     *     The identifier of the specific query parameter within the
-     *     authentication process that this exception pertains to.
-     *
-     * @param expires
-     *     The timestamp after which the state token associated with the authentication process expires,
-     *     specified as the number of milliseconds since the UNIX epoch.
-     */
-    public TranslatableGuacamoleInsufficientCredentialsException(String message,
-            String key, CredentialsInfo credentialsInfo, String state, String providerIdentifier, 
-            String queryIdentifier, long expires) {
-        super(message, credentialsInfo, state, providerIdentifier, queryIdentifier, expires);
-        this.translatableMessage = new TranslatableMessage(key);
-    }
-
     @Override
     public TranslatableMessage getTranslatableMessage() {
         return translatableMessage;
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AbstractAuthenticationProvider.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AbstractAuthenticationProvider.java
index 81a91d9d9..6b6fd8f21 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AbstractAuthenticationProvider.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AbstractAuthenticationProvider.java
@@ -42,6 +42,20 @@ public abstract class AbstractAuthenticationProvider implements AuthenticationPr
         return null;
     }
 
+    /**
+     * {@inheritDoc}
+     *
+     * <p>This implementation simply returns the provided {@code credentials}
+     * without performing any updates. Implementations that wish to perform
+     * credential updates for in-progress authentication requests should
+     * override this function.
+     */
+    @Override
+    public Credentials updateCredentials(Credentials credentials)
+            throws GuacamoleException {
+        return credentials;
+    }
+
     /**
      * {@inheritDoc}
      *
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AuthenticationProvider.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AuthenticationProvider.java
index fd7d84478..680c7c382 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AuthenticationProvider.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/AuthenticationProvider.java
@@ -62,6 +62,33 @@ public interface AuthenticationProvider {
      */
     Object getResource() throws GuacamoleException;
 
+    /**
+     * Given the set of credentials that a user has submitted during
+     * authentication but has not yet been provided to the
+     * {@link #authenticateUser(org.apache.guacamole.net.auth.Credentials)} or
+     * {@link #updateAuthenticatedUser(org.apache.guacamole.net.auth.AuthenticatedUser, org.apache.guacamole.net.auth.Credentials)}
+     * functions of installed AuthenticationProviders, returns the set of
+     * credentials that should be used instead. The returned credentials may
+     * be the original credentials, with or without modifications, or may be an
+     * entirely new {@link Credentials} object.
+     *
+     * @param credentials
+     *     The credentials provided by a user during authentication.
+     *
+     * @return
+     *     The set of credentials that should be provided to all
+     *     AuthenticationProviders, including this AuthenticationProvider. This
+     *     set of credentials may optionally be entirely new or may have been
+     *     modified.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs while updating the provided credentials.
+     */
+    default Credentials updateCredentials(Credentials credentials)
+            throws GuacamoleException {
+        return credentials;
+    }
+
     /**
      * Returns an AuthenticatedUser representing the user authenticated by the
      * given credentials, if any.
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java
index 45eebe80d..6ad0e240b 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java
@@ -34,16 +34,6 @@ import javax.servlet.http.HttpSession;
  */
 public class Credentials implements Serializable {
 
-    /**
-     * The RESUME_QUERY is a query parameter key used to determine which
-     * authentication provider's process should be resumed during multi-step
-     * authentication. The auth provider will set this parameter before 
-     * redirecting to an external service, and it is checked upon return to 
-     * Guacamole to ensure the correct authentication state is continued 
-     * without starting over.
-     */
-    public static final String RESUME_QUERY = "provider_id";
-
     /**
      * Unique identifier associated with this specific version of Credentials.
      */
diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
index 8c7669474..06ae3ea5c 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/credentials/GuacamoleInsufficientCredentialsException.java
@@ -28,95 +28,6 @@ package org.apache.guacamole.net.auth.credentials;
  */
 public class GuacamoleInsufficientCredentialsException extends GuacamoleCredentialsException {
 
-    /**
-     * The default state token to use when no specific state information is provided.
-     */
-    private static final String DEFAULT_STATE = "";
-
-    /**
-     * The default provider identifier to use when no specific provider is identified.
-     * This serves as a placeholder indicating that either no specific provider is
-     * responsible for the exception or the responsible provider has not been identified.
-     */
-    private static final String DEFAULT_PROVIDER_IDENTIFIER = "";
-
-    /**
-     * The default query identifier to use when no specific query is identified.
-     * This serves as a placeholder and indicates that the specific query related to
-     * the provider's state resume operation has not been provided.
-     */
-    private static final String DEFAULT_QUERY_IDENTIFIER = "";
-
-    /**
-     * The default expiration timestamp to use when no specific expiration is provided,
-     * effectively indicating that the state token does not expire.
-     */
-    private static final long DEFAULT_EXPIRES = -1L;
-
-    /**
-     * An opaque value that may be used by a client to maintain state across requests
-     * which are part of the same authentication transaction.
-     */
-    protected final String state;
-
-    /**
-     * The identifier for the authentication provider that threw this exception.
-     * This is used to link the exception back to the originating source of the
-     * authentication attempt, allowing clients to determine which provider's
-     * authentication process should be resumed.
-     */
-    protected final String providerIdentifier;
-
-    /**
-     * An identifier for the specific query within the URL for this provider that can
-     * be checked to resume the authentication state.
-     */
-    protected final String queryIdentifier;
-
-    /**
-     * The timestamp after which the state token associated with the authentication process
-     * should no longer be considered valid, expressed as the number of milliseconds since
-     * UNIX epoch.
-     */
-    protected final long expires;
-
-    /**
-     * Creates a new GuacamoleInsufficientCredentialsException with the specified
-     * message, the credential information required for authentication, the state
-     * token associated with the authentication process, and an expiration timestamp.
-     *
-     * @param message
-     *     A human-readable description of the exception that occurred.
-     *
-     * @param credentialsInfo
-     *     Information describing the form of valid credentials.
-     *
-     * @param state
-     *     An opaque value that may be used by a client to maintain state
-     *     across requests which are part of the same authentication transaction.
-     *
-     * @param providerIdentifier
-     *     The identifier of the authentication provider that this exception pertains to.
-     *
-     * @param queryIdentifier
-     *     The identifier of the specific query parameter within the
-     *     authentication process that this exception pertains to.
-     * 
-     * @param expires
-     *     The timestamp after which the state token associated with the
-     *     authentication process should no longer be considered valid, expressed
-     *     as the number of milliseconds since UNIX epoch.
-     */
-    public GuacamoleInsufficientCredentialsException(String message,
-            CredentialsInfo credentialsInfo, String state, 
-            String providerIdentifier, String queryIdentifier, long expires) {
-        super(message, credentialsInfo);
-        this.state = state;
-        this.providerIdentifier = providerIdentifier;
-        this.queryIdentifier = queryIdentifier;
-        this.expires = expires;
-    }
-
     /**
      * Creates a new GuacamoleInsufficientCredentialsException with the given
      * message, cause, and associated credential information.
@@ -133,10 +44,6 @@ public class GuacamoleInsufficientCredentialsException extends GuacamoleCredenti
     public GuacamoleInsufficientCredentialsException(String message, Throwable cause,
             CredentialsInfo credentialsInfo) {
         super(message, cause, credentialsInfo);
-        this.state = DEFAULT_STATE;
-        this.providerIdentifier = DEFAULT_PROVIDER_IDENTIFIER;
-        this.queryIdentifier = DEFAULT_QUERY_IDENTIFIER;
-        this.expires = DEFAULT_EXPIRES;
     }
 
     /**
@@ -151,10 +58,6 @@ public class GuacamoleInsufficientCredentialsException extends GuacamoleCredenti
      */
     public GuacamoleInsufficientCredentialsException(String message, CredentialsInfo credentialsInfo) {
         super(message, credentialsInfo);
-        this.state = DEFAULT_STATE;
-        this.providerIdentifier = DEFAULT_PROVIDER_IDENTIFIER;
-        this.queryIdentifier = DEFAULT_QUERY_IDENTIFIER;
-        this.expires = DEFAULT_EXPIRES;
     }
 
     /**
@@ -169,52 +72,6 @@ public class GuacamoleInsufficientCredentialsException extends GuacamoleCredenti
      */
     public GuacamoleInsufficientCredentialsException(Throwable cause, CredentialsInfo credentialsInfo) {
         super(cause, credentialsInfo);
-        this.state = DEFAULT_STATE;
-        this.providerIdentifier = DEFAULT_PROVIDER_IDENTIFIER;
-        this.queryIdentifier = DEFAULT_QUERY_IDENTIFIER;
-        this.expires = DEFAULT_EXPIRES;
-    }
-
-    /**
-     * Retrieves the state token associated with the authentication process.
-     *
-     * @return The opaque state token used to maintain consistency across multiple
-     *         requests in the same authentication transaction.
-     */
-    public String getState() {
-        return state;
-    }
-
-    /**
-     * Retrieves the identifier of the authentication provider responsible for this exception.
-     *
-     * @return The identifier of the authentication provider, allowing clients to know
-     *         which provider's process should be resumed in response to this exception.
-     */
-    public String getProviderIdentifier() {
-        return providerIdentifier;
-    }
-
-    /**
-     * Retrieves the specific query identifier associated with the URL for the provider
-     * that can be checked to resume the authentication state.
-     *
-     * @return The query identifier that serves as a reference to a specific point or
-     *         transaction within the provider's authentication process.
-     */
-    public String getQueryIdentifier() {
-        return queryIdentifier;
-    }
-
-    /**
-     * Retrieves the expiration timestamp of the state token, specified as the
-     * number of milliseconds since the UNIX epoch.
-     *
-     * @return The expiration timestamp of the state token, or a negative value if
-     *         the token does not expire.
-     */
-    public long getExpires() {
-        return expires;
     }
 
 }
diff --git a/guacamole/src/main/java/org/apache/guacamole/extension/AuthenticationProviderFacade.java b/guacamole/src/main/java/org/apache/guacamole/extension/AuthenticationProviderFacade.java
index 9855cd6fd..b89b2ada6 100644
--- a/guacamole/src/main/java/org/apache/guacamole/extension/AuthenticationProviderFacade.java
+++ b/guacamole/src/main/java/org/apache/guacamole/extension/AuthenticationProviderFacade.java
@@ -119,6 +119,18 @@ public class AuthenticationProviderFacade implements AuthenticationProvider {
 
     }
 
+    @Override
+    public Credentials updateCredentials(Credentials credentials) throws GuacamoleException {
+
+        // Do nothing if underlying auth provider could not be loaded
+        if (authProvider == null)
+            return credentials;
+
+        // Delegate to underlying auth provider
+        return authProvider.updateCredentials(credentials);
+
+    }
+
     /**
      * Returns whether this authentication provider should tolerate internal
      * failures during the authentication process, allowing other
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
index dc8d3bb7d..7bb1e6fa8 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
@@ -21,11 +21,8 @@ package org.apache.guacamole.rest.auth;
 
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
 
 import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
 
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleSecurityException;
@@ -47,7 +44,6 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import com.google.inject.Singleton;
-import java.util.Iterator;
 
 /**
  * A service for performing authentication checks in REST endpoints.
@@ -103,11 +99,6 @@ public class AuthenticationService {
      */
     public static final String TOKEN_PARAMETER_NAME = "token";
 
-    /** 
-     * Map to store resumable authentication states with an expiration time.
-     */ 
-    private Map<String, ResumableAuthenticationState> resumableStateMap = new ConcurrentHashMap<>();
-
     /**
      * Attempts authentication against all AuthenticationProviders, in order,
      * using the provided credentials. The first authentication failure takes
@@ -322,20 +313,6 @@ public class AuthenticationService {
                 try {
                     userContext = authProvider.getUserContext(authenticatedUser);
                 }
-                catch (GuacamoleInsufficientCredentialsException e) {
-                    // Store state and expiration
-                    String state = e.getState();
-                    long expiration = e.getExpires();
-                    String queryIdentifier = e.getQueryIdentifier();
-                    String providerIdentifier = e.getProviderIdentifier();
-
-                    resumableStateMap.put(state, new ResumableAuthenticationState(providerIdentifier, 
-                            queryIdentifier, expiration, credentials));
-
-                    throw new GuacamoleAuthenticationProcessException("User "
-                            + "authentication aborted during initial "
-                            + "UserContext creation.", authProvider, e);
-                }
                 catch (GuacamoleException | RuntimeException | Error e) {
                     throw new GuacamoleAuthenticationProcessException("User "
                             + "authentication aborted during initial "
@@ -354,81 +331,42 @@ public class AuthenticationService {
         return userContexts;
 
     }
-    
+
     /**
-     * Resumes authentication using given credentials if a matching resumable 
-     * state is found.
+     * Performs arbitrary and optional updates to the credentials supplied by
+     * the authenticating user as dictated by the {@link AuthenticationProvider#updateCredentials(org.apache.guacamole.net.auth.Credentials)}
+     * functions of any installed AuthenticationProvider. Each installed
+     * AuthenticationProvider is given the opportunity, in order, to make
+     * updates to the supplied credentials.
      *
-     * @param credentials 
-     *     The initial credentials containing the request object.
+     * @param credentials
+     *     The credentials to be updated.
      *
-     * @return 
-     *     Resumed credentials if a valid resumable state is found; otherwise, 
-     *     returns null.
+     * @return
+     *     The set of credentials that should be provided to all
+     *     AuthenticationProviders during authentication, now possibly updated
+     *     (or even replaced) by any number of installed
+     *     AuthenticationProviders.
+     *
+     * @throws GuacamoleAuthenticationProcessException 
+     *     If an error occurs while updating the supplied credentials.
      */
-    private Credentials resumeAuthentication(Credentials credentials) {
-        
-        Credentials resumedCredentials = null;
+    private Credentials getUpdatedCredentials(Credentials credentials)
+            throws GuacamoleAuthenticationProcessException {
 
-        // Retrieve signed State from the request
-        HttpServletRequest request = credentials.getRequest();
-        
-        // Retrieve the provider id from the query parameters
-        String resumableProviderId = request.getParameter(Credentials.RESUME_QUERY);
-        // Check if a provider id is set
-        if (resumableProviderId == null || resumableProviderId.isEmpty()) {
-            // Return if a provider id is not set
-            return null;
-        }
-
-        // Use an iterator to safely remove entries while iterating
-        Iterator<Map.Entry<String, ResumableAuthenticationState>> iterator = resumableStateMap.entrySet().iterator();
-        while (iterator.hasNext()) {
-            Map.Entry<String, ResumableAuthenticationState> entry = iterator.next();
-            ResumableAuthenticationState resumableState = entry.getValue();
-
-            // Check if the provider ID from the request matches the one in the map entry
-            boolean providerMatches = resumableProviderId.equals(resumableState.getProviderIdentifier());
-            if (!providerMatches) {
-                // If the provider doesn't match, skip to the next entry
-                continue;
+        for (AuthenticationProvider authProvider : authProviders) {
+            try {
+                credentials = authProvider.updateCredentials(credentials);
             }
-
-            // Use the query identifier from the entry to retrieve the corresponding state parameter
-            String stateQueryParameter = resumableState.getQueryIdentifier();
-            String stateFromParameter = request.getParameter(stateQueryParameter);
-
-            // Check if a state parameter is set
-            if (stateFromParameter == null || stateFromParameter.isEmpty()) {
-                // Remove and continue if`state is not provided or is empty
-                iterator.remove(); 
-                continue;
-            }
-
-            // If the key in the entry (state) matches the state parameter provided in the request
-            if (entry.getKey().equals(stateFromParameter)) {
-
-                // Remove the current entry from the map
-                iterator.remove();                
-
-                // Check if the resumableState has expired
-                if (!resumableState.isExpired()) {
-
-                    // Set the actualCredentials to the credentials from the matched entry
-                    resumedCredentials = resumableState.getCredentials();
-
-                    if (resumedCredentials != null) {
-                        resumedCredentials.setRequest(request);
-                    }
-
-                }
-
-                // Exit the loop since we've found the matching state and it's unique
-                break;
+            catch (GuacamoleException | RuntimeException | Error e) {
+                throw new GuacamoleAuthenticationProcessException("User "
+                        + "authentication aborted during credential "
+                        + "update/revision.", authProvider, e);
             }
         }
 
-        return resumedCredentials;
+        return credentials;
+
     }
 
     /**
@@ -469,16 +407,15 @@ public class AuthenticationService {
         AuthenticatedUser authenticatedUser;
         String authToken;
 
-        // Retrieve credentials if resuming authentication
-        Credentials actualCredentials = resumeAuthentication(credentials);
-        if (actualCredentials == null)
-            actualCredentials = credentials;
-
         try {
 
+            // Allow extensions to make updated to credentials prior to
+            // actual authentication
+            Credentials updatedCredentials = getUpdatedCredentials(credentials);
+
             // Get up-to-date AuthenticatedUser and associated UserContexts
-            authenticatedUser = getAuthenticatedUser(existingSession, actualCredentials);
-            List<DecoratedUserContext> userContexts = getUserContexts(existingSession, authenticatedUser, actualCredentials);
+            authenticatedUser = getAuthenticatedUser(existingSession, updatedCredentials);
+            List<DecoratedUserContext> userContexts = getUserContexts(existingSession, authenticatedUser, updatedCredentials);
 
             // Update existing session, if it exists
             if (existingSession != null) {
@@ -508,7 +445,7 @@ public class AuthenticationService {
         // Log and rethrow any authentication errors
         catch (GuacamoleAuthenticationProcessException e) {
 
-            listenerService.handleEvent(new AuthenticationFailureEvent(actualCredentials,
+            listenerService.handleEvent(new AuthenticationFailureEvent(credentials,
                     e.getAuthenticationProvider(), e.getCause()));
 
             // Rethrow exception
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java
deleted file mode 100644
index 1aaa7ea57..000000000
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/ResumableAuthenticationState.java
+++ /dev/null
@@ -1,128 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.guacamole.rest.auth;
-
-import org.apache.guacamole.net.auth.Credentials;
-
-/**
- * Encapsulates the state information required for resuming an authentication
- * process. This includes an expiration timestamp to determine state validity
- * and the original credentials submitted by the user.
- */
-public class ResumableAuthenticationState {
-    
-    /**
-     * The timestamp at which this state should no longer be considered valid,
-     * measured in milliseconds since the Unix epoch.
-     */
-    private long expirationTimestamp;
-    
-    /**
-     * The original user credentials that were submitted at the start of the
-     * authentication process.
-     */
-    private Credentials credentials;
-
-    /**
-     * A unique string identifying the authentication provider related to the state.
-     * This field allows the client to know which provider's authentication process
-     * should be resumed using this state.
-     */
-    private String providerIdentifier;
-
-    /**
-     * A unique string that can be used to identify a specific query within the
-     * authentication process for the identified provider. This identifier can
-     * help the resumption of an authentication process.
-     */
-    private String queryIdentifier;
-
-    /**
-     * Constructs a new ResumableAuthenticationState object with the specified
-     * expiration timestamp and user credentials.
-     *
-     * @param providerIdentifier
-     *     The identifier of the authentication provider to which this resumable state pertains.
-     *
-     * @param queryIdenifier
-     *     The identifier of the specific query within the provider's
-     *     authentication process that this state corresponds to.
-     *
-     * @param expirationTimestamp
-     *     The timestamp in milliseconds since the Unix epoch when this state
-     *     expires and can no longer be used to resume authentication.
-     *
-     * @param credentials
-     *     The Credentials object initially submitted by the user and associated
-     *     with this resumable state.
-     */
-    public ResumableAuthenticationState(String providerIdentifier, String queryIdentifier, 
-            long expirationTimestamp, Credentials credentials) {
-        this.expirationTimestamp = expirationTimestamp;
-        this.credentials = credentials;
-        this.providerIdentifier = providerIdentifier;
-        this.queryIdentifier = queryIdentifier;
-    }
-
-    /**
-     * Checks if this resumable state has expired based on the stored expiration
-     * timestamp and the current system time.
-     *
-     * @return 
-     *     True if the current system time is after the expiration timestamp,
-     *     indicating that the state is expired; false otherwise.
-     */
-    public boolean isExpired() {
-        return System.currentTimeMillis() >= expirationTimestamp;
-    }
-
-    /**
-     * Retrieves the original credentials associated with this resumable state.
-     *
-     * @return 
-     *     The Credentials object containing user details that were submitted
-     *     when the state was created.
-     */
-    public Credentials getCredentials() {
-        return this.credentials;
-    }
-
-    /**
-     * Retrieves the identifier of the authentication provider associated with this state.
-     *
-     * @return 
-     *     The identifier of the authentication provider, providing context for this state
-     *     within the overall authentication sequence.
-     */
-    public String getProviderIdentifier() {
-        return this.providerIdentifier;
-    }
-
-    /**
-     * Retrieves the identifier for a specific query in the authentication
-     * process that is associated with this state.
-     *
-     * @return 
-     *     The query identifier used for retrieving a value representing the state within
-     *     the provider's authentication process that should be resumed.
-     */
-    public String getQueryIdentifier() {
-        return this.queryIdentifier;
-    }
-}

From 23ed76d4600839fe6f42e63385c05ff0bece67d1 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 25 Apr 2024 14:06:33 -0700
Subject: [PATCH 274/289] GUACAMOLE-1289: Remove Duo dependency on Spring.
 Update transitive Duo dependencies to latest compatible.

---
 doc/licenses/okhttp-3.14.9/NOTICE             |  13 --
 .../okhttp-3.14.9/dep-coordinates.txt         |   1 -
 .../LICENSE.txt                               |   0
 .../{okhttp-4.9.1 => okhttp-4.12.0}/NOTICE    |   0
 .../{okhttp-3.14.9 => okhttp-4.12.0}/README   |   2 +-
 .../okhttp-4.12.0/dep-coordinates.txt         |   2 +
 doc/licenses/okhttp-4.9.1/README              |   7 -
 doc/licenses/okhttp-4.9.1/dep-coordinates.txt |   1 -
 doc/licenses/okio-1.17.2/LICENSE.txt          | 201 -----------------
 doc/licenses/okio-1.17.2/NOTICE               |  13 --
 doc/licenses/okio-1.17.2/README               |   7 -
 doc/licenses/okio-1.17.2/dep-coordinates.txt  |   1 -
 doc/licenses/okio-2.8.0/LICENSE.txt           | 201 -----------------
 doc/licenses/okio-2.8.0/dep-coordinates.txt   |   1 -
 .../{okhttp-4.9.1 => okio-3.6.0}/LICENSE.txt  |   0
 .../{okio-2.8.0 => okio-3.6.0}/NOTICE         |   0
 .../{okio-2.8.0 => okio-3.6.0}/README         |   4 +-
 doc/licenses/okio-3.6.0/dep-coordinates.txt   |   2 +
 doc/licenses/spring-web-5.3.25/LICENSE        | 202 ------------------
 doc/licenses/spring-web-5.3.25/README         |   7 -
 .../spring-web-5.3.25/dep-coordinates.txt     |   4 -
 extensions/guacamole-auth-duo/pom.xml         |  82 ++++---
 22 files changed, 58 insertions(+), 693 deletions(-)
 delete mode 100644 doc/licenses/okhttp-3.14.9/NOTICE
 delete mode 100644 doc/licenses/okhttp-3.14.9/dep-coordinates.txt
 rename doc/licenses/{okhttp-3.14.9 => okhttp-4.12.0}/LICENSE.txt (100%)
 rename doc/licenses/{okhttp-4.9.1 => okhttp-4.12.0}/NOTICE (100%)
 rename doc/licenses/{okhttp-3.14.9 => okhttp-4.12.0}/README (88%)
 create mode 100644 doc/licenses/okhttp-4.12.0/dep-coordinates.txt
 delete mode 100644 doc/licenses/okhttp-4.9.1/README
 delete mode 100644 doc/licenses/okhttp-4.9.1/dep-coordinates.txt
 delete mode 100644 doc/licenses/okio-1.17.2/LICENSE.txt
 delete mode 100644 doc/licenses/okio-1.17.2/NOTICE
 delete mode 100644 doc/licenses/okio-1.17.2/README
 delete mode 100644 doc/licenses/okio-1.17.2/dep-coordinates.txt
 delete mode 100644 doc/licenses/okio-2.8.0/LICENSE.txt
 delete mode 100644 doc/licenses/okio-2.8.0/dep-coordinates.txt
 rename doc/licenses/{okhttp-4.9.1 => okio-3.6.0}/LICENSE.txt (100%)
 rename doc/licenses/{okio-2.8.0 => okio-3.6.0}/NOTICE (100%)
 rename doc/licenses/{okio-2.8.0 => okio-3.6.0}/README (62%)
 create mode 100644 doc/licenses/okio-3.6.0/dep-coordinates.txt
 delete mode 100644 doc/licenses/spring-web-5.3.25/LICENSE
 delete mode 100644 doc/licenses/spring-web-5.3.25/README
 delete mode 100644 doc/licenses/spring-web-5.3.25/dep-coordinates.txt

diff --git a/doc/licenses/okhttp-3.14.9/NOTICE b/doc/licenses/okhttp-3.14.9/NOTICE
deleted file mode 100644
index 48164b3fc..000000000
--- a/doc/licenses/okhttp-3.14.9/NOTICE
+++ /dev/null
@@ -1,13 +0,0 @@
-Copyright 2019 Square, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
diff --git a/doc/licenses/okhttp-3.14.9/dep-coordinates.txt b/doc/licenses/okhttp-3.14.9/dep-coordinates.txt
deleted file mode 100644
index eb6c3831b..000000000
--- a/doc/licenses/okhttp-3.14.9/dep-coordinates.txt
+++ /dev/null
@@ -1 +0,0 @@
-com.squareup.okhttp3:okhttp:jar:3.14.9
diff --git a/doc/licenses/okhttp-3.14.9/LICENSE.txt b/doc/licenses/okhttp-4.12.0/LICENSE.txt
similarity index 100%
rename from doc/licenses/okhttp-3.14.9/LICENSE.txt
rename to doc/licenses/okhttp-4.12.0/LICENSE.txt
diff --git a/doc/licenses/okhttp-4.9.1/NOTICE b/doc/licenses/okhttp-4.12.0/NOTICE
similarity index 100%
rename from doc/licenses/okhttp-4.9.1/NOTICE
rename to doc/licenses/okhttp-4.12.0/NOTICE
diff --git a/doc/licenses/okhttp-3.14.9/README b/doc/licenses/okhttp-4.12.0/README
similarity index 88%
rename from doc/licenses/okhttp-3.14.9/README
rename to doc/licenses/okhttp-4.12.0/README
index ed470799c..c322ec2a6 100644
--- a/doc/licenses/okhttp-3.14.9/README
+++ b/doc/licenses/okhttp-4.12.0/README
@@ -1,7 +1,7 @@
 okhttp (https://square.github.io/okhttp/)
 ---------------------------------------------
 
-    Version: 3.14.9
+    Version: 4.12.0
     From: 'Square Inc'
     License(s):
         Apache 2.0
diff --git a/doc/licenses/okhttp-4.12.0/dep-coordinates.txt b/doc/licenses/okhttp-4.12.0/dep-coordinates.txt
new file mode 100644
index 000000000..8aeb660e8
--- /dev/null
+++ b/doc/licenses/okhttp-4.12.0/dep-coordinates.txt
@@ -0,0 +1,2 @@
+com.squareup.okhttp3:okhttp:jar:4.12.0
+com.squareup.okhttp3:logging-interceptor:jar:4.12.0
diff --git a/doc/licenses/okhttp-4.9.1/README b/doc/licenses/okhttp-4.9.1/README
deleted file mode 100644
index 427724260..000000000
--- a/doc/licenses/okhttp-4.9.1/README
+++ /dev/null
@@ -1,7 +0,0 @@
-okhttp (https://square.github.io/okhttp/)
----------------------------------------------
-
-    Version: 4.9.1
-    From: 'Square Inc'
-    License(s):
-        Apache 2.0
diff --git a/doc/licenses/okhttp-4.9.1/dep-coordinates.txt b/doc/licenses/okhttp-4.9.1/dep-coordinates.txt
deleted file mode 100644
index 0215ca270..000000000
--- a/doc/licenses/okhttp-4.9.1/dep-coordinates.txt
+++ /dev/null
@@ -1 +0,0 @@
-com.squareup.okhttp3:okhttp:jar:4.9.1
diff --git a/doc/licenses/okio-1.17.2/LICENSE.txt b/doc/licenses/okio-1.17.2/LICENSE.txt
deleted file mode 100644
index f49a4e16e..000000000
--- a/doc/licenses/okio-1.17.2/LICENSE.txt
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okio-1.17.2/NOTICE b/doc/licenses/okio-1.17.2/NOTICE
deleted file mode 100644
index 25fdd5926..000000000
--- a/doc/licenses/okio-1.17.2/NOTICE
+++ /dev/null
@@ -1,13 +0,0 @@
-Copyright 2013 Square, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okio-1.17.2/README b/doc/licenses/okio-1.17.2/README
deleted file mode 100644
index a8723ed5a..000000000
--- a/doc/licenses/okio-1.17.2/README
+++ /dev/null
@@ -1,7 +0,0 @@
-okio (https://square.github.io/okio/)
----------------------------------------------
-
-    Version: 1.17.2
-    From: 'Square Inc'
-    License(s):
-        Apache 2.0 (bundled/retrofit-2.9.0/LICENSE.txt)
diff --git a/doc/licenses/okio-1.17.2/dep-coordinates.txt b/doc/licenses/okio-1.17.2/dep-coordinates.txt
deleted file mode 100644
index 54ab8297c..000000000
--- a/doc/licenses/okio-1.17.2/dep-coordinates.txt
+++ /dev/null
@@ -1 +0,0 @@
-com.squareup.okio:okio:jar:1.17.2
diff --git a/doc/licenses/okio-2.8.0/LICENSE.txt b/doc/licenses/okio-2.8.0/LICENSE.txt
deleted file mode 100644
index f49a4e16e..000000000
--- a/doc/licenses/okio-2.8.0/LICENSE.txt
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okio-2.8.0/dep-coordinates.txt b/doc/licenses/okio-2.8.0/dep-coordinates.txt
deleted file mode 100644
index 88c8776ad..000000000
--- a/doc/licenses/okio-2.8.0/dep-coordinates.txt
+++ /dev/null
@@ -1 +0,0 @@
-com.squareup.okio:okio:jar:2.8.0
diff --git a/doc/licenses/okhttp-4.9.1/LICENSE.txt b/doc/licenses/okio-3.6.0/LICENSE.txt
similarity index 100%
rename from doc/licenses/okhttp-4.9.1/LICENSE.txt
rename to doc/licenses/okio-3.6.0/LICENSE.txt
diff --git a/doc/licenses/okio-2.8.0/NOTICE b/doc/licenses/okio-3.6.0/NOTICE
similarity index 100%
rename from doc/licenses/okio-2.8.0/NOTICE
rename to doc/licenses/okio-3.6.0/NOTICE
diff --git a/doc/licenses/okio-2.8.0/README b/doc/licenses/okio-3.6.0/README
similarity index 62%
rename from doc/licenses/okio-2.8.0/README
rename to doc/licenses/okio-3.6.0/README
index cf4693dbd..75593ddb7 100644
--- a/doc/licenses/okio-2.8.0/README
+++ b/doc/licenses/okio-3.6.0/README
@@ -1,7 +1,7 @@
 okio (https://square.github.io/okio/)
 ---------------------------------------------
 
-    Version: 2.8.0
+    Version: 3.6.0
     From: 'Square Inc'
     License(s):
-        Apache 2.0 (bundled/retrofit-2.9.0/LICENSE.txt)
+        Apache 2.0 (bundled/okio-3.6.0/LICENSE.txt)
diff --git a/doc/licenses/okio-3.6.0/dep-coordinates.txt b/doc/licenses/okio-3.6.0/dep-coordinates.txt
new file mode 100644
index 000000000..b785b2613
--- /dev/null
+++ b/doc/licenses/okio-3.6.0/dep-coordinates.txt
@@ -0,0 +1,2 @@
+com.squareup.okio:okio:jar:3.6.0
+com.squareup.okio:okio-jvm:jar:3.6.0
diff --git a/doc/licenses/spring-web-5.3.25/LICENSE b/doc/licenses/spring-web-5.3.25/LICENSE
deleted file mode 100644
index ff7737963..000000000
--- a/doc/licenses/spring-web-5.3.25/LICENSE
+++ /dev/null
@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        https://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       https://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/doc/licenses/spring-web-5.3.25/README b/doc/licenses/spring-web-5.3.25/README
deleted file mode 100644
index f719e88ff..000000000
--- a/doc/licenses/spring-web-5.3.25/README
+++ /dev/null
@@ -1,7 +0,0 @@
-Spring Framework (https://spring.io/projects/spring-framework)
---------------------------------------------------------------
-
-    Version: 5.3.25
-    From: 'Spring' (https://spring.io/)
-    License(s):
-        Apache v2.0
diff --git a/doc/licenses/spring-web-5.3.25/dep-coordinates.txt b/doc/licenses/spring-web-5.3.25/dep-coordinates.txt
deleted file mode 100644
index 0670c0fa8..000000000
--- a/doc/licenses/spring-web-5.3.25/dep-coordinates.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-org.springframework:spring-web:jar:5.3.25
-org.springframework:spring-beans:jar:5.3.25
-org.springframework:spring-core:jar:5.3.25
-org.springframework:spring-jcl:jar:5.3.25
diff --git a/extensions/guacamole-auth-duo/pom.xml b/extensions/guacamole-auth-duo/pom.xml
index f7f49563c..95afee441 100644
--- a/extensions/guacamole-auth-duo/pom.xml
+++ b/extensions/guacamole-auth-duo/pom.xml
@@ -39,33 +39,10 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <okhttp.version>4.12.0</okhttp.version>
+        <kotlin.version>1.9.23</kotlin.version>
     </properties>
 
-    <dependencyManagement>
-        <dependencies>
-            <!-- Define okhttp version to use everywhere to resolve conflict -->
-            <dependency>
-                <groupId>com.squareup.okhttp3</groupId>
-                <artifactId>okhttp</artifactId>
-                <version>4.9.1</version> <!-- Specify the desired version -->
-            </dependency>
-
-            <!-- Force the use of a consistent version of Kotlin standard library common -->
-            <dependency>
-                <groupId>org.jetbrains.kotlin</groupId>
-                <artifactId>kotlin-stdlib-common</artifactId>
-                <version>1.4.10</version>
-            </dependency>
-
-            <dependency>
-                <groupId>org.jetbrains.kotlin</groupId>
-                <artifactId>kotlin-stdlib</artifactId>
-                <version>1.4.10</version>
-            </dependency>
-
-        </dependencies>
-    </dependencyManagement>
-
     <dependencies>
 
        <!-- Guacamole Extension API -->
@@ -95,19 +72,62 @@
             <version>2.5</version>
             <scope>provided</scope>
         </dependency>
-        
+
         <!-- Duo SDK -->
         <dependency>
             <groupId>com.duosecurity</groupId>
             <artifactId>duo-universal-sdk</artifactId>
             <version>1.1.3</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>com.squareup.okhttp3</groupId>
+                    <artifactId>okhttp</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>com.squareup.okhttp3</groupId>
+                    <artifactId>logging-interceptor</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
-        
-        <!-- spring-web -->
+
+        <!-- Force the use of a consistent version of "okhttp" -->
         <dependency>
-            <groupId>org.springframework</groupId>
-            <artifactId>spring-web</artifactId>
-            <version>5.3.25</version>
+            <groupId>com.squareup.okhttp3</groupId>
+            <artifactId>okhttp</artifactId>
+            <version>${okhttp.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.jetbrains.kotlin</groupId>
+                    <artifactId>kotlin-stdlib-common</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.jetbrains.kotlin</groupId>
+                    <artifactId>kotlin-stdlib-jdk8</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>com.squareup.okhttp3</groupId>
+            <artifactId>logging-interceptor</artifactId>
+            <version>${okhttp.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.jetbrains.kotlin</groupId>
+                    <artifactId>kotlin-stdlib-jdk8</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+
+        <!-- Force the use of a consistent version of Kotlin standard library common -->
+        <dependency>
+            <groupId>org.jetbrains.kotlin</groupId>
+            <artifactId>kotlin-stdlib-common</artifactId>
+            <version>${kotlin.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.jetbrains.kotlin</groupId>
+            <artifactId>kotlin-stdlib-jdk8</artifactId>
+            <version>${kotlin.version}</version>
         </dependency>
 
     </dependencies>

From 3859fd2f1c57da9bc28462a8bc5eb4f04a75a827 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 25 Apr 2024 16:18:33 -0700
Subject: [PATCH 275/289] GUACAMOLE-1289: Migrate to minute-granularity
 timeouts for Duo (default of 5 minutes).

---
 .../auth/duo/UserVerificationService.java     |  2 +-
 .../auth/duo/conf/ConfigurationService.java   | 27 ++++++++++---------
 2 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
index 6f36371f8..a30f4d7cd 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
@@ -151,7 +151,7 @@ public class UserVerificationService {
             // GUAC_PASSWORD tokens continue to work as expected despite the
             // redirect to/from the external Duo service)
             duoState = duoClient.generateState();
-            long expirationTimestamp = System.currentTimeMillis() + (confService.getAuthTimeout() * 1000L);
+            long expirationTimestamp = System.currentTimeMillis() + (confService.getAuthenticationTimeout() * 60000L);
             sessionManager.defer(new DuoAuthenticationSession(credentials, expirationTimestamp), duoState);
 
             // Obtain authentication URL from Duo client
diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java
index f6bed8073..5ed7d7a21 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/conf/ConfigurationService.java
@@ -94,7 +94,7 @@ public class ConfigurationService {
     };
     
     /**
-     * The property that configures the timeout, in seconds, of in-progress
+     * The property that configures the timeout, in minutes, of in-progress
      * Duo authentication attempts. Authentication attempts that take longer
      * than this period of time will be invalidated.
      */
@@ -170,20 +170,23 @@ public class ConfigurationService {
     public URI getRedirectUri() throws GuacamoleException {
         return environment.getRequiredProperty(DUO_REDIRECT_URI);
     }
-    
+
+
     /**
-     * Return the number of seconds after which in-progress authentication attempts with
-     * Duo should be invalidated. The default is 30 seconds.
-     * 
+     * Returns the maximum amount of time to allow for an in-progress Duo
+     * authentication attempt to be completed, in minutes. A user that takes
+     * longer than this amount of time to complete authentication with Duo
+     * will need to try again.
+     *
      * @return
-     *     The number of seconds after which in-progress Duo MFA attempts should
-     *     be invalidated.
-     * 
-     * @throws GuacamoleException 
-     *     If guacamole.properties cannot be parsed.
+     *     The maximum amount of time to allow for an in-progress Duo
+     *     authentication attempt to be completed, in minutes.
+     *
+     * @throws GuacamoleException
+     *     If the authentication timeout cannot be parsed.
      */
-    public int getAuthTimeout() throws GuacamoleException {
-        return environment.getProperty(DUO_AUTH_TIMEOUT, 30);
+    public int getAuthenticationTimeout() throws GuacamoleException {
+        return environment.getProperty(DUO_AUTH_TIMEOUT, 5);
     }
 
 }

From 73eb4536a9bfaab3ec87a952d3438025c4e381ee Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 25 Apr 2024 17:20:21 -0700
Subject: [PATCH 276/289] GUACAMOLE-1289: Remove unnecessary re-bundling of
 Apache license.

---
 .../logging-interceptor-4.9.1/LICENSE.txt     | 201 ------------------
 doc/licenses/okhttp-4.12.0/LICENSE.txt        | 201 ------------------
 doc/licenses/okio-3.6.0/LICENSE.txt           | 201 ------------------
 doc/licenses/okio-3.6.0/README                |   2 +-
 doc/licenses/retrofit-2.9.0/LICENSE.txt       | 201 ------------------
 doc/licenses/retrofit-2.9.0/README            |   2 +-
 6 files changed, 2 insertions(+), 806 deletions(-)
 delete mode 100644 doc/licenses/logging-interceptor-4.9.1/LICENSE.txt
 delete mode 100644 doc/licenses/okhttp-4.12.0/LICENSE.txt
 delete mode 100644 doc/licenses/okio-3.6.0/LICENSE.txt
 delete mode 100644 doc/licenses/retrofit-2.9.0/LICENSE.txt

diff --git a/doc/licenses/logging-interceptor-4.9.1/LICENSE.txt b/doc/licenses/logging-interceptor-4.9.1/LICENSE.txt
deleted file mode 100644
index f49a4e16e..000000000
--- a/doc/licenses/logging-interceptor-4.9.1/LICENSE.txt
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okhttp-4.12.0/LICENSE.txt b/doc/licenses/okhttp-4.12.0/LICENSE.txt
deleted file mode 100644
index f49a4e16e..000000000
--- a/doc/licenses/okhttp-4.12.0/LICENSE.txt
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okio-3.6.0/LICENSE.txt b/doc/licenses/okio-3.6.0/LICENSE.txt
deleted file mode 100644
index f49a4e16e..000000000
--- a/doc/licenses/okio-3.6.0/LICENSE.txt
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/okio-3.6.0/README b/doc/licenses/okio-3.6.0/README
index 75593ddb7..931417d37 100644
--- a/doc/licenses/okio-3.6.0/README
+++ b/doc/licenses/okio-3.6.0/README
@@ -4,4 +4,4 @@ okio (https://square.github.io/okio/)
     Version: 3.6.0
     From: 'Square Inc'
     License(s):
-        Apache 2.0 (bundled/okio-3.6.0/LICENSE.txt)
+        Apache 2.0
diff --git a/doc/licenses/retrofit-2.9.0/LICENSE.txt b/doc/licenses/retrofit-2.9.0/LICENSE.txt
deleted file mode 100644
index f49a4e16e..000000000
--- a/doc/licenses/retrofit-2.9.0/LICENSE.txt
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
\ No newline at end of file
diff --git a/doc/licenses/retrofit-2.9.0/README b/doc/licenses/retrofit-2.9.0/README
index 8de113264..b13d569d6 100644
--- a/doc/licenses/retrofit-2.9.0/README
+++ b/doc/licenses/retrofit-2.9.0/README
@@ -4,5 +4,5 @@ retrofit (https://square.github.io/retrofit/)
     Version: 2.9.0
     From: 'Square Inc'
     License(s):
-        Apache 2.0 (bundled/retrofit-2.9.0/LICENSE.txt)
+        Apache 2.0
 

From 9cca3dc6574e8446fdb55ae4f555930216a664b6 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 25 Apr 2024 17:21:09 -0700
Subject: [PATCH 277/289] GUACAMOLE-1289: Update recently-added, Duo-related
 dependency names to match the naming style of their corresponding projects.

