public static void verifyTimeRestrictions(UserContext context,
            Set<String> effectiveUserGroups) throws GuacamoleException {
        
        // Retrieve the current User object associated with the UserContext
        User currentUser = context.self();
        
        // Admins always have access.
        if (currentUser.getEffectivePermissions().getSystemPermissions().hasPermission(SystemPermission.Type.ADMINISTER)) {
            LOGGER.warn("User \"{}\" has System Administration permissions; additional restrictions will be bypassed.", 
                    currentUser.getIdentifier());
            return;
        }
        
        // Get user's attributes
        Map<String, String> userAttributes = currentUser.getAttributes();
        
        // Verify time-based restrictions specific to the user
        String allowedTimeString = userAttributes.get(Restrictable.RESTRICT_TIME_ALLOWED_ATTRIBUTE_NAME);
        String deniedTimeString = userAttributes.get(Restrictable.RESTRICT_TIME_DENIED_ATTRIBUTE_NAME);
        RestrictionType timeRestrictionResult = allowedByTimeRestrictions(allowedTimeString, deniedTimeString);
        
        // Check the time restriction for explicit results.
        switch (timeRestrictionResult) {
            // User-level explicit deny overrides everything
            case EXPLICIT_DENY:
                throw new TranslatableInvalidTimeLoginException("User \""
                        + currentUser.getIdentifier()
                        + "\" is not allowed to log in at this time.",
                        "RESTRICT.ERROR_USER_LOGIN_NOT_ALLOWED_NOW"
                );
            
            // User-level explicit allow means the user is allowed.
            case EXPLICIT_ALLOW:
                return;
            
        }
        
        // Gather user's effective groups.
        Collection<UserGroup> userGroups = context
                .getPrivileged()
                .getUserGroupDirectory()
                .getAll(effectiveUserGroups);
        
        // Loop user's effective groups and verify restrictions
        for (UserGroup userGroup : userGroups) {
            
            // Get group's attributes
            Map<String, String> grpAttributes = userGroup.getAttributes();
            
            // Pull time-based restrictions for this group and verify
            String grpAllowedTimeString = grpAttributes.get(Restrictable.RESTRICT_TIME_ALLOWED_ATTRIBUTE_NAME);
            String grpDeniedTimeString = grpAttributes.get(Restrictable.RESTRICT_TIME_DENIED_ATTRIBUTE_NAME);
            RestrictionType grpRestrictionResult = allowedByTimeRestrictions(grpAllowedTimeString, grpDeniedTimeString);
            
            // An explicit deny results in immediate denial of the login.
            if (grpRestrictionResult == RestrictionType.EXPLICIT_DENY)
                throw new TranslatableInvalidTimeLoginException("User \"" 
                        + currentUser.getIdentifier() 
                        +"\" is not allowed to log in at this time due to restrictions on group \"" 
                        + userGroup + "\".",
                        "RESTRICT.ERROR_USER_LOGIN_NOT_ALLOWED_NOW"
                );
            
            // Compare the two, returning the highest-priority restriction so far.
            timeRestrictionResult = RestrictionType.getHigherPriority(timeRestrictionResult, grpRestrictionResult);
            
        }
        
        switch (timeRestrictionResult) {
            // Explicit allow was the highest result, so we log it and return, allowing the user to be logged in.
            case EXPLICIT_ALLOW:
                return;
                
            // Implicit allow was the highest result, so we log it and return, allowing the user to be logged in.
            case IMPLICIT_ALLOW:
                return;
        }
        
        // If we reach, here, we've reached an implict deny, so we throw an exception.
        throw new TranslatableInvalidTimeLoginException("User \""
                + currentUser.getIdentifier()
                + "\" is implicitly denied at this time.",
                "RESTRICT.ERROR_USER_LOGIN_NOT_ALLOWED_NOW"
        );
        
    }
Verifies the time restrictions for this extension and whether or not the
account should be allowed to be logged in to Guacamole at the current
day and time, throwing an exception if any of the restrictions result
in a violation of the time constraints of the account.

@param context
    The UserContext of the user whose access to Guacamole is being
    checked.

@param effectiveUserGroups
    The set of identifiers of groups of which the user who is being
    verified is a member.

@throws GuacamoleException 
    If any of the time constraints configured for the user result in the
    user not being allowed to be logged in to Guacamole, or if errors
    occur trying to retrieve permissions or attributes.
extensions/guacamole-auth-restrict/src/main/java/org/apache/guacamole/auth/restrict/RestrictionVerificationService.java