GUACAMOLE-2172: Update italian localization

extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/MySQLAuthenticationProviderModule.java

@@ -84,6 +84,10 @@ public MySQLAuthenticationProviderModule(MySQLEnvironment environment)
         myBatisProperties.setProperty("mybatis.pooled.pingEnabled", "true");
         myBatisProperties.setProperty("mybatis.pooled.pingQuery", "SELECT 1");
 
+        // Set whether public key retrieval from the server is allowed
+        driverProperties.setProperty("allowPublicKeyRetrieval",
+            environment.getMYSQLAllowPublicKeyRetrieval() ? "true" : "false");
+
         // Use UTF-8 in database
         driverProperties.setProperty("characterEncoding", "UTF-8");
 
@@ -121,10 +125,22 @@ public MySQLAuthenticationProviderModule(MySQLEnvironment environment)
         if (clientPassword != null)
             driverProperties.setProperty("clientCertificateKeyStorePassword",
                     clientPassword);
-        
+
         // Get the MySQL-compatible driver to use.
         mysqlDriver = environment.getMySQLDriver();
 
+        // Set the path to the server public key, if any
+        // Note that the property name casing is slightly different for MySQL
+        // and MariaDB drivers. See
+        // https://dev.mysql.com/doc/connector-j/en/connector-j-connp-props-security.html#cj-conn-prop_serverRSAPublicKeyFile
+        // and https://mariadb.com/kb/en/about-mariadb-connector-j/#infrequently-used-parameters
+        String publicKeyFile = environment.getMYSQLServerRSAPublicKeyFile();
+        if (publicKeyFile != null)
+            driverProperties.setProperty(
+                mysqlDriver == MySQLDriver.MYSQL
+                    ? "serverRSAPublicKeyFile" : "serverRsaPublicKeyFile",
+                publicKeyFile);
+
         // If timezone is present, set it.
         TimeZone serverTz = environment.getServerTimeZone();
         if (serverTz != null)

extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLEnvironment.java

@@ -443,4 +443,35 @@ public boolean enforceAccessWindowsForActiveSessions() throws GuacamoleException
         );
     }
 
+    /**
+     * Returns the absolute path to the public key for the server being connected to,
+     * if any, or null if the configuration property is unset.
+     *
+     * @return
+     *     The absolute path to the public key for the server being connected to.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs retrieving the configuration value.
+     */
+    public String getMYSQLServerRSAPublicKeyFile() throws GuacamoleException {
+        return getProperty(MySQLGuacamoleProperties.MYSQL_SERVER_RSA_PUBLIC_KEY_FILE);
+    }
+
+    /**
+     * Returns true if the database server public key should be automatically
+     * retrieved from the MySQL server, or false otherwise.
+     *
+     * @return
+     *     Whether the database server public key should be automatically
+     *     retrieved from the MySQL server.
+     *
+     * @throws GuacamoleException
+     *     If an error occurs retrieving the configuration value.
+     */
+    public boolean getMYSQLAllowPublicKeyRetrieval() throws GuacamoleException {
+        return getProperty(
+                MySQLGuacamoleProperties.MYSQL_ALLOW_PUBLIC_KEY_RETRIEVAL,
+                false);
+    }
+
 }

extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/java/org/apache/guacamole/auth/mysql/conf/MySQLGuacamoleProperties.java

@@ -302,5 +302,28 @@ private MySQLGuacamoleProperties() {}
         public String getName() { return "mysql-batch-size"; }
 
     };
-
+
+    /**
+     * The absolute path to the public key for the server being connected to, if any.
+     */
+    public static final StringGuacamoleProperty MYSQL_SERVER_RSA_PUBLIC_KEY_FILE =
+            new StringGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "mysql-server-rsa-public-key-file"; }
+
+    };
+
+    /**
+     * Whether or not the server public key should be automatically retreived from
+     * the MySQL server.
+     */
+    public static final BooleanGuacamoleProperty MYSQL_ALLOW_PUBLIC_KEY_RETRIEVAL =
+            new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "mysql-allow-public-key-retrieval"; }
+
+    };
+
 }

extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/ConnectedLDAPConfiguration.java

@@ -223,5 +223,10 @@ public String getMemberAttribute() throws GuacamoleException {
     public MemberAttributeType getMemberAttributeType() throws GuacamoleException {
         return config.getMemberAttributeType();
     }
+
+    @Override
+    public boolean getNestedGroups() throws GuacamoleException {
+        return config.getNestedGroups();
+    }
 