---
 doc/licenses/logging-interceptor-4.9.1/README | 2 +-
 doc/licenses/okhttp-4.12.0/README             | 5 +++--
 doc/licenses/okio-3.6.0/README                | 5 +++--
 doc/licenses/retrofit-2.9.0/README            | 2 +-
 4 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/doc/licenses/logging-interceptor-4.9.1/README b/doc/licenses/logging-interceptor-4.9.1/README
index 4755b031c..e6c30ced5 100644
--- a/doc/licenses/logging-interceptor-4.9.1/README
+++ b/doc/licenses/logging-interceptor-4.9.1/README
@@ -1,4 +1,4 @@
-okhttp logging-interceptor (https://square.github.io/okhttp/)
+OkHttp Logging Interceptor (https://square.github.io/okhttp/)
 -------------------------------------------------------------
 
     Version: 4.9.1
diff --git a/doc/licenses/okhttp-4.12.0/README b/doc/licenses/okhttp-4.12.0/README
index c322ec2a6..54aee2549 100644
--- a/doc/licenses/okhttp-4.12.0/README
+++ b/doc/licenses/okhttp-4.12.0/README
@@ -1,7 +1,8 @@
-okhttp (https://square.github.io/okhttp/)
----------------------------------------------
+OkHttp (https://square.github.io/okhttp/)
+-----------------------------------------
 
     Version: 4.12.0
     From: 'Square Inc'
     License(s):
         Apache 2.0
+
diff --git a/doc/licenses/okio-3.6.0/README b/doc/licenses/okio-3.6.0/README
index 931417d37..23b519783 100644
--- a/doc/licenses/okio-3.6.0/README
+++ b/doc/licenses/okio-3.6.0/README
@@ -1,7 +1,8 @@
-okio (https://square.github.io/okio/)
----------------------------------------------
+Okio (https://square.github.io/okio/)
+-------------------------------------
 
     Version: 3.6.0
     From: 'Square Inc'
     License(s):
         Apache 2.0
+
diff --git a/doc/licenses/retrofit-2.9.0/README b/doc/licenses/retrofit-2.9.0/README
index b13d569d6..64da92651 100644
--- a/doc/licenses/retrofit-2.9.0/README
+++ b/doc/licenses/retrofit-2.9.0/README
@@ -1,4 +1,4 @@
-retrofit (https://square.github.io/retrofit/)
+Retrofit (https://square.github.io/retrofit/)
 ---------------------------------------------
 
     Version: 2.9.0

From 13bb5f0e30d396f9e0aa70f367fe8cbc3c4a5fc1 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 25 Apr 2024 17:28:02 -0700
Subject: [PATCH 278/289] GUACAMOLE-1289: Prevent IdentifierGenerator utility
 class from being instantiated.

---
 .../org/apache/guacamole/net/auth/IdentifierGenerator.java  | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/IdentifierGenerator.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/IdentifierGenerator.java
index fcc365a9b..2a2dd340f 100644
--- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/IdentifierGenerator.java
+++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/IdentifierGenerator.java
@@ -36,6 +36,12 @@ public class IdentifierGenerator {
      */
     private static final SecureRandom secureRandom = new SecureRandom();
 
+    /**
+     * IdentifierGenerator is a utility class that is not intended to be
+     * separately instantiated.
+     */
+    private IdentifierGenerator() {}
+    
     /**
      * Generates a unique and unpredictable identifier. Each identifier is at
      * least 256-bit and produced using a cryptographically-secure random

From 4a0e9f310f8af0abdd7b377e9cf2324590b12de1 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 25 Apr 2024 18:10:18 -0700
Subject: [PATCH 279/289] GUACAMOLE-1289: Ensure updates to credentials are
 accurately represented in failure events.

---
 .../rest/auth/AuthenticationService.java      | 83 +++++++------------
 1 file changed, 31 insertions(+), 52 deletions(-)

diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
index 7bb1e6fa8..5a0e4c5fe 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/auth/AuthenticationService.java
@@ -332,43 +332,6 @@ public class AuthenticationService {
 
     }
 
-    /**
-     * Performs arbitrary and optional updates to the credentials supplied by
-     * the authenticating user as dictated by the {@link AuthenticationProvider#updateCredentials(org.apache.guacamole.net.auth.Credentials)}
-     * functions of any installed AuthenticationProvider. Each installed
-     * AuthenticationProvider is given the opportunity, in order, to make
-     * updates to the supplied credentials.
-     *
-     * @param credentials
-     *     The credentials to be updated.
-     *
-     * @return
-     *     The set of credentials that should be provided to all
-     *     AuthenticationProviders during authentication, now possibly updated
-     *     (or even replaced) by any number of installed
-     *     AuthenticationProviders.
-     *
-     * @throws GuacamoleAuthenticationProcessException 
-     *     If an error occurs while updating the supplied credentials.
-     */
-    private Credentials getUpdatedCredentials(Credentials credentials)
-            throws GuacamoleAuthenticationProcessException {
-
-        for (AuthenticationProvider authProvider : authProviders) {
-            try {
-                credentials = authProvider.updateCredentials(credentials);
-            }
-            catch (GuacamoleException | RuntimeException | Error e) {
-                throw new GuacamoleAuthenticationProcessException("User "
-                        + "authentication aborted during credential "
-                        + "update/revision.", authProvider, e);
-            }
-        }
-
-        return credentials;
-
-    }
-
     /**
      * Authenticates a user using the given credentials and optional
      * authentication token, returning the authentication token associated with
@@ -394,27 +357,38 @@ public class AuthenticationService {
     public String authenticate(Credentials credentials, String token)
             throws GuacamoleException {
 
-        // Fire pre-authentication event before ANY authn/authz occurs at all
-        listenerService.handleEvent((AuthenticationRequestReceivedEvent) () -> credentials);
-
-        // Pull existing session if token provided
-        GuacamoleSession existingSession;
-        if (token != null)
-            existingSession = tokenSessionMap.get(token);
-        else
-            existingSession = null;
-
-        AuthenticatedUser authenticatedUser;
         String authToken;
-
         try {
 
             // Allow extensions to make updated to credentials prior to
-            // actual authentication
-            Credentials updatedCredentials = getUpdatedCredentials(credentials);
+            // actual authentication (NOTE: We do this here instead of in a
+            // separate function to ensure that failure events accurately
+            // represent the credentials that failed when a chain of credential
+            // updates is involved)
+            for (AuthenticationProvider authProvider : authProviders) {
+                try {
+                    credentials = authProvider.updateCredentials(credentials);
+                }
+                catch (GuacamoleException | RuntimeException | Error e) {
+                    throw new GuacamoleAuthenticationProcessException("User "
+                            + "authentication aborted during credential "
+                            + "update/revision.", authProvider, e);
+                }
+            }
+
+            // Fire pre-authentication event before ANY authn/authz occurs at all
+            final Credentials updatedCredentials = credentials;
+            listenerService.handleEvent((AuthenticationRequestReceivedEvent) () -> updatedCredentials);
+
+            // Pull existing session if token provided
+            GuacamoleSession existingSession;
+            if (token != null)
+                existingSession = tokenSessionMap.get(token);
+            else
+                existingSession = null;
 
             // Get up-to-date AuthenticatedUser and associated UserContexts
-            authenticatedUser = getAuthenticatedUser(existingSession, updatedCredentials);
+            AuthenticatedUser authenticatedUser = getAuthenticatedUser(existingSession, updatedCredentials);
             List<DecoratedUserContext> userContexts = getUserContexts(existingSession, authenticatedUser, updatedCredentials);
 
             // Update existing session, if it exists
@@ -445,6 +419,11 @@ public class AuthenticationService {
         // Log and rethrow any authentication errors
         catch (GuacamoleAuthenticationProcessException e) {
 
+            // NOTE: The credentials referenced here are intentionally NOT the
+            // final updatedCredentials reference (though they may often be
+            // equivalent) to ensure that failure events accurately represent
+            // the credentials that failed if that failure occurs in the middle
+            // of a chain of credential updates via updateCredentials()
             listenerService.handleEvent(new AuthenticationFailureEvent(credentials,
                     e.getAuthenticationProvider(), e.getCause()));
 

From ed4c0ab7792606f4c0e573cdb5ce4fc44ad31ea6 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 25 Apr 2024 18:43:00 -0700
Subject: [PATCH 280/289] GUACAMOLE-1289: Redirect back to Duo in case of
 unexpected failures or invalid tokens.

---
 .../auth/duo/UserVerificationService.java     | 141 +++++++++++-------
 1 file changed, 87 insertions(+), 54 deletions(-)

diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
index a30f4d7cd..1fe6d9979 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
@@ -31,18 +31,25 @@ import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
 import org.apache.guacamole.auth.duo.conf.ConfigurationService;
 import org.apache.guacamole.form.RedirectField;
-import org.apache.guacamole.language.TranslatableGuacamoleClientException;
 import org.apache.guacamole.language.TranslatableGuacamoleInsufficientCredentialsException;
 import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
+import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * Service for verifying the identity of a user against Duo.
  */
 public class UserVerificationService {
 
+    /**
+     * Logger for this class.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(UserVerificationService.class);
+
     /**
      * The name of the HTTP parameter that Duo will use to communicate the
      * result of the user's attempt to authenticate with their service. This
@@ -143,72 +150,98 @@ public class UserVerificationService {
 
         // Redirect to Duo to obtain an authentication code if that redirect
         // has not yet occurred
-        if (duoCode == null || duoState == null) {
+        if (duoCode != null && duoState != null) {
 
-            // Store received credentials for later retrieval leveraging Duo's
-            // opaque session state identifier (we need to maintain these
-            // credentials so that things like the GUAC_USERNAME and
-            // GUAC_PASSWORD tokens continue to work as expected despite the
-            // redirect to/from the external Duo service)
-            duoState = duoClient.generateState();
-            long expirationTimestamp = System.currentTimeMillis() + (confService.getAuthenticationTimeout() * 60000L);
-            sessionManager.defer(new DuoAuthenticationSession(credentials, expirationTimestamp), duoState);
-
-            // Obtain authentication URL from Duo client
-            String duoAuthUrlString;
+            // Validate that the user has successfully verified their identify with
+            // the Duo service
             try {
-                duoAuthUrlString = duoClient.createAuthUrl(username, duoState);
+
+                // Note unexpected behavior (Duo is expected to always return
+                // a token)
+                Token token = duoClient.exchangeAuthorizationCodeFor2FAResult(duoCode, username);
+                if (token == null) {
+                    logger.warn("Duo did not return an authentication result "
+                            + "at all for the authentication attempt by user "
+                            + "\"{}\". This is unexpected behavior and may be "
+                            + "a bug in the Duo service or the Duo SDK. "
+                            + "Guacamole will attempt to automatically work "
+                            + "around the issue by making a fresh Duo "
+                            + "authentication request.", username);
+                }
+
+                // Warn if Duo explicitly denies authentication
+                else if (token.getAuth_result() == null || !DUO_TOKEN_SUCCESS_VALUE.equals(token.getAuth_result().getStatus())) {
+                    logger.warn("Duo did not return an explicitly successful "
+                            + "authentication result for the authentication "
+                            + "attempt by user \"{}\". The user will now be "
+                            + "redirected back to the Duo service to reattempt"
+                            + "authentication.", username);
+                }
+
+                // Allow user to continue authenticating with Guacamole only if
+                // Duo has validated their identity
+                else
+                    return;
+
             }
             catch (DuoException e) {
-                throw new GuacamoleServerException("Duo client failed to "
-                        + "generate the authentication URL necessary to "
-                        + "redirect the authenticating user to the Duo "
-                        + "service.", e);
+                logger.debug("The Duo client failed internally while "
+                        + "attempting to validate the identity of user "
+                        + "\"{}\". This is commonly caused by stale query "
+                        + "parameters from an older Duo request remaining "
+                        + "present in the Guacamole URL. The user will now be "
+                        + "redirected back to the Duo service to reattempt "
+                        + "authentication.", e);
             }
 
-            // Parse and validate URL obtained from Duo client
-            URI duoAuthUrl;
-            try {
-                duoAuthUrl = new URI(duoAuthUrlString);
-            }
-            catch (URISyntaxException e) {
-                throw new GuacamoleServerException("Authentication URL "
-                        + "generated by the Duo client is not actually a "
-                        + "valid URL and cannot be used to redirect the "
-                        + "authenticating user to the Duo service.", e);
-            }
-
-            // Request that user be redirected to the Duo service to obtain
-            // a Duo authentication code
-            throw new TranslatableGuacamoleInsufficientCredentialsException(
-                "Verification using Duo is required before authentication "
-                + "can continue.", "LOGIN.INFO_DUO_AUTH_REQUIRED",
-                new CredentialsInfo(Collections.singletonList(
-                    new RedirectField(
-                            DUO_CODE_PARAMETER_NAME, duoAuthUrl,
-                            new TranslatableMessage("LOGIN.INFO_DUO_REDIRECT_PENDING")
-                    )
-                ))
-            );
-
         }
 
-        // Validate that the user has successfully verified their identify with
-        // the Duo service
+        // Store received credentials for later retrieval leveraging Duo's
+        // opaque session state identifier (we need to maintain these
+        // credentials so that things like the GUAC_USERNAME and
+        // GUAC_PASSWORD tokens continue to work as expected despite the
+        // redirect to/from the external Duo service)
+        duoState = duoClient.generateState();
+        long expirationTimestamp = System.currentTimeMillis() + (confService.getAuthenticationTimeout() * 60000L);
+        sessionManager.defer(new DuoAuthenticationSession(credentials, expirationTimestamp), duoState);
+
+        // Obtain authentication URL from Duo client
+        String duoAuthUrlString;
         try {
-            Token token = duoClient.exchangeAuthorizationCodeFor2FAResult(duoCode, username);
-            if (token == null || token.getAuth_result() == null
-                    || !DUO_TOKEN_SUCCESS_VALUE.equals(token.getAuth_result().getStatus()))
-                throw new TranslatableGuacamoleClientException("Provided Duo "
-                        + "validation code is incorrect.",
-                        "LOGIN.INFO_DUO_VALIDATION_CODE_INCORRECT");
+            duoAuthUrlString = duoClient.createAuthUrl(username, duoState);
         }
         catch (DuoException e) {
-            throw new GuacamoleServerException("Duo client refused to verify "
-                    + "the identity of the authenticating user due to an "
-                    + "underlying error condition.", e);
+            throw new GuacamoleServerException("Duo client failed to "
+                    + "generate the authentication URL necessary to "
+                    + "redirect the authenticating user to the Duo "
+                    + "service.", e);
         }
 
+        // Parse and validate URL obtained from Duo client
+        URI duoAuthUrl;
+        try {
+            duoAuthUrl = new URI(duoAuthUrlString);
+        }
+        catch (URISyntaxException e) {
+            throw new GuacamoleServerException("Authentication URL "
+                    + "generated by the Duo client is not actually a "
+                    + "valid URL and cannot be used to redirect the "
+                    + "authenticating user to the Duo service.", e);
+        }
+
+        // Request that user be redirected to the Duo service to obtain
+        // a Duo authentication code
+        throw new TranslatableGuacamoleInsufficientCredentialsException(
+            "Verification using Duo is required before authentication "
+            + "can continue.", "LOGIN.INFO_DUO_AUTH_REQUIRED",
+            new CredentialsInfo(Collections.singletonList(
+                new RedirectField(
+                        DUO_CODE_PARAMETER_NAME, duoAuthUrl,
+                        new TranslatableMessage("LOGIN.INFO_DUO_REDIRECT_PENDING")
+                )
+            ))
+        );
+
     }
 
 }

From ee75b01c50c463395807dde9f4b3a32f01025733 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Fri, 26 Apr 2024 00:40:51 -0700
Subject: [PATCH 281/289] GUACAMOLE-1289: Expiration times for
 AuthenticationSessionManager are relative, not absolute.

---
 .../apache/guacamole/auth/duo/UserVerificationService.java  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
index 1fe6d9979..2333e21ef 100644
--- a/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
+++ b/extensions/guacamole-auth-duo/src/main/java/org/apache/guacamole/auth/duo/UserVerificationService.java
@@ -26,6 +26,7 @@ import com.google.inject.Inject;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Collections;
+import java.util.concurrent.TimeUnit;
 import javax.servlet.http.HttpServletRequest;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleServerException;
@@ -36,7 +37,6 @@ import org.apache.guacamole.language.TranslatableMessage;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.credentials.CredentialsInfo;
-import org.apache.guacamole.net.auth.credentials.GuacamoleInvalidCredentialsException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -202,8 +202,8 @@ public class UserVerificationService {
         // GUAC_PASSWORD tokens continue to work as expected despite the
         // redirect to/from the external Duo service)
         duoState = duoClient.generateState();
-        long expirationTimestamp = System.currentTimeMillis() + (confService.getAuthenticationTimeout() * 60000L);
-        sessionManager.defer(new DuoAuthenticationSession(credentials, expirationTimestamp), duoState);
+        long expiresAfter = TimeUnit.MINUTES.toMillis(confService.getAuthenticationTimeout());
+        sessionManager.defer(new DuoAuthenticationSession(credentials, expiresAfter), duoState);
 
         // Obtain authentication URL from Duo client
         String duoAuthUrlString;

From 58d6828e17b92c9c7c0a85a0eb642ac98fc411e3 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Wed, 1 May 2024 10:24:13 -0700
Subject: [PATCH 282/289] GUACAMOLE-1289: Remove old license information from
 before migration to Duo's "Universal Prompt".

---
 .../src/licenses/bundled/README               |  4 ---
 .../licenses/bundled/duo-java-56570d1/LICENSE | 25 -------------------
 .../licenses/bundled/duo-java-56570d1/README  |  8 ------
 .../src/main/resources/license.txt            | 18 -------------
 4 files changed, 55 deletions(-)
 delete mode 100644 extensions/guacamole-auth-duo/src/licenses/bundled/README
 delete mode 100644 extensions/guacamole-auth-duo/src/licenses/bundled/duo-java-56570d1/LICENSE
 delete mode 100644 extensions/guacamole-auth-duo/src/licenses/bundled/duo-java-56570d1/README
 delete mode 100644 extensions/guacamole-auth-duo/src/main/resources/license.txt

diff --git a/extensions/guacamole-auth-duo/src/licenses/bundled/README b/extensions/guacamole-auth-duo/src/licenses/bundled/README
deleted file mode 100644
index 47ba19db0..000000000
--- a/extensions/guacamole-auth-duo/src/licenses/bundled/README
+++ /dev/null
@@ -1,4 +0,0 @@
-Apache Guacamole includes a number of subcomponents with separate copyright
-notices and license terms. Your use of these subcomponents is subject to the
-terms and conditions of their respective licenses, included within this
-directory for reference.
diff --git a/extensions/guacamole-auth-duo/src/licenses/bundled/duo-java-56570d1/LICENSE b/extensions/guacamole-auth-duo/src/licenses/bundled/duo-java-56570d1/LICENSE
deleted file mode 100644
index 66e1f74d5..000000000
--- a/extensions/guacamole-auth-duo/src/licenses/bundled/duo-java-56570d1/LICENSE
+++ /dev/null
@@ -1,25 +0,0 @@
-Copyright (c) 2011, Duo Security, Inc.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. The name of the author may not be used to endorse or promote products
-   derived from this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/extensions/guacamole-auth-duo/src/licenses/bundled/duo-java-56570d1/README b/extensions/guacamole-auth-duo/src/licenses/bundled/duo-java-56570d1/README
deleted file mode 100644
index 3fbce98dd..000000000
--- a/extensions/guacamole-auth-duo/src/licenses/bundled/duo-java-56570d1/README
+++ /dev/null
@@ -1,8 +0,0 @@
-DuoWeb Java SDK (https://github.com/duosecurity/duo_java)
----------------------------------------------------------
-
-    Verson: commit 56570d18a1f98642500e6c1158a3f41e448963ff
-    From: `Duo Security, Inc.' (https://duo.com/)
-    License(s):
-        BSD 3-clause (bundled/duo-java-56570d1/LICENSE)
-
diff --git a/extensions/guacamole-auth-duo/src/main/resources/license.txt b/extensions/guacamole-auth-duo/src/main/resources/license.txt
deleted file mode 100644
index 042f3ce1f..000000000
--- a/extensions/guacamole-auth-duo/src/main/resources/license.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */

From b92871f11e5ffcb4a611b46aad7c60c025cb0ce4 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Thu, 2 May 2024 08:05:17 -0400
Subject: [PATCH 283/289] GUACAMOLE-1267: Add client-side setting for disabling
 server input.

---
 .../main/resources/org/apache/guacamole/protocols/vnc.json   | 5 +++++
 guacamole/src/main/frontend/src/translations/en.json         | 5 +++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
index 3c87f99e1..651d943fd 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
@@ -38,6 +38,11 @@
                     "type"    : "BOOLEAN",
                     "options" : [ "true" ]
                 },
+                {
+                    "name"    : "disable-server-input",
+                    "type"    : "BOOLEAN",
+                    "options" : [ "true" ]
+                },
                 {
                     "name"    : "swap-red-blue",
                     "type"    : "BOOLEAN",
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 76b22d3c3..39b19691c 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -904,8 +904,9 @@
         "FIELD_HEADER_CURSOR"           : "Cursor:",
         "FIELD_HEADER_DEST_HOST"        : "Destination host:",
         "FIELD_HEADER_DEST_PORT"        : "Destination port:",
-        "FIELD_HEADER_DISABLE_COPY"     : "Disable copying from remote desktop:",
-        "FIELD_HEADER_DISABLE_PASTE"    : "Disable pasting from client:",
+        "FIELD_HEADER_DISABLE_COPY"         : "Disable copying from remote desktop:",
+        "FIELD_HEADER_DISABLE_PASTE"        : "Disable pasting from client:",
+        "FIELD_HEADER_DISABLE_SERVER_INPUT" : "Disable server input when client is connected:",
         "FIELD_HEADER_ENABLE_AUDIO"     : "Enable audio:",
         "FIELD_HEADER_ENABLE_SFTP"      : "Enable SFTP:",
         "FIELD_HEADER_FORCE_LOSSLESS"   : "Force lossless compression:",

From ea7c5ef18ea977bc1691f119ac2e2a29f7a55b19 Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 11 Jun 2024 18:43:38 +0000
Subject: [PATCH 284/289] GUACAMOLE-1956: Switch guacamole-auth-sso-ssl to
 updated version of bc-fips.

---
 .../guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
index 8926517df..991f278fd 100644
--- a/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
+++ b/extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/pom.xml
@@ -142,7 +142,7 @@
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bc-fips</artifactId>
-            <version>1.0.2.4</version>
+            <version>1.0.2.5</version>
         </dependency>
 
     </dependencies>

From 279dc3866e6d3aa8f020d71b1ba0598340de45ff Mon Sep 17 00:00:00 2001
From: James Muehlner <james.muehlner@guac-dev.org>
Date: Tue, 11 Jun 2024 21:40:28 +0000
Subject: [PATCH 285/289] GUACAMOLE-1956: Update NPM dependencies.

---
 doc/licenses/csv-6.2.5/dep-coordinates.txt    |    2 -
 doc/licenses/{csv-6.2.5 => csv-6.3.9}/LICENSE |    0
 doc/licenses/{csv-6.2.5 => csv-6.3.9}/README  |    4 +-
 doc/licenses/csv-6.3.9/dep-coordinates.txt    |    2 +
 guacamole/src/main/frontend/package-lock.json | 3274 +++++++++--------
 guacamole/src/main/frontend/package.json      |    8 +-
 6 files changed, 1741 insertions(+), 1549 deletions(-)
 delete mode 100644 doc/licenses/csv-6.2.5/dep-coordinates.txt
 rename doc/licenses/{csv-6.2.5 => csv-6.3.9}/LICENSE (100%)
 rename doc/licenses/{csv-6.2.5 => csv-6.3.9}/README (72%)
 create mode 100644 doc/licenses/csv-6.3.9/dep-coordinates.txt

diff --git a/doc/licenses/csv-6.2.5/dep-coordinates.txt b/doc/licenses/csv-6.2.5/dep-coordinates.txt
deleted file mode 100644
index dc0f22695..000000000
--- a/doc/licenses/csv-6.2.5/dep-coordinates.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-csv:6.2.5
-csv-parse:5.3.3
diff --git a/doc/licenses/csv-6.2.5/LICENSE b/doc/licenses/csv-6.3.9/LICENSE
similarity index 100%
rename from doc/licenses/csv-6.2.5/LICENSE
rename to doc/licenses/csv-6.3.9/LICENSE
diff --git a/doc/licenses/csv-6.2.5/README b/doc/licenses/csv-6.3.9/README
similarity index 72%
rename from doc/licenses/csv-6.2.5/README
rename to doc/licenses/csv-6.3.9/README
index 8a8d6debb..691f87f67 100644
--- a/doc/licenses/csv-6.2.5/README
+++ b/doc/licenses/csv-6.3.9/README
@@ -1,7 +1,7 @@
 node-csv (https://github.com/adaltas/node-csv)
 ---------------------------------------------
 
