public String getUsername(String name) throws GuacamoleException {

        // Extract user's DN from their X.509 certificate
        LdapName dn;
        try {
            dn = new LdapName(name);
        }
        catch (InvalidNameException e) {
            throw new GuacamoleClientException("Subject \"" + name + "\" is "
                    + "not a valid DN: " + e.getMessage(), e);
        }

        // Verify DN actually contains components
        int numComponents = dn.size();
        if (numComponents < 1)
            throw new GuacamoleClientException("Subject DN is empty.");

        // Verify DN is within configured base DN (if any)
        LdapName baseDN = confService.getSubjectBaseDN();
        if (baseDN != null && !(numComponents > baseDN.size() && dn.startsWith(baseDN)))
            throw new GuacamoleClientException("Subject DN \"" + dn + "\" is "
                    + "not within the configured base DN.");

        // Retrieve the least significant attribute from the parsed DN - this
        // will be the username
        Rdn nameRdn = dn.getRdn(numComponents - 1);

        // Verify that the username is specified with one of the allowed
        // attributes
        Collection<String> usernameAttributes = confService.getSubjectUsernameAttributes();
        if (usernameAttributes != null && !usernameAttributes.stream().anyMatch(nameRdn.getType()::equalsIgnoreCase))
            throw new GuacamoleClientException("Subject DN \"" + dn + "\" "
                    + "does not contain an acceptable username attribute.");

        // The DN is valid - extract the username from the least significant
        // component
        String username = nameRdn.getValue().toString();
        logger.debug("Username \"{}\" extracted from subject DN \"{}\".", username, dn);
        return username;

    }
Extracts a user's username from the X.509 subject name, which should be
in LDAP DN format. If specific username attributes are configured, only
those username attributes are used to determine the name. If a specific
base DN is configured, only subject names that are formatted as LDAP DNs
within that base DN will be accepted.

@param name
    The subject name to extract the username from.

@return
    The username of the user represented by the given subject name.

@throws GuacamoleException
    If any configuration parameters related to retrieving certificates
    from HTTP request cannot be parsed, or if the provided subject name
    cannot be parsed or is not acceptable (wrong base DN or wrong
    username attribute).
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java