 }

extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/DefaultLDAPConfiguration.java

@@ -151,4 +151,9 @@ public MemberAttributeType getMemberAttributeType()
         return MemberAttributeType.DN;
     }
 
+    @Override
+    public boolean getNestedGroups() {
+        return false;
+    }
+
 }

extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/EnvironmentLDAPConfiguration.java

@@ -234,4 +234,12 @@ public MemberAttributeType getMemberAttributeType()
         );
     }
 
+    @Override
+    public boolean getNestedGroups() throws GuacamoleException {
+        return environment.getProperty(
+            LDAPGuacamoleProperties.LDAP_NESTED_GROUPS,
+            DEFAULT.getNestedGroups()
+        );
+    }
+
 }

extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/JacksonLDAPConfiguration.java

@@ -204,6 +204,13 @@ public class JacksonLDAPConfiguration implements LDAPConfiguration {
     @JsonProperty("member-attribute-type")
     private String memberAttributeType;
 
+    /**
+     * The raw YAML value of {@link LDAPGuacamoleProperties#LDAP_NESTED_GROUPS}.
+     * If not set within the YAML, this will be false.
+     */
+    @JsonProperty("nested-groups")
+    private Boolean nestedGroups;
+
     /**
      * The default configuration options for all parameters.
      */
@@ -434,6 +441,11 @@ public String getMemberAttribute() throws GuacamoleException {
         return withDefault(memberAttribute, defaultConfig::getMemberAttribute);
     }
 
+    @Override
+    public boolean getNestedGroups() throws GuacamoleException {
+        return withDefault(nestedGroups, defaultConfig::getNestedGroups);
+    }
+
     @Override
     public MemberAttributeType getMemberAttributeType() throws GuacamoleException {
         return withDefault(LDAPGuacamoleProperties.LDAP_MEMBER_ATTRIBUTE_TYPE,

extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPConfiguration.java

@@ -334,4 +334,16 @@ public interface LDAPConfiguration {
      */
     MemberAttributeType getMemberAttributeType() throws GuacamoleException;
 
+    /**
+     * Returns whether nested groups should be included in group membership.
+     *
+     * @return
+     *     Whether to search in nested groups.
+     *
+     * @throws GuacamoleException
+     *     If the configuration information determining whether nested
+     *     groups should be used cannot be retrieved.
+     */
+    boolean getNestedGroups() throws GuacamoleException;
+
 }

extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/conf/LDAPGuacamoleProperties.java

@@ -307,4 +307,15 @@ private LDAPGuacamoleProperties() {}
 
     };
 
+    /**
+     * Whether or not to search nested groups.
+     */
+    public static final BooleanGuacamoleProperty LDAP_NESTED_GROUPS = 
+            new BooleanGuacamoleProperty() {
+
+        @Override
+        public String getName() { return "ldap-nested-groups"; }
+
+    };
+
 }

extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/group/UserGroupService.java

@@ -27,10 +27,12 @@
 import java.util.Map;
 import java.util.Set;
 import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.entry.Value;
 import org.apache.directory.api.ldap.model.exception.LdapInvalidAttributeValueException;
 import org.apache.directory.api.ldap.model.filter.AndNode;
 import org.apache.directory.api.ldap.model.filter.EqualityNode;
 import org.apache.directory.api.ldap.model.filter.ExprNode;
+import org.apache.directory.api.ldap.model.filter.ExtensibleNode;
 import org.apache.directory.api.ldap.model.filter.NotNode;
 import org.apache.directory.api.ldap.model.name.Dn;
 import org.apache.guacamole.auth.ldap.conf.MemberAttributeType;
@@ -55,6 +57,11 @@ public class UserGroupService {
      */
     private static final Logger logger = LoggerFactory.getLogger(UserGroupService.class);
 
+    /**
+     * Constant for nested LDAP group matching in Active Directory
+     */
+    private static final String LDAP_GROUP_NESTED_MATCHING_OID = "1.2.840.113556.1.4.1941";
+
     /**
      * Service for executing LDAP queries.
      */
@@ -225,14 +232,36 @@ public List<Entry> getParentUserGroupEntries(ConnectedLDAPConfiguration config,
         groupAttributes.add(memberAttribute);
 