-    Version: 6.2.5
+    Version: 6.3.9
     From: 'Adaltas' (https://github.com/adaltas)
     License(s):
-        MIT (bundled/csv-6.2.5/LICENSE)
+        MIT (bundled/csv-6.3.9/LICENSE)
diff --git a/doc/licenses/csv-6.3.9/dep-coordinates.txt b/doc/licenses/csv-6.3.9/dep-coordinates.txt
new file mode 100644
index 000000000..53c436734
--- /dev/null
+++ b/doc/licenses/csv-6.3.9/dep-coordinates.txt
@@ -0,0 +1,2 @@
+csv:6.3.9
+csv-parse:5.5.6
diff --git a/guacamole/src/main/frontend/package-lock.json b/guacamole/src/main/frontend/package-lock.json
index 1afa2825a..21ceaa486 100644
--- a/guacamole/src/main/frontend/package-lock.json
+++ b/guacamole/src/main/frontend/package-lock.json
@@ -13,7 +13,7 @@
                 "angular-translate-interpolation-messageformat": "^2.19.1",
                 "angular-translate-loader-static-files": "^2.19.1",
                 "blob-polyfill": ">=7.0.20220408",
-                "csv": "^6.2.5",
+                "csv": "^6.3.9",
                 "d3-path": "^3.1.0",
                 "d3-shape": "^3.2.0",
                 "datalist-polyfill": "^1.25.1",
@@ -22,11 +22,11 @@
                 "jquery": "^3.7.1",
                 "jstz": "^2.1.1",
                 "lodash": "^4.17.21",
-                "yaml": "^2.2.2"
+                "yaml": "^2.4.5"
             },
             "devDependencies": {
-                "@babel/core": "^7.20.12",
-                "@babel/preset-env": "^7.20.2",
+                "@babel/core": "^7.24.7",
+                "@babel/preset-env": "^7.24.7",
                 "babel-loader": "^8.3.0",
                 "clean-webpack-plugin": "^4.0.0",
                 "closure-webpack-plugin": "^2.6.1",
@@ -56,47 +56,48 @@
             }
         },
         "node_modules/@babel/code-frame": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.18.6.tgz",
-            "integrity": "sha512-TDCmlK5eOvH+eH7cdAFlNXeVJqWIQ7gW9tY1GJIpUtFb6CmjVyq2VM3u71bOyR8CRihcCgMUYoDNyLXao3+70Q==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.24.7.tgz",
+            "integrity": "sha512-BcYH1CVJBO9tvyIZ2jVeXgSIMvGZ2FDRvDdOIVQyuklNKSsx+eppDEBq/g47Ayw+RqNFE+URvOShmf+f/qwAlA==",
             "dev": true,
             "dependencies": {
-                "@babel/highlight": "^7.18.6"
+                "@babel/highlight": "^7.24.7",
+                "picocolors": "^1.0.0"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/compat-data": {
-            "version": "7.20.10",
-            "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.20.10.tgz",
-            "integrity": "sha512-sEnuDPpOJR/fcafHMjpcpGN5M2jbUGUHwmuWKM/YdPzeEDJg8bgmbcWQFUfE32MQjti1koACvoPVsDe8Uq+idg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.24.7.tgz",
+            "integrity": "sha512-qJzAIcv03PyaWqxRgO4mSU3lihncDT296vnyuE2O8uA4w3UHWI4S3hgeZd1L8W1Bft40w9JxJ2b412iDUFFRhw==",
             "dev": true,
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/core": {
-            "version": "7.20.12",
-            "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.20.12.tgz",
-            "integrity": "sha512-XsMfHovsUYHFMdrIHkZphTN/2Hzzi78R08NuHfDBehym2VsPDL6Zn/JAD/JQdnRvbSsbQc4mVaU1m6JgtTEElg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.24.7.tgz",
+            "integrity": "sha512-nykK+LEK86ahTkX/3TgauT0ikKoNCfKHEaZYTUVupJdTLzGNvrblu4u6fa7DhZONAltdf8e662t/abY8idrd/g==",
             "dev": true,
             "dependencies": {
-                "@ampproject/remapping": "^2.1.0",
-                "@babel/code-frame": "^7.18.6",
-                "@babel/generator": "^7.20.7",
-                "@babel/helper-compilation-targets": "^7.20.7",
-                "@babel/helper-module-transforms": "^7.20.11",
-                "@babel/helpers": "^7.20.7",
-                "@babel/parser": "^7.20.7",
-                "@babel/template": "^7.20.7",
-                "@babel/traverse": "^7.20.12",
-                "@babel/types": "^7.20.7",
-                "convert-source-map": "^1.7.0",
+                "@ampproject/remapping": "^2.2.0",
+                "@babel/code-frame": "^7.24.7",
+                "@babel/generator": "^7.24.7",
+                "@babel/helper-compilation-targets": "^7.24.7",
+                "@babel/helper-module-transforms": "^7.24.7",
+                "@babel/helpers": "^7.24.7",
+                "@babel/parser": "^7.24.7",
+                "@babel/template": "^7.24.7",
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7",
+                "convert-source-map": "^2.0.0",
                 "debug": "^4.1.0",
                 "gensync": "^1.0.0-beta.2",
-                "json5": "^2.2.2",
-                "semver": "^6.3.0"
+                "json5": "^2.2.3",
+                "semver": "^6.3.1"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -142,22 +143,23 @@
             "dev": true
         },
         "node_modules/@babel/core/node_modules/semver": {
-            "version": "6.3.0",
-            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-            "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+            "version": "6.3.1",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+            "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
             "dev": true,
             "bin": {
                 "semver": "bin/semver.js"
             }
         },
         "node_modules/@babel/generator": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.20.7.tgz",
-            "integrity": "sha512-7wqMOJq8doJMZmP4ApXTzLxSr7+oO2jroJURrVEp6XShrQUObV8Tq/D0NCcoYg2uHqUrjzO0zwBjoYzelxK+sw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.24.7.tgz",
+            "integrity": "sha512-oipXieGC3i45Y1A41t4tAqpnEZWgB/lC6Ehh6+rOviR5XWpTtMmLN+fGjz9vOiNRt0p6RtO6DtD0pdU3vpqdSA==",
             "dev": true,
             "dependencies": {
-                "@babel/types": "^7.20.7",
-                "@jridgewell/gen-mapping": "^0.3.2",
+                "@babel/types": "^7.24.7",
+                "@jridgewell/gen-mapping": "^0.3.5",
+                "@jridgewell/trace-mapping": "^0.3.25",
                 "jsesc": "^2.5.1"
             },
             "engines": {
@@ -165,14 +167,14 @@
             }
         },
         "node_modules/@babel/generator/node_modules/@jridgewell/gen-mapping": {
-            "version": "0.3.2",
-            "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
-            "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+            "version": "0.3.5",
+            "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.5.tgz",
+            "integrity": "sha512-IzL8ZoEDIBRWEzlCcRhOaCupYyN5gdIK+Q6fbFdPDg6HqX6jpkItn7DFIpW9LQzXG6Df9sA7+OKnq0qlz/GaQg==",
             "dev": true,
             "dependencies": {
-                "@jridgewell/set-array": "^1.0.1",
+                "@jridgewell/set-array": "^1.2.1",
                 "@jridgewell/sourcemap-codec": "^1.4.10",
-                "@jridgewell/trace-mapping": "^0.3.9"
+                "@jridgewell/trace-mapping": "^0.3.24"
             },
             "engines": {
                 "node": ">=6.0.0"
@@ -191,72 +193,70 @@
             }
         },
         "node_modules/@babel/helper-annotate-as-pure": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.18.6.tgz",
-            "integrity": "sha512-duORpUiYrEpzKIop6iNbjnwKLAKnJ47csTyRACyEmWj0QdUrm5aqNJGHSSEQSUAvNW0ojX0dOmK9dZduvkfeXA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.24.7.tgz",
+            "integrity": "sha512-BaDeOonYvhdKw+JoMVkAixAAJzG2jVPIwWoKBPdYuY9b452e2rPuI9QPYh3KpofZ3pW2akOmwZLOiOsHMiqRAg==",
             "dev": true,
             "dependencies": {
-                "@babel/types": "^7.18.6"
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-builder-binary-assignment-operator-visitor": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.18.9.tgz",
-            "integrity": "sha512-yFQ0YCHoIqarl8BCRwBL8ulYUaZpz3bNsA7oFepAzee+8/+ImtADXNOmO5vJvsPff3qi+hvpkY/NYBTrBQgdNw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.24.7.tgz",
+            "integrity": "sha512-xZeCVVdwb4MsDBkkyZ64tReWYrLRHlMN72vP7Bdm3OUOuyFZExhsHUUnuWnm2/XOlAJzR0LfPpB56WXZn0X/lA==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-explode-assignable-expression": "^7.18.6",
-                "@babel/types": "^7.18.9"
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-compilation-targets": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.20.7.tgz",
-            "integrity": "sha512-4tGORmfQcrc+bvrjb5y3dG9Mx1IOZjsHqQVUz7XCNHO+iTmqxWnVg3KRygjGmpRLJGdQSKuvFinbIb0CnZwHAQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.24.7.tgz",
+            "integrity": "sha512-ctSdRHBi20qWOfy27RUb4Fhp07KSJ3sXcuSvTrXrc4aG8NSYDo1ici3Vhg9bg69y5bj0Mr1lh0aeEgTvc12rMg==",
             "dev": true,
             "dependencies": {
-                "@babel/compat-data": "^7.20.5",
-                "@babel/helper-validator-option": "^7.18.6",
-                "browserslist": "^4.21.3",
+                "@babel/compat-data": "^7.24.7",
+                "@babel/helper-validator-option": "^7.24.7",
+                "browserslist": "^4.22.2",
                 "lru-cache": "^5.1.1",
-                "semver": "^6.3.0"
+                "semver": "^6.3.1"
             },
             "engines": {
                 "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0"
             }
         },
         "node_modules/@babel/helper-compilation-targets/node_modules/semver": {
-            "version": "6.3.0",
-            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-            "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+            "version": "6.3.1",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+            "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
             "dev": true,
             "bin": {
                 "semver": "bin/semver.js"
             }
         },
         "node_modules/@babel/helper-create-class-features-plugin": {
-            "version": "7.20.12",
-            "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.20.12.tgz",
-            "integrity": "sha512-9OunRkbT0JQcednL0UFvbfXpAsUXiGjUk0a7sN8fUXX7Mue79cUSMjHGDRRi/Vz9vYlpIhLV5fMD5dKoMhhsNQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.24.7.tgz",
+            "integrity": "sha512-kTkaDl7c9vO80zeX1rJxnuRpEsD5tA81yh11X1gQo+PhSti3JS+7qeZo9U4RHobKRiFPKaGK3svUAeb8D0Q7eg==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-annotate-as-pure": "^7.18.6",
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-function-name": "^7.19.0",
-                "@babel/helper-member-expression-to-functions": "^7.20.7",
-                "@babel/helper-optimise-call-expression": "^7.18.6",
-                "@babel/helper-replace-supers": "^7.20.7",
-                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
-                "@babel/helper-split-export-declaration": "^7.18.6"
+                "@babel/helper-annotate-as-pure": "^7.24.7",
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-function-name": "^7.24.7",
+                "@babel/helper-member-expression-to-functions": "^7.24.7",
+                "@babel/helper-optimise-call-expression": "^7.24.7",
+                "@babel/helper-replace-supers": "^7.24.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.24.7",
+                "@babel/helper-split-export-declaration": "^7.24.7",
+                "semver": "^6.3.1"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -265,14 +265,24 @@
                 "@babel/core": "^7.0.0"
             }
         },
+        "node_modules/@babel/helper-create-class-features-plugin/node_modules/semver": {
+            "version": "6.3.1",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+            "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+            "dev": true,
+            "bin": {
+                "semver": "bin/semver.js"
+            }
+        },
         "node_modules/@babel/helper-create-regexp-features-plugin": {
-            "version": "7.20.5",
-            "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.20.5.tgz",
-            "integrity": "sha512-m68B1lkg3XDGX5yCvGO0kPx3v9WIYLnzjKfPcQiwntEQa5ZeRkPmo2X/ISJc8qxWGfwUr+kvZAeEzAwLec2r2w==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.24.7.tgz",
+            "integrity": "sha512-03TCmXy2FtXJEZfbXDTSqq1fRJArk7lX9DOFC/47VthYcxyIOx+eXQmdo6DOQvrbpIix+KfXwvuXdFDZHxt+rA==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-annotate-as-pure": "^7.18.6",
-                "regexpu-core": "^5.2.1"
+                "@babel/helper-annotate-as-pure": "^7.24.7",
+                "regexpu-core": "^5.3.1",
+                "semver": "^6.3.1"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -281,27 +291,35 @@
                 "@babel/core": "^7.0.0"
             }
         },
+        "node_modules/@babel/helper-create-regexp-features-plugin/node_modules/semver": {
+            "version": "6.3.1",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+            "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+            "dev": true,
+            "bin": {
+                "semver": "bin/semver.js"
+            }
+        },
         "node_modules/@babel/helper-define-polyfill-provider": {
-            "version": "0.3.3",
-            "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.3.3.tgz",
-            "integrity": "sha512-z5aQKU4IzbqCC1XH0nAqfsFLMVSo22SBKUc0BxGrLkolTdPTructy0ToNnlO2zA4j9Q/7pjMZf0DSY+DSTYzww==",
+            "version": "0.6.2",
+            "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.6.2.tgz",
+            "integrity": "sha512-LV76g+C502biUK6AyZ3LK10vDpDyCzZnhZFXkH1L75zHPj68+qc8Zfpx2th+gzwA2MzyK+1g/3EPl62yFnVttQ==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-compilation-targets": "^7.17.7",
-                "@babel/helper-plugin-utils": "^7.16.7",
+                "@babel/helper-compilation-targets": "^7.22.6",
+                "@babel/helper-plugin-utils": "^7.22.5",
                 "debug": "^4.1.1",
                 "lodash.debounce": "^4.0.8",
-                "resolve": "^1.14.2",
-                "semver": "^6.1.2"
+                "resolve": "^1.14.2"
             },
             "peerDependencies": {
-                "@babel/core": "^7.4.0-0"
+                "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0"
             }
         },
         "node_modules/@babel/helper-define-polyfill-provider/node_modules/debug": {
-            "version": "4.3.4",
-            "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
-            "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+            "version": "4.3.5",
+            "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.5.tgz",
+            "integrity": "sha512-pt0bNEmneDIvdL1Xsd9oDQ/wrQRkXDT4AUWlNZNPKvW5x/jyO9VFXkJUP07vQ2upmw5PlaITaPKc31jK13V+jg==",
             "dev": true,
             "dependencies": {
                 "ms": "2.1.2"
@@ -321,135 +339,118 @@
             "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
             "dev": true
         },
-        "node_modules/@babel/helper-define-polyfill-provider/node_modules/semver": {
-            "version": "6.3.0",
-            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-            "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-            "dev": true,
-            "bin": {
-                "semver": "bin/semver.js"
-            }
-        },
         "node_modules/@babel/helper-environment-visitor": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.18.9.tgz",
-            "integrity": "sha512-3r/aACDJ3fhQ/EVgFy0hpj8oHyHpQc+LPtJoY9SzTThAsStm4Ptegq92vqKoE3vD706ZVFWITnMnxucw+S9Ipg==",
-            "dev": true,
-            "engines": {
-                "node": ">=6.9.0"
-            }
-        },
-        "node_modules/@babel/helper-explode-assignable-expression": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-explode-assignable-expression/-/helper-explode-assignable-expression-7.18.6.tgz",
-            "integrity": "sha512-eyAYAsQmB80jNfg4baAtLeWAQHfHFiR483rzFK+BhETlGZaQC9bsfrugfXDCbRHLQbIA7U5NxhhOxN7p/dWIcg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.24.7.tgz",
+            "integrity": "sha512-DoiN84+4Gnd0ncbBOM9AZENV4a5ZiL39HYMyZJGZ/AZEykHYdJw0wW3kdcsh9/Kn+BRXHLkkklZ51ecPKmI1CQ==",
             "dev": true,
             "dependencies": {
-                "@babel/types": "^7.18.6"
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-function-name": {
-            "version": "7.19.0",
-            "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.19.0.tgz",
-            "integrity": "sha512-WAwHBINyrpqywkUH0nTnNgI5ina5TFn85HKS0pbPDfxFfhyR/aNQEn4hGi1P1JyT//I0t4OgXUlofzWILRvS5w==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.24.7.tgz",
+            "integrity": "sha512-FyoJTsj/PEUWu1/TYRiXTIHc8lbw+TDYkZuoE43opPS5TrI7MyONBE1oNvfguEXAD9yhQRrVBnXdXzSLQl9XnA==",
             "dev": true,
             "dependencies": {
-                "@babel/template": "^7.18.10",
-                "@babel/types": "^7.19.0"
+                "@babel/template": "^7.24.7",
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-hoist-variables": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.18.6.tgz",
-            "integrity": "sha512-UlJQPkFqFULIcyW5sbzgbkxn2FKRgwWiRexcuaR8RNJRy8+LLveqPjwZV/bwrLZCN0eUHD/x8D0heK1ozuoo6Q==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.24.7.tgz",
+            "integrity": "sha512-MJJwhkoGy5c4ehfoRyrJ/owKeMl19U54h27YYftT0o2teQ3FJ3nQUf/I3LlJsX4l3qlw7WRXUmiyajvHXoTubQ==",
             "dev": true,
             "dependencies": {
-                "@babel/types": "^7.18.6"
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-member-expression-to-functions": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.20.7.tgz",
-            "integrity": "sha512-9J0CxJLq315fEdi4s7xK5TQaNYjZw+nDVpVqr1axNGKzdrdwYBD5b4uKv3n75aABG0rCCTK8Im8Ww7eYfMrZgw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.24.7.tgz",
+            "integrity": "sha512-LGeMaf5JN4hAT471eJdBs/GK1DoYIJ5GCtZN/EsL6KUiiDZOvO/eKE11AMZJa2zP4zk4qe9V2O/hxAmkRc8p6w==",
             "dev": true,
             "dependencies": {
-                "@babel/types": "^7.20.7"
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-module-imports": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.18.6.tgz",
-            "integrity": "sha512-0NFvs3VkuSYbFi1x2Vd6tKrywq+z/cLeYC/RJNFrIX/30Bf5aiGYbtvGXolEktzJH8o5E5KJ3tT+nkxuuZFVlA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.24.7.tgz",
+            "integrity": "sha512-8AyH3C+74cgCVVXow/myrynrAGv+nTVg5vKu2nZph9x7RcRwzmh0VFallJuFTZ9mx6u4eSdXZfcOzSqTUm0HCA==",
             "dev": true,
             "dependencies": {
-                "@babel/types": "^7.18.6"
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-module-transforms": {
-            "version": "7.20.11",
-            "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.20.11.tgz",
-            "integrity": "sha512-uRy78kN4psmji1s2QtbtcCSaj/LILFDp0f/ymhpQH5QY3nljUZCaNWz9X1dEj/8MBdBEFECs7yRhKn8i7NjZgg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.24.7.tgz",
+            "integrity": "sha512-1fuJEwIrp+97rM4RWdO+qrRsZlAeL1lQJoPqtCYWv0NL115XM93hIH4CSRln2w52SqvmY5hqdtauB6QFCDiZNQ==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-module-imports": "^7.18.6",
-                "@babel/helper-simple-access": "^7.20.2",
-                "@babel/helper-split-export-declaration": "^7.18.6",
-                "@babel/helper-validator-identifier": "^7.19.1",
-                "@babel/template": "^7.20.7",
-                "@babel/traverse": "^7.20.10",
-                "@babel/types": "^7.20.7"
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-module-imports": "^7.24.7",
+                "@babel/helper-simple-access": "^7.24.7",
+                "@babel/helper-split-export-declaration": "^7.24.7",
+                "@babel/helper-validator-identifier": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0"
             }
         },
         "node_modules/@babel/helper-optimise-call-expression": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.18.6.tgz",
-            "integrity": "sha512-HP59oD9/fEHQkdcbgFCnbmgH5vIQTJbxh2yf+CdM89/glUNnuzr87Q8GIjGEnOktTROemO0Pe0iPAYbqZuOUiA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.24.7.tgz",
+            "integrity": "sha512-jKiTsW2xmWwxT1ixIdfXUZp+P5yURx2suzLZr5Hi64rURpDYdMW0pv+Uf17EYk2Rd428Lx4tLsnjGJzYKDM/6A==",
             "dev": true,
             "dependencies": {
-                "@babel/types": "^7.18.6"
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-plugin-utils": {
-            "version": "7.20.2",
-            "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.20.2.tgz",
-            "integrity": "sha512-8RvlJG2mj4huQ4pZ+rU9lqKi9ZKiRmuvGuM2HlWmkmgOhbs6zEAw6IEiJ5cQqGbDzGZOhwuOQNtZMi/ENLjZoQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.24.7.tgz",
+            "integrity": "sha512-Rq76wjt7yz9AAc1KnlRKNAi/dMSVWgDRx43FHoJEbcYU6xOWaE2dVPwcdTukJrjxS65GITyfbvEYHvkirZ6uEg==",
             "dev": true,
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-remap-async-to-generator": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.18.9.tgz",
-            "integrity": "sha512-dI7q50YKd8BAv3VEfgg7PS7yD3Rtbi2J1XMXaalXO0W0164hYLnh8zpjRS0mte9MfVp/tltvr/cfdXPvJr1opA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.24.7.tgz",
+            "integrity": "sha512-9pKLcTlZ92hNZMQfGCHImUpDOlAgkkpqalWEeftW5FBya75k8Li2ilerxkM/uBEj01iBZXcCIB/bwvDYgWyibA==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-annotate-as-pure": "^7.18.6",
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-wrap-function": "^7.18.9",
-                "@babel/types": "^7.18.9"
+                "@babel/helper-annotate-as-pure": "^7.24.7",
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-wrap-function": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -459,123 +460,125 @@
             }
         },
         "node_modules/@babel/helper-replace-supers": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.20.7.tgz",
-            "integrity": "sha512-vujDMtB6LVfNW13jhlCrp48QNslK6JXi7lQG736HVbHz/mbf4Dc7tIRh1Xf5C0rF7BP8iiSxGMCmY6Ci1ven3A==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.24.7.tgz",
+            "integrity": "sha512-qTAxxBM81VEyoAY0TtLrx1oAEJc09ZK67Q9ljQToqCnA+55eNwCORaxlKyu+rNfX86o8OXRUSNUnrtsAZXM9sg==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-member-expression-to-functions": "^7.20.7",
-                "@babel/helper-optimise-call-expression": "^7.18.6",
-                "@babel/template": "^7.20.7",
-                "@babel/traverse": "^7.20.7",
-                "@babel/types": "^7.20.7"
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-member-expression-to-functions": "^7.24.7",
+                "@babel/helper-optimise-call-expression": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0"
             }
         },
         "node_modules/@babel/helper-simple-access": {
-            "version": "7.20.2",
-            "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.20.2.tgz",
-            "integrity": "sha512-+0woI/WPq59IrqDYbVGfshjT5Dmk/nnbdpcF8SnMhhXObpTq2KNBdLFRFrkVdbDOyUmHBCxzm5FHV1rACIkIbA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.24.7.tgz",
+            "integrity": "sha512-zBAIvbCMh5Ts+b86r/CjU+4XGYIs+R1j951gxI3KmmxBMhCg4oQMsv6ZXQ64XOm/cvzfU1FmoCyt6+owc5QMYg==",
             "dev": true,
             "dependencies": {
-                "@babel/types": "^7.20.2"
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-skip-transparent-expression-wrappers": {
-            "version": "7.20.0",
-            "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.20.0.tgz",
-            "integrity": "sha512-5y1JYeNKfvnT8sZcK9DVRtpTbGiomYIHviSP3OQWmDPU3DeH4a1ZlT/N2lyQ5P8egjcRaT/Y9aNqUxK0WsnIIg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.24.7.tgz",
+            "integrity": "sha512-IO+DLT3LQUElMbpzlatRASEyQtfhSE0+m465v++3jyyXeBTBUjtVZg28/gHeV5mrTJqvEKhKroBGAvhW+qPHiQ==",
             "dev": true,
             "dependencies": {
-                "@babel/types": "^7.20.0"
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-split-export-declaration": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.18.6.tgz",
-            "integrity": "sha512-bde1etTx6ZyTmobl9LLMMQsaizFVZrquTEHOqKeQESMKo4PlObf+8+JA25ZsIpZhT/WEd39+vOdLXAFG/nELpA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.24.7.tgz",
+            "integrity": "sha512-oy5V7pD+UvfkEATUKvIjvIAH/xCzfsFVw7ygW2SI6NClZzquT+mwdTfgfdbUiceh6iQO0CHtCPsyze/MZ2YbAA==",
             "dev": true,
             "dependencies": {
-                "@babel/types": "^7.18.6"
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-string-parser": {
-            "version": "7.19.4",
-            "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.19.4.tgz",
-            "integrity": "sha512-nHtDoQcuqFmwYNYPz3Rah5ph2p8PFeFCsZk9A/48dPc/rGocJ5J3hAAZ7pb76VWX3fZKu+uEr/FhH5jLx7umrw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.24.7.tgz",
+            "integrity": "sha512-7MbVt6xrwFQbunH2DNQsAP5sTGxfqQtErvBIvIMi6EQnbgUOuVYanvREcmFrOPhoXBrTtjhhP+lW+o5UfK+tDg==",
             "dev": true,
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-validator-identifier": {
-            "version": "7.19.1",
-            "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.19.1.tgz",
-            "integrity": "sha512-awrNfaMtnHUr653GgGEs++LlAvW6w+DcPrOliSMXWCKo597CwL5Acf/wWdNkf/tfEQE3mjkeD1YOVZOUV/od1w==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.24.7.tgz",
+            "integrity": "sha512-rR+PBcQ1SMQDDyF6X0wxtG8QyLCgUB0eRAGguqRLfkCA87l7yAP7ehq8SNj96OOGTO8OBV70KhuFYcIkHXOg0w==",
             "dev": true,
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-validator-option": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.18.6.tgz",
-            "integrity": "sha512-XO7gESt5ouv/LRJdrVjkShckw6STTaB7l9BrpBaAHDeF5YZT+01PCwmR0SJHnkW6i8OwW/EVWRShfi4j2x+KQw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.24.7.tgz",
+            "integrity": "sha512-yy1/KvjhV/ZCL+SM7hBrvnZJ3ZuT9OuZgIJAGpPEToANvc3iM6iDvBnRjtElWibHU6n8/LPR/EjX9EtIEYO3pw==",
             "dev": true,
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helper-wrap-function": {
-            "version": "7.20.5",
-            "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.20.5.tgz",
-            "integrity": "sha512-bYMxIWK5mh+TgXGVqAtnu5Yn1un+v8DDZtqyzKRLUzrh70Eal2O3aZ7aPYiMADO4uKlkzOiRiZ6GX5q3qxvW9Q==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.24.7.tgz",
+            "integrity": "sha512-N9JIYk3TD+1vq/wn77YnJOqMtfWhNewNE+DJV4puD2X7Ew9J4JvrzrFDfTfyv5EgEXVy9/Wt8QiOErzEmv5Ifw==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-function-name": "^7.19.0",
-                "@babel/template": "^7.18.10",
-                "@babel/traverse": "^7.20.5",
-                "@babel/types": "^7.20.5"
+                "@babel/helper-function-name": "^7.24.7",
+                "@babel/template": "^7.24.7",
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/helpers": {
-            "version": "7.20.13",
-            "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.20.13.tgz",
-            "integrity": "sha512-nzJ0DWCL3gB5RCXbUO3KIMMsBY2Eqbx8mBpKGE/02PgyRQFcPQLbkQ1vyy596mZLaP+dAfD+R4ckASzNVmW3jg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.24.7.tgz",
+            "integrity": "sha512-NlmJJtvcw72yRJRcnCmGvSi+3jDEg8qFu3z0AFoymmzLx5ERVWyzd9kVXr7Th9/8yIJi2Zc6av4Tqz3wFs8QWg==",
             "dev": true,
             "dependencies": {
-                "@babel/template": "^7.20.7",
-                "@babel/traverse": "^7.20.13",
-                "@babel/types": "^7.20.7"
+                "@babel/template": "^7.24.7",
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/highlight": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.18.6.tgz",
-            "integrity": "sha512-u7stbOuYjaPezCuLj29hNW1v64M2Md2qupEKP1fHc7WdOA3DgLh37suiSrZYY7haUB7iBeQZ9P1uiRF359do3g==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.24.7.tgz",
+            "integrity": "sha512-EStJpq4OuY8xYfhGVXngigBJRWxftKX9ksiGDnmlY3o7B/V7KIAc9X4oiK87uPJSc/vs5L869bem5fhZa8caZw==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-validator-identifier": "^7.18.6",
-                "chalk": "^2.0.0",
-                "js-tokens": "^4.0.0"
+                "@babel/helper-validator-identifier": "^7.24.7",
+                "chalk": "^2.4.2",
+                "js-tokens": "^4.0.0",
+                "picocolors": "^1.0.0"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -644,9 +647,9 @@
             }
         },
         "node_modules/@babel/parser": {
-            "version": "7.20.13",
-            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.20.13.tgz",
-            "integrity": "sha512-gFDLKMfpiXCsjt4za2JA9oTMn70CeseCehb11kRZgvd7+F67Hih3OHOK24cRrWECJ/ljfPGac6ygXAs/C8kIvw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.24.7.tgz",
+            "integrity": "sha512-9uUYRm6OqQrCqQdG1iCBwBPZgN8ciDBro2nIOFaiRz1/BCxaI7CNvQbDHvsArAC7Tw9Hda/B3U+6ui9u4HWXPw==",
             "dev": true,
             "bin": {
                 "parser": "bin/babel-parser.js"
@@ -655,13 +658,29 @@
                 "node": ">=6.0.0"
             }
         },
-        "node_modules/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.18.6.tgz",
-            "integrity": "sha512-Dgxsyg54Fx1d4Nge8UnvTrED63vrwOdPmyvPzlNN/boaliRP54pm3pGzZD1SJUwrBA+Cs/xdG8kXX6Mn/RfISQ==",
+        "node_modules/@babel/plugin-bugfix-firefox-class-in-computed-class-key": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-firefox-class-in-computed-class-key/-/plugin-bugfix-firefox-class-in-computed-class-key-7.24.7.tgz",
+            "integrity": "sha512-TiT1ss81W80eQsN+722OaeQMY/G4yTb4G9JrqeiDADs3N8lbPMGldWi9x8tyqCW5NLx1Jh2AvkE6r6QvEltMMQ==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0"
+            }
+        },
+        "node_modules/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.24.7.tgz",
+            "integrity": "sha512-unaQgZ/iRu/By6tsjMZzpeBZjChYfLYry6HrEXPoz3KmfF0sVBQ1l8zKMQ4xRGLWVsjuvB8nQfjNP/DcfEOCsg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -671,14 +690,14 @@
             }
         },
         "node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.20.7.tgz",
-            "integrity": "sha512-sbr9+wNE5aXMBBFBICk01tt7sBf2Oc9ikRFEcem/ZORup9IMUdNhW7/wVLEbbtlWOsEubJet46mHAL2C8+2jKQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.24.7.tgz",
+            "integrity": "sha512-+izXIbke1T33mY4MSNnrqhPXDz01WYhEf3yF5NbnUtkiNnm+XBZJl3kNfoK6NKmYlz/D07+l2GWVK/QfDkNCuQ==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
-                "@babel/plugin-proposal-optional-chaining": "^7.20.7"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.24.7",
+                "@babel/plugin-transform-optional-chaining": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -687,232 +706,27 @@
                 "@babel/core": "^7.13.0"
             }
         },
-        "node_modules/@babel/plugin-proposal-async-generator-functions": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.20.7.tgz",
-            "integrity": "sha512-xMbiLsn/8RK7Wq7VeVytytS2L6qE69bXPB10YCmMdDZbKF4okCqY74pI/jJQ/8U0b/F6NrT2+14b8/P9/3AMGA==",
+        "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/-/plugin-bugfix-v8-static-class-fields-redefine-readonly-7.24.7.tgz",
+            "integrity": "sha512-utA4HuR6F4Vvcr+o4DnjL8fCOlgRFGbeeBEGNg3ZTrLFw6VWG5XmUrvcQ0FjIYMU2ST4XcR2Wsp7t9qOAPnxMg==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-remap-async-to-generator": "^7.18.9",
-                "@babel/plugin-syntax-async-generators": "^7.8.4"
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             },
             "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-class-properties": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.18.6.tgz",
-            "integrity": "sha512-cumfXOF0+nzZrrN8Rf0t7M+tF6sZc7vhQwYQck9q1/5w2OExlD+b4v4RpMJFaV1Z7WcDRgO6FqvxqxGlwo+RHQ==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-create-class-features-plugin": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-class-static-block": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-static-block/-/plugin-proposal-class-static-block-7.20.7.tgz",
-            "integrity": "sha512-AveGOoi9DAjUYYuUAG//Ig69GlazLnoyzMw68VCDux+c1tsnnH/OkYcpz/5xzMkEFC6UxjR5Gw1c+iY2wOGVeQ==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-create-class-features-plugin": "^7.20.7",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/plugin-syntax-class-static-block": "^7.14.5"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.12.0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-dynamic-import": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-dynamic-import/-/plugin-proposal-dynamic-import-7.18.6.tgz",
-            "integrity": "sha512-1auuwmK+Rz13SJj36R+jqFPMJWyKEDd7lLSdOj4oJK0UTgGueSAtkrCvz9ewmgyU/P941Rv2fQwZJN8s6QruXw==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/plugin-syntax-dynamic-import": "^7.8.3"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-export-namespace-from": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-export-namespace-from/-/plugin-proposal-export-namespace-from-7.18.9.tgz",
-            "integrity": "sha512-k1NtHyOMvlDDFeb9G5PhUXuGj8m/wiwojgQVEhJ/fsVsMCpLyOP4h0uGEjYJKrRI+EVPlb5Jk+Gt9P97lOGwtA==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.9",
-                "@babel/plugin-syntax-export-namespace-from": "^7.8.3"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-json-strings": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-json-strings/-/plugin-proposal-json-strings-7.18.6.tgz",
-            "integrity": "sha512-lr1peyn9kOdbYc0xr0OdHTZ5FMqS6Di+H0Fz2I/JwMzGmzJETNeOFq2pBySw6X/KFL5EWDjlJuMsUGRFb8fQgQ==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/plugin-syntax-json-strings": "^7.8.3"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-logical-assignment-operators": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-logical-assignment-operators/-/plugin-proposal-logical-assignment-operators-7.20.7.tgz",
-            "integrity": "sha512-y7C7cZgpMIjWlKE5T7eJwp+tnRYM89HmRvWM5EQuB5BoHEONjmQ8lSNmBUwOyy/GFRsohJED51YBF79hE1djug==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-nullish-coalescing-operator": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-nullish-coalescing-operator/-/plugin-proposal-nullish-coalescing-operator-7.18.6.tgz",
-            "integrity": "sha512-wQxQzxYeJqHcfppzBDnm1yAY0jSRkUXR2z8RePZYrKwMKgMlE8+Z6LUno+bd6LvbGh8Gltvy74+9pIYkr+XkKA==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-numeric-separator": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-numeric-separator/-/plugin-proposal-numeric-separator-7.18.6.tgz",
-            "integrity": "sha512-ozlZFogPqoLm8WBr5Z8UckIoE4YQ5KESVcNudyXOR8uqIkliTEgJ3RoketfG6pmzLdeZF0H/wjE9/cCEitBl7Q==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/plugin-syntax-numeric-separator": "^7.10.4"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-object-rest-spread": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.20.7.tgz",
-            "integrity": "sha512-d2S98yCiLxDVmBmE8UjGcfPvNEUbA1U5q5WxaWFUGRzJSVAZqm5W6MbPct0jxnegUZ0niLeNX+IOzEs7wYg9Dg==",
-            "dev": true,
-            "dependencies": {
-                "@babel/compat-data": "^7.20.5",
-                "@babel/helper-compilation-targets": "^7.20.7",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
-                "@babel/plugin-transform-parameters": "^7.20.7"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-optional-catch-binding": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-catch-binding/-/plugin-proposal-optional-catch-binding-7.18.6.tgz",
-            "integrity": "sha512-Q40HEhs9DJQyaZfUjjn6vE8Cv4GmMHCYuMGIWUnlxH6400VGxOuwWsPt4FxXxJkC/5eOzgn0z21M9gMT4MOhbw==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/plugin-syntax-optional-catch-binding": "^7.8.3"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-optional-chaining": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-chaining/-/plugin-proposal-optional-chaining-7.20.7.tgz",
-            "integrity": "sha512-T+A7b1kfjtRM51ssoOfS1+wbyCVqorfyZhT99TvxxLMirPShD8CzKMRepMlCBGM5RpHMbn8s+5MMHnPstJH6mQ==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
-                "@babel/plugin-syntax-optional-chaining": "^7.8.3"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
-        "node_modules/@babel/plugin-proposal-private-methods": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-methods/-/plugin-proposal-private-methods-7.18.6.tgz",
-            "integrity": "sha512-nutsvktDItsNn4rpGItSNV2sz1XwS+nfU0Rg8aCx3W3NOKVzdMjJRu0O5OkgDp3ZGICSTbgRpxZoWsxoKRvbeA==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-create-class-features-plugin": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
+                "@babel/core": "^7.0.0"
             }
         },
         "node_modules/@babel/plugin-proposal-private-property-in-object": {
-            "version": "7.20.5",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.20.5.tgz",
-            "integrity": "sha512-Vq7b9dUA12ByzB4EjQTPo25sFhY+08pQDBSZRtUAkj7lb7jahaHR5igera16QZ+3my1nYR4dKsNdYj5IjPHilQ==",
+            "version": "7.21.0-placeholder-for-preset-env.2",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.21.0-placeholder-for-preset-env.2.tgz",
+            "integrity": "sha512-SOSkfJDddaM7mak6cPEpswyTRnuRltl429hMraQEglW+OkovnCzsiszTmsrlY//qLFjCpQDFRvjdm2wA5pPm9w==",
             "dev": true,
-            "dependencies": {
-                "@babel/helper-annotate-as-pure": "^7.18.6",
-                "@babel/helper-create-class-features-plugin": "^7.20.5",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/plugin-syntax-private-property-in-object": "^7.14.5"
-            },
             "engines": {
                 "node": ">=6.9.0"
             },
@@ -920,22 +734,6 @@
                 "@babel/core": "^7.0.0-0"
             }
         },
-        "node_modules/@babel/plugin-proposal-unicode-property-regex": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-unicode-property-regex/-/plugin-proposal-unicode-property-regex-7.18.6.tgz",
-            "integrity": "sha512-2BShG/d5yoZyXZfVePH91urL5wTG6ASZU9M4o03lKK8u8UW1y08OMttBSOADTcJrnPMpvDXRG3G8fyLh4ovs8w==",
-            "dev": true,
-            "dependencies": {
-                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
-            },
-            "engines": {
-                "node": ">=4"
-            },
-            "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
-            }
-        },
         "node_modules/@babel/plugin-syntax-async-generators": {
             "version": "7.8.4",
             "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
@@ -1000,12 +798,12 @@
             }
         },
         "node_modules/@babel/plugin-syntax-import-assertions": {
-            "version": "7.20.0",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.20.0.tgz",
-            "integrity": "sha512-IUh1vakzNoWalR8ch/areW7qFopR2AEw03JlG7BbrDqmQ4X3q9uuipQwSGrUn7oGiemKjtSLDhNtQHzMHr1JdQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.24.7.tgz",
+            "integrity": "sha512-Ec3NRUMoi8gskrkBe3fNmEQfxDvY8bgfQpz6jlk/41kX9eUjvpyqWU7PBP/pLAvMaSQjbMNKJmvX57jP+M6bPg==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.19.0"
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1014,6 +812,33 @@
                 "@babel/core": "^7.0.0-0"
             }
         },
+        "node_modules/@babel/plugin-syntax-import-attributes": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.24.7.tgz",
+            "integrity": "sha512-hbX+lKKeUMGihnK8nvKqmXBInriT3GVjzXKFriV3YC6APGxMbP8RZNFwy91+hocLXq90Mta+HshoB31802bb8A==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-syntax-import-meta": {
+            "version": "7.10.4",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz",
+            "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.10.4"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
         "node_modules/@babel/plugin-syntax-json-strings": {
             "version": "7.8.3",
             "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
@@ -1128,13 +953,47 @@
                 "@babel/core": "^7.0.0-0"
             }
         },
-        "node_modules/@babel/plugin-transform-arrow-functions": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.20.7.tgz",
-            "integrity": "sha512-3poA5E7dzDomxj9WXWwuD6A5F3kc7VXwIJO+E+J8qtDtS+pXPAhrgEyh+9GBwBgPq1Z+bB+/JD60lp5jsN7JPQ==",
+        "node_modules/@babel/plugin-syntax-unicode-sets-regex": {
+            "version": "7.18.6",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-unicode-sets-regex/-/plugin-syntax-unicode-sets-regex-7.18.6.tgz",
+            "integrity": "sha512-727YkEAPwSIQTv5im8QHz3upqp92JTWhidIC81Tdx4VJYIte/VndKf1qKrfnnhPLiPghStWfvC/iFaMCQu7Nqg==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.20.2"
+                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+                "@babel/helper-plugin-utils": "^7.18.6"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-arrow-functions": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.24.7.tgz",
+            "integrity": "sha512-Dt9LQs6iEY++gXUwY03DNFat5C2NbO48jj+j/bSAz6b3HgPs39qcPiYt77fDObIcFwj3/C2ICX9YMwGflUoSHQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-async-generator-functions": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-generator-functions/-/plugin-transform-async-generator-functions-7.24.7.tgz",
+            "integrity": "sha512-o+iF77e3u7ZS4AoAuJvapz9Fm001PuD2V3Lp6OSE4FYQke+cSewYtnek+THqGRWyQloRCyvWL1OkyfNEl9vr/g==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-remap-async-to-generator": "^7.24.7",
+                "@babel/plugin-syntax-async-generators": "^7.8.4"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1144,14 +1003,14 @@
             }
         },
         "node_modules/@babel/plugin-transform-async-to-generator": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.20.7.tgz",
-            "integrity": "sha512-Uo5gwHPT9vgnSXQxqGtpdufUiWp96gk7yiP4Mp5bm1QMkEmLXBO7PAGYbKoJ6DhAwiNkcHFBol/x5zZZkL/t0Q==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.24.7.tgz",
+            "integrity": "sha512-SQY01PcJfmQ+4Ash7NE+rpbLFbmqA2GPIgqzxfFTL4t1FKRq4zTms/7htKpoCUI9OcFYgzqfmCdH53s6/jn5fA==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-module-imports": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-remap-async-to-generator": "^7.18.9"
+                "@babel/helper-module-imports": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-remap-async-to-generator": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1161,12 +1020,12 @@
             }
         },
         "node_modules/@babel/plugin-transform-block-scoped-functions": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.18.6.tgz",
-            "integrity": "sha512-ExUcOqpPWnliRcPqves5HJcJOvHvIIWfuS4sroBUenPuMdmW+SMHDakmtS7qOo13sVppmUijqeTv7qqGsvURpQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.24.7.tgz",
+            "integrity": "sha512-yO7RAz6EsVQDaBH18IDJcMB1HnrUn2FJ/Jslc/WtPPWcjhpUJXU/rjbwmluzp7v/ZzWcEhTMXELnnsz8djWDwQ==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1176,12 +1035,12 @@
             }
         },
         "node_modules/@babel/plugin-transform-block-scoping": {
-            "version": "7.20.11",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.20.11.tgz",
-            "integrity": "sha512-tA4N427a7fjf1P0/2I4ScsHGc5jcHPbb30xMbaTke2gxDuWpUfXDuX1FEymJwKk4tuGUvGcejAR6HdZVqmmPyw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.24.7.tgz",
+            "integrity": "sha512-Nd5CvgMbWc+oWzBsuaMcbwjJWAcp5qzrbg69SZdHSP7AMY0AbWFqFO0WTFCA1jxhMCwodRwvRec8k0QUbZk7RQ==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.20.2"
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1190,20 +1049,52 @@
                 "@babel/core": "^7.0.0-0"
             }
         },
-        "node_modules/@babel/plugin-transform-classes": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.20.7.tgz",
-            "integrity": "sha512-LWYbsiXTPKl+oBlXUGlwNlJZetXD5Am+CyBdqhPsDVjM9Jc8jwBJFrKhHf900Kfk2eZG1y9MAG3UNajol7A4VQ==",
+        "node_modules/@babel/plugin-transform-class-properties": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-class-properties/-/plugin-transform-class-properties-7.24.7.tgz",
+            "integrity": "sha512-vKbfawVYayKcSeSR5YYzzyXvsDFWU2mD8U5TFeXtbCPLFUqe7GyCgvO6XDHzje862ODrOwy6WCPmKeWHbCFJ4w==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-annotate-as-pure": "^7.18.6",
-                "@babel/helper-compilation-targets": "^7.20.7",
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-function-name": "^7.19.0",
-                "@babel/helper-optimise-call-expression": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-replace-supers": "^7.20.7",
-                "@babel/helper-split-export-declaration": "^7.18.6",
+                "@babel/helper-create-class-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-class-static-block": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-class-static-block/-/plugin-transform-class-static-block-7.24.7.tgz",
+            "integrity": "sha512-HMXK3WbBPpZQufbMG4B46A90PkuuhN9vBCb5T8+VAHqvAqvcLi+2cKoukcpmUYkszLhScU3l1iudhrks3DggRQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-create-class-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-class-static-block": "^7.14.5"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.12.0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-classes": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.24.7.tgz",
+            "integrity": "sha512-CFbbBigp8ln4FU6Bpy6g7sE8B/WmCmzvivzUC6xDAdWVsjYTXijpuuGJmYkAaoWAzcItGKT3IOAbxRItZ5HTjw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-annotate-as-pure": "^7.24.7",
+                "@babel/helper-compilation-targets": "^7.24.7",
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-function-name": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-replace-supers": "^7.24.7",
+                "@babel/helper-split-export-declaration": "^7.24.7",
                 "globals": "^11.1.0"
             },
             "engines": {
@@ -1214,13 +1105,13 @@
             }
         },
         "node_modules/@babel/plugin-transform-computed-properties": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.20.7.tgz",
-            "integrity": "sha512-Lz7MvBK6DTjElHAmfu6bfANzKcxpyNPeYBGEafyA6E5HtRpjpZwU+u7Qrgz/2OR0z+5TvKYbPdphfSaAcZBrYQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.24.7.tgz",
+            "integrity": "sha512-25cS7v+707Gu6Ds2oY6tCkUwsJ9YIDbggd9+cu9jzzDgiNq7hR/8dkzxWfKWnTic26vsI3EsCXNd4iEB6e8esQ==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/template": "^7.20.7"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/template": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1230,12 +1121,12 @@
             }
         },
         "node_modules/@babel/plugin-transform-destructuring": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.20.7.tgz",
-            "integrity": "sha512-Xwg403sRrZb81IVB79ZPqNQME23yhugYVqgTxAhT99h485F4f+GMELFhhOsscDUB7HCswepKeCKLn/GZvUKoBA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.24.7.tgz",
+            "integrity": "sha512-19eJO/8kdCQ9zISOf+SEUJM/bAUIsvY3YDnXZTupUCQ8LgrWnsG/gFB9dvXqdXnRXMAM8fvt7b0CBKQHNGy1mw==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.20.2"
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1245,13 +1136,13 @@
             }
         },
         "node_modules/@babel/plugin-transform-dotall-regex": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.18.6.tgz",
-            "integrity": "sha512-6S3jpun1eEbAxq7TdjLotAsl4WpQI9DxfkycRcKrjhQYzU87qpXdknpBg/e+TdcMehqGnLFi7tnFUBR02Vq6wg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.24.7.tgz",
+            "integrity": "sha512-ZOA3W+1RRTSWvyqcMJDLqbchh7U4NRGqwRfFSVbOLS/ePIP4vHB5e8T8eXcuqyN1QkgKyj5wuW0lcS85v4CrSw==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-create-regexp-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1261,12 +1152,28 @@
             }
         },
         "node_modules/@babel/plugin-transform-duplicate-keys": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.18.9.tgz",
-            "integrity": "sha512-d2bmXCtZXYc59/0SanQKbiWINadaJXqtvIQIzd4+hNwkWBgyCd5F/2t1kXoUdvPMrxzPvhK6EMQRROxsue+mfw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.24.7.tgz",
+            "integrity": "sha512-JdYfXyCRihAe46jUIliuL2/s0x0wObgwwiGxw/UbgJBr20gQBThrokO4nYKgWkD7uBaqM7+9x5TU7NkExZJyzw==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-dynamic-import": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dynamic-import/-/plugin-transform-dynamic-import-7.24.7.tgz",
+            "integrity": "sha512-sc3X26PhZQDb3JhORmakcbvkeInvxz+A8oda99lj7J60QRuPZvNAk9wQlTBS1ZynelDrDmTU4pw1tyc5d5ZMUg==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-dynamic-import": "^7.8.3"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1276,13 +1183,29 @@
             }
         },
         "node_modules/@babel/plugin-transform-exponentiation-operator": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.18.6.tgz",
-            "integrity": "sha512-wzEtc0+2c88FVR34aQmiz56dxEkxr2g8DQb/KfaFa1JYXOFVsbhvAonFN6PwVWj++fKmku8NP80plJ5Et4wqHw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.24.7.tgz",
+            "integrity": "sha512-Rqe/vSc9OYgDajNIK35u7ot+KeCoetqQYFXM4Epf7M7ez3lWlOjrDjrwMei6caCVhfdw+mIKD4cgdGNy5JQotQ==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-builder-binary-assignment-operator-visitor": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-builder-binary-assignment-operator-visitor": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-export-namespace-from": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-export-namespace-from/-/plugin-transform-export-namespace-from-7.24.7.tgz",
+            "integrity": "sha512-v0K9uNYsPL3oXZ/7F9NNIbAj2jv1whUEtyA6aujhekLs56R++JDQuzRcP2/z4WX5Vg/c5lE9uWZA0/iUoFhLTA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-export-namespace-from": "^7.8.3"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1292,12 +1215,13 @@
             }
         },
         "node_modules/@babel/plugin-transform-for-of": {
-            "version": "7.18.8",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.18.8.tgz",
-            "integrity": "sha512-yEfTRnjuskWYo0k1mHUqrVWaZwrdq8AYbfrpqULOJOaucGSp4mNMVps+YtA8byoevxS/urwU75vyhQIxcCgiBQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.24.7.tgz",
+            "integrity": "sha512-wo9ogrDG1ITTTBsy46oGiN1dS9A7MROBTcYsfS8DtsImMkHk9JXJ3EWQM6X2SUw4x80uGPlwj0o00Uoc6nEE3g==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1307,14 +1231,30 @@
             }
         },
         "node_modules/@babel/plugin-transform-function-name": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.18.9.tgz",
-            "integrity": "sha512-WvIBoRPaJQ5yVHzcnJFor7oS5Ls0PYixlTYE63lCj2RtdQEl15M68FXQlxnG6wdraJIXRdR7KI+hQ7q/9QjrCQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.24.7.tgz",
+            "integrity": "sha512-U9FcnA821YoILngSmYkW6FjyQe2TyZD5pHt4EVIhmcTkrJw/3KqcrRSxuOo5tFZJi7TE19iDyI1u+weTI7bn2w==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-compilation-targets": "^7.18.9",
