public String getClientAuthenticationSubdomain(String hostname) throws GuacamoleException {

        // Any hostname that matches the explicitly-specific primary URI is not
        // a client auth subdomain
        if (isPrimaryHostname(hostname))
            return null;

        // Verify the first domain component is at least one character in
        // length
        int firstPeriod = hostname.indexOf('.');
        if (firstPeriod <= 0)
            return null;

        // Verify domain matches the configured auth URI except for the leading
        // subdomain
        URI authURI = environment.getRequiredProperty(SSL_AUTH_URI);
        if (!hostnameMatches(hostname, firstPeriod + 1, authURI))
            return null;

        // Extract subdomain
        return hostname.substring(0, firstPeriod);

    }
Given a hostname that was used by a user for SSL/TLS client
authentication, returns the subdomain at the beginning of that hostname.
If the hostname does not match the pattern of hosts represented by the
configured client authentication URI, null is returned.

@param hostname
    The hostname to extract the subdomain from.

@return
    The subdomain at the beginning of the provided hostname, if that
    hostname matches the pattern of hosts represented by the
    configured client authentication URI, or null otherwise.

@throws GuacamoleException
    If the required property for configuring the client authentication
    URI is missing or cannot be parsed.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/conf/ConfigurationService.java