         // Get all groups the user is a member of starting at the groupBaseDN,
-        // excluding guacConfigGroups
+        // excluding guacConfigGroups and evaluating nested groups 
+        // (if enabled).
+
+        ExprNode groupFilter = config.getGroupSearchFilter();
+        String filterValue = userIDorDN;
+
+        if (config.getNestedGroups()) {
+
+            // Add support for nested groups using LDAP_MATCHING_RULE_IN_CHAIN
+            // (memberOf:1.2.840.113556.1.4.1941:=<UserDN>)
+            // Matching rule OID for LDAP_MATCHING_RULE_IN_CHAIN
+            // ** This possibly only supports Active Directory **
+            ExtensibleNode node = new ExtensibleNode("member");
+            filterValue = null;
+
+            // Explicitly set the matching rule ID and dnAttributes
+            node.setMatchingRuleId(LDAP_GROUP_NESTED_MATCHING_OID);
+            node.setDnAttributes(false);
+            node.setValue(new Value(userIDorDN));
+            groupFilter = new AndNode(
+                    groupFilter, node
+            );
+        }
         return queryService.search(
             config,
             config.getLDAPConnection(),
             groupBaseDN,
-            getGroupSearchFilter(config),
+            groupFilter,
             Collections.singleton(memberAttribute),
-            userIDorDN,
+            filterValue,
             groupAttributes
         );
 

extensions/guacamole-auth-restrict/src/main/java/org/apache/guacamole/auth/restrict/Restrictable.java

@@ -27,6 +27,65 @@
  */
 public interface Restrictable extends Attributes {
 
+    /**
+     * The name of the attribute that contains the absolute date and time after
+     * which this restrictable object may be used. If this attribute is present
+     * access to to this object will be denied at any time prior to the parsed
+     * value of this attribute, regardless of what other restrictions may be
+     * present to allow access to the object at certain days/times of the week
+     * or from certain hosts.
+     */
+    public static final String RESTRICT_TIME_AFTER_ATTRIBUTE_NAME = "guac-restrict-time-after";
+
+    /**
+     * The name of the attribute that contains a list of weekdays and times (UTC)
+     * that this restrictable object can be used. The presence of values within
+     * this attribute will automatically restrict use of the object at any times
+     * that are not specified.
+     */
+    public static final String RESTRICT_TIME_ALLOWED_ATTRIBUTE_NAME = "guac-restrict-time-allowed";
+
+    /**
+     * The name of the attribute that contains the absolute date and time before
+     * which use of this restrictable object may be used. If this attribute is
+     * present use of the object will be denied at any time after the parsed
+     * value of this attribute, regardless of the presence of other restrictions
+     * that may allow access at certain days/times of the week or from certain
+     * hosts.
+     */
+    public static final String RESTRICT_TIME_BEFORE_ATTRIBUTE_NAME = "guac-restrict-time-before";
+
+    /**
+     * The name of the attribute that contains a list of weekdays and times (UTC)
+     * that this restrictable object cannot be used. Denied times will always take
+     * precedence over allowed times. The presence of this attribute without
+     * guac-restrict-time-allowed will deny access only during the times listed
+     * in this attribute, allowing access at all other times. The presence of
+     * this attribute along with the guac-restrict-time-allowed attribute will
+     * deny access at any times that overlap with the allowed times.
+     */
+    public static final String RESTRICT_TIME_DENIED_ATTRIBUTE_NAME = "guac-restrict-time-denied";
+
+    /**
+     * The name of the attribute that contains a list of hosts from which this
+     * restrictable object may be used. The presence of this attribute will
+     * restrict use to only users accessing Guacamole from the list of hosts
+     * contained in the attribute, subject to further restriction by the
+     * guac-restrict-hosts-denied attribute.
+     */
+    public static final String RESTRICT_HOSTS_ALLOWED_ATTRIBUTE_NAME = "guac-restrict-hosts-allowed";
+
+    /**
+     * The name of the attribute that contains a list of hosts from which this
+     * restrictable object may not be used. The presence of this attribute,
+     * absent the guac-restrict-hosts-allowed attribute, will allow use from
+     * all hosts except the ones listed in this attribute. The presence of this
+     * attribute coupled with the guac-restrict-hosts-allowed attribute will
+     * block access from any IPs in this list, overriding any that may be
+     * allowed.
+     */
+    public static final String RESTRICT_HOSTS_DENIED_ATTRIBUTE_NAME = "guac-restrict-hosts-denied";
+
     /**
      * Return the restriction state for this restrictable object at the
      * current date and time. By default returns an implicit denial.