-                "@babel/helper-function-name": "^7.18.9",
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-compilation-targets": "^7.24.7",
+                "@babel/helper-function-name": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-json-strings": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-json-strings/-/plugin-transform-json-strings-7.24.7.tgz",
+            "integrity": "sha512-2yFnBGDvRuxAaE/f0vfBKvtnvvqU8tGpMHqMNpTN2oWMKIR3NqFkjaAgGwawhqK/pIN2T3XdjGPdaG0vDhOBGw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-json-strings": "^7.8.3"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1324,12 +1264,28 @@
             }
         },
         "node_modules/@babel/plugin-transform-literals": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.18.9.tgz",
-            "integrity": "sha512-IFQDSRoTPnrAIrI5zoZv73IFeZu2dhu6irxQjY9rNjTT53VmKg9fenjvoiOWOkJ6mm4jKVPtdMzBY98Fp4Z4cg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.24.7.tgz",
+            "integrity": "sha512-vcwCbb4HDH+hWi8Pqenwnjy+UiklO4Kt1vfspcQYFhJdpthSnW8XvWGyDZWKNVrVbVViI/S7K9PDJZiUmP2fYQ==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-logical-assignment-operators": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-logical-assignment-operators/-/plugin-transform-logical-assignment-operators-7.24.7.tgz",
+            "integrity": "sha512-4D2tpwlQ1odXmTEIFWy9ELJcZHqrStlzK/dAOWYyxX3zT0iXQB6banjgeOJQXzEc4S0E0a5A+hahxPaEFYftsw==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1339,12 +1295,12 @@
             }
         },
         "node_modules/@babel/plugin-transform-member-expression-literals": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.18.6.tgz",
-            "integrity": "sha512-qSF1ihLGO3q+/g48k85tUjD033C29TNTVB2paCwZPVmOsjn9pClvYYrM2VeJpBY2bcNkuny0YUyTNRyRxJ54KA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.24.7.tgz",
+            "integrity": "sha512-T/hRC1uqrzXMKLQ6UCwMT85S3EvqaBXDGf0FaMf4446Qx9vKwlghvee0+uuZcDUCZU5RuNi4781UQ7R308zzBw==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1354,13 +1310,13 @@
             }
         },
         "node_modules/@babel/plugin-transform-modules-amd": {
-            "version": "7.20.11",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.20.11.tgz",
-            "integrity": "sha512-NuzCt5IIYOW0O30UvqktzHYR2ud5bOWbY0yaxWZ6G+aFzOMJvrs5YHNikrbdaT15+KNO31nPOy5Fim3ku6Zb5g==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.24.7.tgz",
+            "integrity": "sha512-9+pB1qxV3vs/8Hdmz/CulFB8w2tuu6EB94JZFsjdqxQokwGa9Unap7Bo2gGBGIvPmDIVvQrom7r5m/TCDMURhg==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-module-transforms": "^7.20.11",
-                "@babel/helper-plugin-utils": "^7.20.2"
+                "@babel/helper-module-transforms": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1370,14 +1326,14 @@
             }
         },
         "node_modules/@babel/plugin-transform-modules-commonjs": {
-            "version": "7.20.11",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.20.11.tgz",
-            "integrity": "sha512-S8e1f7WQ7cimJQ51JkAaDrEtohVEitXjgCGAS2N8S31Y42E+kWwfSz83LYz57QdBm7q9diARVqanIaH2oVgQnw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.24.7.tgz",
+            "integrity": "sha512-iFI8GDxtevHJ/Z22J5xQpVqFLlMNstcLXh994xifFwxxGslr2ZXXLWgtBeLctOD63UFDArdvN6Tg8RFw+aEmjQ==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-module-transforms": "^7.20.11",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-simple-access": "^7.20.2"
+                "@babel/helper-module-transforms": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-simple-access": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1387,15 +1343,15 @@
             }
         },
         "node_modules/@babel/plugin-transform-modules-systemjs": {
-            "version": "7.20.11",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.20.11.tgz",
-            "integrity": "sha512-vVu5g9BPQKSFEmvt2TA4Da5N+QVS66EX21d8uoOihC+OCpUoGvzVsXeqFdtAEfVa5BILAeFt+U7yVmLbQnAJmw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.24.7.tgz",
+            "integrity": "sha512-GYQE0tW7YoaN13qFh3O1NCY4MPkUiAH3fiF7UcV/I3ajmDKEdG3l+UOcbAm4zUE3gnvUU+Eni7XrVKo9eO9auw==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-hoist-variables": "^7.18.6",
-                "@babel/helper-module-transforms": "^7.20.11",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-validator-identifier": "^7.19.1"
+                "@babel/helper-hoist-variables": "^7.24.7",
+                "@babel/helper-module-transforms": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-validator-identifier": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1405,13 +1361,13 @@
             }
         },
         "node_modules/@babel/plugin-transform-modules-umd": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.18.6.tgz",
-            "integrity": "sha512-dcegErExVeXcRqNtkRU/z8WlBLnvD4MRnHgNs3MytRO1Mn1sHRyhbcpYbVMGclAqOjdW+9cfkdZno9dFdfKLfQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.24.7.tgz",
+            "integrity": "sha512-3aytQvqJ/h9z4g8AsKPLvD4Zqi2qT+L3j7XoFFu1XBlZWEl2/1kWnhmAbxpLgPrHSY0M6UA02jyTiwUVtiKR6A==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-module-transforms": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-module-transforms": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1421,13 +1377,13 @@
             }
         },
         "node_modules/@babel/plugin-transform-named-capturing-groups-regex": {
-            "version": "7.20.5",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.20.5.tgz",
-            "integrity": "sha512-mOW4tTzi5iTLnw+78iEq3gr8Aoq4WNRGpmSlrogqaiCBoR1HFhpU4JkpQFOHfeYx3ReVIFWOQJS4aZBRvuZ6mA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.24.7.tgz",
+            "integrity": "sha512-/jr7h/EWeJtk1U/uz2jlsCioHkZk1JJZVcc8oQsJ1dUlaJD83f4/6Zeh2aHt9BIFokHIsSeDfhUmju0+1GPd6g==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-create-regexp-features-plugin": "^7.20.5",
-                "@babel/helper-plugin-utils": "^7.20.2"
+                "@babel/helper-create-regexp-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1437,12 +1393,62 @@
             }
         },
         "node_modules/@babel/plugin-transform-new-target": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.18.6.tgz",
-            "integrity": "sha512-DjwFA/9Iu3Z+vrAn+8pBUGcjhxKguSMlsFqeCKbhb9BAV756v0krzVK04CRDi/4aqmk8BsHb4a/gFcaA5joXRw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.24.7.tgz",
+            "integrity": "sha512-RNKwfRIXg4Ls/8mMTza5oPF5RkOW8Wy/WgMAp1/F1yZ8mMbtwXW+HDoJiOsagWrAhI5f57Vncrmr9XeT4CVapA==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-nullish-coalescing-operator": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-nullish-coalescing-operator/-/plugin-transform-nullish-coalescing-operator-7.24.7.tgz",
+            "integrity": "sha512-Ts7xQVk1OEocqzm8rHMXHlxvsfZ0cEF2yomUqpKENHWMF4zKk175Y4q8H5knJes6PgYad50uuRmt3UJuhBw8pQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-numeric-separator": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-numeric-separator/-/plugin-transform-numeric-separator-7.24.7.tgz",
+            "integrity": "sha512-e6q1TiVUzvH9KRvicuxdBTUj4AdKSRwzIyFFnfnezpCfP2/7Qmbb8qbU2j7GODbl4JMkblitCQjKYUaX/qkkwA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-numeric-separator": "^7.10.4"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-object-rest-spread": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-rest-spread/-/plugin-transform-object-rest-spread-7.24.7.tgz",
+            "integrity": "sha512-4QrHAr0aXQCEFni2q4DqKLD31n2DL+RxcwnNjDFkSG0eNQ/xCavnRkfCUjsyqGC2OviNJvZOF/mQqZBw7i2C5Q==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-compilation-targets": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+                "@babel/plugin-transform-parameters": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1452,13 +1458,46 @@
             }
         },
         "node_modules/@babel/plugin-transform-object-super": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.18.6.tgz",
-            "integrity": "sha512-uvGz6zk+pZoS1aTZrOvrbj6Pp/kK2mp45t2B+bTDre2UgsZZ8EZLSJtUg7m/no0zOJUWgFONpB7Zv9W2tSaFlA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.24.7.tgz",
+            "integrity": "sha512-A/vVLwN6lBrMFmMDmPPz0jnE6ZGx7Jq7d6sT/Ev4H65RER6pZ+kczlf1DthF5N0qaPHBsI7UXiE8Zy66nmAovg==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/helper-replace-supers": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-replace-supers": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-optional-catch-binding": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-optional-catch-binding/-/plugin-transform-optional-catch-binding-7.24.7.tgz",
+            "integrity": "sha512-uLEndKqP5BfBbC/5jTwPxLh9kqPWWgzN/f8w6UwAIirAEqiIVJWWY312X72Eub09g5KF9+Zn7+hT7sDxmhRuKA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-optional-catch-binding": "^7.8.3"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-optional-chaining": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-optional-chaining/-/plugin-transform-optional-chaining-7.24.7.tgz",
+            "integrity": "sha512-tK+0N9yd4j+x/4hxF3F0e0fu/VdcxU18y5SevtyM/PCFlQvXbR0Zmlo2eBrKtVipGNFzpq56o8WsIIKcJFUCRQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.24.7",
+                "@babel/plugin-syntax-optional-chaining": "^7.8.3"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1468,12 +1507,46 @@
             }
         },
         "node_modules/@babel/plugin-transform-parameters": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.20.7.tgz",
-            "integrity": "sha512-WiWBIkeHKVOSYPO0pWkxGPfKeWrCJyD3NJ53+Lrp/QMSZbsVPovrVl2aWZ19D/LTVnaDv5Ap7GJ/B2CTOZdrfA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.24.7.tgz",
+            "integrity": "sha512-yGWW5Rr+sQOhK0Ot8hjDJuxU3XLRQGflvT4lhlSY0DFvdb3TwKaY26CJzHtYllU0vT9j58hc37ndFPsqT1SrzA==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.20.2"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-private-methods": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-private-methods/-/plugin-transform-private-methods-7.24.7.tgz",
+            "integrity": "sha512-COTCOkG2hn4JKGEKBADkA8WNb35TGkkRbI5iT845dB+NyqgO8Hn+ajPbSnIQznneJTa3d30scb6iz/DhH8GsJQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-create-class-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-private-property-in-object": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-private-property-in-object/-/plugin-transform-private-property-in-object-7.24.7.tgz",
+            "integrity": "sha512-9z76mxwnwFxMyxZWEgdgECQglF2Q7cFLm0kMf8pGwt+GSJsY0cONKj/UuO4bOH0w/uAel3ekS4ra5CEAyJRmDA==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-annotate-as-pure": "^7.24.7",
+                "@babel/helper-create-class-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-private-property-in-object": "^7.14.5"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1483,12 +1556,12 @@
             }
         },
         "node_modules/@babel/plugin-transform-property-literals": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.18.6.tgz",
-            "integrity": "sha512-cYcs6qlgafTud3PAzrrRNbQtfpQ8+y/+M5tKmksS9+M1ckbH6kzY8MrexEM9mcA6JDsukE19iIRvAyYl463sMg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.24.7.tgz",
+            "integrity": "sha512-EMi4MLQSHfd2nrCqQEWxFdha2gBCqU4ZcCng4WBGZ5CJL4bBRW0ptdqqDdeirGZcpALazVVNJqRmsO8/+oNCBA==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1498,13 +1571,13 @@
             }
         },
         "node_modules/@babel/plugin-transform-regenerator": {
-            "version": "7.20.5",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.20.5.tgz",
-            "integrity": "sha512-kW/oO7HPBtntbsahzQ0qSE3tFvkFwnbozz3NWFhLGqH75vLEg+sCGngLlhVkePlCs3Jv0dBBHDzCHxNiFAQKCQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.24.7.tgz",
+            "integrity": "sha512-lq3fvXPdimDrlg6LWBoqj+r/DEWgONuwjuOuQCSYgRroXDH/IdM1C0IZf59fL5cHLpjEH/O6opIRBbqv7ELnuA==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "regenerator-transform": "^0.15.1"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "regenerator-transform": "^0.15.2"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1514,12 +1587,12 @@
             }
         },
         "node_modules/@babel/plugin-transform-reserved-words": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.18.6.tgz",
-            "integrity": "sha512-oX/4MyMoypzHjFrT1CdivfKZ+XvIPMFXwwxHp/r0Ddy2Vuomt4HDFGmft1TAY2yiTKiNSsh3kjBAzcM8kSdsjA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.24.7.tgz",
+            "integrity": "sha512-0DUq0pHcPKbjFZCfTss/pGkYMfy3vFWydkUBd9r0GHpIyfs2eCDENvqadMycRS9wZCXR41wucAfJHJmwA0UmoQ==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1529,12 +1602,12 @@
             }
         },
         "node_modules/@babel/plugin-transform-shorthand-properties": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.18.6.tgz",
-            "integrity": "sha512-eCLXXJqv8okzg86ywZJbRn19YJHU4XUa55oz2wbHhaQVn/MM+XhukiT7SYqp/7o00dg52Rj51Ny+Ecw4oyoygw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.24.7.tgz",
+            "integrity": "sha512-KsDsevZMDsigzbA09+vacnLpmPH4aWjcZjXdyFKGzpplxhbeB4wYtury3vglQkg6KM/xEPKt73eCjPPf1PgXBA==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1544,13 +1617,13 @@
             }
         },
         "node_modules/@babel/plugin-transform-spread": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.20.7.tgz",
-            "integrity": "sha512-ewBbHQ+1U/VnH1fxltbJqDeWBU1oNLG8Dj11uIv3xVf7nrQu0bPGe5Rf716r7K5Qz+SqtAOVswoVunoiBtGhxw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.24.7.tgz",
+            "integrity": "sha512-x96oO0I09dgMDxJaANcRyD4ellXFLLiWhuwDxKZX5g2rWP1bTPkBSwCYv96VDXVT1bD9aPj8tppr5ITIh8hBng==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1560,12 +1633,12 @@
             }
         },
         "node_modules/@babel/plugin-transform-sticky-regex": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.18.6.tgz",
-            "integrity": "sha512-kfiDrDQ+PBsQDO85yj1icueWMfGfJFKN1KCkndygtu/C9+XUfydLC8Iv5UYJqRwy4zk8EcplRxEOeLyjq1gm6Q==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.24.7.tgz",
+            "integrity": "sha512-kHPSIJc9v24zEml5geKg9Mjx5ULpfncj0wRpYtxbvKyTtHCYDkVE3aHQ03FrpEo4gEe2vrJJS1Y9CJTaThA52g==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1575,12 +1648,12 @@
             }
         },
         "node_modules/@babel/plugin-transform-template-literals": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.18.9.tgz",
-            "integrity": "sha512-S8cOWfT82gTezpYOiVaGHrCbhlHgKhQt8XH5ES46P2XWmX92yisoZywf5km75wv5sYcXDUCLMmMxOLCtthDgMA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.24.7.tgz",
+            "integrity": "sha512-AfDTQmClklHCOLxtGoP7HkeMw56k1/bTQjwsfhL6pppo/M4TOBSq+jjBUBLmV/4oeFg4GWMavIl44ZeCtmmZTw==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1590,12 +1663,12 @@
             }
         },
         "node_modules/@babel/plugin-transform-typeof-symbol": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.18.9.tgz",
-            "integrity": "sha512-SRfwTtF11G2aemAZWivL7PD+C9z52v9EvMqH9BuYbabyPuKUvSWks3oCg6041pT925L4zVFqaVBeECwsmlguEw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.24.7.tgz",
+            "integrity": "sha512-VtR8hDy7YLB7+Pet9IarXjg/zgCMSF+1mNS/EQEiEaUPoFXCVsHG64SIxcaaI2zJgRiv+YmgaQESUfWAdbjzgg==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1605,12 +1678,28 @@
             }
         },
         "node_modules/@babel/plugin-transform-unicode-escapes": {
-            "version": "7.18.10",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.18.10.tgz",
-            "integrity": "sha512-kKAdAI+YzPgGY/ftStBFXTI1LZFju38rYThnfMykS+IXy8BVx+res7s2fxf1l8I35DV2T97ezo6+SGrXz6B3iQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.24.7.tgz",
+            "integrity": "sha512-U3ap1gm5+4edc2Q/P+9VrBNhGkfnf+8ZqppY71Bo/pzZmXhhLdqgaUl6cuB07O1+AQJtCLfaOmswiNbSQ9ivhw==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0-0"
+            }
+        },
+        "node_modules/@babel/plugin-transform-unicode-property-regex": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-property-regex/-/plugin-transform-unicode-property-regex-7.24.7.tgz",
+            "integrity": "sha512-uH2O4OV5M9FZYQrwc7NdVmMxQJOCCzFeYudlZSzUAHRFeOujQefa92E74TQDVskNHCzOXoigEuoyzHDhaEaK5w==",
+            "dev": true,
+            "dependencies": {
+                "@babel/helper-create-regexp-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1620,13 +1709,13 @@
             }
         },
         "node_modules/@babel/plugin-transform-unicode-regex": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.18.6.tgz",
-            "integrity": "sha512-gE7A6Lt7YLnNOL3Pb9BNeZvi+d8l7tcRrG4+pwJjK9hD2xX4mEvjlQW60G9EEmfXVYRPv9VRQcyegIVHCql/AA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.24.7.tgz",
+            "integrity": "sha512-hlQ96MBZSAXUq7ltkjtu3FJCCSMx/j629ns3hA3pXnBXjanNP0LHi+JpPeA81zaWgVK1VGH95Xuy7u0RyQ8kMg==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-create-regexp-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1635,39 +1724,45 @@
                 "@babel/core": "^7.0.0-0"
             }
         },
-        "node_modules/@babel/preset-env": {
-            "version": "7.20.2",
-            "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.20.2.tgz",
-            "integrity": "sha512-1G0efQEWR1EHkKvKHqbG+IN/QdgwfByUpM5V5QroDzGV2t3S/WXNQd693cHiHTlCFMpr9B6FkPFXDA2lQcKoDg==",
+        "node_modules/@babel/plugin-transform-unicode-sets-regex": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-sets-regex/-/plugin-transform-unicode-sets-regex-7.24.7.tgz",
+            "integrity": "sha512-2G8aAvF4wy1w/AGZkemprdGMRg5o6zPNhbHVImRz3lss55TYCBd6xStN19rt8XJHq20sqV0JbyWjOWwQRwV/wg==",
             "dev": true,
             "dependencies": {
-                "@babel/compat-data": "^7.20.1",
-                "@babel/helper-compilation-targets": "^7.20.0",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-validator-option": "^7.18.6",
-                "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.18.6",
-                "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.18.9",
-                "@babel/plugin-proposal-async-generator-functions": "^7.20.1",
-                "@babel/plugin-proposal-class-properties": "^7.18.6",
-                "@babel/plugin-proposal-class-static-block": "^7.18.6",
-                "@babel/plugin-proposal-dynamic-import": "^7.18.6",
-                "@babel/plugin-proposal-export-namespace-from": "^7.18.9",
-                "@babel/plugin-proposal-json-strings": "^7.18.6",
-                "@babel/plugin-proposal-logical-assignment-operators": "^7.18.9",
-                "@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6",
-                "@babel/plugin-proposal-numeric-separator": "^7.18.6",
-                "@babel/plugin-proposal-object-rest-spread": "^7.20.2",
-                "@babel/plugin-proposal-optional-catch-binding": "^7.18.6",
-                "@babel/plugin-proposal-optional-chaining": "^7.18.9",
-                "@babel/plugin-proposal-private-methods": "^7.18.6",
-                "@babel/plugin-proposal-private-property-in-object": "^7.18.6",
-                "@babel/plugin-proposal-unicode-property-regex": "^7.18.6",
+                "@babel/helper-create-regexp-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            },
+            "engines": {
+                "node": ">=6.9.0"
+            },
+            "peerDependencies": {
+                "@babel/core": "^7.0.0"
+            }
+        },
+        "node_modules/@babel/preset-env": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.24.7.tgz",
+            "integrity": "sha512-1YZNsc+y6cTvWlDHidMBsQZrZfEFjRIo/BZCT906PMdzOyXtSLTgqGdrpcuTDCXyd11Am5uQULtDIcCfnTc8fQ==",
+            "dev": true,
+            "dependencies": {
+                "@babel/compat-data": "^7.24.7",
+                "@babel/helper-compilation-targets": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-validator-option": "^7.24.7",
+                "@babel/plugin-bugfix-firefox-class-in-computed-class-key": "^7.24.7",
+                "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.24.7",
+                "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.24.7",
+                "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": "^7.24.7",
+                "@babel/plugin-proposal-private-property-in-object": "7.21.0-placeholder-for-preset-env.2",
                 "@babel/plugin-syntax-async-generators": "^7.8.4",
                 "@babel/plugin-syntax-class-properties": "^7.12.13",
                 "@babel/plugin-syntax-class-static-block": "^7.14.5",
                 "@babel/plugin-syntax-dynamic-import": "^7.8.3",
                 "@babel/plugin-syntax-export-namespace-from": "^7.8.3",
-                "@babel/plugin-syntax-import-assertions": "^7.20.0",
+                "@babel/plugin-syntax-import-assertions": "^7.24.7",
+                "@babel/plugin-syntax-import-attributes": "^7.24.7",
+                "@babel/plugin-syntax-import-meta": "^7.10.4",
                 "@babel/plugin-syntax-json-strings": "^7.8.3",
                 "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4",
                 "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
@@ -1677,45 +1772,61 @@
                 "@babel/plugin-syntax-optional-chaining": "^7.8.3",
                 "@babel/plugin-syntax-private-property-in-object": "^7.14.5",
                 "@babel/plugin-syntax-top-level-await": "^7.14.5",
-                "@babel/plugin-transform-arrow-functions": "^7.18.6",
-                "@babel/plugin-transform-async-to-generator": "^7.18.6",
-                "@babel/plugin-transform-block-scoped-functions": "^7.18.6",
-                "@babel/plugin-transform-block-scoping": "^7.20.2",
-                "@babel/plugin-transform-classes": "^7.20.2",
-                "@babel/plugin-transform-computed-properties": "^7.18.9",
-                "@babel/plugin-transform-destructuring": "^7.20.2",
-                "@babel/plugin-transform-dotall-regex": "^7.18.6",
-                "@babel/plugin-transform-duplicate-keys": "^7.18.9",
-                "@babel/plugin-transform-exponentiation-operator": "^7.18.6",
-                "@babel/plugin-transform-for-of": "^7.18.8",
-                "@babel/plugin-transform-function-name": "^7.18.9",
-                "@babel/plugin-transform-literals": "^7.18.9",
-                "@babel/plugin-transform-member-expression-literals": "^7.18.6",
-                "@babel/plugin-transform-modules-amd": "^7.19.6",
-                "@babel/plugin-transform-modules-commonjs": "^7.19.6",
-                "@babel/plugin-transform-modules-systemjs": "^7.19.6",
-                "@babel/plugin-transform-modules-umd": "^7.18.6",
-                "@babel/plugin-transform-named-capturing-groups-regex": "^7.19.1",
-                "@babel/plugin-transform-new-target": "^7.18.6",
-                "@babel/plugin-transform-object-super": "^7.18.6",
-                "@babel/plugin-transform-parameters": "^7.20.1",
-                "@babel/plugin-transform-property-literals": "^7.18.6",
-                "@babel/plugin-transform-regenerator": "^7.18.6",
-                "@babel/plugin-transform-reserved-words": "^7.18.6",
-                "@babel/plugin-transform-shorthand-properties": "^7.18.6",
-                "@babel/plugin-transform-spread": "^7.19.0",
-                "@babel/plugin-transform-sticky-regex": "^7.18.6",
-                "@babel/plugin-transform-template-literals": "^7.18.9",
-                "@babel/plugin-transform-typeof-symbol": "^7.18.9",
-                "@babel/plugin-transform-unicode-escapes": "^7.18.10",
-                "@babel/plugin-transform-unicode-regex": "^7.18.6",
-                "@babel/preset-modules": "^0.1.5",
-                "@babel/types": "^7.20.2",
-                "babel-plugin-polyfill-corejs2": "^0.3.3",
-                "babel-plugin-polyfill-corejs3": "^0.6.0",
-                "babel-plugin-polyfill-regenerator": "^0.4.1",
-                "core-js-compat": "^3.25.1",
-                "semver": "^6.3.0"
+                "@babel/plugin-syntax-unicode-sets-regex": "^7.18.6",
+                "@babel/plugin-transform-arrow-functions": "^7.24.7",
+                "@babel/plugin-transform-async-generator-functions": "^7.24.7",
+                "@babel/plugin-transform-async-to-generator": "^7.24.7",
+                "@babel/plugin-transform-block-scoped-functions": "^7.24.7",
+                "@babel/plugin-transform-block-scoping": "^7.24.7",
+                "@babel/plugin-transform-class-properties": "^7.24.7",
+                "@babel/plugin-transform-class-static-block": "^7.24.7",
+                "@babel/plugin-transform-classes": "^7.24.7",
+                "@babel/plugin-transform-computed-properties": "^7.24.7",
+                "@babel/plugin-transform-destructuring": "^7.24.7",
+                "@babel/plugin-transform-dotall-regex": "^7.24.7",
+                "@babel/plugin-transform-duplicate-keys": "^7.24.7",
+                "@babel/plugin-transform-dynamic-import": "^7.24.7",
+                "@babel/plugin-transform-exponentiation-operator": "^7.24.7",
+                "@babel/plugin-transform-export-namespace-from": "^7.24.7",
+                "@babel/plugin-transform-for-of": "^7.24.7",
+                "@babel/plugin-transform-function-name": "^7.24.7",
+                "@babel/plugin-transform-json-strings": "^7.24.7",
+                "@babel/plugin-transform-literals": "^7.24.7",
+                "@babel/plugin-transform-logical-assignment-operators": "^7.24.7",
+                "@babel/plugin-transform-member-expression-literals": "^7.24.7",
+                "@babel/plugin-transform-modules-amd": "^7.24.7",
+                "@babel/plugin-transform-modules-commonjs": "^7.24.7",
+                "@babel/plugin-transform-modules-systemjs": "^7.24.7",
+                "@babel/plugin-transform-modules-umd": "^7.24.7",
+                "@babel/plugin-transform-named-capturing-groups-regex": "^7.24.7",
+                "@babel/plugin-transform-new-target": "^7.24.7",
+                "@babel/plugin-transform-nullish-coalescing-operator": "^7.24.7",
+                "@babel/plugin-transform-numeric-separator": "^7.24.7",
+                "@babel/plugin-transform-object-rest-spread": "^7.24.7",
+                "@babel/plugin-transform-object-super": "^7.24.7",
+                "@babel/plugin-transform-optional-catch-binding": "^7.24.7",
+                "@babel/plugin-transform-optional-chaining": "^7.24.7",
+                "@babel/plugin-transform-parameters": "^7.24.7",
+                "@babel/plugin-transform-private-methods": "^7.24.7",
+                "@babel/plugin-transform-private-property-in-object": "^7.24.7",
+                "@babel/plugin-transform-property-literals": "^7.24.7",
+                "@babel/plugin-transform-regenerator": "^7.24.7",
+                "@babel/plugin-transform-reserved-words": "^7.24.7",
+                "@babel/plugin-transform-shorthand-properties": "^7.24.7",
+                "@babel/plugin-transform-spread": "^7.24.7",
+                "@babel/plugin-transform-sticky-regex": "^7.24.7",
+                "@babel/plugin-transform-template-literals": "^7.24.7",
+                "@babel/plugin-transform-typeof-symbol": "^7.24.7",
+                "@babel/plugin-transform-unicode-escapes": "^7.24.7",
+                "@babel/plugin-transform-unicode-property-regex": "^7.24.7",
+                "@babel/plugin-transform-unicode-regex": "^7.24.7",
+                "@babel/plugin-transform-unicode-sets-regex": "^7.24.7",
+                "@babel/preset-modules": "0.1.6-no-external-plugins",
+                "babel-plugin-polyfill-corejs2": "^0.4.10",
+                "babel-plugin-polyfill-corejs3": "^0.10.4",
+                "babel-plugin-polyfill-regenerator": "^0.6.1",
+                "core-js-compat": "^3.31.0",
+                "semver": "^6.3.1"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -1725,71 +1836,75 @@
             }
         },
         "node_modules/@babel/preset-env/node_modules/semver": {
-            "version": "6.3.0",
-            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-            "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+            "version": "6.3.1",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+            "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
             "dev": true,
             "bin": {
                 "semver": "bin/semver.js"
             }
         },
         "node_modules/@babel/preset-modules": {
-            "version": "0.1.5",
-            "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.5.tgz",
-            "integrity": "sha512-A57th6YRG7oR3cq/yt/Y84MvGgE0eJG2F1JLhKuyG+jFxEgrd/HAMJatiFtmOiZurz+0DkrvbheCLaV5f2JfjA==",
+            "version": "0.1.6-no-external-plugins",
+            "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.6-no-external-plugins.tgz",
+            "integrity": "sha512-HrcgcIESLm9aIR842yhJ5RWan/gebQUJ6E/E5+rf0y9o6oj7w0Br+sWuL6kEQ/o/AdfvR1Je9jG18/gnpwjEyA==",
             "dev": true,
             "dependencies": {
                 "@babel/helper-plugin-utils": "^7.0.0",
-                "@babel/plugin-proposal-unicode-property-regex": "^7.4.4",
-                "@babel/plugin-transform-dotall-regex": "^7.4.4",
                 "@babel/types": "^7.4.4",
                 "esutils": "^2.0.2"
             },
             "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
+                "@babel/core": "^7.0.0-0 || ^8.0.0-0 <8.0.0"
             }
         },
+        "node_modules/@babel/regjsgen": {
+            "version": "0.8.0",
+            "resolved": "https://registry.npmjs.org/@babel/regjsgen/-/regjsgen-0.8.0.tgz",
+            "integrity": "sha512-x/rqGMdzj+fWZvCOYForTghzbtqPDZ5gPwaoNGHdgDfF2QA/XZbCBp4Moo5scrkAMPhB7z26XM/AaHuIJdgauA==",
+            "dev": true
+        },
         "node_modules/@babel/runtime": {
-            "version": "7.20.13",
-            "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.20.13.tgz",
-            "integrity": "sha512-gt3PKXs0DBoL9xCvOIIZ2NEqAGZqHjAnmVbfQtB620V0uReIQutpel14KcneZuer7UioY8ALKZ7iocavvzTNFA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.24.7.tgz",
+            "integrity": "sha512-UwgBRMjJP+xv857DCngvqXI3Iq6J4v0wXmwc6sapg+zyhbwmQX67LUEFrkK5tbyJ30jGuG3ZvWpBiB9LCy1kWw==",
             "dev": true,
             "dependencies": {
-                "regenerator-runtime": "^0.13.11"
+                "regenerator-runtime": "^0.14.0"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/template": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.20.7.tgz",
-            "integrity": "sha512-8SegXApWe6VoNw0r9JHpSteLKTpTiLZ4rMlGIm9JQ18KiCtyQiAMEazujAHrUS5flrcqYZa75ukev3P6QmUwUw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.24.7.tgz",
+            "integrity": "sha512-jYqfPrU9JTF0PmPy1tLYHW4Mp4KlgxJD9l2nP9fD6yT/ICi554DmrWBAEYpIelzjHf1msDP3PxJIRt/nFNfBig==",
             "dev": true,
             "dependencies": {
-                "@babel/code-frame": "^7.18.6",
-                "@babel/parser": "^7.20.7",
-                "@babel/types": "^7.20.7"
+                "@babel/code-frame": "^7.24.7",
+                "@babel/parser": "^7.24.7",
+                "@babel/types": "^7.24.7"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/traverse": {
-            "version": "7.20.13",
-            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.20.13.tgz",
-            "integrity": "sha512-kMJXfF0T6DIS9E8cgdLCSAL+cuCK+YEZHWiLK0SXpTo8YRj5lpJu3CDNKiIBCne4m9hhTIqUg6SYTAI39tAiVQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.24.7.tgz",
+            "integrity": "sha512-yb65Ed5S/QAcewNPh0nZczy9JdYXkkAbIsEo+P7BE7yO3txAY30Y/oPa3QkQ5It3xVG2kpKMg9MsdxZaO31uKA==",
             "dev": true,
             "dependencies": {
-                "@babel/code-frame": "^7.18.6",
-                "@babel/generator": "^7.20.7",
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-function-name": "^7.19.0",
-                "@babel/helper-hoist-variables": "^7.18.6",
-                "@babel/helper-split-export-declaration": "^7.18.6",
-                "@babel/parser": "^7.20.13",
-                "@babel/types": "^7.20.7",
-                "debug": "^4.1.0",
+                "@babel/code-frame": "^7.24.7",
+                "@babel/generator": "^7.24.7",
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-function-name": "^7.24.7",
+                "@babel/helper-hoist-variables": "^7.24.7",
+                "@babel/helper-split-export-declaration": "^7.24.7",
+                "@babel/parser": "^7.24.7",
+                "@babel/types": "^7.24.7",
+                "debug": "^4.3.1",
                 "globals": "^11.1.0"
             },
             "engines": {
@@ -1797,9 +1912,9 @@
             }
         },
         "node_modules/@babel/traverse/node_modules/debug": {
-            "version": "4.3.4",
-            "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
-            "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+            "version": "4.3.5",
+            "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.5.tgz",
+            "integrity": "sha512-pt0bNEmneDIvdL1Xsd9oDQ/wrQRkXDT4AUWlNZNPKvW5x/jyO9VFXkJUP07vQ2upmw5PlaITaPKc31jK13V+jg==",
             "dev": true,
             "dependencies": {
                 "ms": "2.1.2"
@@ -1820,13 +1935,13 @@
             "dev": true
         },
         "node_modules/@babel/types": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.20.7.tgz",
-            "integrity": "sha512-69OnhBxSSgK0OzTJai4kyPDiKTIe3j+ctaHdIGVbRahTLAT7L3R9oeXHC2aVSuGYt3cVnoAMDmOCgJ2yaiLMvg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.24.7.tgz",
+            "integrity": "sha512-XEFXSlxiG5td2EJRe8vOmRbaXVgfcBlszKujvVmWIK/UpywWljQCfzAv3RQCGujWQ1RD4YYWEAqDXfuJiy8f5Q==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-string-parser": "^7.19.4",
-                "@babel/helper-validator-identifier": "^7.19.1",
+                "@babel/helper-string-parser": "^7.24.7",
+                "@babel/helper-validator-identifier": "^7.24.7",
                 "to-fast-properties": "^2.0.0"
             },
             "engines": {
@@ -1871,9 +1986,9 @@
             }
         },
         "node_modules/@jridgewell/set-array": {
-            "version": "1.1.2",
-            "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
-            "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
+            "version": "1.2.1",
+            "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.2.1.tgz",
+            "integrity": "sha512-R8gLRTZeyp03ymzP/6Lil/28tGeGEzhx1q2k703KGWRAI1VdvPIXdG70VJc2pAMw3NA6JKL5hhFu1sJX0Mnn/A==",
             "dev": true,
             "engines": {
                 "node": ">=6.0.0"
@@ -1886,13 +2001,13 @@
             "dev": true
         },
         "node_modules/@jridgewell/trace-mapping": {
-            "version": "0.3.17",
-            "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.17.tgz",
-            "integrity": "sha512-MCNzAp77qzKca9+W/+I0+sEpaUnZoeasnghNeVc41VZCEKaCH73Vq3BZZ/SzWIgrqE4H4ceI+p+b6C0mHf9T4g==",
+            "version": "0.3.25",
+            "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.25.tgz",
+            "integrity": "sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ==",
             "dev": true,
             "dependencies": {
-                "@jridgewell/resolve-uri": "3.1.0",
-                "@jridgewell/sourcemap-codec": "1.4.14"
+                "@jridgewell/resolve-uri": "^3.1.0",
+                "@jridgewell/sourcemap-codec": "^1.4.14"
             }
         },
         "node_modules/@npmcli/fs": {
@@ -2778,51 +2893,51 @@
             }
         },
         "node_modules/babel-plugin-polyfill-corejs2": {
-            "version": "0.3.3",
-            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.3.3.tgz",
-            "integrity": "sha512-8hOdmFYFSZhqg2C/JgLUQ+t52o5nirNwaWM2B9LWteozwIvM14VSwdsCAUET10qT+kmySAlseadmfeeSWFCy+Q==",
+            "version": "0.4.11",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.4.11.tgz",
+            "integrity": "sha512-sMEJ27L0gRHShOh5G54uAAPaiCOygY/5ratXuiyb2G46FmlSpc9eFCzYVyDiPxfNbwzA7mYahmjQc5q+CZQ09Q==",
             "dev": true,
             "dependencies": {
-                "@babel/compat-data": "^7.17.7",
-                "@babel/helper-define-polyfill-provider": "^0.3.3",
-                "semver": "^6.1.1"
+                "@babel/compat-data": "^7.22.6",
+                "@babel/helper-define-polyfill-provider": "^0.6.2",
+                "semver": "^6.3.1"
             },
             "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
+                "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0"
             }
         },
         "node_modules/babel-plugin-polyfill-corejs2/node_modules/semver": {
-            "version": "6.3.0",
-            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-            "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+            "version": "6.3.1",
+            "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+            "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
             "dev": true,
             "bin": {
                 "semver": "bin/semver.js"
             }
         },
         "node_modules/babel-plugin-polyfill-corejs3": {
-            "version": "0.6.0",
-            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.6.0.tgz",
-            "integrity": "sha512-+eHqR6OPcBhJOGgsIar7xoAB1GcSwVUA3XjAd7HJNzOXT4wv6/H7KIdA/Nc60cvUlDbKApmqNvD1B1bzOt4nyA==",
+            "version": "0.10.4",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.10.4.tgz",
+            "integrity": "sha512-25J6I8NGfa5YkCDogHRID3fVCadIR8/pGl1/spvCkzb6lVn6SR3ojpx9nOn9iEBcUsjY24AmdKm5khcfKdylcg==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-define-polyfill-provider": "^0.3.3",
-                "core-js-compat": "^3.25.1"
+                "@babel/helper-define-polyfill-provider": "^0.6.1",
+                "core-js-compat": "^3.36.1"
             },
             "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
+                "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0"
             }
         },
         "node_modules/babel-plugin-polyfill-regenerator": {
-            "version": "0.4.1",
-            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.4.1.tgz",
-            "integrity": "sha512-NtQGmyQDXjQqQ+IzRkBVwEOz9lQ4zxAQZgoAYEtU9dJjnl1Oc98qnN7jcp+bE7O7aYzVpavXE3/VKXNzUbh7aw==",
+            "version": "0.6.2",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.6.2.tgz",
+            "integrity": "sha512-2R25rQZWP63nGwaAswvDazbPXfrM3HwVoBXK6HcqeKrSrL/JqcC/rDcf95l4r7LXLyxDXc8uQDa064GubtCABg==",
             "dev": true,
             "dependencies": {
-                "@babel/helper-define-polyfill-provider": "^0.3.3"
+                "@babel/helper-define-polyfill-provider": "^0.6.2"
             },
             "peerDependencies": {
-                "@babel/core": "^7.0.0-0"
+                "@babel/core": "^7.4.0 || ^8.0.0-0 <8.0.0"
             }
         },
         "node_modules/balanced-match": {
@@ -3077,9 +3192,9 @@
             }
         },
         "node_modules/browserslist": {
-            "version": "4.21.5",
-            "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.21.5.tgz",
-            "integrity": "sha512-tUkiguQGW7S3IhB7N+c2MV/HZPSCPAAiYBZXLsBhFB/PCy6ZKKsZrmBayHV9fdGV/ARIfJ14NkxKzRDjvp7L6w==",
+            "version": "4.23.1",
+            "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.23.1.tgz",
+            "integrity": "sha512-TUfofFo/KsK/bWZ9TWQ5O26tsWW4Uhmt8IYklbnUa70udB6P2wA7w7o4PY4muaEPBQaAX+CEnmmIA41NVHtPVw==",
             "dev": true,
             "funding": [
                 {
@@ -3089,13 +3204,17 @@
                 {
                     "type": "tidelift",
                     "url": "https://tidelift.com/funding/github/npm/browserslist"
+                },
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/ai"
                 }
             ],
             "dependencies": {
-                "caniuse-lite": "^1.0.30001449",
-                "electron-to-chromium": "^1.4.284",
-                "node-releases": "^2.0.8",
-                "update-browserslist-db": "^1.0.10"
+                "caniuse-lite": "^1.0.30001629",
+                "electron-to-chromium": "^1.4.796",
+                "node-releases": "^2.0.14",
+                "update-browserslist-db": "^1.0.16"
             },
             "bin": {
                 "browserslist": "cli.js"
@@ -3239,9 +3358,9 @@
             }
         },
         "node_modules/caniuse-lite": {
-            "version": "1.0.30001473",
-            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001473.tgz",
-            "integrity": "sha512-ewDad7+D2vlyy+E4UJuVfiBsU69IL+8oVmTuZnH5Q6CIUbxNfI50uVpRHbUPDD6SUaN2o0Lh4DhTrvLG/Tn1yg==",
+            "version": "1.0.30001632",
+            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001632.tgz",
+            "integrity": "sha512-udx3o7yHJfUxMLkGohMlVHCvFvWmirKh9JAH/d7WOLPetlH+LTL5cocMZ0t7oZx/mdlOWXti97xLZWc8uURRHg==",
             "dev": true,
             "funding": [
                 {
@@ -3763,9 +3882,9 @@
             "integrity": "sha512-xFxOwqIzR/e1k1gLiWEophSCMqXcwVHIH7akf7b/vxcUeGunlj3hvZaaqxwHsTgn+IndtkQJgSztIDWeumWJDQ=="
         },
         "node_modules/convert-source-map": {
-            "version": "1.9.0",
-            "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
-            "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
+            "version": "2.0.0",
+            "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+            "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
             "dev": true
         },
         "node_modules/copy-concurrently": {
@@ -3852,12 +3971,12 @@
             }
         },
         "node_modules/core-js-compat": {
-            "version": "3.27.2",
-            "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.27.2.tgz",
-            "integrity": "sha512-welaYuF7ZtbYKGrIy7y3eb40d37rG1FvzEOfe7hSLd2iD6duMDqUhRfSvCGyC46HhR6Y8JXXdZ2lnRUMkPBpvg==",
+            "version": "3.37.1",
+            "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.37.1.tgz",
+            "integrity": "sha512-9TNiImhKvQqSUkOvk/mMRZzOANTiEVC7WaBNhHcKM7x+/5E1l5NvsysR19zuDQScE8k+kfQXWRN3AtS/eOSHpg==",
             "dev": true,
             "dependencies": {
-                "browserslist": "^4.21.4"
+                "browserslist": "^4.23.0"
             },
             "funding": {
                 "type": "opencollective",
@@ -4623,33 +4742,33 @@
             "dev": true
         },
         "node_modules/csv": {
-            "version": "6.2.5",
-            "resolved": "https://registry.npmjs.org/csv/-/csv-6.2.5.tgz",
-            "integrity": "sha512-T+K0H7MIrlrnP6KxYKo3lK+uLl6OC2Gmwdd81TG/VdkhKvpatl35sR7tyRSpDLGl22y2T+q9KvNHnVtn4OAscQ==",
+            "version": "6.3.9",
+            "resolved": "https://registry.npmjs.org/csv/-/csv-6.3.9.tgz",
+            "integrity": "sha512-eiN+Qu8NwSLxZYia6WzB8xlX/rAQ/8EgK5A4dIF7Bz96mzcr5dW1jlcNmjG0QWySWKfPdCerH3RQ96ZqqsE8cA==",
             "dependencies": {
-                "csv-generate": "^4.2.1",
-                "csv-parse": "^5.3.3",
-                "csv-stringify": "^6.2.3",
-                "stream-transform": "^3.2.1"
+                "csv-generate": "^4.4.1",
+                "csv-parse": "^5.5.6",
+                "csv-stringify": "^6.5.0",
+                "stream-transform": "^3.3.2"
             },
             "engines": {
                 "node": ">= 0.1.90"
             }
         },
         "node_modules/csv-generate": {
-            "version": "4.2.1",
-            "resolved": "https://registry.npmjs.org/csv-generate/-/csv-generate-4.2.1.tgz",
-            "integrity": "sha512-w6GFHjvApv6bcJ2xdi9JGsH6ZvUBfC+vUdfefnEzurXG6hMRwzkBLnhztU2H7v7+zfCk1I/knnQ+tGbgpxWrBw=="
+            "version": "4.4.1",
+            "resolved": "https://registry.npmjs.org/csv-generate/-/csv-generate-4.4.1.tgz",
+            "integrity": "sha512-O/einO0v4zPmXaOV+sYqGa02VkST4GP5GLpWBNHEouIU7pF3kpGf3D0kCCvX82ydIY4EKkOK+R8b1BYsRXravg=="
         },
         "node_modules/csv-parse": {
-            "version": "5.3.3",
-            "resolved": "https://registry.npmjs.org/csv-parse/-/csv-parse-5.3.3.tgz",
-            "integrity": "sha512-kEWkAPleNEdhFNkHQpFHu9RYPogsFj3dx6bCxL847fsiLgidzWg0z/O0B1kVWMJUc5ky64zGp18LX2T3DQrOfw=="
+            "version": "5.5.6",
+            "resolved": "https://registry.npmjs.org/csv-parse/-/csv-parse-5.5.6.tgz",
+            "integrity": "sha512-uNpm30m/AGSkLxxy7d9yRXpJQFrZzVWLFBkS+6ngPcZkw/5k3L/jjFuj7tVnEpRn+QgmiXr21nDlhCiUK4ij2A=="
         },
         "node_modules/csv-stringify": {
-            "version": "6.2.3",
-            "resolved": "https://registry.npmjs.org/csv-stringify/-/csv-stringify-6.2.3.tgz",
-            "integrity": "sha512-4qGjUMwnlaRc00gc2jrIYh2w/h1fo25B0mTuY9K8fBiIgtmCX3LcgUbrEGViL98Ci4Se/F5LFEtu8k+dItJVZQ=="
+            "version": "6.5.0",
+            "resolved": "https://registry.npmjs.org/csv-stringify/-/csv-stringify-6.5.0.tgz",
+            "integrity": "sha512-edlXFVKcUx7r8Vx5zQucsuMg4wb/xT6qyz+Sr1vnLrdXqlLD1+UKyWNyZ9zn6mUW1ewmGxrpVwAcChGF0HQ/2Q=="
         },
         "node_modules/cyclist": {
             "version": "1.0.1",
@@ -4910,9 +5029,9 @@
             }
         },
         "node_modules/electron-to-chromium": {
-            "version": "1.4.349",
-            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.349.tgz",
-            "integrity": "sha512-34LBfVDiL6byWorSmQOPwq4gD5wpN8Mhh5yPGQr67FbcxsfUS0BDJP9y6RykSgeWVUfSkN/2dChywnsrmKVyUg==",
+            "version": "1.4.798",
+            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.798.tgz",
+            "integrity": "sha512-by9J2CiM9KPGj9qfp5U4FcPSbXJG7FNzqnYaY4WLzX+v2PHieVGmnsA4dxfpGE3QEC7JofpPZmn7Vn1B9NR2+Q==",
             "dev": true
         },
         "node_modules/elliptic": {
@@ -5102,9 +5221,9 @@
             }
         },
         "node_modules/escalade": {
-            "version": "3.1.1",
-            "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
-            "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
+            "version": "3.1.2",
+            "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.2.tgz",
+            "integrity": "sha512-ErCHMCae19vR8vQGe50xIsVomy19rg6gFu3+r3jkEO46suLMWBksvVyoGgQV+jOfl84ZSOSlmv6Gxa89PmTGmA==",
             "dev": true,
             "engines": {
                 "node": ">=6"
@@ -7465,9 +7584,9 @@
             }
         },
         "node_modules/node-releases": {
-            "version": "2.0.10",
-            "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.10.tgz",
-            "integrity": "sha512-5GFldHPXVG/YZmFzJvKK2zDSzPKhEp0+ZR5SVaoSag9fsL5YgHbUHDfnG5494ISANDcK4KwPXAx2xqVEydmd7w==",
+            "version": "2.0.14",
+            "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.14.tgz",
+            "integrity": "sha512-y10wOWt8yZpqXmOgRo77WaHEmhYQYGNA6y421PKsKYWEK8aW+cqAphborZDhqfyKrbZEN92CN1X2KbafY2s7Yw==",
             "dev": true
         },
         "node_modules/nopt": {
@@ -7907,9 +8026,9 @@
             }
         },
         "node_modules/picocolors": {
-            "version": "1.0.0",
-            "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
-            "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.1.tgz",
+            "integrity": "sha512-anP1Z8qwhkbmu7MFP5iTt+wQKXgwzf7zTyGlcdzabySa9vd0Xt392U0rVmz9poOaBj0uHJKyyo9/upk0HrEQew==",
             "dev": true
         },
         "node_modules/picomatch": {
@@ -9383,9 +9502,9 @@
             "dev": true
         },
         "node_modules/regenerate-unicode-properties": {
-            "version": "10.1.0",
-            "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-10.1.0.tgz",
-            "integrity": "sha512-d1VudCLoIGitcU/hEg2QqvyGZQmdC0Lf8BqdOMXGFSvJP4bNV1+XqbPQeHHLD51Jh4QJJ225dlIFvY4Ly6MXmQ==",
+            "version": "10.1.1",
+            "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-10.1.1.tgz",
+            "integrity": "sha512-X007RyZLsCJVVrjgEFVpLUTZwyOZk3oiL75ZcuYjlIWd6rNJtOjkBwQc5AsRrpbKVkxN6sklw/k/9m2jJYOf8Q==",
             "dev": true,
             "dependencies": {
                 "regenerate": "^1.4.2"
@@ -9395,15 +9514,15 @@
             }
         },
         "node_modules/regenerator-runtime": {
-            "version": "0.13.11",
-            "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
-            "integrity": "sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==",
+            "version": "0.14.1",
+            "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.14.1.tgz",
+            "integrity": "sha512-dYnhHh0nJoMfnkZs6GmmhFknAGRrLznOu5nc9ML+EJxGvrx6H7teuevqVqCuPcPK//3eDrrjQhehXVx9cnkGdw==",
             "dev": true
         },
         "node_modules/regenerator-transform": {
-            "version": "0.15.1",
-            "resolved": "https://registry.npmjs.org/regenerator-transform/-/regenerator-transform-0.15.1.tgz",
-            "integrity": "sha512-knzmNAcuyxV+gQCufkYcvOqX/qIIfHLv0u5x79kRxuGojfYVky1f15TzZEu2Avte8QGepvUNTnLskf8E6X6Vyg==",
+            "version": "0.15.2",
+            "resolved": "https://registry.npmjs.org/regenerator-transform/-/regenerator-transform-0.15.2.tgz",
+            "integrity": "sha512-hfMp2BoF0qOk3uc5V20ALGDS2ddjQaLrdl7xrGXvAIow7qeWRM2VA2HuCHkUKk9slq3VwEwLNK3DFBqDfPGYtg==",
             "dev": true,
             "dependencies": {
                 "@babel/runtime": "^7.8.4"
@@ -9439,14 +9558,14 @@
             }
         },
         "node_modules/regexpu-core": {
-            "version": "5.2.2",
-            "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-5.2.2.tgz",
-            "integrity": "sha512-T0+1Zp2wjF/juXMrMxHxidqGYn8U4R+zleSJhX9tQ1PUsS8a9UtYfbsF9LdiVgNX3kiX8RNaKM42nfSgvFJjmw==",
+            "version": "5.3.2",
+            "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-5.3.2.tgz",
+            "integrity": "sha512-RAM5FlZz+Lhmo7db9L298p2vHP5ZywrVXmVXpmAD9GuL5MPH6t9ROw1iA/wfHkQ76Qe7AaPF0nGuim96/IrQMQ==",
             "dev": true,
             "dependencies": {
+                "@babel/regjsgen": "^0.8.0",
                 "regenerate": "^1.4.2",
                 "regenerate-unicode-properties": "^10.1.0",
-                "regjsgen": "^0.7.1",
                 "regjsparser": "^0.9.1",
                 "unicode-match-property-ecmascript": "^2.0.0",
                 "unicode-match-property-value-ecmascript": "^2.1.0"
@@ -9455,12 +9574,6 @@
                 "node": ">=4"
             }
         },
-        "node_modules/regjsgen": {
-            "version": "0.7.1",
-            "resolved": "https://registry.npmjs.org/regjsgen/-/regjsgen-0.7.1.tgz",
-            "integrity": "sha512-RAt+8H2ZEzHeYWxZ3H2z6tF18zyyOnlcdaafLrm21Bguj7uZy6ULibiAFdXEtKQY4Sy7wDTwDiOazasMLc4KPA==",
