@Override
    public String parse(String casGroup) {

        // Reject null/empty group names
        if (casGroup == null || casGroup.isEmpty())
            return null;

        // Parse group as an LDAP DN
        LdapName group;
        try {
            group = new LdapName(casGroup);
        }
        catch (InvalidNameException e) {
            logger.debug("CAS group \"{}\" has been rejected as it is not a "
                    + "valid LDAP DN.", casGroup, e);
            return null;
        }

        // Reject any group that is not beneath the base DN
        if (baseDn != null && !group.startsWith(baseDn))
            return null;

        // If a specific name attribute is defined, restrict to groups that
        // use that attribute to distinguish themselves
        Rdn last = group.getRdn(group.size() - 1);
        if (nameAttribute != null && !nameAttribute.equalsIgnoreCase(last.getType()))
            return null;

        // The group name is the string value of the final attribute in the DN
        return last.getValue().toString();

    }
Creates a new LDAPGroupParser which applies the given restrictions on
any provided group names.

@param nameAttribute
    The LDAP attribute to require for all accepted group names. This
    restriction applies to the last (leftmost) attribute only, which is
    always used to determine the name of the group. If null, any LDAP
    attribute will be allowed in the last (leftmost) position.

@param baseDn
    The base DN to require for all accepted group names. If null,
    ancestor tree structure will not be considered in
    accepting/rejecting a group.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/java/org/apache/guacamole/auth/cas/group/LDAPGroupParser.java