public static void verifyHostRestrictions(UserContext context,
            Set<String> effectiveUserGroups, String remoteAddress)
            throws GuacamoleException {
        
        // Get the current user
        User currentUser = context.self();
        
        // Admins always have access.
        if (currentUser.getEffectivePermissions().getSystemPermissions().hasPermission(SystemPermission.Type.ADMINISTER)) {
            LOGGER.warn("User \"{}\" has System Administration permissions; additional restrictions will be bypassed.", 
                    currentUser.getIdentifier());
            return;
        }
        
        // Get user's attributes
        Map<String, String> userAttributes = currentUser.getAttributes();
        
        // Verify host-based restrictions specific to the user
        String allowedHostString = userAttributes.get(Restrictable.RESTRICT_HOSTS_ALLOWED_ATTRIBUTE_NAME);
        String deniedHostString = userAttributes.get(Restrictable.RESTRICT_HOSTS_DENIED_ATTRIBUTE_NAME);
        RestrictionType hostRestrictionResult = allowedByHostRestrictions(allowedHostString, deniedHostString, remoteAddress);
        
        switch (hostRestrictionResult) {
            // User-level explicit deny overrides everything
            case EXPLICIT_DENY:
                throw new TranslatableInvalidHostLoginException("User \"" 
                    + currentUser.getIdentifier() 
                    +"\" is not allowed to log in from \"" 
                    + remoteAddress + "\"",
                    "RESTRICT.ERROR_USER_LOGIN_NOT_ALLOWED_FROM_HOST"
                );
            
            // User-level explicit allow means the user is allowed.
            case EXPLICIT_ALLOW:
                return;
            
        }
        
        // Gather user's effective groups.
        Collection<UserGroup> userGroups = context
                .getPrivileged()
                .getUserGroupDirectory()
                .getAll(effectiveUserGroups);
        
        // Loop user's effective groups and verify restrictions
        for (UserGroup userGroup : userGroups) {

            // Get group's attributes
            Map<String, String> grpAttributes = userGroup.getAttributes();
            
            // Pull host-based restrictions for this group and verify
            String grpAllowedHostString = grpAttributes.get(Restrictable.RESTRICT_HOSTS_ALLOWED_ATTRIBUTE_NAME);
            String grpDeniedHostString = grpAttributes.get(Restrictable.RESTRICT_HOSTS_DENIED_ATTRIBUTE_NAME);
            RestrictionType grpRestrictionResult = allowedByHostRestrictions(grpAllowedHostString, grpDeniedHostString, remoteAddress);
            
            // Any explicit denials are thrown immediately
            if (grpRestrictionResult == RestrictionType.EXPLICIT_DENY)
                throw new TranslatableInvalidHostLoginException("User \"" 
                        + currentUser.getIdentifier() 
                        + "\" is not allowed to log in from host \""
                        + remoteAddress
                        + "\" due to restrictions on group \"" 
                        + userGroup.getIdentifier() + "\".",
                        "RESTRICT.ERROR_USER_LOGIN_NOT_ALLOWED_FROM_HOST"
                );
            
            // Compare the two, returning the highest-priority restriction so far.
            hostRestrictionResult = RestrictionType.getHigherPriority(hostRestrictionResult, grpRestrictionResult);
            
        }

        // Check the result and log allowed
        switch (hostRestrictionResult) {
            // Explicit allow was the highest result, so we log it and return, allowing the user to be logged in.
            case EXPLICIT_ALLOW:
                return;
                
            // Implicit allow was the highest result, so we log it and return, allowing the user to be logged in.
            case IMPLICIT_ALLOW:
                return;
        }
        
        // If we reach, here, we've reached an implict deny, so we throw an exception.
        throw new TranslatableInvalidHostLoginException("User \""
                + currentUser.getIdentifier()
                + "\" is implicitly denied at this time.",
                "RESTRICT.ERROR_USER_LOGIN_NOT_ALLOWED_FROM_HOST"
        );
        
    }
Verify the host restrictions for the user associated with the given
UserContext, throwing an exception if any of the restrictions result
in the user not being allowed to be logged in to Guacamole from this
host.

@param context
    The UserContext associated with the user who is being verified.

@param effectiveUserGroups
    The set of identifiers of groups of which the user who is being
    verified is a member.

@param remoteAddress
    The remote address of the client from which the current user is
    logged in.

@throws GuacamoleException 
    If the restrictions on the user should prevent the user from
    logging in from the current client, or if an error occurs attempting
    to retrieve permissions.
extensions/guacamole-auth-restrict/src/main/java/org/apache/guacamole/auth/restrict/RestrictionVerificationService.java