-            "dev": true
-        },
         "node_modules/regjsparser": {
             "version": "0.9.1",
             "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.9.1.tgz",
@@ -10227,9 +10340,9 @@
             "integrity": "sha512-AiisoFqQ0vbGcZgQPY1cdP2I76glaVA/RauYR4G4thNFgkTqr90yXTo4LYX60Jl+sIlPNHHdGSwo01AvbKUSVQ=="
         },
         "node_modules/stream-transform": {
-            "version": "3.2.1",
-            "resolved": "https://registry.npmjs.org/stream-transform/-/stream-transform-3.2.1.tgz",
-            "integrity": "sha512-ApK+WTJ5bCOf0A2tlec1qhvr8bGEBM/sgXXB7mysdCYgZJO5DZeaV3h3G+g0HnAQ372P5IhiGqnW29zoLOfTzQ=="
+            "version": "3.3.2",
+            "resolved": "https://registry.npmjs.org/stream-transform/-/stream-transform-3.3.2.tgz",
+            "integrity": "sha512-v64PUnPy9Qw94NGuaEMo+9RHQe4jTBYf+NkTtqkCgeuiNo8NlL0LtLR7fkKWNVFtp3RhIm5Dlxkgm5uz7TDimQ=="
         },
         "node_modules/string_decoder": {
             "version": "1.1.1",
@@ -10917,9 +11030,9 @@
             }
         },
         "node_modules/update-browserslist-db": {
-            "version": "1.0.10",
-            "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.0.10.tgz",
-            "integrity": "sha512-OztqDenkfFkbSG+tRxBeAnCVPckDBcvibKd35yDONx6OU8N7sqgwc7rCbkJ/WcYtVRZ4ba68d6byhC21GFh7sQ==",
+            "version": "1.0.16",
+            "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.0.16.tgz",
+            "integrity": "sha512-KVbTxlBYlckhF5wgfyZXTWnMn7MMZjMu9XG8bPlliUOP9ThaF4QnhP8qrjrH7DRzHfSk0oQv1wToW+iA5GajEQ==",
             "dev": true,
             "funding": [
                 {
@@ -10929,14 +11042,18 @@
                 {
                     "type": "tidelift",
                     "url": "https://tidelift.com/funding/github/npm/browserslist"
+                },
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/ai"
                 }
             ],
             "dependencies": {
-                "escalade": "^3.1.1",
-                "picocolors": "^1.0.0"
+                "escalade": "^3.1.2",
+                "picocolors": "^1.0.1"
             },
             "bin": {
-                "browserslist-lint": "cli.js"
+                "update-browserslist-db": "cli.js"
             },
             "peerDependencies": {
                 "browserslist": ">= 4.21.0"
@@ -11453,9 +11570,12 @@
             "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
         },
         "node_modules/yaml": {
-            "version": "2.2.2",
-            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.2.tgz",
-            "integrity": "sha512-CBKFWExMn46Foo4cldiChEzn7S7SRV+wqiluAb6xmueD/fGyRHIhX8m14vVGgeFWjN540nKCNVj6P21eQjgTuA==",
+            "version": "2.4.5",
+            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.4.5.tgz",
+            "integrity": "sha512-aBx2bnqDzVOyNKfsysjA2ms5ZlnjSAW2eG3/L5G/CSujfjLJTJsEw1bGw8kCf04KodQWk1pxlGnZ56CRxiawmg==",
+            "bin": {
+                "yaml": "bin.mjs"
+            },
             "engines": {
                 "node": ">= 14"
             }
@@ -11485,41 +11605,42 @@
             }
         },
         "@babel/code-frame": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.18.6.tgz",
-            "integrity": "sha512-TDCmlK5eOvH+eH7cdAFlNXeVJqWIQ7gW9tY1GJIpUtFb6CmjVyq2VM3u71bOyR8CRihcCgMUYoDNyLXao3+70Q==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.24.7.tgz",
+            "integrity": "sha512-BcYH1CVJBO9tvyIZ2jVeXgSIMvGZ2FDRvDdOIVQyuklNKSsx+eppDEBq/g47Ayw+RqNFE+URvOShmf+f/qwAlA==",
             "dev": true,
             "requires": {
-                "@babel/highlight": "^7.18.6"
+                "@babel/highlight": "^7.24.7",
+                "picocolors": "^1.0.0"
             }
         },
         "@babel/compat-data": {
-            "version": "7.20.10",
-            "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.20.10.tgz",
-            "integrity": "sha512-sEnuDPpOJR/fcafHMjpcpGN5M2jbUGUHwmuWKM/YdPzeEDJg8bgmbcWQFUfE32MQjti1koACvoPVsDe8Uq+idg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.24.7.tgz",
+            "integrity": "sha512-qJzAIcv03PyaWqxRgO4mSU3lihncDT296vnyuE2O8uA4w3UHWI4S3hgeZd1L8W1Bft40w9JxJ2b412iDUFFRhw==",
             "dev": true
         },
         "@babel/core": {
-            "version": "7.20.12",
-            "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.20.12.tgz",
-            "integrity": "sha512-XsMfHovsUYHFMdrIHkZphTN/2Hzzi78R08NuHfDBehym2VsPDL6Zn/JAD/JQdnRvbSsbQc4mVaU1m6JgtTEElg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.24.7.tgz",
+            "integrity": "sha512-nykK+LEK86ahTkX/3TgauT0ikKoNCfKHEaZYTUVupJdTLzGNvrblu4u6fa7DhZONAltdf8e662t/abY8idrd/g==",
             "dev": true,
             "requires": {
-                "@ampproject/remapping": "^2.1.0",
-                "@babel/code-frame": "^7.18.6",
-                "@babel/generator": "^7.20.7",
-                "@babel/helper-compilation-targets": "^7.20.7",
-                "@babel/helper-module-transforms": "^7.20.11",
-                "@babel/helpers": "^7.20.7",
-                "@babel/parser": "^7.20.7",
-                "@babel/template": "^7.20.7",
-                "@babel/traverse": "^7.20.12",
-                "@babel/types": "^7.20.7",
-                "convert-source-map": "^1.7.0",
+                "@ampproject/remapping": "^2.2.0",
+                "@babel/code-frame": "^7.24.7",
+                "@babel/generator": "^7.24.7",
+                "@babel/helper-compilation-targets": "^7.24.7",
+                "@babel/helper-module-transforms": "^7.24.7",
+                "@babel/helpers": "^7.24.7",
+                "@babel/parser": "^7.24.7",
+                "@babel/template": "^7.24.7",
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7",
+                "convert-source-map": "^2.0.0",
                 "debug": "^4.1.0",
                 "gensync": "^1.0.0-beta.2",
-                "json5": "^2.2.2",
-                "semver": "^6.3.0"
+                "json5": "^2.2.3",
+                "semver": "^6.3.1"
             },
             "dependencies": {
                 "debug": {
@@ -11544,33 +11665,34 @@
                     "dev": true
                 },
                 "semver": {
-                    "version": "6.3.0",
-                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-                    "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+                    "version": "6.3.1",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+                    "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
                     "dev": true
                 }
             }
         },
         "@babel/generator": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.20.7.tgz",
-            "integrity": "sha512-7wqMOJq8doJMZmP4ApXTzLxSr7+oO2jroJURrVEp6XShrQUObV8Tq/D0NCcoYg2uHqUrjzO0zwBjoYzelxK+sw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.24.7.tgz",
+            "integrity": "sha512-oipXieGC3i45Y1A41t4tAqpnEZWgB/lC6Ehh6+rOviR5XWpTtMmLN+fGjz9vOiNRt0p6RtO6DtD0pdU3vpqdSA==",
             "dev": true,
             "requires": {
-                "@babel/types": "^7.20.7",
-                "@jridgewell/gen-mapping": "^0.3.2",
+                "@babel/types": "^7.24.7",
+                "@jridgewell/gen-mapping": "^0.3.5",
+                "@jridgewell/trace-mapping": "^0.3.25",
                 "jsesc": "^2.5.1"
             },
             "dependencies": {
                 "@jridgewell/gen-mapping": {
-                    "version": "0.3.2",
-                    "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
-                    "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+                    "version": "0.3.5",
+                    "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.5.tgz",
+                    "integrity": "sha512-IzL8ZoEDIBRWEzlCcRhOaCupYyN5gdIK+Q6fbFdPDg6HqX6jpkItn7DFIpW9LQzXG6Df9sA7+OKnq0qlz/GaQg==",
                     "dev": true,
                     "requires": {
-                        "@jridgewell/set-array": "^1.0.1",
+                        "@jridgewell/set-array": "^1.2.1",
                         "@jridgewell/sourcemap-codec": "^1.4.10",
-                        "@jridgewell/trace-mapping": "^0.3.9"
+                        "@jridgewell/trace-mapping": "^0.3.24"
                     }
                 },
                 "jsesc": {
@@ -11582,89 +11704,106 @@
             }
         },
         "@babel/helper-annotate-as-pure": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.18.6.tgz",
-            "integrity": "sha512-duORpUiYrEpzKIop6iNbjnwKLAKnJ47csTyRACyEmWj0QdUrm5aqNJGHSSEQSUAvNW0ojX0dOmK9dZduvkfeXA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.24.7.tgz",
+            "integrity": "sha512-BaDeOonYvhdKw+JoMVkAixAAJzG2jVPIwWoKBPdYuY9b452e2rPuI9QPYh3KpofZ3pW2akOmwZLOiOsHMiqRAg==",
             "dev": true,
             "requires": {
-                "@babel/types": "^7.18.6"
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helper-builder-binary-assignment-operator-visitor": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.18.9.tgz",
-            "integrity": "sha512-yFQ0YCHoIqarl8BCRwBL8ulYUaZpz3bNsA7oFepAzee+8/+ImtADXNOmO5vJvsPff3qi+hvpkY/NYBTrBQgdNw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.24.7.tgz",
+            "integrity": "sha512-xZeCVVdwb4MsDBkkyZ64tReWYrLRHlMN72vP7Bdm3OUOuyFZExhsHUUnuWnm2/XOlAJzR0LfPpB56WXZn0X/lA==",
             "dev": true,
             "requires": {
-                "@babel/helper-explode-assignable-expression": "^7.18.6",
-                "@babel/types": "^7.18.9"
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helper-compilation-targets": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.20.7.tgz",
-            "integrity": "sha512-4tGORmfQcrc+bvrjb5y3dG9Mx1IOZjsHqQVUz7XCNHO+iTmqxWnVg3KRygjGmpRLJGdQSKuvFinbIb0CnZwHAQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.24.7.tgz",
+            "integrity": "sha512-ctSdRHBi20qWOfy27RUb4Fhp07KSJ3sXcuSvTrXrc4aG8NSYDo1ici3Vhg9bg69y5bj0Mr1lh0aeEgTvc12rMg==",
             "dev": true,
             "requires": {
-                "@babel/compat-data": "^7.20.5",
-                "@babel/helper-validator-option": "^7.18.6",
-                "browserslist": "^4.21.3",
+                "@babel/compat-data": "^7.24.7",
+                "@babel/helper-validator-option": "^7.24.7",
+                "browserslist": "^4.22.2",
                 "lru-cache": "^5.1.1",
-                "semver": "^6.3.0"
+                "semver": "^6.3.1"
             },
             "dependencies": {
                 "semver": {
-                    "version": "6.3.0",
-                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-                    "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+                    "version": "6.3.1",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+                    "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
                     "dev": true
                 }
             }
         },
         "@babel/helper-create-class-features-plugin": {
-            "version": "7.20.12",
-            "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.20.12.tgz",
-            "integrity": "sha512-9OunRkbT0JQcednL0UFvbfXpAsUXiGjUk0a7sN8fUXX7Mue79cUSMjHGDRRi/Vz9vYlpIhLV5fMD5dKoMhhsNQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.24.7.tgz",
+            "integrity": "sha512-kTkaDl7c9vO80zeX1rJxnuRpEsD5tA81yh11X1gQo+PhSti3JS+7qeZo9U4RHobKRiFPKaGK3svUAeb8D0Q7eg==",
             "dev": true,
             "requires": {
-                "@babel/helper-annotate-as-pure": "^7.18.6",
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-function-name": "^7.19.0",
-                "@babel/helper-member-expression-to-functions": "^7.20.7",
-                "@babel/helper-optimise-call-expression": "^7.18.6",
-                "@babel/helper-replace-supers": "^7.20.7",
-                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
-                "@babel/helper-split-export-declaration": "^7.18.6"
+                "@babel/helper-annotate-as-pure": "^7.24.7",
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-function-name": "^7.24.7",
+                "@babel/helper-member-expression-to-functions": "^7.24.7",
+                "@babel/helper-optimise-call-expression": "^7.24.7",
+                "@babel/helper-replace-supers": "^7.24.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.24.7",
+                "@babel/helper-split-export-declaration": "^7.24.7",
+                "semver": "^6.3.1"
+            },
+            "dependencies": {
+                "semver": {
+                    "version": "6.3.1",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+                    "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+                    "dev": true
+                }
             }
         },
         "@babel/helper-create-regexp-features-plugin": {
-            "version": "7.20.5",
-            "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.20.5.tgz",
-            "integrity": "sha512-m68B1lkg3XDGX5yCvGO0kPx3v9WIYLnzjKfPcQiwntEQa5ZeRkPmo2X/ISJc8qxWGfwUr+kvZAeEzAwLec2r2w==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.24.7.tgz",
+            "integrity": "sha512-03TCmXy2FtXJEZfbXDTSqq1fRJArk7lX9DOFC/47VthYcxyIOx+eXQmdo6DOQvrbpIix+KfXwvuXdFDZHxt+rA==",
             "dev": true,
             "requires": {
-                "@babel/helper-annotate-as-pure": "^7.18.6",
-                "regexpu-core": "^5.2.1"
+                "@babel/helper-annotate-as-pure": "^7.24.7",
+                "regexpu-core": "^5.3.1",
+                "semver": "^6.3.1"
+            },
+            "dependencies": {
+                "semver": {
+                    "version": "6.3.1",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+                    "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+                    "dev": true
+                }
             }
         },
         "@babel/helper-define-polyfill-provider": {
-            "version": "0.3.3",
-            "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.3.3.tgz",
-            "integrity": "sha512-z5aQKU4IzbqCC1XH0nAqfsFLMVSo22SBKUc0BxGrLkolTdPTructy0ToNnlO2zA4j9Q/7pjMZf0DSY+DSTYzww==",
+            "version": "0.6.2",
+            "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.6.2.tgz",
+            "integrity": "sha512-LV76g+C502biUK6AyZ3LK10vDpDyCzZnhZFXkH1L75zHPj68+qc8Zfpx2th+gzwA2MzyK+1g/3EPl62yFnVttQ==",
             "dev": true,
             "requires": {
-                "@babel/helper-compilation-targets": "^7.17.7",
-                "@babel/helper-plugin-utils": "^7.16.7",
+                "@babel/helper-compilation-targets": "^7.22.6",
+                "@babel/helper-plugin-utils": "^7.22.5",
                 "debug": "^4.1.1",
                 "lodash.debounce": "^4.0.8",
-                "resolve": "^1.14.2",
-                "semver": "^6.1.2"
+                "resolve": "^1.14.2"
             },
             "dependencies": {
                 "debug": {
-                    "version": "4.3.4",
-                    "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
-                    "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+                    "version": "4.3.5",
+                    "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.5.tgz",
+                    "integrity": "sha512-pt0bNEmneDIvdL1Xsd9oDQ/wrQRkXDT4AUWlNZNPKvW5x/jyO9VFXkJUP07vQ2upmw5PlaITaPKc31jK13V+jg==",
                     "dev": true,
                     "requires": {
                         "ms": "2.1.2"
@@ -11675,201 +11814,186 @@
                     "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
                     "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
                     "dev": true
-                },
-                "semver": {
-                    "version": "6.3.0",
-                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-                    "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-                    "dev": true
                 }
             }
         },
         "@babel/helper-environment-visitor": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.18.9.tgz",
-            "integrity": "sha512-3r/aACDJ3fhQ/EVgFy0hpj8oHyHpQc+LPtJoY9SzTThAsStm4Ptegq92vqKoE3vD706ZVFWITnMnxucw+S9Ipg==",
-            "dev": true
-        },
-        "@babel/helper-explode-assignable-expression": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-explode-assignable-expression/-/helper-explode-assignable-expression-7.18.6.tgz",
-            "integrity": "sha512-eyAYAsQmB80jNfg4baAtLeWAQHfHFiR483rzFK+BhETlGZaQC9bsfrugfXDCbRHLQbIA7U5NxhhOxN7p/dWIcg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.24.7.tgz",
+            "integrity": "sha512-DoiN84+4Gnd0ncbBOM9AZENV4a5ZiL39HYMyZJGZ/AZEykHYdJw0wW3kdcsh9/Kn+BRXHLkkklZ51ecPKmI1CQ==",
             "dev": true,
             "requires": {
-                "@babel/types": "^7.18.6"
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helper-function-name": {
-            "version": "7.19.0",
-            "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.19.0.tgz",
-            "integrity": "sha512-WAwHBINyrpqywkUH0nTnNgI5ina5TFn85HKS0pbPDfxFfhyR/aNQEn4hGi1P1JyT//I0t4OgXUlofzWILRvS5w==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.24.7.tgz",
+            "integrity": "sha512-FyoJTsj/PEUWu1/TYRiXTIHc8lbw+TDYkZuoE43opPS5TrI7MyONBE1oNvfguEXAD9yhQRrVBnXdXzSLQl9XnA==",
             "dev": true,
             "requires": {
-                "@babel/template": "^7.18.10",
-                "@babel/types": "^7.19.0"
+                "@babel/template": "^7.24.7",
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helper-hoist-variables": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.18.6.tgz",
-            "integrity": "sha512-UlJQPkFqFULIcyW5sbzgbkxn2FKRgwWiRexcuaR8RNJRy8+LLveqPjwZV/bwrLZCN0eUHD/x8D0heK1ozuoo6Q==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.24.7.tgz",
+            "integrity": "sha512-MJJwhkoGy5c4ehfoRyrJ/owKeMl19U54h27YYftT0o2teQ3FJ3nQUf/I3LlJsX4l3qlw7WRXUmiyajvHXoTubQ==",
             "dev": true,
             "requires": {
-                "@babel/types": "^7.18.6"
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helper-member-expression-to-functions": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.20.7.tgz",
-            "integrity": "sha512-9J0CxJLq315fEdi4s7xK5TQaNYjZw+nDVpVqr1axNGKzdrdwYBD5b4uKv3n75aABG0rCCTK8Im8Ww7eYfMrZgw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.24.7.tgz",
+            "integrity": "sha512-LGeMaf5JN4hAT471eJdBs/GK1DoYIJ5GCtZN/EsL6KUiiDZOvO/eKE11AMZJa2zP4zk4qe9V2O/hxAmkRc8p6w==",
             "dev": true,
             "requires": {
-                "@babel/types": "^7.20.7"
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helper-module-imports": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.18.6.tgz",
-            "integrity": "sha512-0NFvs3VkuSYbFi1x2Vd6tKrywq+z/cLeYC/RJNFrIX/30Bf5aiGYbtvGXolEktzJH8o5E5KJ3tT+nkxuuZFVlA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.24.7.tgz",
+            "integrity": "sha512-8AyH3C+74cgCVVXow/myrynrAGv+nTVg5vKu2nZph9x7RcRwzmh0VFallJuFTZ9mx6u4eSdXZfcOzSqTUm0HCA==",
             "dev": true,
             "requires": {
-                "@babel/types": "^7.18.6"
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helper-module-transforms": {
-            "version": "7.20.11",
-            "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.20.11.tgz",
-            "integrity": "sha512-uRy78kN4psmji1s2QtbtcCSaj/LILFDp0f/ymhpQH5QY3nljUZCaNWz9X1dEj/8MBdBEFECs7yRhKn8i7NjZgg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.24.7.tgz",
+            "integrity": "sha512-1fuJEwIrp+97rM4RWdO+qrRsZlAeL1lQJoPqtCYWv0NL115XM93hIH4CSRln2w52SqvmY5hqdtauB6QFCDiZNQ==",
             "dev": true,
             "requires": {
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-module-imports": "^7.18.6",
-                "@babel/helper-simple-access": "^7.20.2",
-                "@babel/helper-split-export-declaration": "^7.18.6",
-                "@babel/helper-validator-identifier": "^7.19.1",
-                "@babel/template": "^7.20.7",
-                "@babel/traverse": "^7.20.10",
-                "@babel/types": "^7.20.7"
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-module-imports": "^7.24.7",
+                "@babel/helper-simple-access": "^7.24.7",
+                "@babel/helper-split-export-declaration": "^7.24.7",
+                "@babel/helper-validator-identifier": "^7.24.7"
             }
         },
         "@babel/helper-optimise-call-expression": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.18.6.tgz",
-            "integrity": "sha512-HP59oD9/fEHQkdcbgFCnbmgH5vIQTJbxh2yf+CdM89/glUNnuzr87Q8GIjGEnOktTROemO0Pe0iPAYbqZuOUiA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.24.7.tgz",
+            "integrity": "sha512-jKiTsW2xmWwxT1ixIdfXUZp+P5yURx2suzLZr5Hi64rURpDYdMW0pv+Uf17EYk2Rd428Lx4tLsnjGJzYKDM/6A==",
             "dev": true,
             "requires": {
-                "@babel/types": "^7.18.6"
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helper-plugin-utils": {
-            "version": "7.20.2",
-            "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.20.2.tgz",
-            "integrity": "sha512-8RvlJG2mj4huQ4pZ+rU9lqKi9ZKiRmuvGuM2HlWmkmgOhbs6zEAw6IEiJ5cQqGbDzGZOhwuOQNtZMi/ENLjZoQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.24.7.tgz",
+            "integrity": "sha512-Rq76wjt7yz9AAc1KnlRKNAi/dMSVWgDRx43FHoJEbcYU6xOWaE2dVPwcdTukJrjxS65GITyfbvEYHvkirZ6uEg==",
             "dev": true
         },
         "@babel/helper-remap-async-to-generator": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.18.9.tgz",
-            "integrity": "sha512-dI7q50YKd8BAv3VEfgg7PS7yD3Rtbi2J1XMXaalXO0W0164hYLnh8zpjRS0mte9MfVp/tltvr/cfdXPvJr1opA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.24.7.tgz",
+            "integrity": "sha512-9pKLcTlZ92hNZMQfGCHImUpDOlAgkkpqalWEeftW5FBya75k8Li2ilerxkM/uBEj01iBZXcCIB/bwvDYgWyibA==",
             "dev": true,
             "requires": {
-                "@babel/helper-annotate-as-pure": "^7.18.6",
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-wrap-function": "^7.18.9",
-                "@babel/types": "^7.18.9"
+                "@babel/helper-annotate-as-pure": "^7.24.7",
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-wrap-function": "^7.24.7"
             }
         },
         "@babel/helper-replace-supers": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.20.7.tgz",
-            "integrity": "sha512-vujDMtB6LVfNW13jhlCrp48QNslK6JXi7lQG736HVbHz/mbf4Dc7tIRh1Xf5C0rF7BP8iiSxGMCmY6Ci1ven3A==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.24.7.tgz",
+            "integrity": "sha512-qTAxxBM81VEyoAY0TtLrx1oAEJc09ZK67Q9ljQToqCnA+55eNwCORaxlKyu+rNfX86o8OXRUSNUnrtsAZXM9sg==",
             "dev": true,
             "requires": {
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-member-expression-to-functions": "^7.20.7",
-                "@babel/helper-optimise-call-expression": "^7.18.6",
-                "@babel/template": "^7.20.7",
-                "@babel/traverse": "^7.20.7",
-                "@babel/types": "^7.20.7"
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-member-expression-to-functions": "^7.24.7",
+                "@babel/helper-optimise-call-expression": "^7.24.7"
             }
         },
         "@babel/helper-simple-access": {
-            "version": "7.20.2",
-            "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.20.2.tgz",
-            "integrity": "sha512-+0woI/WPq59IrqDYbVGfshjT5Dmk/nnbdpcF8SnMhhXObpTq2KNBdLFRFrkVdbDOyUmHBCxzm5FHV1rACIkIbA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.24.7.tgz",
+            "integrity": "sha512-zBAIvbCMh5Ts+b86r/CjU+4XGYIs+R1j951gxI3KmmxBMhCg4oQMsv6ZXQ64XOm/cvzfU1FmoCyt6+owc5QMYg==",
             "dev": true,
             "requires": {
-                "@babel/types": "^7.20.2"
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helper-skip-transparent-expression-wrappers": {
-            "version": "7.20.0",
-            "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.20.0.tgz",
-            "integrity": "sha512-5y1JYeNKfvnT8sZcK9DVRtpTbGiomYIHviSP3OQWmDPU3DeH4a1ZlT/N2lyQ5P8egjcRaT/Y9aNqUxK0WsnIIg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.24.7.tgz",
+            "integrity": "sha512-IO+DLT3LQUElMbpzlatRASEyQtfhSE0+m465v++3jyyXeBTBUjtVZg28/gHeV5mrTJqvEKhKroBGAvhW+qPHiQ==",
             "dev": true,
             "requires": {
-                "@babel/types": "^7.20.0"
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helper-split-export-declaration": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.18.6.tgz",
-            "integrity": "sha512-bde1etTx6ZyTmobl9LLMMQsaizFVZrquTEHOqKeQESMKo4PlObf+8+JA25ZsIpZhT/WEd39+vOdLXAFG/nELpA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.24.7.tgz",
+            "integrity": "sha512-oy5V7pD+UvfkEATUKvIjvIAH/xCzfsFVw7ygW2SI6NClZzquT+mwdTfgfdbUiceh6iQO0CHtCPsyze/MZ2YbAA==",
             "dev": true,
             "requires": {
-                "@babel/types": "^7.18.6"
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helper-string-parser": {
-            "version": "7.19.4",
-            "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.19.4.tgz",
-            "integrity": "sha512-nHtDoQcuqFmwYNYPz3Rah5ph2p8PFeFCsZk9A/48dPc/rGocJ5J3hAAZ7pb76VWX3fZKu+uEr/FhH5jLx7umrw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.24.7.tgz",
+            "integrity": "sha512-7MbVt6xrwFQbunH2DNQsAP5sTGxfqQtErvBIvIMi6EQnbgUOuVYanvREcmFrOPhoXBrTtjhhP+lW+o5UfK+tDg==",
             "dev": true
         },
         "@babel/helper-validator-identifier": {
-            "version": "7.19.1",
-            "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.19.1.tgz",
-            "integrity": "sha512-awrNfaMtnHUr653GgGEs++LlAvW6w+DcPrOliSMXWCKo597CwL5Acf/wWdNkf/tfEQE3mjkeD1YOVZOUV/od1w==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.24.7.tgz",
+            "integrity": "sha512-rR+PBcQ1SMQDDyF6X0wxtG8QyLCgUB0eRAGguqRLfkCA87l7yAP7ehq8SNj96OOGTO8OBV70KhuFYcIkHXOg0w==",
             "dev": true
         },
         "@babel/helper-validator-option": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.18.6.tgz",
-            "integrity": "sha512-XO7gESt5ouv/LRJdrVjkShckw6STTaB7l9BrpBaAHDeF5YZT+01PCwmR0SJHnkW6i8OwW/EVWRShfi4j2x+KQw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.24.7.tgz",
+            "integrity": "sha512-yy1/KvjhV/ZCL+SM7hBrvnZJ3ZuT9OuZgIJAGpPEToANvc3iM6iDvBnRjtElWibHU6n8/LPR/EjX9EtIEYO3pw==",
             "dev": true
         },
         "@babel/helper-wrap-function": {
-            "version": "7.20.5",
-            "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.20.5.tgz",
-            "integrity": "sha512-bYMxIWK5mh+TgXGVqAtnu5Yn1un+v8DDZtqyzKRLUzrh70Eal2O3aZ7aPYiMADO4uKlkzOiRiZ6GX5q3qxvW9Q==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.24.7.tgz",
+            "integrity": "sha512-N9JIYk3TD+1vq/wn77YnJOqMtfWhNewNE+DJV4puD2X7Ew9J4JvrzrFDfTfyv5EgEXVy9/Wt8QiOErzEmv5Ifw==",
             "dev": true,
             "requires": {
-                "@babel/helper-function-name": "^7.19.0",
-                "@babel/template": "^7.18.10",
-                "@babel/traverse": "^7.20.5",
-                "@babel/types": "^7.20.5"
+                "@babel/helper-function-name": "^7.24.7",
+                "@babel/template": "^7.24.7",
+                "@babel/traverse": "^7.24.7",
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/helpers": {
-            "version": "7.20.13",
-            "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.20.13.tgz",
-            "integrity": "sha512-nzJ0DWCL3gB5RCXbUO3KIMMsBY2Eqbx8mBpKGE/02PgyRQFcPQLbkQ1vyy596mZLaP+dAfD+R4ckASzNVmW3jg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.24.7.tgz",
+            "integrity": "sha512-NlmJJtvcw72yRJRcnCmGvSi+3jDEg8qFu3z0AFoymmzLx5ERVWyzd9kVXr7Th9/8yIJi2Zc6av4Tqz3wFs8QWg==",
             "dev": true,
             "requires": {
-                "@babel/template": "^7.20.7",
-                "@babel/traverse": "^7.20.13",
-                "@babel/types": "^7.20.7"
+                "@babel/template": "^7.24.7",
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/highlight": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.18.6.tgz",
-            "integrity": "sha512-u7stbOuYjaPezCuLj29hNW1v64M2Md2qupEKP1fHc7WdOA3DgLh37suiSrZYY7haUB7iBeQZ9P1uiRF359do3g==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.24.7.tgz",
+            "integrity": "sha512-EStJpq4OuY8xYfhGVXngigBJRWxftKX9ksiGDnmlY3o7B/V7KIAc9X4oiK87uPJSc/vs5L869bem5fhZa8caZw==",
             "dev": true,
             "requires": {
-                "@babel/helper-validator-identifier": "^7.18.6",
-                "chalk": "^2.0.0",
-                "js-tokens": "^4.0.0"
+                "@babel/helper-validator-identifier": "^7.24.7",
+                "chalk": "^2.4.2",
+                "js-tokens": "^4.0.0",
+                "picocolors": "^1.0.0"
             },
             "dependencies": {
                 "ansi-styles": {
@@ -11925,189 +12049,57 @@
             }
         },
         "@babel/parser": {
-            "version": "7.20.13",
-            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.20.13.tgz",
-            "integrity": "sha512-gFDLKMfpiXCsjt4za2JA9oTMn70CeseCehb11kRZgvd7+F67Hih3OHOK24cRrWECJ/ljfPGac6ygXAs/C8kIvw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.24.7.tgz",
+            "integrity": "sha512-9uUYRm6OqQrCqQdG1iCBwBPZgN8ciDBro2nIOFaiRz1/BCxaI7CNvQbDHvsArAC7Tw9Hda/B3U+6ui9u4HWXPw==",
             "dev": true
         },
-        "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.18.6.tgz",
-            "integrity": "sha512-Dgxsyg54Fx1d4Nge8UnvTrED63vrwOdPmyvPzlNN/boaliRP54pm3pGzZD1SJUwrBA+Cs/xdG8kXX6Mn/RfISQ==",
+        "@babel/plugin-bugfix-firefox-class-in-computed-class-key": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-firefox-class-in-computed-class-key/-/plugin-bugfix-firefox-class-in-computed-class-key-7.24.7.tgz",
+            "integrity": "sha512-TiT1ss81W80eQsN+722OaeQMY/G4yTb4G9JrqeiDADs3N8lbPMGldWi9x8tyqCW5NLx1Jh2AvkE6r6QvEltMMQ==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.24.7.tgz",
+            "integrity": "sha512-unaQgZ/iRu/By6tsjMZzpeBZjChYfLYry6HrEXPoz3KmfF0sVBQ1l8zKMQ4xRGLWVsjuvB8nQfjNP/DcfEOCsg==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.20.7.tgz",
-            "integrity": "sha512-sbr9+wNE5aXMBBFBICk01tt7sBf2Oc9ikRFEcem/ZORup9IMUdNhW7/wVLEbbtlWOsEubJet46mHAL2C8+2jKQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.24.7.tgz",
+            "integrity": "sha512-+izXIbke1T33mY4MSNnrqhPXDz01WYhEf3yF5NbnUtkiNnm+XBZJl3kNfoK6NKmYlz/D07+l2GWVK/QfDkNCuQ==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
-                "@babel/plugin-proposal-optional-chaining": "^7.20.7"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.24.7",
+                "@babel/plugin-transform-optional-chaining": "^7.24.7"
             }
         },
-        "@babel/plugin-proposal-async-generator-functions": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.20.7.tgz",
-            "integrity": "sha512-xMbiLsn/8RK7Wq7VeVytytS2L6qE69bXPB10YCmMdDZbKF4okCqY74pI/jJQ/8U0b/F6NrT2+14b8/P9/3AMGA==",
+        "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/-/plugin-bugfix-v8-static-class-fields-redefine-readonly-7.24.7.tgz",
+            "integrity": "sha512-utA4HuR6F4Vvcr+o4DnjL8fCOlgRFGbeeBEGNg3ZTrLFw6VWG5XmUrvcQ0FjIYMU2ST4XcR2Wsp7t9qOAPnxMg==",
             "dev": true,
             "requires": {
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-remap-async-to-generator": "^7.18.9",
-                "@babel/plugin-syntax-async-generators": "^7.8.4"
-            }
-        },
-        "@babel/plugin-proposal-class-properties": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.18.6.tgz",
-            "integrity": "sha512-cumfXOF0+nzZrrN8Rf0t7M+tF6sZc7vhQwYQck9q1/5w2OExlD+b4v4RpMJFaV1Z7WcDRgO6FqvxqxGlwo+RHQ==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-create-class-features-plugin": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
-            }
-        },
-        "@babel/plugin-proposal-class-static-block": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-static-block/-/plugin-proposal-class-static-block-7.20.7.tgz",
-            "integrity": "sha512-AveGOoi9DAjUYYuUAG//Ig69GlazLnoyzMw68VCDux+c1tsnnH/OkYcpz/5xzMkEFC6UxjR5Gw1c+iY2wOGVeQ==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-create-class-features-plugin": "^7.20.7",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/plugin-syntax-class-static-block": "^7.14.5"
-            }
-        },
-        "@babel/plugin-proposal-dynamic-import": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-dynamic-import/-/plugin-proposal-dynamic-import-7.18.6.tgz",
-            "integrity": "sha512-1auuwmK+Rz13SJj36R+jqFPMJWyKEDd7lLSdOj4oJK0UTgGueSAtkrCvz9ewmgyU/P941Rv2fQwZJN8s6QruXw==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/plugin-syntax-dynamic-import": "^7.8.3"
-            }
-        },
-        "@babel/plugin-proposal-export-namespace-from": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-export-namespace-from/-/plugin-proposal-export-namespace-from-7.18.9.tgz",
-            "integrity": "sha512-k1NtHyOMvlDDFeb9G5PhUXuGj8m/wiwojgQVEhJ/fsVsMCpLyOP4h0uGEjYJKrRI+EVPlb5Jk+Gt9P97lOGwtA==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-plugin-utils": "^7.18.9",
-                "@babel/plugin-syntax-export-namespace-from": "^7.8.3"
-            }
-        },
-        "@babel/plugin-proposal-json-strings": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-json-strings/-/plugin-proposal-json-strings-7.18.6.tgz",
-            "integrity": "sha512-lr1peyn9kOdbYc0xr0OdHTZ5FMqS6Di+H0Fz2I/JwMzGmzJETNeOFq2pBySw6X/KFL5EWDjlJuMsUGRFb8fQgQ==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/plugin-syntax-json-strings": "^7.8.3"
-            }
-        },
-        "@babel/plugin-proposal-logical-assignment-operators": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-logical-assignment-operators/-/plugin-proposal-logical-assignment-operators-7.20.7.tgz",
-            "integrity": "sha512-y7C7cZgpMIjWlKE5T7eJwp+tnRYM89HmRvWM5EQuB5BoHEONjmQ8lSNmBUwOyy/GFRsohJED51YBF79hE1djug==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4"
-            }
-        },
-        "@babel/plugin-proposal-nullish-coalescing-operator": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-nullish-coalescing-operator/-/plugin-proposal-nullish-coalescing-operator-7.18.6.tgz",
-            "integrity": "sha512-wQxQzxYeJqHcfppzBDnm1yAY0jSRkUXR2z8RePZYrKwMKgMlE8+Z6LUno+bd6LvbGh8Gltvy74+9pIYkr+XkKA==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3"
-            }
-        },
-        "@babel/plugin-proposal-numeric-separator": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-numeric-separator/-/plugin-proposal-numeric-separator-7.18.6.tgz",
-            "integrity": "sha512-ozlZFogPqoLm8WBr5Z8UckIoE4YQ5KESVcNudyXOR8uqIkliTEgJ3RoketfG6pmzLdeZF0H/wjE9/cCEitBl7Q==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/plugin-syntax-numeric-separator": "^7.10.4"
-            }
-        },
-        "@babel/plugin-proposal-object-rest-spread": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.20.7.tgz",
-            "integrity": "sha512-d2S98yCiLxDVmBmE8UjGcfPvNEUbA1U5q5WxaWFUGRzJSVAZqm5W6MbPct0jxnegUZ0niLeNX+IOzEs7wYg9Dg==",
-            "dev": true,
-            "requires": {
-                "@babel/compat-data": "^7.20.5",
-                "@babel/helper-compilation-targets": "^7.20.7",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
-                "@babel/plugin-transform-parameters": "^7.20.7"
-            }
-        },
-        "@babel/plugin-proposal-optional-catch-binding": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-catch-binding/-/plugin-proposal-optional-catch-binding-7.18.6.tgz",
-            "integrity": "sha512-Q40HEhs9DJQyaZfUjjn6vE8Cv4GmMHCYuMGIWUnlxH6400VGxOuwWsPt4FxXxJkC/5eOzgn0z21M9gMT4MOhbw==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/plugin-syntax-optional-catch-binding": "^7.8.3"
-            }
-        },
-        "@babel/plugin-proposal-optional-chaining": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-chaining/-/plugin-proposal-optional-chaining-7.20.7.tgz",
-            "integrity": "sha512-T+A7b1kfjtRM51ssoOfS1+wbyCVqorfyZhT99TvxxLMirPShD8CzKMRepMlCBGM5RpHMbn8s+5MMHnPstJH6mQ==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0",
-                "@babel/plugin-syntax-optional-chaining": "^7.8.3"
-            }
-        },
-        "@babel/plugin-proposal-private-methods": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-methods/-/plugin-proposal-private-methods-7.18.6.tgz",
-            "integrity": "sha512-nutsvktDItsNn4rpGItSNV2sz1XwS+nfU0Rg8aCx3W3NOKVzdMjJRu0O5OkgDp3ZGICSTbgRpxZoWsxoKRvbeA==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-create-class-features-plugin": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-proposal-private-property-in-object": {
-            "version": "7.20.5",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.20.5.tgz",
-            "integrity": "sha512-Vq7b9dUA12ByzB4EjQTPo25sFhY+08pQDBSZRtUAkj7lb7jahaHR5igera16QZ+3my1nYR4dKsNdYj5IjPHilQ==",
+            "version": "7.21.0-placeholder-for-preset-env.2",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.21.0-placeholder-for-preset-env.2.tgz",
+            "integrity": "sha512-SOSkfJDddaM7mak6cPEpswyTRnuRltl429hMraQEglW+OkovnCzsiszTmsrlY//qLFjCpQDFRvjdm2wA5pPm9w==",
             "dev": true,
-            "requires": {
-                "@babel/helper-annotate-as-pure": "^7.18.6",
-                "@babel/helper-create-class-features-plugin": "^7.20.5",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/plugin-syntax-private-property-in-object": "^7.14.5"
-            }
-        },
-        "@babel/plugin-proposal-unicode-property-regex": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-unicode-property-regex/-/plugin-proposal-unicode-property-regex-7.18.6.tgz",
-            "integrity": "sha512-2BShG/d5yoZyXZfVePH91urL5wTG6ASZU9M4o03lKK8u8UW1y08OMttBSOADTcJrnPMpvDXRG3G8fyLh4ovs8w==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
-            }
+            "requires": {}
         },
         "@babel/plugin-syntax-async-generators": {
             "version": "7.8.4",
@@ -12155,12 +12147,30 @@
             }
         },
         "@babel/plugin-syntax-import-assertions": {
-            "version": "7.20.0",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.20.0.tgz",
-            "integrity": "sha512-IUh1vakzNoWalR8ch/areW7qFopR2AEw03JlG7BbrDqmQ4X3q9uuipQwSGrUn7oGiemKjtSLDhNtQHzMHr1JdQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.24.7.tgz",
+            "integrity": "sha512-Ec3NRUMoi8gskrkBe3fNmEQfxDvY8bgfQpz6jlk/41kX9eUjvpyqWU7PBP/pLAvMaSQjbMNKJmvX57jP+M6bPg==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.19.0"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-syntax-import-attributes": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.24.7.tgz",
+            "integrity": "sha512-hbX+lKKeUMGihnK8nvKqmXBInriT3GVjzXKFriV3YC6APGxMbP8RZNFwy91+hocLXq90Mta+HshoB31802bb8A==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-syntax-import-meta": {
+            "version": "7.10.4",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz",
+            "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.10.4"
             }
         },
         "@babel/plugin-syntax-json-strings": {
@@ -12244,354 +12254,522 @@
                 "@babel/helper-plugin-utils": "^7.14.5"
             }
         },
-        "@babel/plugin-transform-arrow-functions": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.20.7.tgz",
-            "integrity": "sha512-3poA5E7dzDomxj9WXWwuD6A5F3kc7VXwIJO+E+J8qtDtS+pXPAhrgEyh+9GBwBgPq1Z+bB+/JD60lp5jsN7JPQ==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-plugin-utils": "^7.20.2"
-            }
-        },
-        "@babel/plugin-transform-async-to-generator": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.20.7.tgz",
-            "integrity": "sha512-Uo5gwHPT9vgnSXQxqGtpdufUiWp96gk7yiP4Mp5bm1QMkEmLXBO7PAGYbKoJ6DhAwiNkcHFBol/x5zZZkL/t0Q==",
-            "dev": true,
-            "requires": {
-                "@babel/helper-module-imports": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-remap-async-to-generator": "^7.18.9"
-            }
-        },
-        "@babel/plugin-transform-block-scoped-functions": {
+        "@babel/plugin-syntax-unicode-sets-regex": {
             "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.18.6.tgz",
-            "integrity": "sha512-ExUcOqpPWnliRcPqves5HJcJOvHvIIWfuS4sroBUenPuMdmW+SMHDakmtS7qOo13sVppmUijqeTv7qqGsvURpQ==",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-unicode-sets-regex/-/plugin-syntax-unicode-sets-regex-7.18.6.tgz",
+            "integrity": "sha512-727YkEAPwSIQTv5im8QHz3upqp92JTWhidIC81Tdx4VJYIte/VndKf1qKrfnnhPLiPghStWfvC/iFaMCQu7Nqg==",
             "dev": true,
             "requires": {
+                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
                 "@babel/helper-plugin-utils": "^7.18.6"
             }
         },
-        "@babel/plugin-transform-block-scoping": {
-            "version": "7.20.11",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.20.11.tgz",
-            "integrity": "sha512-tA4N427a7fjf1P0/2I4ScsHGc5jcHPbb30xMbaTke2gxDuWpUfXDuX1FEymJwKk4tuGUvGcejAR6HdZVqmmPyw==",
+        "@babel/plugin-transform-arrow-functions": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.24.7.tgz",
+            "integrity": "sha512-Dt9LQs6iEY++gXUwY03DNFat5C2NbO48jj+j/bSAz6b3HgPs39qcPiYt77fDObIcFwj3/C2ICX9YMwGflUoSHQ==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.20.2"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-async-generator-functions": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-generator-functions/-/plugin-transform-async-generator-functions-7.24.7.tgz",
+            "integrity": "sha512-o+iF77e3u7ZS4AoAuJvapz9Fm001PuD2V3Lp6OSE4FYQke+cSewYtnek+THqGRWyQloRCyvWL1OkyfNEl9vr/g==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-remap-async-to-generator": "^7.24.7",
+                "@babel/plugin-syntax-async-generators": "^7.8.4"
+            }
+        },
+        "@babel/plugin-transform-async-to-generator": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.24.7.tgz",
+            "integrity": "sha512-SQY01PcJfmQ+4Ash7NE+rpbLFbmqA2GPIgqzxfFTL4t1FKRq4zTms/7htKpoCUI9OcFYgzqfmCdH53s6/jn5fA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-module-imports": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-remap-async-to-generator": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-block-scoped-functions": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.24.7.tgz",
+            "integrity": "sha512-yO7RAz6EsVQDaBH18IDJcMB1HnrUn2FJ/Jslc/WtPPWcjhpUJXU/rjbwmluzp7v/ZzWcEhTMXELnnsz8djWDwQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-block-scoping": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.24.7.tgz",
+            "integrity": "sha512-Nd5CvgMbWc+oWzBsuaMcbwjJWAcp5qzrbg69SZdHSP7AMY0AbWFqFO0WTFCA1jxhMCwodRwvRec8k0QUbZk7RQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-class-properties": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-class-properties/-/plugin-transform-class-properties-7.24.7.tgz",
+            "integrity": "sha512-vKbfawVYayKcSeSR5YYzzyXvsDFWU2mD8U5TFeXtbCPLFUqe7GyCgvO6XDHzje862ODrOwy6WCPmKeWHbCFJ4w==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-class-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-class-static-block": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-class-static-block/-/plugin-transform-class-static-block-7.24.7.tgz",
+            "integrity": "sha512-HMXK3WbBPpZQufbMG4B46A90PkuuhN9vBCb5T8+VAHqvAqvcLi+2cKoukcpmUYkszLhScU3l1iudhrks3DggRQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-class-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-class-static-block": "^7.14.5"
             }
         },
         "@babel/plugin-transform-classes": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.20.7.tgz",
-            "integrity": "sha512-LWYbsiXTPKl+oBlXUGlwNlJZetXD5Am+CyBdqhPsDVjM9Jc8jwBJFrKhHf900Kfk2eZG1y9MAG3UNajol7A4VQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.24.7.tgz",
+            "integrity": "sha512-CFbbBigp8ln4FU6Bpy6g7sE8B/WmCmzvivzUC6xDAdWVsjYTXijpuuGJmYkAaoWAzcItGKT3IOAbxRItZ5HTjw==",
             "dev": true,
             "requires": {
-                "@babel/helper-annotate-as-pure": "^7.18.6",
-                "@babel/helper-compilation-targets": "^7.20.7",
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-function-name": "^7.19.0",
-                "@babel/helper-optimise-call-expression": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-replace-supers": "^7.20.7",
-                "@babel/helper-split-export-declaration": "^7.18.6",
+                "@babel/helper-annotate-as-pure": "^7.24.7",
+                "@babel/helper-compilation-targets": "^7.24.7",
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-function-name": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-replace-supers": "^7.24.7",
+                "@babel/helper-split-export-declaration": "^7.24.7",
                 "globals": "^11.1.0"
             }
         },
         "@babel/plugin-transform-computed-properties": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.20.7.tgz",
-            "integrity": "sha512-Lz7MvBK6DTjElHAmfu6bfANzKcxpyNPeYBGEafyA6E5HtRpjpZwU+u7Qrgz/2OR0z+5TvKYbPdphfSaAcZBrYQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.24.7.tgz",
+            "integrity": "sha512-25cS7v+707Gu6Ds2oY6tCkUwsJ9YIDbggd9+cu9jzzDgiNq7hR/8dkzxWfKWnTic26vsI3EsCXNd4iEB6e8esQ==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/template": "^7.20.7"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/template": "^7.24.7"
             }
         },
         "@babel/plugin-transform-destructuring": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.20.7.tgz",
-            "integrity": "sha512-Xwg403sRrZb81IVB79ZPqNQME23yhugYVqgTxAhT99h485F4f+GMELFhhOsscDUB7HCswepKeCKLn/GZvUKoBA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.24.7.tgz",
+            "integrity": "sha512-19eJO/8kdCQ9zISOf+SEUJM/bAUIsvY3YDnXZTupUCQ8LgrWnsG/gFB9dvXqdXnRXMAM8fvt7b0CBKQHNGy1mw==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.20.2"
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-dotall-regex": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.18.6.tgz",
-            "integrity": "sha512-6S3jpun1eEbAxq7TdjLotAsl4WpQI9DxfkycRcKrjhQYzU87qpXdknpBg/e+TdcMehqGnLFi7tnFUBR02Vq6wg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.24.7.tgz",
+            "integrity": "sha512-ZOA3W+1RRTSWvyqcMJDLqbchh7U4NRGqwRfFSVbOLS/ePIP4vHB5e8T8eXcuqyN1QkgKyj5wuW0lcS85v4CrSw==",
             "dev": true,
             "requires": {
-                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-create-regexp-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-duplicate-keys": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.18.9.tgz",
-            "integrity": "sha512-d2bmXCtZXYc59/0SanQKbiWINadaJXqtvIQIzd4+hNwkWBgyCd5F/2t1kXoUdvPMrxzPvhK6EMQRROxsue+mfw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.24.7.tgz",
+            "integrity": "sha512-JdYfXyCRihAe46jUIliuL2/s0x0wObgwwiGxw/UbgJBr20gQBThrokO4nYKgWkD7uBaqM7+9x5TU7NkExZJyzw==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-dynamic-import": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dynamic-import/-/plugin-transform-dynamic-import-7.24.7.tgz",
+            "integrity": "sha512-sc3X26PhZQDb3JhORmakcbvkeInvxz+A8oda99lj7J60QRuPZvNAk9wQlTBS1ZynelDrDmTU4pw1tyc5d5ZMUg==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-dynamic-import": "^7.8.3"
             }
         },
         "@babel/plugin-transform-exponentiation-operator": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.18.6.tgz",
-            "integrity": "sha512-wzEtc0+2c88FVR34aQmiz56dxEkxr2g8DQb/KfaFa1JYXOFVsbhvAonFN6PwVWj++fKmku8NP80plJ5Et4wqHw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.24.7.tgz",
+            "integrity": "sha512-Rqe/vSc9OYgDajNIK35u7ot+KeCoetqQYFXM4Epf7M7ez3lWlOjrDjrwMei6caCVhfdw+mIKD4cgdGNy5JQotQ==",
             "dev": true,
             "requires": {
-                "@babel/helper-builder-binary-assignment-operator-visitor": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-builder-binary-assignment-operator-visitor": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-export-namespace-from": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-export-namespace-from/-/plugin-transform-export-namespace-from-7.24.7.tgz",
+            "integrity": "sha512-v0K9uNYsPL3oXZ/7F9NNIbAj2jv1whUEtyA6aujhekLs56R++JDQuzRcP2/z4WX5Vg/c5lE9uWZA0/iUoFhLTA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-export-namespace-from": "^7.8.3"
             }
         },
         "@babel/plugin-transform-for-of": {
-            "version": "7.18.8",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.18.8.tgz",
-            "integrity": "sha512-yEfTRnjuskWYo0k1mHUqrVWaZwrdq8AYbfrpqULOJOaucGSp4mNMVps+YtA8byoevxS/urwU75vyhQIxcCgiBQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.24.7.tgz",
+            "integrity": "sha512-wo9ogrDG1ITTTBsy46oGiN1dS9A7MROBTcYsfS8DtsImMkHk9JXJ3EWQM6X2SUw4x80uGPlwj0o00Uoc6nEE3g==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.24.7"
             }
         },
         "@babel/plugin-transform-function-name": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.18.9.tgz",
-            "integrity": "sha512-WvIBoRPaJQ5yVHzcnJFor7oS5Ls0PYixlTYE63lCj2RtdQEl15M68FXQlxnG6wdraJIXRdR7KI+hQ7q/9QjrCQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.24.7.tgz",
+            "integrity": "sha512-U9FcnA821YoILngSmYkW6FjyQe2TyZD5pHt4EVIhmcTkrJw/3KqcrRSxuOo5tFZJi7TE19iDyI1u+weTI7bn2w==",
             "dev": true,
             "requires": {
-                "@babel/helper-compilation-targets": "^7.18.9",
-                "@babel/helper-function-name": "^7.18.9",
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-compilation-targets": "^7.24.7",
+                "@babel/helper-function-name": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-json-strings": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-json-strings/-/plugin-transform-json-strings-7.24.7.tgz",
+            "integrity": "sha512-2yFnBGDvRuxAaE/f0vfBKvtnvvqU8tGpMHqMNpTN2oWMKIR3NqFkjaAgGwawhqK/pIN2T3XdjGPdaG0vDhOBGw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-json-strings": "^7.8.3"
             }
         },
         "@babel/plugin-transform-literals": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.18.9.tgz",
-            "integrity": "sha512-IFQDSRoTPnrAIrI5zoZv73IFeZu2dhu6irxQjY9rNjTT53VmKg9fenjvoiOWOkJ6mm4jKVPtdMzBY98Fp4Z4cg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.24.7.tgz",
