Merge patch branch changes to main.

src/jdbc-auth.md

@@ -1052,6 +1052,34 @@ sqlserver-auto-create-accounts: true
 ```
 :::
 
+### Access window enforcment
+
+Guacamole supports the use of access windows to limit the time periods
+during which users are allowed to access the system. Prior to version
+1.6.0, this would only restrict the times when a user could log on,
+but would not impact actively running sessions - that is, a user
+could continue an active session after their access window had expired.
+Starting in version 1.6.0, Guacamole will, by default, forcible log
+users off of the system as soon as the access window expires. This
+behavior can be changed if the prior behavior is desired, by disabling
+the enforcement of this policy during active sessions.
+
+:::{tab} MySQL
+```
+mysql-enforce-access-windows-for-active-sessions: false
+```
+
+:::{tab} PostgreSQL
+```
+postgresql-enforce-access-windows-for-active-sessions: false
+```
+
+:::{tab} SQL Server
+```
+sqlserver-enforce-access-windows-for-active-sessions: false
+```
+:::
+
 ### Completing the installation
 
 Guacamole will only reread `guacamole.properties` and load newly-installed

src/recording-playback.md

@@ -72,6 +72,9 @@ depend upon the options selected when recording is enabled - for example,
 keystrokes will not be available if keystroke logging has not been
 enabled for a connection.
 
+Additionally, heatmaps of screen update activity and key events (if captured)
+will be displayed when the progress bar is hovered.
+
 ![Display and search key events](images/player-key-events.png)
 
 (playback-downloading)=

src/vault.md

@@ -164,6 +164,12 @@ All other configuration properties are optional.
   amount generate additional cost. Setting this property allows you to
   limit Guacamole's impact on that cost.
 
+`ksm-strip-windows-domains`
+: Whether or not the Windows domain should be stripped off of the username
+  when usernames are retrieved from the KSM vault and placed into its own
+  secret. This is optional, and by default it is false - domains will
+  not be stripped from the username.
+
 (completing-vault-install)=
 
 ### Completing the installation
@@ -263,6 +269,12 @@ The following `SECRET` types are supported:
   custom field, the label must contain the word "username" (case-insensitive)
   and must be a "text" or "hidden" field.
 
+`DOMAIN`
+: The domain name of the record, either retrieved directly from the vault, or
+  split out from the username if so configured in the vault. Typically this
+  will apply when the username is associated with an Active Directory
+  domain.
+
 `PASSWORD`
 : The password specified by the record's "password" or "hidden" field. If the
   field is a custom field, the label must contain the word "password"