@Override
    public Directory<User> getUserDirectory() throws GuacamoleException {
        
        // Pull permissions of the current logged-in user.
        Permissions currentPermissions = self().getEffectivePermissions();
        boolean isAdmin = currentPermissions.getSystemPermissions().hasPermission(
                                        SystemPermission.Type.ADMINISTER
                        );
        Collection<String> adminIdentifiers = 
                currentPermissions.getUserPermissions().getAccessibleObjects(
                        Collections.singletonList(ObjectPermission.Type.ADMINISTER), super.getUserDirectory().getIdentifiers());
        
        return new DecoratingDirectory<User>(super.getUserDirectory()) {

            @Override
            protected User decorate(User object) throws GuacamoleException {
                
                // Check and see if the logged in user has admin privileges -
                // either system-level or for that particular object.
                boolean hasAdmin = isAdmin || adminIdentifiers.contains(object.getIdentifier());
                return new RestrictedUser(object, remoteAddress, hasAdmin);
            }

            @Override
            protected User undecorate(User object) {
                assert(object instanceof RestrictedUser);
                return ((RestrictedUser) object).getUndecorated();
            }

        };
    }
Creates a new RestrictedUserContext which wraps the given UserContext,
providing additional control for user logins and connections.

@param userContext
    The UserContext to wrap.

@param remoteAddress
    The address the user is logging in from, if known.

@param effectiveUserGroups
    The identifiers of the groups this user is associated with.
extensions/guacamole-auth-restrict/src/main/java/org/apache/guacamole/auth/restrict/user/RestrictedUserContext.java