+            "integrity": "sha512-vcwCbb4HDH+hWi8Pqenwnjy+UiklO4Kt1vfspcQYFhJdpthSnW8XvWGyDZWKNVrVbVViI/S7K9PDJZiUmP2fYQ==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-logical-assignment-operators": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-logical-assignment-operators/-/plugin-transform-logical-assignment-operators-7.24.7.tgz",
+            "integrity": "sha512-4D2tpwlQ1odXmTEIFWy9ELJcZHqrStlzK/dAOWYyxX3zT0iXQB6banjgeOJQXzEc4S0E0a5A+hahxPaEFYftsw==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4"
             }
         },
         "@babel/plugin-transform-member-expression-literals": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.18.6.tgz",
-            "integrity": "sha512-qSF1ihLGO3q+/g48k85tUjD033C29TNTVB2paCwZPVmOsjn9pClvYYrM2VeJpBY2bcNkuny0YUyTNRyRxJ54KA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.24.7.tgz",
+            "integrity": "sha512-T/hRC1uqrzXMKLQ6UCwMT85S3EvqaBXDGf0FaMf4446Qx9vKwlghvee0+uuZcDUCZU5RuNi4781UQ7R308zzBw==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-modules-amd": {
-            "version": "7.20.11",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.20.11.tgz",
-            "integrity": "sha512-NuzCt5IIYOW0O30UvqktzHYR2ud5bOWbY0yaxWZ6G+aFzOMJvrs5YHNikrbdaT15+KNO31nPOy5Fim3ku6Zb5g==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.24.7.tgz",
+            "integrity": "sha512-9+pB1qxV3vs/8Hdmz/CulFB8w2tuu6EB94JZFsjdqxQokwGa9Unap7Bo2gGBGIvPmDIVvQrom7r5m/TCDMURhg==",
             "dev": true,
             "requires": {
-                "@babel/helper-module-transforms": "^7.20.11",
-                "@babel/helper-plugin-utils": "^7.20.2"
+                "@babel/helper-module-transforms": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-modules-commonjs": {
-            "version": "7.20.11",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.20.11.tgz",
-            "integrity": "sha512-S8e1f7WQ7cimJQ51JkAaDrEtohVEitXjgCGAS2N8S31Y42E+kWwfSz83LYz57QdBm7q9diARVqanIaH2oVgQnw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.24.7.tgz",
+            "integrity": "sha512-iFI8GDxtevHJ/Z22J5xQpVqFLlMNstcLXh994xifFwxxGslr2ZXXLWgtBeLctOD63UFDArdvN6Tg8RFw+aEmjQ==",
             "dev": true,
             "requires": {
-                "@babel/helper-module-transforms": "^7.20.11",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-simple-access": "^7.20.2"
+                "@babel/helper-module-transforms": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-simple-access": "^7.24.7"
             }
         },
         "@babel/plugin-transform-modules-systemjs": {
-            "version": "7.20.11",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.20.11.tgz",
-            "integrity": "sha512-vVu5g9BPQKSFEmvt2TA4Da5N+QVS66EX21d8uoOihC+OCpUoGvzVsXeqFdtAEfVa5BILAeFt+U7yVmLbQnAJmw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.24.7.tgz",
+            "integrity": "sha512-GYQE0tW7YoaN13qFh3O1NCY4MPkUiAH3fiF7UcV/I3ajmDKEdG3l+UOcbAm4zUE3gnvUU+Eni7XrVKo9eO9auw==",
             "dev": true,
             "requires": {
-                "@babel/helper-hoist-variables": "^7.18.6",
-                "@babel/helper-module-transforms": "^7.20.11",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-validator-identifier": "^7.19.1"
+                "@babel/helper-hoist-variables": "^7.24.7",
+                "@babel/helper-module-transforms": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-validator-identifier": "^7.24.7"
             }
         },
         "@babel/plugin-transform-modules-umd": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.18.6.tgz",
-            "integrity": "sha512-dcegErExVeXcRqNtkRU/z8WlBLnvD4MRnHgNs3MytRO1Mn1sHRyhbcpYbVMGclAqOjdW+9cfkdZno9dFdfKLfQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.24.7.tgz",
+            "integrity": "sha512-3aytQvqJ/h9z4g8AsKPLvD4Zqi2qT+L3j7XoFFu1XBlZWEl2/1kWnhmAbxpLgPrHSY0M6UA02jyTiwUVtiKR6A==",
             "dev": true,
             "requires": {
-                "@babel/helper-module-transforms": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-module-transforms": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-named-capturing-groups-regex": {
-            "version": "7.20.5",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.20.5.tgz",
-            "integrity": "sha512-mOW4tTzi5iTLnw+78iEq3gr8Aoq4WNRGpmSlrogqaiCBoR1HFhpU4JkpQFOHfeYx3ReVIFWOQJS4aZBRvuZ6mA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.24.7.tgz",
+            "integrity": "sha512-/jr7h/EWeJtk1U/uz2jlsCioHkZk1JJZVcc8oQsJ1dUlaJD83f4/6Zeh2aHt9BIFokHIsSeDfhUmju0+1GPd6g==",
             "dev": true,
             "requires": {
-                "@babel/helper-create-regexp-features-plugin": "^7.20.5",
-                "@babel/helper-plugin-utils": "^7.20.2"
+                "@babel/helper-create-regexp-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-new-target": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.18.6.tgz",
-            "integrity": "sha512-DjwFA/9Iu3Z+vrAn+8pBUGcjhxKguSMlsFqeCKbhb9BAV756v0krzVK04CRDi/4aqmk8BsHb4a/gFcaA5joXRw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.24.7.tgz",
+            "integrity": "sha512-RNKwfRIXg4Ls/8mMTza5oPF5RkOW8Wy/WgMAp1/F1yZ8mMbtwXW+HDoJiOsagWrAhI5f57Vncrmr9XeT4CVapA==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-nullish-coalescing-operator": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-nullish-coalescing-operator/-/plugin-transform-nullish-coalescing-operator-7.24.7.tgz",
+            "integrity": "sha512-Ts7xQVk1OEocqzm8rHMXHlxvsfZ0cEF2yomUqpKENHWMF4zKk175Y4q8H5knJes6PgYad50uuRmt3UJuhBw8pQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3"
+            }
+        },
+        "@babel/plugin-transform-numeric-separator": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-numeric-separator/-/plugin-transform-numeric-separator-7.24.7.tgz",
+            "integrity": "sha512-e6q1TiVUzvH9KRvicuxdBTUj4AdKSRwzIyFFnfnezpCfP2/7Qmbb8qbU2j7GODbl4JMkblitCQjKYUaX/qkkwA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-numeric-separator": "^7.10.4"
+            }
+        },
+        "@babel/plugin-transform-object-rest-spread": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-rest-spread/-/plugin-transform-object-rest-spread-7.24.7.tgz",
+            "integrity": "sha512-4QrHAr0aXQCEFni2q4DqKLD31n2DL+RxcwnNjDFkSG0eNQ/xCavnRkfCUjsyqGC2OviNJvZOF/mQqZBw7i2C5Q==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-compilation-targets": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+                "@babel/plugin-transform-parameters": "^7.24.7"
             }
         },
         "@babel/plugin-transform-object-super": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.18.6.tgz",
-            "integrity": "sha512-uvGz6zk+pZoS1aTZrOvrbj6Pp/kK2mp45t2B+bTDre2UgsZZ8EZLSJtUg7m/no0zOJUWgFONpB7Zv9W2tSaFlA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.24.7.tgz",
+            "integrity": "sha512-A/vVLwN6lBrMFmMDmPPz0jnE6ZGx7Jq7d6sT/Ev4H65RER6pZ+kczlf1DthF5N0qaPHBsI7UXiE8Zy66nmAovg==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6",
-                "@babel/helper-replace-supers": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-replace-supers": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-optional-catch-binding": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-optional-catch-binding/-/plugin-transform-optional-catch-binding-7.24.7.tgz",
+            "integrity": "sha512-uLEndKqP5BfBbC/5jTwPxLh9kqPWWgzN/f8w6UwAIirAEqiIVJWWY312X72Eub09g5KF9+Zn7+hT7sDxmhRuKA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-optional-catch-binding": "^7.8.3"
+            }
+        },
+        "@babel/plugin-transform-optional-chaining": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-optional-chaining/-/plugin-transform-optional-chaining-7.24.7.tgz",
+            "integrity": "sha512-tK+0N9yd4j+x/4hxF3F0e0fu/VdcxU18y5SevtyM/PCFlQvXbR0Zmlo2eBrKtVipGNFzpq56o8WsIIKcJFUCRQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.24.7",
+                "@babel/plugin-syntax-optional-chaining": "^7.8.3"
             }
         },
         "@babel/plugin-transform-parameters": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.20.7.tgz",
-            "integrity": "sha512-WiWBIkeHKVOSYPO0pWkxGPfKeWrCJyD3NJ53+Lrp/QMSZbsVPovrVl2aWZ19D/LTVnaDv5Ap7GJ/B2CTOZdrfA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.24.7.tgz",
+            "integrity": "sha512-yGWW5Rr+sQOhK0Ot8hjDJuxU3XLRQGflvT4lhlSY0DFvdb3TwKaY26CJzHtYllU0vT9j58hc37ndFPsqT1SrzA==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.20.2"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-private-methods": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-private-methods/-/plugin-transform-private-methods-7.24.7.tgz",
+            "integrity": "sha512-COTCOkG2hn4JKGEKBADkA8WNb35TGkkRbI5iT845dB+NyqgO8Hn+ajPbSnIQznneJTa3d30scb6iz/DhH8GsJQ==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-class-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-private-property-in-object": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-private-property-in-object/-/plugin-transform-private-property-in-object-7.24.7.tgz",
+            "integrity": "sha512-9z76mxwnwFxMyxZWEgdgECQglF2Q7cFLm0kMf8pGwt+GSJsY0cONKj/UuO4bOH0w/uAel3ekS4ra5CEAyJRmDA==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-annotate-as-pure": "^7.24.7",
+                "@babel/helper-create-class-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/plugin-syntax-private-property-in-object": "^7.14.5"
             }
         },
         "@babel/plugin-transform-property-literals": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.18.6.tgz",
-            "integrity": "sha512-cYcs6qlgafTud3PAzrrRNbQtfpQ8+y/+M5tKmksS9+M1ckbH6kzY8MrexEM9mcA6JDsukE19iIRvAyYl463sMg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.24.7.tgz",
+            "integrity": "sha512-EMi4MLQSHfd2nrCqQEWxFdha2gBCqU4ZcCng4WBGZ5CJL4bBRW0ptdqqDdeirGZcpALazVVNJqRmsO8/+oNCBA==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-regenerator": {
-            "version": "7.20.5",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.20.5.tgz",
-            "integrity": "sha512-kW/oO7HPBtntbsahzQ0qSE3tFvkFwnbozz3NWFhLGqH75vLEg+sCGngLlhVkePlCs3Jv0dBBHDzCHxNiFAQKCQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.24.7.tgz",
+            "integrity": "sha512-lq3fvXPdimDrlg6LWBoqj+r/DEWgONuwjuOuQCSYgRroXDH/IdM1C0IZf59fL5cHLpjEH/O6opIRBbqv7ELnuA==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "regenerator-transform": "^0.15.1"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "regenerator-transform": "^0.15.2"
             }
         },
         "@babel/plugin-transform-reserved-words": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.18.6.tgz",
-            "integrity": "sha512-oX/4MyMoypzHjFrT1CdivfKZ+XvIPMFXwwxHp/r0Ddy2Vuomt4HDFGmft1TAY2yiTKiNSsh3kjBAzcM8kSdsjA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.24.7.tgz",
+            "integrity": "sha512-0DUq0pHcPKbjFZCfTss/pGkYMfy3vFWydkUBd9r0GHpIyfs2eCDENvqadMycRS9wZCXR41wucAfJHJmwA0UmoQ==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-shorthand-properties": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.18.6.tgz",
-            "integrity": "sha512-eCLXXJqv8okzg86ywZJbRn19YJHU4XUa55oz2wbHhaQVn/MM+XhukiT7SYqp/7o00dg52Rj51Ny+Ecw4oyoygw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.24.7.tgz",
+            "integrity": "sha512-KsDsevZMDsigzbA09+vacnLpmPH4aWjcZjXdyFKGzpplxhbeB4wYtury3vglQkg6KM/xEPKt73eCjPPf1PgXBA==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-spread": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.20.7.tgz",
-            "integrity": "sha512-ewBbHQ+1U/VnH1fxltbJqDeWBU1oNLG8Dj11uIv3xVf7nrQu0bPGe5Rf716r7K5Qz+SqtAOVswoVunoiBtGhxw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.24.7.tgz",
+            "integrity": "sha512-x96oO0I09dgMDxJaANcRyD4ellXFLLiWhuwDxKZX5g2rWP1bTPkBSwCYv96VDXVT1bD9aPj8tppr5ITIh8hBng==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-skip-transparent-expression-wrappers": "^7.20.0"
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-skip-transparent-expression-wrappers": "^7.24.7"
             }
         },
         "@babel/plugin-transform-sticky-regex": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.18.6.tgz",
-            "integrity": "sha512-kfiDrDQ+PBsQDO85yj1icueWMfGfJFKN1KCkndygtu/C9+XUfydLC8Iv5UYJqRwy4zk8EcplRxEOeLyjq1gm6Q==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.24.7.tgz",
+            "integrity": "sha512-kHPSIJc9v24zEml5geKg9Mjx5ULpfncj0wRpYtxbvKyTtHCYDkVE3aHQ03FrpEo4gEe2vrJJS1Y9CJTaThA52g==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-template-literals": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.18.9.tgz",
-            "integrity": "sha512-S8cOWfT82gTezpYOiVaGHrCbhlHgKhQt8XH5ES46P2XWmX92yisoZywf5km75wv5sYcXDUCLMmMxOLCtthDgMA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.24.7.tgz",
+            "integrity": "sha512-AfDTQmClklHCOLxtGoP7HkeMw56k1/bTQjwsfhL6pppo/M4TOBSq+jjBUBLmV/4oeFg4GWMavIl44ZeCtmmZTw==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-typeof-symbol": {
-            "version": "7.18.9",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.18.9.tgz",
-            "integrity": "sha512-SRfwTtF11G2aemAZWivL7PD+C9z52v9EvMqH9BuYbabyPuKUvSWks3oCg6041pT925L4zVFqaVBeECwsmlguEw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.24.7.tgz",
+            "integrity": "sha512-VtR8hDy7YLB7+Pet9IarXjg/zgCMSF+1mNS/EQEiEaUPoFXCVsHG64SIxcaaI2zJgRiv+YmgaQESUfWAdbjzgg==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-unicode-escapes": {
-            "version": "7.18.10",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.18.10.tgz",
-            "integrity": "sha512-kKAdAI+YzPgGY/ftStBFXTI1LZFju38rYThnfMykS+IXy8BVx+res7s2fxf1l8I35DV2T97ezo6+SGrXz6B3iQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.24.7.tgz",
+            "integrity": "sha512-U3ap1gm5+4edc2Q/P+9VrBNhGkfnf+8ZqppY71Bo/pzZmXhhLdqgaUl6cuB07O1+AQJtCLfaOmswiNbSQ9ivhw==",
             "dev": true,
             "requires": {
-                "@babel/helper-plugin-utils": "^7.18.9"
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-unicode-property-regex": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-property-regex/-/plugin-transform-unicode-property-regex-7.24.7.tgz",
+            "integrity": "sha512-uH2O4OV5M9FZYQrwc7NdVmMxQJOCCzFeYudlZSzUAHRFeOujQefa92E74TQDVskNHCzOXoigEuoyzHDhaEaK5w==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-regexp-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/plugin-transform-unicode-regex": {
-            "version": "7.18.6",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.18.6.tgz",
-            "integrity": "sha512-gE7A6Lt7YLnNOL3Pb9BNeZvi+d8l7tcRrG4+pwJjK9hD2xX4mEvjlQW60G9EEmfXVYRPv9VRQcyegIVHCql/AA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.24.7.tgz",
+            "integrity": "sha512-hlQ96MBZSAXUq7ltkjtu3FJCCSMx/j629ns3hA3pXnBXjanNP0LHi+JpPeA81zaWgVK1VGH95Xuy7u0RyQ8kMg==",
             "dev": true,
             "requires": {
-                "@babel/helper-create-regexp-features-plugin": "^7.18.6",
-                "@babel/helper-plugin-utils": "^7.18.6"
+                "@babel/helper-create-regexp-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
+            }
+        },
+        "@babel/plugin-transform-unicode-sets-regex": {
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-sets-regex/-/plugin-transform-unicode-sets-regex-7.24.7.tgz",
+            "integrity": "sha512-2G8aAvF4wy1w/AGZkemprdGMRg5o6zPNhbHVImRz3lss55TYCBd6xStN19rt8XJHq20sqV0JbyWjOWwQRwV/wg==",
+            "dev": true,
+            "requires": {
+                "@babel/helper-create-regexp-features-plugin": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7"
             }
         },
         "@babel/preset-env": {
-            "version": "7.20.2",
-            "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.20.2.tgz",
-            "integrity": "sha512-1G0efQEWR1EHkKvKHqbG+IN/QdgwfByUpM5V5QroDzGV2t3S/WXNQd693cHiHTlCFMpr9B6FkPFXDA2lQcKoDg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.24.7.tgz",
+            "integrity": "sha512-1YZNsc+y6cTvWlDHidMBsQZrZfEFjRIo/BZCT906PMdzOyXtSLTgqGdrpcuTDCXyd11Am5uQULtDIcCfnTc8fQ==",
             "dev": true,
             "requires": {
-                "@babel/compat-data": "^7.20.1",
-                "@babel/helper-compilation-targets": "^7.20.0",
-                "@babel/helper-plugin-utils": "^7.20.2",
-                "@babel/helper-validator-option": "^7.18.6",
-                "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.18.6",
-                "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.18.9",
-                "@babel/plugin-proposal-async-generator-functions": "^7.20.1",
-                "@babel/plugin-proposal-class-properties": "^7.18.6",
-                "@babel/plugin-proposal-class-static-block": "^7.18.6",
-                "@babel/plugin-proposal-dynamic-import": "^7.18.6",
-                "@babel/plugin-proposal-export-namespace-from": "^7.18.9",
-                "@babel/plugin-proposal-json-strings": "^7.18.6",
-                "@babel/plugin-proposal-logical-assignment-operators": "^7.18.9",
-                "@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6",
-                "@babel/plugin-proposal-numeric-separator": "^7.18.6",
-                "@babel/plugin-proposal-object-rest-spread": "^7.20.2",
-                "@babel/plugin-proposal-optional-catch-binding": "^7.18.6",
-                "@babel/plugin-proposal-optional-chaining": "^7.18.9",
-                "@babel/plugin-proposal-private-methods": "^7.18.6",
-                "@babel/plugin-proposal-private-property-in-object": "^7.18.6",
-                "@babel/plugin-proposal-unicode-property-regex": "^7.18.6",
+                "@babel/compat-data": "^7.24.7",
+                "@babel/helper-compilation-targets": "^7.24.7",
+                "@babel/helper-plugin-utils": "^7.24.7",
+                "@babel/helper-validator-option": "^7.24.7",
+                "@babel/plugin-bugfix-firefox-class-in-computed-class-key": "^7.24.7",
+                "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.24.7",
+                "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.24.7",
+                "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": "^7.24.7",
+                "@babel/plugin-proposal-private-property-in-object": "7.21.0-placeholder-for-preset-env.2",
                 "@babel/plugin-syntax-async-generators": "^7.8.4",
                 "@babel/plugin-syntax-class-properties": "^7.12.13",
                 "@babel/plugin-syntax-class-static-block": "^7.14.5",
                 "@babel/plugin-syntax-dynamic-import": "^7.8.3",
                 "@babel/plugin-syntax-export-namespace-from": "^7.8.3",
-                "@babel/plugin-syntax-import-assertions": "^7.20.0",
+                "@babel/plugin-syntax-import-assertions": "^7.24.7",
+                "@babel/plugin-syntax-import-attributes": "^7.24.7",
+                "@babel/plugin-syntax-import-meta": "^7.10.4",
                 "@babel/plugin-syntax-json-strings": "^7.8.3",
                 "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4",
                 "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
@@ -12601,110 +12779,130 @@
                 "@babel/plugin-syntax-optional-chaining": "^7.8.3",
                 "@babel/plugin-syntax-private-property-in-object": "^7.14.5",
                 "@babel/plugin-syntax-top-level-await": "^7.14.5",
-                "@babel/plugin-transform-arrow-functions": "^7.18.6",
-                "@babel/plugin-transform-async-to-generator": "^7.18.6",
-                "@babel/plugin-transform-block-scoped-functions": "^7.18.6",
-                "@babel/plugin-transform-block-scoping": "^7.20.2",
-                "@babel/plugin-transform-classes": "^7.20.2",
-                "@babel/plugin-transform-computed-properties": "^7.18.9",
-                "@babel/plugin-transform-destructuring": "^7.20.2",
-                "@babel/plugin-transform-dotall-regex": "^7.18.6",
-                "@babel/plugin-transform-duplicate-keys": "^7.18.9",
-                "@babel/plugin-transform-exponentiation-operator": "^7.18.6",
-                "@babel/plugin-transform-for-of": "^7.18.8",
-                "@babel/plugin-transform-function-name": "^7.18.9",
-                "@babel/plugin-transform-literals": "^7.18.9",
-                "@babel/plugin-transform-member-expression-literals": "^7.18.6",
-                "@babel/plugin-transform-modules-amd": "^7.19.6",
-                "@babel/plugin-transform-modules-commonjs": "^7.19.6",
-                "@babel/plugin-transform-modules-systemjs": "^7.19.6",
-                "@babel/plugin-transform-modules-umd": "^7.18.6",
-                "@babel/plugin-transform-named-capturing-groups-regex": "^7.19.1",
-                "@babel/plugin-transform-new-target": "^7.18.6",
-                "@babel/plugin-transform-object-super": "^7.18.6",
-                "@babel/plugin-transform-parameters": "^7.20.1",
-                "@babel/plugin-transform-property-literals": "^7.18.6",
-                "@babel/plugin-transform-regenerator": "^7.18.6",
-                "@babel/plugin-transform-reserved-words": "^7.18.6",
-                "@babel/plugin-transform-shorthand-properties": "^7.18.6",
-                "@babel/plugin-transform-spread": "^7.19.0",
-                "@babel/plugin-transform-sticky-regex": "^7.18.6",
-                "@babel/plugin-transform-template-literals": "^7.18.9",
-                "@babel/plugin-transform-typeof-symbol": "^7.18.9",
-                "@babel/plugin-transform-unicode-escapes": "^7.18.10",
-                "@babel/plugin-transform-unicode-regex": "^7.18.6",
-                "@babel/preset-modules": "^0.1.5",
-                "@babel/types": "^7.20.2",
-                "babel-plugin-polyfill-corejs2": "^0.3.3",
-                "babel-plugin-polyfill-corejs3": "^0.6.0",
-                "babel-plugin-polyfill-regenerator": "^0.4.1",
-                "core-js-compat": "^3.25.1",
-                "semver": "^6.3.0"
+                "@babel/plugin-syntax-unicode-sets-regex": "^7.18.6",
+                "@babel/plugin-transform-arrow-functions": "^7.24.7",
+                "@babel/plugin-transform-async-generator-functions": "^7.24.7",
+                "@babel/plugin-transform-async-to-generator": "^7.24.7",
+                "@babel/plugin-transform-block-scoped-functions": "^7.24.7",
+                "@babel/plugin-transform-block-scoping": "^7.24.7",
+                "@babel/plugin-transform-class-properties": "^7.24.7",
+                "@babel/plugin-transform-class-static-block": "^7.24.7",
+                "@babel/plugin-transform-classes": "^7.24.7",
+                "@babel/plugin-transform-computed-properties": "^7.24.7",
+                "@babel/plugin-transform-destructuring": "^7.24.7",
+                "@babel/plugin-transform-dotall-regex": "^7.24.7",
+                "@babel/plugin-transform-duplicate-keys": "^7.24.7",
+                "@babel/plugin-transform-dynamic-import": "^7.24.7",
+                "@babel/plugin-transform-exponentiation-operator": "^7.24.7",
+                "@babel/plugin-transform-export-namespace-from": "^7.24.7",
+                "@babel/plugin-transform-for-of": "^7.24.7",
+                "@babel/plugin-transform-function-name": "^7.24.7",
+                "@babel/plugin-transform-json-strings": "^7.24.7",
+                "@babel/plugin-transform-literals": "^7.24.7",
+                "@babel/plugin-transform-logical-assignment-operators": "^7.24.7",
+                "@babel/plugin-transform-member-expression-literals": "^7.24.7",
+                "@babel/plugin-transform-modules-amd": "^7.24.7",
+                "@babel/plugin-transform-modules-commonjs": "^7.24.7",
+                "@babel/plugin-transform-modules-systemjs": "^7.24.7",
+                "@babel/plugin-transform-modules-umd": "^7.24.7",
+                "@babel/plugin-transform-named-capturing-groups-regex": "^7.24.7",
+                "@babel/plugin-transform-new-target": "^7.24.7",
+                "@babel/plugin-transform-nullish-coalescing-operator": "^7.24.7",
+                "@babel/plugin-transform-numeric-separator": "^7.24.7",
+                "@babel/plugin-transform-object-rest-spread": "^7.24.7",
+                "@babel/plugin-transform-object-super": "^7.24.7",
+                "@babel/plugin-transform-optional-catch-binding": "^7.24.7",
+                "@babel/plugin-transform-optional-chaining": "^7.24.7",
+                "@babel/plugin-transform-parameters": "^7.24.7",
+                "@babel/plugin-transform-private-methods": "^7.24.7",
+                "@babel/plugin-transform-private-property-in-object": "^7.24.7",
+                "@babel/plugin-transform-property-literals": "^7.24.7",
+                "@babel/plugin-transform-regenerator": "^7.24.7",
+                "@babel/plugin-transform-reserved-words": "^7.24.7",
+                "@babel/plugin-transform-shorthand-properties": "^7.24.7",
+                "@babel/plugin-transform-spread": "^7.24.7",
+                "@babel/plugin-transform-sticky-regex": "^7.24.7",
+                "@babel/plugin-transform-template-literals": "^7.24.7",
+                "@babel/plugin-transform-typeof-symbol": "^7.24.7",
+                "@babel/plugin-transform-unicode-escapes": "^7.24.7",
+                "@babel/plugin-transform-unicode-property-regex": "^7.24.7",
+                "@babel/plugin-transform-unicode-regex": "^7.24.7",
+                "@babel/plugin-transform-unicode-sets-regex": "^7.24.7",
+                "@babel/preset-modules": "0.1.6-no-external-plugins",
+                "babel-plugin-polyfill-corejs2": "^0.4.10",
+                "babel-plugin-polyfill-corejs3": "^0.10.4",
+                "babel-plugin-polyfill-regenerator": "^0.6.1",
+                "core-js-compat": "^3.31.0",
+                "semver": "^6.3.1"
             },
             "dependencies": {
                 "semver": {
-                    "version": "6.3.0",
-                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-                    "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+                    "version": "6.3.1",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+                    "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
                     "dev": true
                 }
             }
         },
         "@babel/preset-modules": {
-            "version": "0.1.5",
-            "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.5.tgz",
-            "integrity": "sha512-A57th6YRG7oR3cq/yt/Y84MvGgE0eJG2F1JLhKuyG+jFxEgrd/HAMJatiFtmOiZurz+0DkrvbheCLaV5f2JfjA==",
+            "version": "0.1.6-no-external-plugins",
+            "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.6-no-external-plugins.tgz",
+            "integrity": "sha512-HrcgcIESLm9aIR842yhJ5RWan/gebQUJ6E/E5+rf0y9o6oj7w0Br+sWuL6kEQ/o/AdfvR1Je9jG18/gnpwjEyA==",
             "dev": true,
             "requires": {
                 "@babel/helper-plugin-utils": "^7.0.0",
-                "@babel/plugin-proposal-unicode-property-regex": "^7.4.4",
-                "@babel/plugin-transform-dotall-regex": "^7.4.4",
                 "@babel/types": "^7.4.4",
                 "esutils": "^2.0.2"
             }
         },
+        "@babel/regjsgen": {
+            "version": "0.8.0",
+            "resolved": "https://registry.npmjs.org/@babel/regjsgen/-/regjsgen-0.8.0.tgz",
+            "integrity": "sha512-x/rqGMdzj+fWZvCOYForTghzbtqPDZ5gPwaoNGHdgDfF2QA/XZbCBp4Moo5scrkAMPhB7z26XM/AaHuIJdgauA==",
+            "dev": true
+        },
         "@babel/runtime": {
-            "version": "7.20.13",
-            "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.20.13.tgz",
-            "integrity": "sha512-gt3PKXs0DBoL9xCvOIIZ2NEqAGZqHjAnmVbfQtB620V0uReIQutpel14KcneZuer7UioY8ALKZ7iocavvzTNFA==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.24.7.tgz",
+            "integrity": "sha512-UwgBRMjJP+xv857DCngvqXI3Iq6J4v0wXmwc6sapg+zyhbwmQX67LUEFrkK5tbyJ30jGuG3ZvWpBiB9LCy1kWw==",
             "dev": true,
             "requires": {
-                "regenerator-runtime": "^0.13.11"
+                "regenerator-runtime": "^0.14.0"
             }
         },
         "@babel/template": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.20.7.tgz",
-            "integrity": "sha512-8SegXApWe6VoNw0r9JHpSteLKTpTiLZ4rMlGIm9JQ18KiCtyQiAMEazujAHrUS5flrcqYZa75ukev3P6QmUwUw==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.24.7.tgz",
+            "integrity": "sha512-jYqfPrU9JTF0PmPy1tLYHW4Mp4KlgxJD9l2nP9fD6yT/ICi554DmrWBAEYpIelzjHf1msDP3PxJIRt/nFNfBig==",
             "dev": true,
             "requires": {
-                "@babel/code-frame": "^7.18.6",
-                "@babel/parser": "^7.20.7",
-                "@babel/types": "^7.20.7"
+                "@babel/code-frame": "^7.24.7",
+                "@babel/parser": "^7.24.7",
+                "@babel/types": "^7.24.7"
             }
         },
         "@babel/traverse": {
-            "version": "7.20.13",
-            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.20.13.tgz",
-            "integrity": "sha512-kMJXfF0T6DIS9E8cgdLCSAL+cuCK+YEZHWiLK0SXpTo8YRj5lpJu3CDNKiIBCne4m9hhTIqUg6SYTAI39tAiVQ==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.24.7.tgz",
+            "integrity": "sha512-yb65Ed5S/QAcewNPh0nZczy9JdYXkkAbIsEo+P7BE7yO3txAY30Y/oPa3QkQ5It3xVG2kpKMg9MsdxZaO31uKA==",
             "dev": true,
             "requires": {
-                "@babel/code-frame": "^7.18.6",
-                "@babel/generator": "^7.20.7",
-                "@babel/helper-environment-visitor": "^7.18.9",
-                "@babel/helper-function-name": "^7.19.0",
-                "@babel/helper-hoist-variables": "^7.18.6",
-                "@babel/helper-split-export-declaration": "^7.18.6",
-                "@babel/parser": "^7.20.13",
-                "@babel/types": "^7.20.7",
-                "debug": "^4.1.0",
+                "@babel/code-frame": "^7.24.7",
+                "@babel/generator": "^7.24.7",
+                "@babel/helper-environment-visitor": "^7.24.7",
+                "@babel/helper-function-name": "^7.24.7",
+                "@babel/helper-hoist-variables": "^7.24.7",
+                "@babel/helper-split-export-declaration": "^7.24.7",
+                "@babel/parser": "^7.24.7",
+                "@babel/types": "^7.24.7",
+                "debug": "^4.3.1",
                 "globals": "^11.1.0"
             },
             "dependencies": {
                 "debug": {
-                    "version": "4.3.4",
-                    "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
-                    "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+                    "version": "4.3.5",
+                    "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.5.tgz",
+                    "integrity": "sha512-pt0bNEmneDIvdL1Xsd9oDQ/wrQRkXDT4AUWlNZNPKvW5x/jyO9VFXkJUP07vQ2upmw5PlaITaPKc31jK13V+jg==",
                     "dev": true,
                     "requires": {
                         "ms": "2.1.2"
@@ -12719,13 +12917,13 @@
             }
         },
         "@babel/types": {
-            "version": "7.20.7",
-            "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.20.7.tgz",
-            "integrity": "sha512-69OnhBxSSgK0OzTJai4kyPDiKTIe3j+ctaHdIGVbRahTLAT7L3R9oeXHC2aVSuGYt3cVnoAMDmOCgJ2yaiLMvg==",
+            "version": "7.24.7",
+            "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.24.7.tgz",
+            "integrity": "sha512-XEFXSlxiG5td2EJRe8vOmRbaXVgfcBlszKujvVmWIK/UpywWljQCfzAv3RQCGujWQ1RD4YYWEAqDXfuJiy8f5Q==",
             "dev": true,
             "requires": {
-                "@babel/helper-string-parser": "^7.19.4",
-                "@babel/helper-validator-identifier": "^7.19.1",
+                "@babel/helper-string-parser": "^7.24.7",
+                "@babel/helper-validator-identifier": "^7.24.7",
                 "to-fast-properties": "^2.0.0"
             }
         },
@@ -12758,9 +12956,9 @@
             "dev": true
         },
         "@jridgewell/set-array": {
-            "version": "1.1.2",
-            "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
-            "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
+            "version": "1.2.1",
+            "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.2.1.tgz",
+            "integrity": "sha512-R8gLRTZeyp03ymzP/6Lil/28tGeGEzhx1q2k703KGWRAI1VdvPIXdG70VJc2pAMw3NA6JKL5hhFu1sJX0Mnn/A==",
             "dev": true
         },
         "@jridgewell/sourcemap-codec": {
@@ -12770,13 +12968,13 @@
             "dev": true
         },
         "@jridgewell/trace-mapping": {
-            "version": "0.3.17",
-            "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.17.tgz",
-            "integrity": "sha512-MCNzAp77qzKca9+W/+I0+sEpaUnZoeasnghNeVc41VZCEKaCH73Vq3BZZ/SzWIgrqE4H4ceI+p+b6C0mHf9T4g==",
+            "version": "0.3.25",
+            "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.25.tgz",
+            "integrity": "sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ==",
             "dev": true,
             "requires": {
-                "@jridgewell/resolve-uri": "3.1.0",
-                "@jridgewell/sourcemap-codec": "1.4.14"
+                "@jridgewell/resolve-uri": "^3.1.0",
+                "@jridgewell/sourcemap-codec": "^1.4.14"
             }
         },
         "@npmcli/fs": {
@@ -13493,41 +13691,41 @@
             }
         },
         "babel-plugin-polyfill-corejs2": {
-            "version": "0.3.3",
-            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.3.3.tgz",
-            "integrity": "sha512-8hOdmFYFSZhqg2C/JgLUQ+t52o5nirNwaWM2B9LWteozwIvM14VSwdsCAUET10qT+kmySAlseadmfeeSWFCy+Q==",
+            "version": "0.4.11",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.4.11.tgz",
+            "integrity": "sha512-sMEJ27L0gRHShOh5G54uAAPaiCOygY/5ratXuiyb2G46FmlSpc9eFCzYVyDiPxfNbwzA7mYahmjQc5q+CZQ09Q==",
             "dev": true,
             "requires": {
-                "@babel/compat-data": "^7.17.7",
-                "@babel/helper-define-polyfill-provider": "^0.3.3",
-                "semver": "^6.1.1"
+                "@babel/compat-data": "^7.22.6",
+                "@babel/helper-define-polyfill-provider": "^0.6.2",
+                "semver": "^6.3.1"
             },
             "dependencies": {
                 "semver": {
-                    "version": "6.3.0",
-                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-                    "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+                    "version": "6.3.1",
+                    "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+                    "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
                     "dev": true
                 }
             }
         },
         "babel-plugin-polyfill-corejs3": {
-            "version": "0.6.0",
-            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.6.0.tgz",
-            "integrity": "sha512-+eHqR6OPcBhJOGgsIar7xoAB1GcSwVUA3XjAd7HJNzOXT4wv6/H7KIdA/Nc60cvUlDbKApmqNvD1B1bzOt4nyA==",
+            "version": "0.10.4",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.10.4.tgz",
+            "integrity": "sha512-25J6I8NGfa5YkCDogHRID3fVCadIR8/pGl1/spvCkzb6lVn6SR3ojpx9nOn9iEBcUsjY24AmdKm5khcfKdylcg==",
             "dev": true,
             "requires": {
-                "@babel/helper-define-polyfill-provider": "^0.3.3",
-                "core-js-compat": "^3.25.1"
+                "@babel/helper-define-polyfill-provider": "^0.6.1",
+                "core-js-compat": "^3.36.1"
             }
         },
         "babel-plugin-polyfill-regenerator": {
-            "version": "0.4.1",
-            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.4.1.tgz",
-            "integrity": "sha512-NtQGmyQDXjQqQ+IzRkBVwEOz9lQ4zxAQZgoAYEtU9dJjnl1Oc98qnN7jcp+bE7O7aYzVpavXE3/VKXNzUbh7aw==",
+            "version": "0.6.2",
+            "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.6.2.tgz",
+            "integrity": "sha512-2R25rQZWP63nGwaAswvDazbPXfrM3HwVoBXK6HcqeKrSrL/JqcC/rDcf95l4r7LXLyxDXc8uQDa064GubtCABg==",
             "dev": true,
             "requires": {
-                "@babel/helper-define-polyfill-provider": "^0.3.3"
+                "@babel/helper-define-polyfill-provider": "^0.6.2"
             }
         },
         "balanced-match": {
@@ -13736,15 +13934,15 @@
             }
         },
         "browserslist": {
-            "version": "4.21.5",
-            "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.21.5.tgz",
-            "integrity": "sha512-tUkiguQGW7S3IhB7N+c2MV/HZPSCPAAiYBZXLsBhFB/PCy6ZKKsZrmBayHV9fdGV/ARIfJ14NkxKzRDjvp7L6w==",
+            "version": "4.23.1",
+            "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.23.1.tgz",
+            "integrity": "sha512-TUfofFo/KsK/bWZ9TWQ5O26tsWW4Uhmt8IYklbnUa70udB6P2wA7w7o4PY4muaEPBQaAX+CEnmmIA41NVHtPVw==",
             "dev": true,
             "requires": {
-                "caniuse-lite": "^1.0.30001449",
-                "electron-to-chromium": "^1.4.284",
-                "node-releases": "^2.0.8",
-                "update-browserslist-db": "^1.0.10"
+                "caniuse-lite": "^1.0.30001629",
+                "electron-to-chromium": "^1.4.796",
+                "node-releases": "^2.0.14",
+                "update-browserslist-db": "^1.0.16"
             }
         },
         "buffer": {
@@ -13867,9 +14065,9 @@
             }
         },
         "caniuse-lite": {
-            "version": "1.0.30001473",
-            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001473.tgz",
-            "integrity": "sha512-ewDad7+D2vlyy+E4UJuVfiBsU69IL+8oVmTuZnH5Q6CIUbxNfI50uVpRHbUPDD6SUaN2o0Lh4DhTrvLG/Tn1yg==",
+            "version": "1.0.30001632",
+            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001632.tgz",
+            "integrity": "sha512-udx3o7yHJfUxMLkGohMlVHCvFvWmirKh9JAH/d7WOLPetlH+LTL5cocMZ0t7oZx/mdlOWXti97xLZWc8uURRHg==",
             "dev": true
         },
         "chalk": {
@@ -14274,9 +14472,9 @@
             "integrity": "sha512-xFxOwqIzR/e1k1gLiWEophSCMqXcwVHIH7akf7b/vxcUeGunlj3hvZaaqxwHsTgn+IndtkQJgSztIDWeumWJDQ=="
         },
         "convert-source-map": {
-            "version": "1.9.0",
-            "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
-            "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
+            "version": "2.0.0",
+            "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+            "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
             "dev": true
         },
         "copy-concurrently": {
@@ -14346,12 +14544,12 @@
             "integrity": "sha512-hQotSSARoNh1mYPi9O2YaWeiq/cEB95kOrFb4NCrO4RIFt1qqNpKsaE+vy/L3oiqvND5cThqXzUU3r9F7Efztg=="
         },
         "core-js-compat": {
-            "version": "3.27.2",
-            "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.27.2.tgz",
-            "integrity": "sha512-welaYuF7ZtbYKGrIy7y3eb40d37rG1FvzEOfe7hSLd2iD6duMDqUhRfSvCGyC46HhR6Y8JXXdZ2lnRUMkPBpvg==",
+            "version": "3.37.1",
+            "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.37.1.tgz",
+            "integrity": "sha512-9TNiImhKvQqSUkOvk/mMRZzOANTiEVC7WaBNhHcKM7x+/5E1l5NvsysR19zuDQScE8k+kfQXWRN3AtS/eOSHpg==",
             "dev": true,
             "requires": {
-                "browserslist": "^4.21.4"
+                "browserslist": "^4.23.0"
             }
         },
         "core-util-is": {
@@ -14931,30 +15129,30 @@
             }
         },
         "csv": {
-            "version": "6.2.5",
-            "resolved": "https://registry.npmjs.org/csv/-/csv-6.2.5.tgz",
-            "integrity": "sha512-T+K0H7MIrlrnP6KxYKo3lK+uLl6OC2Gmwdd81TG/VdkhKvpatl35sR7tyRSpDLGl22y2T+q9KvNHnVtn4OAscQ==",
+            "version": "6.3.9",
+            "resolved": "https://registry.npmjs.org/csv/-/csv-6.3.9.tgz",
+            "integrity": "sha512-eiN+Qu8NwSLxZYia6WzB8xlX/rAQ/8EgK5A4dIF7Bz96mzcr5dW1jlcNmjG0QWySWKfPdCerH3RQ96ZqqsE8cA==",
             "requires": {
-                "csv-generate": "^4.2.1",
-                "csv-parse": "^5.3.3",
-                "csv-stringify": "^6.2.3",
-                "stream-transform": "^3.2.1"
+                "csv-generate": "^4.4.1",
+                "csv-parse": "^5.5.6",
+                "csv-stringify": "^6.5.0",
+                "stream-transform": "^3.3.2"
             }
         },
         "csv-generate": {
-            "version": "4.2.1",
-            "resolved": "https://registry.npmjs.org/csv-generate/-/csv-generate-4.2.1.tgz",
-            "integrity": "sha512-w6GFHjvApv6bcJ2xdi9JGsH6ZvUBfC+vUdfefnEzurXG6hMRwzkBLnhztU2H7v7+zfCk1I/knnQ+tGbgpxWrBw=="
+            "version": "4.4.1",
+            "resolved": "https://registry.npmjs.org/csv-generate/-/csv-generate-4.4.1.tgz",
+            "integrity": "sha512-O/einO0v4zPmXaOV+sYqGa02VkST4GP5GLpWBNHEouIU7pF3kpGf3D0kCCvX82ydIY4EKkOK+R8b1BYsRXravg=="
         },
         "csv-parse": {
-            "version": "5.3.3",
-            "resolved": "https://registry.npmjs.org/csv-parse/-/csv-parse-5.3.3.tgz",
-            "integrity": "sha512-kEWkAPleNEdhFNkHQpFHu9RYPogsFj3dx6bCxL847fsiLgidzWg0z/O0B1kVWMJUc5ky64zGp18LX2T3DQrOfw=="
+            "version": "5.5.6",
+            "resolved": "https://registry.npmjs.org/csv-parse/-/csv-parse-5.5.6.tgz",
+            "integrity": "sha512-uNpm30m/AGSkLxxy7d9yRXpJQFrZzVWLFBkS+6ngPcZkw/5k3L/jjFuj7tVnEpRn+QgmiXr21nDlhCiUK4ij2A=="
         },
         "csv-stringify": {
-            "version": "6.2.3",
-            "resolved": "https://registry.npmjs.org/csv-stringify/-/csv-stringify-6.2.3.tgz",
-            "integrity": "sha512-4qGjUMwnlaRc00gc2jrIYh2w/h1fo25B0mTuY9K8fBiIgtmCX3LcgUbrEGViL98Ci4Se/F5LFEtu8k+dItJVZQ=="
+            "version": "6.5.0",
+            "resolved": "https://registry.npmjs.org/csv-stringify/-/csv-stringify-6.5.0.tgz",
+            "integrity": "sha512-edlXFVKcUx7r8Vx5zQucsuMg4wb/xT6qyz+Sr1vnLrdXqlLD1+UKyWNyZ9zn6mUW1ewmGxrpVwAcChGF0HQ/2Q=="
         },
         "cyclist": {
             "version": "1.0.1",
@@ -15166,9 +15364,9 @@
             }
         },
         "electron-to-chromium": {
-            "version": "1.4.349",
-            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.349.tgz",
-            "integrity": "sha512-34LBfVDiL6byWorSmQOPwq4gD5wpN8Mhh5yPGQr67FbcxsfUS0BDJP9y6RykSgeWVUfSkN/2dChywnsrmKVyUg==",
+            "version": "1.4.798",
+            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.798.tgz",
+            "integrity": "sha512-by9J2CiM9KPGj9qfp5U4FcPSbXJG7FNzqnYaY4WLzX+v2PHieVGmnsA4dxfpGE3QEC7JofpPZmn7Vn1B9NR2+Q==",
             "dev": true
         },
         "elliptic": {
@@ -15326,9 +15524,9 @@
             }
         },
         "escalade": {
-            "version": "3.1.1",
-            "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
-            "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
+            "version": "3.1.2",
+            "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.2.tgz",
+            "integrity": "sha512-ErCHMCae19vR8vQGe50xIsVomy19rg6gFu3+r3jkEO46suLMWBksvVyoGgQV+jOfl84ZSOSlmv6Gxa89PmTGmA==",
             "dev": true
         },
         "escape-string-regexp": {
@@ -17117,9 +17315,9 @@
             }
         },
         "node-releases": {
-            "version": "2.0.10",
-            "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.10.tgz",
-            "integrity": "sha512-5GFldHPXVG/YZmFzJvKK2zDSzPKhEp0+ZR5SVaoSag9fsL5YgHbUHDfnG5494ISANDcK4KwPXAx2xqVEydmd7w==",
+            "version": "2.0.14",
+            "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.14.tgz",
+            "integrity": "sha512-y10wOWt8yZpqXmOgRo77WaHEmhYQYGNA6y421PKsKYWEK8aW+cqAphborZDhqfyKrbZEN92CN1X2KbafY2s7Yw==",
             "dev": true
         },
         "nopt": {
@@ -17460,9 +17658,9 @@
             }
         },
         "picocolors": {
-            "version": "1.0.0",
-            "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
-            "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ==",
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.1.tgz",
+            "integrity": "sha512-anP1Z8qwhkbmu7MFP5iTt+wQKXgwzf7zTyGlcdzabySa9vd0Xt392U0rVmz9poOaBj0uHJKyyo9/upk0HrEQew==",
             "dev": true
         },
         "picomatch": {
@@ -18634,24 +18832,24 @@
             "dev": true
         },
         "regenerate-unicode-properties": {
-            "version": "10.1.0",
-            "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-10.1.0.tgz",
-            "integrity": "sha512-d1VudCLoIGitcU/hEg2QqvyGZQmdC0Lf8BqdOMXGFSvJP4bNV1+XqbPQeHHLD51Jh4QJJ225dlIFvY4Ly6MXmQ==",
+            "version": "10.1.1",
+            "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-10.1.1.tgz",
+            "integrity": "sha512-X007RyZLsCJVVrjgEFVpLUTZwyOZk3oiL75ZcuYjlIWd6rNJtOjkBwQc5AsRrpbKVkxN6sklw/k/9m2jJYOf8Q==",
             "dev": true,
             "requires": {
                 "regenerate": "^1.4.2"
             }
         },
         "regenerator-runtime": {
-            "version": "0.13.11",
-            "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
-            "integrity": "sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==",
+            "version": "0.14.1",
+            "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.14.1.tgz",
+            "integrity": "sha512-dYnhHh0nJoMfnkZs6GmmhFknAGRrLznOu5nc9ML+EJxGvrx6H7teuevqVqCuPcPK//3eDrrjQhehXVx9cnkGdw==",
             "dev": true
         },
         "regenerator-transform": {
-            "version": "0.15.1",
-            "resolved": "https://registry.npmjs.org/regenerator-transform/-/regenerator-transform-0.15.1.tgz",
-            "integrity": "sha512-knzmNAcuyxV+gQCufkYcvOqX/qIIfHLv0u5x79kRxuGojfYVky1f15TzZEu2Avte8QGepvUNTnLskf8E6X6Vyg==",
+            "version": "0.15.2",
+            "resolved": "https://registry.npmjs.org/regenerator-transform/-/regenerator-transform-0.15.2.tgz",
+            "integrity": "sha512-hfMp2BoF0qOk3uc5V20ALGDS2ddjQaLrdl7xrGXvAIow7qeWRM2VA2HuCHkUKk9slq3VwEwLNK3DFBqDfPGYtg==",
             "dev": true,
             "requires": {
                 "@babel/runtime": "^7.8.4"
@@ -18678,25 +18876,19 @@
             }
         },
         "regexpu-core": {
-            "version": "5.2.2",
-            "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-5.2.2.tgz",
-            "integrity": "sha512-T0+1Zp2wjF/juXMrMxHxidqGYn8U4R+zleSJhX9tQ1PUsS8a9UtYfbsF9LdiVgNX3kiX8RNaKM42nfSgvFJjmw==",
+            "version": "5.3.2",
+            "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-5.3.2.tgz",
+            "integrity": "sha512-RAM5FlZz+Lhmo7db9L298p2vHP5ZywrVXmVXpmAD9GuL5MPH6t9ROw1iA/wfHkQ76Qe7AaPF0nGuim96/IrQMQ==",
             "dev": true,
             "requires": {
+                "@babel/regjsgen": "^0.8.0",
                 "regenerate": "^1.4.2",
                 "regenerate-unicode-properties": "^10.1.0",
-                "regjsgen": "^0.7.1",
                 "regjsparser": "^0.9.1",
                 "unicode-match-property-ecmascript": "^2.0.0",
                 "unicode-match-property-value-ecmascript": "^2.1.0"
             }
         },
-        "regjsgen": {
-            "version": "0.7.1",
-            "resolved": "https://registry.npmjs.org/regjsgen/-/regjsgen-0.7.1.tgz",
-            "integrity": "sha512-RAt+8H2ZEzHeYWxZ3H2z6tF18zyyOnlcdaafLrm21Bguj7uZy6ULibiAFdXEtKQY4Sy7wDTwDiOazasMLc4KPA==",
-            "dev": true
-        },
         "regjsparser": {
             "version": "0.9.1",
             "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.9.1.tgz",
@@ -19326,9 +19518,9 @@
             "integrity": "sha512-AiisoFqQ0vbGcZgQPY1cdP2I76glaVA/RauYR4G4thNFgkTqr90yXTo4LYX60Jl+sIlPNHHdGSwo01AvbKUSVQ=="
         },
         "stream-transform": {
-            "version": "3.2.1",
-            "resolved": "https://registry.npmjs.org/stream-transform/-/stream-transform-3.2.1.tgz",
-            "integrity": "sha512-ApK+WTJ5bCOf0A2tlec1qhvr8bGEBM/sgXXB7mysdCYgZJO5DZeaV3h3G+g0HnAQ372P5IhiGqnW29zoLOfTzQ=="
+            "version": "3.3.2",
+            "resolved": "https://registry.npmjs.org/stream-transform/-/stream-transform-3.3.2.tgz",
+            "integrity": "sha512-v64PUnPy9Qw94NGuaEMo+9RHQe4jTBYf+NkTtqkCgeuiNo8NlL0LtLR7fkKWNVFtp3RhIm5Dlxkgm5uz7TDimQ=="
         },
         "string_decoder": {
             "version": "1.1.1",
@@ -19881,13 +20073,13 @@
             "optional": true
         },
         "update-browserslist-db": {
-            "version": "1.0.10",
-            "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.0.10.tgz",
-            "integrity": "sha512-OztqDenkfFkbSG+tRxBeAnCVPckDBcvibKd35yDONx6OU8N7sqgwc7rCbkJ/WcYtVRZ4ba68d6byhC21GFh7sQ==",
+            "version": "1.0.16",
+            "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.0.16.tgz",
+            "integrity": "sha512-KVbTxlBYlckhF5wgfyZXTWnMn7MMZjMu9XG8bPlliUOP9ThaF4QnhP8qrjrH7DRzHfSk0oQv1wToW+iA5GajEQ==",
             "dev": true,
             "requires": {
-                "escalade": "^3.1.1",
-                "picocolors": "^1.0.0"
+                "escalade": "^3.1.2",
+                "picocolors": "^1.0.1"
             }
         },
         "uri-js": {
@@ -20293,9 +20485,9 @@
             "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
         },
         "yaml": {
-            "version": "2.2.2",
-            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.2.tgz",
-            "integrity": "sha512-CBKFWExMn46Foo4cldiChEzn7S7SRV+wqiluAb6xmueD/fGyRHIhX8m14vVGgeFWjN540nKCNVj6P21eQjgTuA=="
+            "version": "2.4.5",
+            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.4.5.tgz",
+            "integrity": "sha512-aBx2bnqDzVOyNKfsysjA2ms5ZlnjSAW2eG3/L5G/CSujfjLJTJsEw1bGw8kCf04KodQWk1pxlGnZ56CRxiawmg=="
         },
         "yocto-queue": {
             "version": "0.1.0",
diff --git a/guacamole/src/main/frontend/package.json b/guacamole/src/main/frontend/package.json
index bf409958a..d031d9e43 100644
--- a/guacamole/src/main/frontend/package.json
+++ b/guacamole/src/main/frontend/package.json
@@ -12,7 +12,7 @@
         "angular-translate-interpolation-messageformat": "^2.19.1",
         "angular-translate-loader-static-files": "^2.19.1",
         "blob-polyfill": ">=7.0.20220408",
-        "csv": "^6.2.5",
+        "csv": "^6.3.9",
         "d3-path": "^3.1.0",
         "d3-shape": "^3.2.0",
         "datalist-polyfill": "^1.25.1",
@@ -21,11 +21,11 @@
         "jquery": "^3.7.1",
         "jstz": "^2.1.1",
         "lodash": "^4.17.21",
-        "yaml": "^2.2.2"
+        "yaml": "^2.4.5"
     },
     "devDependencies": {
-        "@babel/core": "^7.20.12",
-        "@babel/preset-env": "^7.20.2",
+        "@babel/core": "^7.24.7",
+        "@babel/preset-env": "^7.24.7",
         "babel-loader": "^8.3.0",
         "clean-webpack-plugin": "^4.0.0",
         "closure-webpack-plugin": "^2.6.1",

