@Override
    public SSOAuthenticatedUser authenticateUser(Credentials credentials)
            throws GuacamoleException {

        // Pull CAS ticket from request if present
        String ticket = credentials.getParameter(TICKET_PARAMETER_NAME);
        if (ticket != null) {
            return ticketService.validateTicket(ticket, credentials);
        }

        // Request CAS ticket (will automatically redirect the user to the
        // CAS authorization page via JavaScript)
        throw new GuacamoleInvalidCredentialsException("Invalid login.",
            new CredentialsInfo(Arrays.asList(new Field[] {
                new RedirectField(TICKET_PARAMETER_NAME, getLoginURI(),
                        new TranslatableMessage("LOGIN.INFO_IDP_REDIRECT_PENDING"))

            }))
        );

    }
Service for validating received ID tickets.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-cas/src/main/java/org/apache/guacamole/auth/cas/AuthenticationProviderService.java