public String getUsername(byte[] certificate) throws GuacamoleException {

        // Parse and re-verify certificate is valid with respect to timestamps
        X509CertificateHolder cert;
        try (Reader reader = new StringReader(new String(certificate, StandardCharsets.UTF_8))) {

            PEMParser parser = new PEMParser(reader);
            Object object = parser.readObject();

            // Verify received data is indeed an X.509 certificate
            if (object == null || !(object instanceof X509CertificateHolder))
                throw new GuacamoleClientException("Certificate did not "
                        + "contain an X.509 certificate.");

            // Verify sanity of received certificate (there should be only
            // one object here)
            if (parser.readObject() != null)
                throw new GuacamoleClientException("Certificate contains "
                        + "more than a single X.509 certificate.");

            cert = (X509CertificateHolder) object;

            // Verify certificate is valid (it should be given pre-validation
            // from SSL termination, but it's worth rechecking for sanity)
            if (!cert.isValidOn(new Date()))
                throw new GuacamoleClientException("Certificate has expired.");

        }
        catch (IOException e) {
            throw new GuacamoleServerException("Certificate could not be read: " + e.getMessage(), e);
        }

        // Extract user's DN from their X.509 certificate in LDAP (RFC 4919) format
        X500Name subject = X500Name.getInstance(RFC4519Style.INSTANCE, cert.getSubject());
        return getUsername(subject.toString());

    }
Authenticates a user using HTTP headers containing that user's verified
X.509 certificate. It is assumed that this certificate is being passed
to Guacamole from an SSL termination service that has already verified
that this certificate is valid and authorized for access to that
Guacamole instance.

@param certificate
    The raw bytes of the X.509 certificate retrieved from the request.

@return
    The username of the user asserted by the SSL termination service via
    that user's X.509 certificate.

@throws GuacamoleException
    If any configuration parameters related to retrieving certificates
    from HTTP request cannot be parsed, or if the certificate is not
    valid/present.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/SSLClientAuthenticationResource.java