From b91d96b0900ffc2d53c5ed18f07f957e14a71978 Mon Sep 17 00:00:00 2001
From: corentin-soriano <corentin+github@soriano.app>
Date: Tue, 18 Jun 2024 09:08:32 +0200
Subject: [PATCH 286/289] GUACAMOLE-1611: Improve FR translations and add
 missings ones.

---
 .../main/frontend/src/translations/fr.json    | 249 ++++++++++++++----
 1 file changed, 201 insertions(+), 48 deletions(-)

diff --git a/guacamole/src/main/frontend/src/translations/fr.json b/guacamole/src/main/frontend/src/translations/fr.json
index bf2904303..d61b041f9 100644
--- a/guacamole/src/main/frontend/src/translations/fr.json
+++ b/guacamole/src/main/frontend/src/translations/fr.json
@@ -6,12 +6,15 @@
 
         "ACTION_ACKNOWLEDGE"        : "Confirmer",
         "ACTION_CANCEL"             : "Annuler",
+        "ACTION_CLEAR"              : "Effacer",
         "ACTION_CLONE"              : "Cloner",
         "ACTION_CONTINUE"           : "Continuer",
         "ACTION_DELETE"             : "Supprimer",
         "ACTION_DELETE_SESSIONS"    : "Fermer les Sessions",
         "ACTION_DOWNLOAD"           : "Télécharger",
+        "ACTION_IMPORT"             : "Importer",
         "ACTION_LOGIN"              : "Se connecter",
+        "ACTION_LOGIN_AGAIN"        : "Se re-connecter",
         "ACTION_LOGOUT"             : "Se déconnecter",
         "ACTION_MANAGE_CONNECTIONS" : "Connexions",
         "ACTION_MANAGE_PREFERENCES" : "Préférences",
@@ -21,26 +24,33 @@
         "ACTION_MANAGE_USER_GROUPS" : "Groupes",
         "ACTION_NAVIGATE_BACK"      : "Retour",
         "ACTION_NAVIGATE_HOME"      : "Accueil",
+        "ACTION_PAUSE"              : "Pause",
+        "ACTION_PLAY"               : "Lecture",
         "ACTION_SAVE"               : "Enregistrer",
         "ACTION_SEARCH"             : "Rechercher",
         "ACTION_SHARE"              : "Partager",
         "ACTION_UPDATE_PASSWORD"    : "Mettre à jour mot de passe",
         "ACTION_VIEW_HISTORY"       : "Historique",
+        "ACTION_VIEW_RECORDING"     : "Voir",
 
         "DIALOG_HEADER_ERROR" : "Erreur",
 
-        "ERROR_PAGE_UNAVAILABLE"  : "Une erreur est apparue et cette action ne pourra pas être achevé. Si le problème persiste, merci de contacter votre administrateur ou regarder les journaux système.",
+        "ERROR_PAGE_UNAVAILABLE"  : "Une erreur est survenue et cette action ne pourra pas être achevée. Si le problème persiste, merci de contacter votre administrateur ou regarder les journaux système.",
         "ERROR_PASSWORD_BLANK"    : "Votre mot de passe ne peut pas être vide.",
         "ERROR_PASSWORD_MISMATCH" : "Le mot de passe ne correspond pas.",
+        "ERROR_SINGLE_FILE_ONLY"  : "Veuillez télécharger un seul fichier à la fois.",
 
         "FIELD_HEADER_PASSWORD"       : "Mot de passe:",
         "FIELD_HEADER_PASSWORD_AGAIN" : "Répéter mot de passe:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING"  : "Autoriser l'écriture dans le fichier d'enregistrement existant:",
+        "FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING" : "Autoriser l'écriture dans le fichier TypeScript existant:",
 
         "FIELD_PLACEHOLDER_FILTER" : "Filtre",
 
         "FORMAT_DATE_TIME_PRECISE" : "dd-MM-yyyy HH:mm:ss",
 
         "INFO_ACTIVE_USER_COUNT" : "Actuellement utilisé par {USERS} {USERS, plural, one{utilisateur} other{utilisateurs}}.",
+        "INFO_LOGGED_OUT"        : "Vous avez été déconnecté.",
 
         "TEXT_ANONYMOUS_USER"   : "Anonyme",
         "TEXT_HISTORY_DURATION" : "{VALUE} {UNIT, select, second{{VALUE, plural, one{seconde} other{secondes}}} minute{{VALUE, plural, one{minute} other{minutes}}} hour{{VALUE, plural, one{heure} other{heures}}} day{{VALUE, plural, one{jour} other{jours}}} other{}}",
@@ -51,8 +61,12 @@
     "CLIENT" : {
 
         "ACTION_ACKNOWLEDGE"               : "@:APP.ACTION_ACKNOWLEDGE",
-        "ACTION_CLEAR_COMPLETED_TRANSFERS" : "Vider",
+        "ACTION_CANCEL"                    : "@:APP.ACTION_CANCEL",
+        "ACTION_CLEAR_CLIENT_MESSAGES"     : "@:APP.ACTION_CLEAR",
+        "ACTION_CLEAR_COMPLETED_TRANSFERS" : "@:APP.ACTION_CLEAR",
+        "ACTION_CONTINUE"                  : "@:APP.ACTION_CONTINUE",
         "ACTION_DISCONNECT"                : "Déconnecter",
+        "ACTION_FULLSCREEN"                : "Plein écran",
         "ACTION_LOGOUT"                    : "@:APP.ACTION_LOGOUT",
         "ACTION_NAVIGATE_BACK"             : "@:APP.ACTION_NAVIGATE_BACK",
         "ACTION_NAVIGATE_HOME"             : "@:APP.ACTION_NAVIGATE_HOME",
@@ -71,20 +85,20 @@
         "ERROR_CLIENT_207"     : "Le server distant est inaccessible. Si le problème persiste, merci de notifier l'administrateur ou de regarder les journaux système.",
         "ERROR_CLIENT_208"     : "Le server distant est indisponible. Si le problème persiste, merci de notifier l'administrateur ou de regarder les journaux système.",
         "ERROR_CLIENT_209"     : "Le serveur distant a fermé la connexion car elle est en conflit avec une autre. Merci de réessayer plus tard.",
-        "ERROR_CLIENT_20A"     : "Le serveur distant a fermé la connexion car il semblait être inactive. Si cela est inattendu, merci de notifier l'administrateur ou verifier vos paramètres système.",
+        "ERROR_CLIENT_20A"     : "Le serveur distant a fermé la connexion car elle semblait être inactive. Si cela est inattendu, merci de notifier l'administrateur ou verifier vos paramètres système.",
         "ERROR_CLIENT_20B"     : "Le serveur distant a forcé la fermeture de la connexion. Si cela est inattendu, merci de notifier l'administrateur ou de regarder les journaux système.",
-        "ERROR_CLIENT_301"     : "Connexion echouée. Merci d'essayer encore.",
+        "ERROR_CLIENT_301"     : "Connexion echouée. Merci de réessayer.",
         "ERROR_CLIENT_303"     : "Vous ne disposez pas des permissions pour accéder à cette connexion. Si vous avez besoin de ces droits demandez à l'administrateur qu'il vous ajoute à la lise des utilisateurs autorisés, ou de vérifier les paramètres système.",
         "ERROR_CLIENT_308"     : "Le serveur Guacamole a fermé la connexion car il n'y avait pas de réponse de votre navigateur Internet et qu'il l'a considéré comme déconnecté. Cela se produit à cause de problèmes réseaux (mauvais signal Wi-Fi ou réseau très lent). Merci de vérifier votre réseau et de réessayer.",
-        "ERROR_CLIENT_31D"     : "Le serveur Guacamole interdit les connexions car vous avez dépassé la limite de connexion simultanée par utilisateur. Merci de fermer une ou plusieurs connexions et de reéssayer.",
+        "ERROR_CLIENT_31D"     : "Le serveur Guacamole interdit les connexions car vous avez dépassé la limite de connexion simultanée par utilisateur. Merci de fermer une ou plusieurs connexions et de réessayer.",
         "ERROR_CLIENT_DEFAULT" : "Une erreur interne est apparue dans le serveur Guacamole et la connexion a été fermée. Si le problème persiste, merci de notifier l'administrateur ou de regarder les journaux système.",
 
         "ERROR_TUNNEL_201"     : "Le serveur Guacamole a rejeté cette tentative de connexion car il y a trop de connexions ouvertes. Merci d'attendre quelques minutes et de réessayer.",
         "ERROR_TUNNEL_202"     : "La connexion a été fermée car le serveur met trop de temps à répondre. En général, il s'agit de problème réseau comme un réseau Wi-Fi trop lent ou un réseau très lent. Merci de vérifier votre réseau ou de contacter l'administrateur.",
         "ERROR_TUNNEL_203"     : "Le serveur a rencontré une erreur et a fermé la connexion. Merci de réessayer ou de contacter l'administrateur.",
         "ERROR_TUNNEL_204"     : "Le connexion demandée n'existe pas. Merci de vérifier le nom et de réessayer.",
-        "ERROR_TUNNEL_205"     : "Cette connexion est actuellement utilisée et les connexions multiples ne sont pas autorisées. Merci de réeassyer plus tard.",
-        "ERROR_TUNNEL_207"     : "Le serveur Guacamole n'est pas actuellement accessible. Veuillez vérifier votre réseau et réessayer..",
+        "ERROR_TUNNEL_205"     : "Cette connexion est actuellement utilisée et les connexions multiples ne sont pas autorisées. Merci de réessayer plus tard.",
+        "ERROR_TUNNEL_207"     : "Le serveur Guacamole n'est pas actuellement accessible. Veuillez vérifier votre réseau et réessayer.",
         "ERROR_TUNNEL_208"     : "Le serveur Guacamole n'accepte pas les connexions. Veuillez vérifier votre réseau et réessayer.",
         "ERROR_TUNNEL_301"     : "Vous n'avez pas le droit d'accéder à cette connexion car vous n'êtes pas connecté. Merci de vous connecter et de réessayer.",
         "ERROR_TUNNEL_303"     : "Vous n'avez pas le droit d'accéder à cette connexion. Si vous souhaitez y avoir accès, merci de demander à l'administrateur de vous ajouter dans la liste des utilisateurs autorisés ou de vérifier les paramètres système.",
@@ -99,7 +113,7 @@
         "ERROR_UPLOAD_204"     : "La destination du transfert de fichier n'existe pas. Merci de vérifier que la destination existe et de réessayer.",
         "ERROR_UPLOAD_205"     : "La destination du transfert de fichier est actuellement verrouillée. Merci de patienter la fin des tâches en cours et de réessayer.",
         "ERROR_UPLOAD_301"     : "Vous n'avez pas la permission d'envoyer ce fichier car vous n'êtes pas connecté. Merci de vous connecter et de réessayer.",
-        "ERROR_UPLOAD_303"     : "Vous n'avez pas la permission d'envoyer le fichier. Si vous avez besoin de cet accès, merci de vérifier vos paramètres system ou de valider avec votre administrateur.",
+        "ERROR_UPLOAD_303"     : "Vous n'avez pas la permission d'envoyer le fichier. Si vous avez besoin de cet accès, merci de vérifier vos paramètres système ou de valider avec votre administrateur.",
         "ERROR_UPLOAD_308"     : "Le transfert de fichier s'est bloqué. En général, il s'agit d'un problème réseau comme un signal Wi-Fi faible ou un réseau très lent. Merci de vérifier votre réseau et de réessayer.",
         "ERROR_UPLOAD_31D"     : "Trop de fichiers sont actuellement transférés. Merci d'attendre que les transferts en cours soient terminés et de réessayer plus tard.",
         "ERROR_UPLOAD_DEFAULT" : "Une erreur interne est apparue dans le serveur Guacamole et la connexion a été fermée. Si le problème persiste, merci de notifier l'administrateur ou de regarder les journaux système.",
@@ -109,14 +123,16 @@
         "HELP_CLIPBOARD"           : "Texte copié/coupé dans Guacamole apparaîtra ici. Changer le texte ci-dessous affectera le presse-papiers distant.",
         "HELP_INPUT_METHOD_NONE"   : "Aucune méthode de saisie utilisée. Clavier accepté depuis un clavier physique connecté.",
         "HELP_INPUT_METHOD_OSK"    : "Affiche et utilise la saisie du clavier virtuel intégré dans Guacamole. Le clavier virtuel permet d'utiliser des combinaisons de touches autrement impossibles (comme Ctrl-Alt-Supp).",
-        "HELP_INPUT_METHOD_TEXT"   : "Affiche et utilise la saisie du clavier virtuel intégré dans Guacamole. Ceci est nécessaire pou les périphériques mobiles ne disposant pas de clavier physique.",
+        "HELP_INPUT_METHOD_TEXT"   : "Affiche et utilise la saisie du clavier virtuel intégré dans Guacamole. Ceci est nécessaire pour les périphériques mobiles ne disposant pas de clavier physique.",
         "HELP_MOUSE_MODE"          : "Détermine comment la souris distante se comporte selon les événements.",
-        "HELP_MOUSE_MODE_ABSOLUTE" : "Appuyer pour cliquer. Le clique s'effectue à l'endroit de l'appui.",
-        "HELP_MOUSE_MODE_RELATIVE" : "Glisser pour déplacer le pointeur de la souris et appuyer opur cliquer. Le clique s'effectue à l'endroit du pointeur.",
-        "HELP_SHARE_LINK"          : "La connexion actuelle est en cours de partage et est accessible à toute personne possédant les caractéristiques suivantes: {LINKS, plusieurs, un{link} autres{links}}:",
+        "HELP_MOUSE_MODE_ABSOLUTE" : "Appuyer pour cliquer. Le clic s'effectue à l'endroit de l'appui.",
+        "HELP_MOUSE_MODE_RELATIVE" : "Glisser pour déplacer le pointeur de la souris et appuyer pour cliquer. Le clic s'effectue à l'endroit du pointeur.",
+        "HELP_SHARE_LINK"          : "La connexion actuelle est en cours de partage et est accessible à toute personne possédant {LINKS, plural, one{le lien suivant} other{les liens suivants}}:",
 
-        "INFO_CONNECTION_SHARED" : "Cette connexion est partagée maintenant.",
-        "INFO_NO_FILE_TRANSFERS" : "Pas de transfert de fichier.",
+        "INFO_ANONYMOUS_USER_COUNT" : "Anonyme{COUNT, plural, one{} other{s (#)}}",
+        "INFO_CONNECTION_SHARED"    : "Cette connexion est partagée maintenant.",
+        "INFO_NO_FILE_TRANSFERS"    : "Pas de transfert de fichier.",
+        "INFO_USER_COUNT"           : "{USERNAME}{COUNT, plural, one{} other{ (#)}}",
 
         "NAME_INPUT_METHOD_NONE"   : "Aucune",
         "NAME_INPUT_METHOD_OSK"    : "Clavier virtuel",
@@ -128,21 +144,28 @@
         "NAME_MOUSE_MODE_ABSOLUTE" : "Écran tactile",
         "NAME_MOUSE_MODE_RELATIVE" : "Pavé tactile",
 
-        "SECTION_HEADER_CLIPBOARD"      : "Presse-papiers",
-        "SECTION_HEADER_DEVICES"        : "Appareils",
-        "SECTION_HEADER_DISPLAY"        : "Affichage",
-        "SECTION_HEADER_FILE_TRANSFERS" : "Transferts de fichiers",
-        "SECTION_HEADER_INPUT_METHOD"   : "Méthode de saisie",
-        "SECTION_HEADER_MOUSE_MODE"     : "Mode émulation souris",
+        "SECTION_HEADER_CLIENT_MESSAGES" : "Messages",
+        "SECTION_HEADER_CLIPBOARD"       : "Presse-papiers",
+        "SECTION_HEADER_DEVICES"         : "Appareils",
+        "SECTION_HEADER_DISPLAY"         : "Affichage",
+        "SECTION_HEADER_FILE_TRANSFERS"  : "Transferts de fichiers",
+        "SECTION_HEADER_INPUT_METHOD"    : "Méthode de saisie",
 
+        "SECTION_HEADER_MOUSE_MODE"     : "Mode d'émulation de la souris",
+
+        "TEXT_ANONYMOUS_USER_JOINED"      : "Un utilisateur anonyme a rejoint la connexion.",
+        "TEXT_ANONYMOUS_USER_LEFT"        : "Un utilisateur anonyme a quitté la connexion.",
         "TEXT_ZOOM_AUTO_FIT"              : "Adapté à la fenêtre du navigateur",
         "TEXT_CLIENT_STATUS_IDLE"         : "Inactif.",
         "TEXT_CLIENT_STATUS_CONNECTING"   : "Connexion à Guacamole...",
         "TEXT_CLIENT_STATUS_DISCONNECTED" : "Vous avez été deconnecté.",
         "TEXT_CLIENT_STATUS_UNSTABLE"     : "La connexion réseau au serveur Guacamole est instable.",
         "TEXT_CLIENT_STATUS_WAITING"      : "Connecté à Guacamole. En attente de réponse...",
+        "TEXT_USER_JOINED"                : "{USERNAME} a rejoint la connexion.",
+        "TEXT_USER_LEFT"                  : "{USERNAME} a quitté la connexion.",
         "TEXT_RECONNECT_COUNTDOWN"        : "Reconnexion dans {REMAINING} {REMAINING, plural, one{seconde} other{secondes}}...",
         "TEXT_FILE_TRANSFER_PROGRESS"     : "{PROGRESS} {UNIT, select, b{B} kb{KB} mb{MB} gb{GB} other{}}",
+        "TEXT_CLIPBOARD_AWAITING_FOCUS"   : "Cliquez pour afficher le contenu du presse-papiers...",
 
         "URL_OSK_LAYOUT" : "layouts/fr-fr-azerty.json"
 
@@ -164,6 +187,80 @@
 
     },
 
+    "IMPORT": {
+
+        "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
+        "ACTION_BROWSE"             : "Parcourir les fichiers",
+        "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
+        "ACTION_CLEAR"              : "@:APP.ACTION_CLEAR",
+        "ACTION_VIEW_FORMAT_HELP"   : "Voir les conseils de format",
+        "ACTION_IMPORT"             : "@:APP.ACTION_IMPORT",
+        "ACTION_IMPORT_CONNECTIONS" : "Importer les connexions",
+    
+        "DIALOG_HEADER_ERROR"   : "@:APP.DIALOG_HEADER_ERROR",
+        "DIALOG_HEADER_SUCCESS" : "Succès",
+    
+        "ERROR_AMBIGUOUS_CSV_HEADER"         : "L'en-tête CSV ambigu \"{HEADER}\" peut être soit un attribut de connexion, soit un paramètre",
+        "ERROR_AMBIGUOUS_PARENT_GROUP"       : "Le groupe et le parentIdentifier peuvent ne pas être spécifiés en même temps",
+        "ERROR_ARRAY_REQUIRED"               : "Le fichier fourni doit contenir une liste de connexions",
+        "ERROR_DETECTED_INVALID_TYPE"        : "Type de fichier non pris en charge. Assurez-vous que le fichier est un CSV, JSON ou YAML valide.",
+        "ERROR_DUPLICATE_CONNECTION_IN_FILE" : "Connexion en double \"{NAME}\" à \"{PATH}\" dans le fichier d'importation",
+        "ERROR_DUPLICATE_CSV_HEADER"         : "En-tête CSV en double : {HEADER}",
+        "ERROR_EMPTY_FILE"                   : "Le fichier fourni est vide",
+        "ERROR_INVALID_CSV_HEADER"           : "En-tête CSV invalide \"{HEADER}\", ni un attribut ni un paramètre de connexion",
+        "ERROR_INVALID_MIME_TYPE"            : "Type de fichier non pris en charge : \"{TYPE}\"",
+        "ERROR_INVALID_GROUP"                : "Aucun groupe correspondant à \"{GROUP}\" trouvé",
+        "ERROR_INVALID_GROUP_IDENTIFIER"     : "Aucun groupe de connexion avec l'identifiant \"{IDENTIFIER}\" trouvé",
+        "ERROR_INVALID_GROUP_TYPE"           : "Groupe invalide - doit être une chaîne de caractères.",
+        "ERROR_INVALID_PROTOCOL"             : "Protocole invalide \"{PROTOCOL}\"",
+        "ERROR_INVALID_USER_GROUPS_TYPE"     : "Groupes d'utilisateurs invalides - doit être un tableau d'identifiants de groupe d'utilisateurs.",
+        "ERROR_INVALID_USERS_TYPE"           : "Utilisateurs invalides - doit être un tableau d'identifiants d'utilisateurs.",
+        "ERROR_NO_FILE_SUPPLIED"             : "Veuillez sélectionner un fichier à importer",
+        "ERROR_PARSE_FAILURE_CSV"            : "Assurez-vous que votre fichier CSV est valide. L'analyse a échoué avec l'erreur \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_JSON"           : "Assurez-vous que votre fichier JSON est valide. L'analyse a échoué avec l'erreur \"{ERROR}\". ",
+        "ERROR_PARSE_FAILURE_YAML"           : "Assurez-vous que votre fichier YAML est valide. L'analyse a échoué avec l'erreur \"{ERROR}\". ",
+        "ERROR_REJECT_UPDATE_CONNECTION"     : "La connexion \"{NAME}\" existe déjà à \"{PATH}\"",
+        "ERROR_REQUIRED_NAME_CONNECTION"     : "Le nom de la connexion est requis",
+        "ERROR_REQUIRED_PROTOCOL_CONNECTION" : "Le protocole de connexion est requis",
+        "ERROR_REQUIRED_NAME_FILE"           : "Aucun nom de connexion trouvé dans le fichier fourni",
+        "ERROR_REQUIRED_PROTOCOL_FILE"       : "Aucun protocole de connexion trouvé dans le fichier fourni",
+    
+        "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
+    
+        "FIELD_HEADER_EXISTING_CONNECTION_MODE" : "Remplacer/Mettre à jour les connexions existantes",
+        "FIELD_HEADER_EXISTING_PERMISSION_MODE" : "Réinitialiser les permissions",
+    
+        "HELP_CSV_DESCRIPTION"              : "Un fichier CSV d'importation de connexion a un enregistrement de connexion par ligne. Chaque colonne spécifie un champ de connexion. Au minimum, le nom de la connexion et le protocole doivent être spécifiés.",
+        "HELP_CSV_EXAMPLE"                  : "name,protocol,username,password,hostname,group,users,groups,guacd-encryption (attribute)\nconn1,vnc,alice,pass1,conn1.web.com,ROOT,guac user 1;guac user 2,Connection 1 Users,none\nconn2,rdp,bob,pass2,conn2.web.com,ROOT/Parent Group,guac user 1,,ssl\nconn3,ssh,carol,pass3,conn3.web.com,ROOT/Parent Group/Child Group,guac user 2;guac user 3,,\nconn4,kubernetes,,,,,,,",
+        "HELP_CSV_MORE_DETAILS"             : "L'en-tête CSV de chaque ligne spécifie le champ de connexion. L'identifiant de groupe de connexion dans lequel la connexion doit être importée peut être directement spécifié avec \"parentIdentifier\", ou le chemin vers le groupe parent peut être spécifié en utilisant \"group\" comme indiqué ci-dessous. Dans la plupart des cas, il ne devrait pas y avoir de conflit entre les champs, mais si nécessaire, un suffixe \" (attribute)\" ou \" (parameter)\" peut être ajouté pour dissocier. Les listes d'identifiants d'utilisateur ou de groupe d'utilisateurs doivent être séparées par des points-virgules.¹",
+        "HELP_FILE_TYPE_DESCRIPTION"        : "Trois types de fichiers sont pris en charge pour l'importation de connexions : CSV, JSON et YAML. Les mêmes données peuvent être spécifiées par chaque type de fichier. Cela doit inclure le nom de la connexion et le protocole. Facultativement, un emplacement de groupe de connexion, une liste d'utilisateurs et/ou de groupes d'utilisateurs auxquels accorder l'accès, des paramètres de connexion ou des protocoles de connexion peuvent également être spécifiés. Tous les utilisateurs ou groupes d'utilisateurs qui n'existent pas dans la source de données actuelle seront automatiquement créés. Notez que toutes les permissions de connexion existantes ne seront pas supprimées pour les connexions mises à jour, sauf si \"Réinitialiser les permissions\" est coché.",
+        "HELP_FILE_TYPE_HEADER"             : "Types de fichiers",
+        "HELP_JSON_DESCRIPTION"             : "Un fichier JSON d'importation de connexion est une liste d'objets de connexion. Au minimum, le nom de la connexion et le protocole doivent être spécifiés dans chaque objet de connexion.",
+        "HELP_JSON_EXAMPLE"                 : "[\n  \\{\n    \"name\": \"conn1\",\n    \"protocol\": \"vnc\",\n    \"parameters\": \\{ \"username\": \"alice\", \"password\": \"pass1\", \"hostname\": \"conn1.web.com\" \\},\n    \"parentIdentifier\": \"ROOT\",\n    \"users\": [ \"guac user 1\", \"guac user 2\" ],\n    \"groups\": [ \"Connection 1 Users\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn2\",\n    \"protocol\": \"rdp\",\n    \"parameters\": \\{ \"username\": \"bob\", \"password\": \"pass2\", \"hostname\": \"conn2.web.com\" \\},\n    \"group\": \"ROOT/Parent Group\",\n    \"users\": [ \"guac user 1\" ],\n    \"attributes\": \\{ \"guacd-encryption\": \"none\" \\}\n  \\},\n  \\{\n    \"name\": \"conn3\",\n    \"protocol\": \"ssh\",\n    \"parameters\": \\{ \"username\": \"carol\", \"password\": \"pass3\", \"hostname\": \"conn3.web.com\" \\},\n    \"group\": \"ROOT/Parent Group/Child Group\",\n    \"users\": [ \"guac user 2\", \"guac user 3\" ]\n  \\},\n  \\{\n    \"name\": \"conn4\",\n    \"protocol\": \"kubernetes\"\n  \\}\n]",
+        "HELP_JSON_MORE_DETAILS"            : "L'identifiant de groupe de connexion dans lequel la connexion doit être importée peut être directement spécifié avec un champ \"parentIdentifier\", ou le chemin vers le groupe parent peut être spécifié en utilisant un champ \"group\" comme indiqué ci-dessous. Un tableau d'identifiants d'utilisateurs et de groupes d'utilisateurs auxquels accorder l'accès peut être spécifié par connexion.",
+        "HELP_EXISTING_CONNECTION_MODE"     : "Remplacer/Mettre à jour entièrement les connexions existantes si leurs noms et groupes de connexion parent correspondent aux valeurs dans le fichier fourni. Si non coché, tenter d'importer une connexion avec le même nom et le même groupe de connexion parent d'une connexion existante sera considéré comme une erreur.",
+        "HELP_EXISTING_PERMISSION_MODE"     : "Réinitialiser entièrement les permissions accordées pour toutes les connexions dans le fichier fourni aux permissions spécifiées dans ce fichier. Si aucune permission n'est spécifiée, toutes les permissions de connexion pertinentes seront révoquées. Si non coché, les permissions existantes sont préservées, et toutes les permissions spécifiées dans le fichier seront ajoutées.",
+        "HELP_SEMICOLON_FOOTNOTE"           : "Si présent, les points-virgules peuvent être échappés avec un backslash, par exemple \"first\\\\;last\"",
+        "HELP_UPLOAD_DROP_TITLE"            : "Déposez un fichier ici",
+        "HELP_UPLOAD_FILE_TYPES"            : "CSV, JSON ou YAML",
+        "HELP_YAML_DESCRIPTION"             : "Un fichier YAML d'importation de connexion est une liste d'objets de connexion avec exactement la même structure que le format JSON.",
+        "HELP_YAML_EXAMPLE"                 : "---\n  - name: conn1\n    protocol: vnc\n    parameters:\n      username: alice\n      password: pass1\n      hostname: conn1.web.com\n    group: ROOT\n    users:\n      - guac user 1\n      - guac user 2\n    groups:\n    - Connection 1 Users\n    attributes:\n      guacd-encryption: none\n  - name: conn2\n    protocol: rdp\n    parameters:\n      username: bob\n      password: pass2\n      hostname: conn2.web.com\n    group: ROOT/Parent Group\n    users:\n      - guac user 1\n    attributes:\n      guacd-encryption: none\n  - name: conn3\n    protocol: ssh\n    parameters:\n      username: carol\n      password: pass3\n      hostname: conn3.web.com\n    group: ROOT/Parent Group/Child Group\n    users:\n      - guac user 2\n      - guac user 3\n  - name: conn4\n    protocol: kubernetes",
+    
+        "INFO_CONNECTIONS_IMPORTED_SUCCESS" : "{NUMBER} {NUMBER, plural, one{connexion} other{connexions}} importée(s) avec succès.",
+        
+        "SECTION_HEADER_CONNECTION_IMPORT"           : "Importation de connexion",
+        "SECTION_HEADER_HELP_CONNECTION_IMPORT_FILE" : "Format de fichier d'importation de connexion",
+        "SECTION_HEADER_CSV"                         : "Format CSV",
+        "SECTION_HEADER_JSON"                        : "Format JSON",
+        "SECTION_HEADER_YAML"                        : "Format YAML",
+    
+        "TABLE_HEADER_ERRORS"     : "Erreurs",
+        "TABLE_HEADER_GROUP"      : "Groupe",
+        "TABLE_HEADER_NAME"       : "Nom",
+        "TABLE_HEADER_PROTOCOL"   : "Protocole",
+        "TABLE_HEADER_ROW_NUMBER" : "Ligne #"
+    },
+    
     "DATA_SOURCE_DEFAULT" : {
         "NAME" : "Standard (XML)"
     },
@@ -240,9 +337,9 @@
         "SECTION_HEADER_PARAMETERS"      : "Paramètres",
 
         "TABLE_HEADER_HISTORY_USERNAME"   : "Identifiant",
-        "TABLE_HEADER_HISTORY_START"      : "Ouverture",
+        "TABLE_HEADER_HISTORY_START"      : "Heure de début",
         "TABLE_HEADER_HISTORY_DURATION"   : "Durée",
-        "TABLE_HEADER_HISTORY_REMOTEHOST" : "Ordinateur distant",
+        "TABLE_HEADER_HISTORY_REMOTEHOST" : "Hôte distant",
 
         "TEXT_CONFIRM_DELETE"   : "Les connexions ne pourront être restaurées une fois supprimées. Êtes-vous certains de vouloir supprimer cette connexion ?",
         "TEXT_HISTORY_DURATION" : "@:APP.TEXT_HISTORY_DURATION"
@@ -303,7 +400,7 @@
         "ACTION_SAVE"          : "@:APP.ACTION_SAVE",
 
         "DIALOG_HEADER_CONFIRM_DELETE"  : "Supprimer Utilisateur",
-        "DIALOG_HEADER_ERROR"           : "Erreur",
+        "DIALOG_HEADER_ERROR"           : "@:APP.DIALOG_HEADER_ERROR",
 
         "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
 
@@ -375,10 +472,28 @@
         "SECTION_HEADER_PERMISSIONS"         : "@:MANAGE_USER.SECTION_HEADER_PERMISSIONS",
         "SECTION_HEADER_USER_GROUPS"         : "Groupes Parent",
 
-        "TEXT_CONFIRM_DELETE" : "Les groupes ne peuvent pas être restaurés après leur suppression. Êtes-vous certains de vouloir supprimer ce groupe?"
+        "TEXT_CONFIRM_DELETE" : "Les groupes ne peuvent pas être restaurés après leur suppression. Êtes-vous certains de vouloir supprimer ce groupe ?"
 
     },
 
+    "PLAYER" : {
+
+        "ACTION_CANCEL"       : "@:APP.ACTION_CANCEL",
+        "ACTION_PAUSE"        : "@:APP.ACTION_PAUSE",
+        "ACTION_PLAY"         : "@:APP.ACTION_PLAY",
+        "ACTION_SHOW_KEY_LOG" : "Journal des frappes",
+    
+        "INFO_FRAME_EVENTS_LEGEND" : "Activité à l'écran",
+        "INFO_KEY_EVENTS_LEGEND"   : "Activité du clavier",
+        "INFO_LOADING_RECORDING"   : "Votre enregistrement est en cours de chargement. Veuillez patienter...",
+        "INFO_NO_KEY_LOG"          : "Journal des frappes non disponible",
+        "INFO_NUMBER_OF_RESULTS"   : "{RESULTS} {RESULTS, plural, one{Résultat} other{Résultats}}",
+        "INFO_SEEK_IN_PROGRESS"    : "Recherche de la position demandée. Veuillez patienter...",
+    
+        "FIELD_PLACEHOLDER_TEXT_BATCH_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER"
+    
+    },    
+
     "PROTOCOL_KUBERNETES" : {
 
         "FIELD_HEADER_BACKSPACE"       : "Touche Retour Arrière envoyée:",
@@ -389,6 +504,7 @@
         "FIELD_HEADER_CONTAINER"       : "Nom du conteneur:",
         "FIELD_HEADER_CREATE_RECORDING_PATH"  : "Créer automatiquement le chemin d'enregistrement:",
         "FIELD_HEADER_CREATE_TYPESCRIPT_PATH" : "Créer automatiquement le chemin typescript:",
+        "FIELD_HEADER_EXEC_COMMAND"    : "Commande (exec):",
         "FIELD_HEADER_FONT_NAME"       : "Nom police:",
         "FIELD_HEADER_FONT_SIZE"       : "Taille police:",
         "FIELD_HEADER_HOSTNAME"        : "Nom d'hôte:",
@@ -397,6 +513,7 @@
         "FIELD_HEADER_POD"             : "Nom du pod:",
         "FIELD_HEADER_PORT"            : "Port:",
         "FIELD_HEADER_READ_ONLY"       : "Lecture seule:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "@:APP.FIELD_HEADER_RECORDING_WRITE_EXISTING",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Exclure la souris:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Exclure les graphiques/flux:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Inclure les évenements clavier:",
@@ -405,6 +522,7 @@
         "FIELD_HEADER_SCROLLBACK"      : "Taille maximum du défilement arrière:",
         "FIELD_HEADER_TYPESCRIPT_NAME" : "Nom Typescript:",
         "FIELD_HEADER_TYPESCRIPT_PATH" : "Chemin Typescript:",
+        "FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING" : "@:APP.FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING",
         "FIELD_HEADER_USE_SSL"         : "Utiliser SSL/TLS",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
@@ -447,6 +565,8 @@
 
     "PROTOCOL_RDP" : {
 
+        "FIELD_HEADER_CERT_TOFU"             : "Faire confiance au certificat de l'hôte lors de la première utilisation:",
+        "FIELD_HEADER_CERT_FINGERPRINTS"     : "Empreintes des certificats d'hôte de confiance:",
         "FIELD_HEADER_CLIENT_NAME"     : "Nom du Client:",
         "FIELD_HEADER_COLOR_DEPTH"     : "Qualité couleur:",
         "FIELD_HEADER_CONSOLE"         : "Console Administrateur:",
@@ -472,10 +592,13 @@
         "FIELD_HEADER_DISABLE_BITMAP_CACHING"     : "Désactiver le cache bitmap:",
         "FIELD_HEADER_DISABLE_OFFSCREEN_CACHING"  : "Désactiver le cache hors écran :",
         "FIELD_HEADER_DISABLE_GLYPH_CACHING"      : "Désactiver le cache glyph:",
+        "FIELD_HEADER_DISABLE_GFX"                : "Désactiver l'extension du pipeline graphique:",
         "FIELD_HEADER_ENABLE_PRINTING" : "Activer imprimante:",
         "FIELD_HEADER_ENABLE_SFTP"     : "Activer SFTP:",
         "FIELD_HEADER_ENABLE_THEMING"  : "Activer thématisation:",
+        "FIELD_HEADER_ENABLE_TOUCH"    : "Activer le multitouch:",
         "FIELD_HEADER_ENABLE_WALLPAPER" : "Activer fond d'écran:",
+        "FIELD_HEADER_FORCE_LOSSLESS"   : "Forcer la compression sans perte:",
         "FIELD_HEADER_GATEWAY_DOMAIN"   : "Nom de domaine:",
         "FIELD_HEADER_GATEWAY_HOSTNAME" : "Nom d'hôte:",
         "FIELD_HEADER_GATEWAY_PASSWORD" : "Mot de passe:",
@@ -486,14 +609,17 @@
         "FIELD_HEADER_IGNORE_CERT"     : "Ignorer le certificat du serveur:",
         "FIELD_HEADER_INITIAL_PROGRAM" : "Programme de démarrage:",
         "FIELD_HEADER_LOAD_BALANCE_INFO" : "Equilibrage de charge info/cookie:",
+        "FIELD_HEADER_NORMALIZE_CLIPBOARD" : "Caractères de fin de ligne:",
         "FIELD_HEADER_PASSWORD"        : "Mot de passe:",
         "FIELD_HEADER_PORT"            : "Port:",
         "FIELD_HEADER_PRINTER_NAME"    : "Nom de l'imprimante redirigée:",
         "FIELD_HEADER_PRECONNECTION_BLOB" : "Préconnexion BLOB (VM ID):",
         "FIELD_HEADER_PRECONNECTION_ID"   : "Source RDP ID:",
         "FIELD_HEADER_READ_ONLY"       : "Lecture seule:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "@:APP.FIELD_HEADER_RECORDING_WRITE_EXISTING",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Exclure la souris:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Exclure les graphiques/flux:",
+        "FIELD_HEADER_RECORDING_EXCLUDE_TOUCH"  : "Exclure les événements tactiles:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Inclure les événements clavier:",
         "FIELD_HEADER_RECORDING_NAME" : "Nom de l'enregistrement:",
         "FIELD_HEADER_RECORDING_PATH" : "Chemin de l'enregistrement:",
@@ -517,12 +643,18 @@
         "FIELD_HEADER_SFTP_USERNAME"    : "Identifiant:",
         "FIELD_HEADER_STATIC_CHANNELS"  : "Noms des canaux statiques:",
         "FIELD_HEADER_TIMEZONE"         : "Fuseau horaire:",
-        "FIELD_HEADER_USERNAME"        : "Identifiant:",
-        "FIELD_HEADER_WIDTH"           : "Largeur:",
-      "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Adresse de diffusion pour les paquets WoL:",
-      "FIELD_HEADER_WOL_MAC_ADDR"       : "Adresse MAC de l'hôte distant:",
-      "FIELD_HEADER_WOL_SEND_PACKET"    : "Envoi de paquets WoL:",
-      "FIELD_HEADER_WOL_WAIT_TIME"      : "Temps d'attente du démarage de l'hôte:",
+        "FIELD_HEADER_USERNAME"         : "Identifiant:",
+        "FIELD_HEADER_WIDTH"            : "Largeur:",
+        "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Adresse de diffusion pour les paquets WoL:",
+        "FIELD_HEADER_WOL_MAC_ADDR"       : "Adresse MAC de l'hôte distant:",
+        "FIELD_HEADER_WOL_SEND_PACKET"    : "Envoi de paquets WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "Port UDP pour le paquet WoL:",
+        "FIELD_HEADER_WOL_WAIT_TIME"      : "Temps d'attente du démarage de l'hôte:",
+
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_EMPTY"    : "",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_PRESERVE" : "Préserver tel quel",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_UNIX"     : "Linux/Mac/Unix (LF)",
+        "FIELD_OPTION_NORMALIZE_CLIPBOARD_WINDOWS"  : "Windows (CRLF)",
 
         "FIELD_OPTION_COLOR_DEPTH_16"    : "Faibles couleurs (16-bit)",
         "FIELD_OPTION_COLOR_DEPTH_24"    : "Vraies couleurs (24-bit)",
@@ -557,6 +689,7 @@
         "FIELD_OPTION_SERVER_LAYOUT_HU_HU_QWERTZ" : "Hongrois (Qwertz)",
         "FIELD_OPTION_SERVER_LAYOUT_IT_IT_QWERTY" : "Italien (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_JA_JP_QWERTY" : "Japonais (Qwerty)",
+        "FIELD_OPTION_SERVER_LAYOUT_NO_NO_QWERTY" : "Norvégien (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PL_PL_QWERTY" : "Polonais (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_BR_QWERTY" : "Portugais Brésilien (Qwerty)",
         "FIELD_OPTION_SERVER_LAYOUT_PT_PT_QWERTY" : "Portugais (Qwerty)",
@@ -605,6 +738,7 @@
         "FIELD_HEADER_PRIVATE_KEY" : "Clé privée:",
         "FIELD_HEADER_SCROLLBACK"  : "Taille maximum du défilement arrière:",
         "FIELD_HEADER_READ_ONLY"   : "Lecture seule:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "@:APP.FIELD_HEADER_RECORDING_WRITE_EXISTING",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Exclure la souris:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Exclure les graphiques/flux:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Inclure les événements clavier:",
@@ -618,9 +752,11 @@
         "FIELD_HEADER_TIMEZONE"        : "Fuseau horaire ($TZ):",
         "FIELD_HEADER_TYPESCRIPT_NAME" : "Nom Typescript :",
         "FIELD_HEADER_TYPESCRIPT_PATH" : "Chemin Typescript :",
+        "FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING" : "@:APP.FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING",
         "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Adresse de diffusion pour les paquets WoL:",
         "FIELD_HEADER_WOL_MAC_ADDR"       : "Adresse MAC de l'hôte distant:",
         "FIELD_HEADER_WOL_SEND_PACKET"    : "Envoi de paquets WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "Port UDP pour le paquet WoL:",
         "FIELD_HEADER_WOL_WAIT_TIME"      : "Temps d'attente du démarage de l'hôte:",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
@@ -691,6 +827,7 @@
         "FIELD_HEADER_PASSWORD_REGEX" : "Expression régulière Mot de passe:",
         "FIELD_HEADER_PORT"           : "Port:",
         "FIELD_HEADER_READ_ONLY"      : "Lecture seule:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "@:APP.FIELD_HEADER_RECORDING_WRITE_EXISTING",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Exclure la souris:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Exclure les graphiques/flux:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Inclure les événements clavier:",
@@ -700,9 +837,11 @@
         "FIELD_HEADER_TERMINAL_TYPE"   : "Type de terminal:",
         "FIELD_HEADER_TYPESCRIPT_NAME" : "Nom Typescript:",
         "FIELD_HEADER_TYPESCRIPT_PATH" : "Chemin Typescript:",
+        "FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING" : "@:APP.FIELD_HEADER_TYPESCRIPT_WRITE_EXISTING",
         "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Adresse de diffusion pour les paquets WoL:",
         "FIELD_HEADER_WOL_MAC_ADDR"       : "Adresse MAC de l'hôte distant:",
         "FIELD_HEADER_WOL_SEND_PACKET"    : "Envoi de paquets WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "Port UDP pour le paquet WoL:",
         "FIELD_HEADER_WOL_WAIT_TIME"      : "Temps d'attente du démarage de l'hôte:",
 
         "FIELD_OPTION_BACKSPACE_EMPTY" : "",
@@ -757,6 +896,7 @@
         "FIELD_HEADER_AUDIO_SERVERNAME" : "Serveur de son:",
         "FIELD_HEADER_CLIPBOARD_ENCODING" : "Encodage:",
         "FIELD_HEADER_COLOR_DEPTH"      : "Qualité couleur:",
+        "FIELD_HEADER_COMPRESS_LEVEL"   : "Niveau de compression:",
         "FIELD_HEADER_CREATE_RECORDING_PATH" : "Créer automatiquement un chemin d'enregistrement:",
         "FIELD_HEADER_CURSOR"           : "Curseur:",
         "FIELD_HEADER_DEST_HOST"        : "Hôte distant:",
@@ -765,11 +905,14 @@
         "FIELD_HEADER_DISABLE_PASTE"    : "Désactiver coller à partir du client:",
         "FIELD_HEADER_ENABLE_AUDIO"     : "Activer son:",
         "FIELD_HEADER_ENABLE_SFTP"      : "Activer SFTP:",
+        "FIELD_HEADER_FORCE_LOSSLESS"   : "Forcer la compression sans perte:",
         "FIELD_HEADER_HOSTNAME"         : "Nom d'hôte:",
         "FIELD_HEADER_USERNAME"         : "Identifiant:",
         "FIELD_HEADER_PASSWORD"         : "Mot de passe:",
         "FIELD_HEADER_PORT"             : "Port:",
+        "FIELD_HEADER_QUALITY_LEVEL"    : "Qualité d'affichage:",
         "FIELD_HEADER_READ_ONLY"        : "Lecture seule:",
+        "FIELD_HEADER_RECORDING_WRITE_EXISTING" : "@:APP.FIELD_HEADER_RECORDING_WRITE_EXISTING",
         "FIELD_HEADER_RECORDING_EXCLUDE_MOUSE"  : "Exclure la souris:",
         "FIELD_HEADER_RECORDING_EXCLUDE_OUTPUT" : "Exclure les graphiques/flux:",
         "FIELD_HEADER_RECORDING_INCLUDE_KEYS"   : "Inclure les événements clavier:",
@@ -791,6 +934,7 @@
         "FIELD_HEADER_WOL_BROADCAST_ADDR" : "Adresse de diffusion pour les paquets WoL:",
         "FIELD_HEADER_WOL_MAC_ADDR"       : "Adresse MAC de l'hôte distant:",
         "FIELD_HEADER_WOL_SEND_PACKET"    : "Envoi de paquets WoL:",
+        "FIELD_HEADER_WOL_UDP_PORT"       : "Port UDP pour le paquet WoL:",
         "FIELD_HEADER_WOL_WAIT_TIME"      : "Temps d'attente du démarage de l'hôte:",
 
         "FIELD_OPTION_COLOR_DEPTH_8"     : "256 couleurs",
@@ -833,6 +977,7 @@
 
         "ACTION_DOWNLOAD" : "@:APP.ACTION_DOWNLOAD",
         "ACTION_SEARCH" : "@:APP.ACTION_SEARCH",
+        "ACTION_VIEW_RECORDING" : "@:APP.ACTION_VIEW_RECORDING",
 
         "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
@@ -840,15 +985,16 @@
 
         "FORMAT_DATE" : "@:APP.FORMAT_DATE_TIME_PRECISE",
 
-        "HELP_CONNECTION_HISTORY" : "L'historique des dernières connexions est listé ici et peut être trié en cliquant sur l'en-tête des colonnes. Pour rechercher des enregistrements spécifiques, entrez un filtre et cliquez sur \"Rechercher\". Seuls les enregistrements correspondants au filtre renseigné seront listés.",
+        "HELP_CONNECTION_HISTORY" : "L'historique des dernières connexions est répertorié ici et peut être trié en cliquant sur l'en-tête des colonnes. Pour rechercher des enregistrements spécifiques, entrez un filtre et cliquez sur \"Rechercher\". Seuls les enregistrements correspondant au filtre renseigné seront listés.",
 
         "INFO_CONNECTION_DURATION_UNKNOWN" : "--",
         "INFO_NO_HISTORY"                  : "Aucun enregistrement correspondant",
 
         "TABLE_HEADER_SESSION_CONNECTION_NAME" : "Nom de connexion",
         "TABLE_HEADER_SESSION_DURATION"        : "Durée",
+        "TABLE_HEADER_SESSION_LOGS"            : "Journaux",
         "TABLE_HEADER_SESSION_REMOTEHOST"      : "Hôte distant",
-        "TABLE_HEADER_SESSION_STARTDATE"       : "Ouvert depuis",
+        "TABLE_HEADER_SESSION_STARTDATE"       : "Heure de début",
         "TABLE_HEADER_SESSION_USERNAME"        : "Identifiant",
 
         "TEXT_HISTORY_DURATION" : "@:APP.TEXT_HISTORY_DURATION"
@@ -858,11 +1004,12 @@
     "SETTINGS_CONNECTIONS" : {
 
       "ACTION_ACKNOWLEDGE"          : "@:APP.ACTION_ACKNOWLEDGE",
+      "ACTION_IMPORT"               : "@:APP.ACTION_IMPORT",
       "ACTION_NEW_CONNECTION"       : "Nouvelle Connexion",
       "ACTION_NEW_CONNECTION_GROUP" : "Nouveau Groupe",
       "ACTION_NEW_SHARING_PROFILE"  : "Nouveau Profil de Partage",
 
-      "DIALOG_HEADER_ERROR"          : "Erreur",
+      "DIALOG_HEADER_ERROR" : "@:APP.DIALOG_HEADER_ERROR",
 
       "FIELD_PLACEHOLDER_FILTER" : "@:APP.FIELD_PLACEHOLDER_FILTER",
 
@@ -878,6 +1025,7 @@
 
         "ACTION_ACKNOWLEDGE"        : "@:APP.ACTION_ACKNOWLEDGE",
         "ACTION_CANCEL"             : "@:APP.ACTION_CANCEL",
+        "ACTION_SAVE"               : "@:APP.ACTION_SAVE",
         "ACTION_UPDATE_PASSWORD"    : "@:APP.ACTION_UPDATE_PASSWORD",
 
         "DIALOG_HEADER_ERROR"    : "@:APP.DIALOG_HEADER_ERROR",
@@ -885,32 +1033,37 @@
         "ERROR_PASSWORD_BLANK"    : "Votre mot de passe ne peut être vide.",
         "ERROR_PASSWORD_MISMATCH" : "@:APP.ERROR_PASSWORD_MISMATCH",
 
-        "FIELD_HEADER_LANGUAGE"           : "Langue affichée:",
-        "FIELD_HEADER_PASSWORD"           : "Mot de passe:",
-        "FIELD_HEADER_PASSWORD_OLD"       : "Mot de passe actuel:",
-        "FIELD_HEADER_PASSWORD_NEW"       : "Nouveau mot de passe:",
-        "FIELD_HEADER_PASSWORD_NEW_AGAIN" : "Confirmer nouveau mot de passe:",
-        "FIELD_HEADER_USERNAME"           : "Identifiant:",
-        "FIELD_HEADER_TIMEZONE"           : "Fuseau horaire:",
+        "FIELD_HEADER_LANGUAGE"                  : "Langue affichée:",
+        "FIELD_HEADER_NUMBER_RECENT_CONNECTIONS" : "Nombre de connexions récentes à afficher:",
+        "FIELD_HEADER_PASSWORD"                  : "Mot de passe:",
+        "FIELD_HEADER_PASSWORD_OLD"              : "Mot de passe actuel:",
+        "FIELD_HEADER_PASSWORD_NEW"              : "Nouveau mot de passe:",
+        "FIELD_HEADER_PASSWORD_NEW_AGAIN"        : "Confirmer nouveau mot de passe:",
+        "FIELD_HEADER_SHOW_RECENT_CONNECTIONS"   : "Afficher les connexions récentes:",
+        "FIELD_HEADER_TIMEZONE"                  : "Fuseau horaire:",
+        "FIELD_HEADER_USERNAME"                  : "Identifiant:",
 
-        "HELP_DEFAULT_INPUT_METHOD" : "La méthode de saisie par défaut détermine comment les événements clavier sont reçus par Guacamole. Modifier ces paramètres peut être nécessaire pour l'utilisateur des smartphone/tablette. Ces paramètres peuvent être écrasés pour chaque connexion dans le menu de Guacamole.",
-        "HELP_DEFAULT_MOUSE_MODE"   : "Le mode d'émulation de la souris détermine comment la souris distante se comportera dans les nouvelles connexions. Ce paramètre peut être définit dans chaque connexion dans le menu de Guacamole.",
+        "HELP_DEFAULT_INPUT_METHOD" : "La méthode de saisie par défaut détermine comment les événements clavier sont reçus par Guacamole. Modifier ce paramètre peut être nécessaire lors de l'utilisation d'un appareil mobile. Ce paramètre peut être remplacé pour chaque connexion dans le menu de Guacamole.",
+        "HELP_DEFAULT_MOUSE_MODE"   : "Le mode d'émulation de la souris par défaut détermine le comportement de la souris distante dans de nouvelles connexions par rapport aux touches. Ce paramètre peut être remplacé pour chaque connexion dans le menu Guacamole.",
         "HELP_INPUT_METHOD_NONE"    : "@:CLIENT.HELP_INPUT_METHOD_NONE",
         "HELP_INPUT_METHOD_OSK"     : "@:CLIENT.HELP_INPUT_METHOD_OSK",
         "HELP_INPUT_METHOD_TEXT"    : "@:CLIENT.HELP_INPUT_METHOD_TEXT",
-        "HELP_LOCALE"               : "Les options ci-dessous sont reliées aux paramètres de localisation de l'utilisateur et affectent ainsi la façon dont certaines parties de l'interface sont affichées.",
+        "HELP_LOCALE"               : "Les options ci-dessous sont liées à la localisation de l'utilisateur et auront un impact sur l'affichage de différentes parties de l'interface.",
         "HELP_MOUSE_MODE_ABSOLUTE"  : "@:CLIENT.HELP_MOUSE_MODE_ABSOLUTE",
         "HELP_MOUSE_MODE_RELATIVE"  : "@:CLIENT.HELP_MOUSE_MODE_RELATIVE",
-        "HELP_UPDATE_PASSWORD"      : "Si vous souhaitez changer votre mot de passe, entrer votre mot de passe actuel et le nouveau mot de passe en dessous puis cliquer sur \"Mettre à jour Mot de passe\". Le changement prendra effet immédiatement.",
+        "HELP_RECENT_CONNECTIONS"   : "Vous pouvez ici activer ou désactiver les connexions récentes sur la page d'accueil de Guacamole, et ajuster le nombre de connexions récentes qui seront affichées.",
+        "HELP_UPDATE_PASSWORD"      : "Si vous souhaitez changer votre mot de passe, saisissez votre mot de passe actuel ainsi que le nouveau mot de passe souhaité ci-dessous, puis cliquez sur \"Mettre à jour Mot de passe\". Le changement prendra effet immédiatement.",
 
-        "INFO_PASSWORD_CHANGED" : "Mot de passe changé.",
+        "INFO_PASSWORD_CHANGED" : "Mot de passe modifié.",
+        "INFO_PREFERENCE_ATTRIBUTES_CHANGED" : "Paramètres utilisateur enregistrés.",
 
         "NAME_INPUT_METHOD_NONE" : "@:CLIENT.NAME_INPUT_METHOD_NONE",
         "NAME_INPUT_METHOD_OSK"  : "@:CLIENT.NAME_INPUT_METHOD_OSK",
         "NAME_INPUT_METHOD_TEXT" : "@:CLIENT.NAME_INPUT_METHOD_TEXT",
 
         "SECTION_HEADER_DEFAULT_INPUT_METHOD" : "Méthode de saisie par défaut",
-        "SECTION_HEADER_DEFAULT_MOUSE_MODE"   : "Mode d'émulation souris par défaut",
+        "SECTION_HEADER_DEFAULT_MOUSE_MODE"   : "Mode d'émulation de la souris par défaut",
+        "SECTION_HEADER_RECENT_CONNECTIONS"   : "Préférences des connexions récentes",
         "SECTION_HEADER_UPDATE_PASSWORD"      : "Modifier Mot de passe"
 
     },
@@ -969,14 +1122,14 @@
 
         "FORMAT_STARTDATE" : "@:APP.FORMAT_DATE_TIME_PRECISE",
 
-        "HELP_SESSIONS" : "Cette page sera remplie avec des connexions actuellement actives. Les connexions répertoriées et la possibilité de supprimer ces connexions dépendent de votre niveau d'accès. Si vous souhaitez en fermer une ou plusieurs, sélectionner les et cliquer sur \"Fermer Sessions\". La fermeture d'une session déconnectera immédiatement l'utilisateur.",
+        "HELP_SESSIONS" : "Cette page sera remplie avec des connexions actuellement actives. Les connexions répertoriées et la possibilité de supprimer ces connexions dépendent de votre niveau d'accès. Si vous souhaitez en fermer une ou plusieurs, sélectionnez les et cliquez sur \"Fermer Sessions\". La fermeture d'une session déconnectera immédiatement l'utilisateur.",
 
         "INFO_NO_SESSIONS" : "Pas de session ouverte",
 
         "SECTION_HEADER_SESSIONS" : "Sessions Actives",
 
         "TABLE_HEADER_SESSION_CONNECTION_NAME" : "Nom de connexion",
-        "TABLE_HEADER_SESSION_STARTDATE"       : "Ouvert depuis",
+        "TABLE_HEADER_SESSION_STARTDATE"       : "Heure de début",
         "TABLE_HEADER_SESSION_REMOTEHOST"      : "Hôte distant",
         "TABLE_HEADER_SESSION_USERNAME"        : "Identifiant",
 

From 4dd7a84dfbee049db8646489e75a1b6fedd37d96 Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Thu, 4 Jul 2024 12:23:48 -0400
Subject: [PATCH 287/289] GUACAMOLE-1196: Add option to disable display resize.

---
 .../main/resources/org/apache/guacamole/protocols/vnc.json | 5 +++++
 guacamole/src/main/frontend/src/translations/en.json       | 7 ++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
index 651d943fd..62c34ac97 100644
--- a/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
+++ b/guacamole-ext/src/main/resources/org/apache/guacamole/protocols/vnc.json
@@ -43,6 +43,11 @@
                     "type"    : "BOOLEAN",
                     "options" : [ "true" ]
                 },
+                {
+                    "name"    : "disable-display-resize",
+                    "type"    : "BOOLEAN",
+                    "options" : [ "true" ]
+                },
                 {
                     "name"    : "swap-red-blue",
                     "type"    : "BOOLEAN",
diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 7b5e55c65..cfa0a0153 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -906,9 +906,10 @@
         "FIELD_HEADER_CURSOR"           : "Cursor:",
         "FIELD_HEADER_DEST_HOST"        : "Destination host:",
         "FIELD_HEADER_DEST_PORT"        : "Destination port:",
-        "FIELD_HEADER_DISABLE_COPY"         : "Disable copying from remote desktop:",
-        "FIELD_HEADER_DISABLE_PASTE"        : "Disable pasting from client:",
-        "FIELD_HEADER_DISABLE_SERVER_INPUT" : "Disable server input when client is connected:",
+        "FIELD_HEADER_DISABLE_COPY"           : "Disable copying from remote desktop:",
+        "FIELD_HEADER_DISABLE_DISPLAY_RESIZE" : "Disable resize of remote display:",
+        "FIELD_HEADER_DISABLE_PASTE"          : "Disable pasting from client:",
+        "FIELD_HEADER_DISABLE_SERVER_INPUT"   : "Disable server input when client is connected:",
         "FIELD_HEADER_ENABLE_AUDIO"     : "Enable audio:",
         "FIELD_HEADER_ENABLE_SFTP"      : "Enable SFTP:",
         "FIELD_HEADER_FORCE_LOSSLESS"   : "Force lossless compression:",

From 7073a9caf77565d58d0bf8cdaa9a818caca44f4b Mon Sep 17 00:00:00 2001
From: Scott Percival <scottp@lastyard.com>
Date: Mon, 29 Jul 2024 18:32:46 +0800
Subject: [PATCH 288/289] GUACAMOLE-374: Fix xmlstarlet syntax for
 RemoteIpValve attributes

---
 guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh b/guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh
index ad6e5ffb5..d998dc139 100644
--- a/guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh
+++ b/guacamole-docker/environment/REMOTE_IP_VALVE_/configure.sh
@@ -29,7 +29,7 @@
 ## RemoteIpValve attributes that correspond to various "REMOTE_IP_VALVE_*"
 ## environment variables.
 ##
-declare -a VALVE_ATTRIBUTES=( --type attr -n className -v org.apache.catalina.valves.RemoteIpValve )
+declare -a VALVE_ATTRIBUTES=( --insert '/Server/Service/Engine/Host/Valve[not(@className)]' --type attr -n className -v org.apache.catalina.valves.RemoteIpValve )
 
 # Translate all properties supported by RemoteIpValve into corresponding
 # environment variables
@@ -45,7 +45,7 @@ for ATTRIBUTE in \
 
     VAR_NAME="REMOTE_IP_VALVE_$(echo "$ATTRIBUTE" | sed 's/\([a-z]\)\([A-Z]\)/\1_\2/g' | tr 'a-z' 'A-Z')"
     if [ -n "${!VAR_NAME}" ]; then
-        VALVE_ATTRIBUTES+=( --type attr -n "$ATTRIBUTE" -v "${!VAR_NAME}" )
+        VALVE_ATTRIBUTES+=( --insert '/Server/Service/Engine/Host/Valve[@className="org.apache.catalina.valves.RemoteIpValve"]' --type attr -n "$ATTRIBUTE" -v "${!VAR_NAME}" )
     else
         echo "Using default RemoteIpValve value for \"$ATTRIBUTE\" attribute."
     fi
@@ -55,7 +55,6 @@ done
 # Programmatically add requested RemoteIpValve entry
 xmlstarlet edit --inplace \
     --insert '/Server/Service/Engine/Host/*' --type elem -n Valve \
-    --insert '/Server/Service/Engine/Host/Valve[not(@className)]' \
     "${VALVE_ATTRIBUTES[@]}" \
     "$CATALINA_BASE/conf/server.xml"
 

From ce06f1c559999ce1564a1e25d2cd868a191133ea Mon Sep 17 00:00:00 2001
From: Virtually Nick <vnick@apache.org>
Date: Wed, 31 Jul 2024 19:33:59 -0400
Subject: [PATCH 289/289] GUACAMOLE-1642: Add translation string for encoding
 field.

---
 guacamole/src/main/frontend/src/translations/en.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/guacamole/src/main/frontend/src/translations/en.json b/guacamole/src/main/frontend/src/translations/en.json
index 7b5e55c65..30a6957ad 100644
--- a/guacamole/src/main/frontend/src/translations/en.json
+++ b/guacamole/src/main/frontend/src/translations/en.json
@@ -911,6 +911,7 @@
         "FIELD_HEADER_DISABLE_SERVER_INPUT" : "Disable server input when client is connected:",
         "FIELD_HEADER_ENABLE_AUDIO"     : "Enable audio:",
         "FIELD_HEADER_ENABLE_SFTP"      : "Enable SFTP:",
+        "FIELD_HEADER_ENCODINGS"        : "Display encodings:",
         "FIELD_HEADER_FORCE_LOSSLESS"   : "Force lossless compression:",
         "FIELD_HEADER_HOSTNAME"         : "Hostname:",
         "FIELD_HEADER_USERNAME"         : "Username:",