@Override
    public void filterExternalObject(UserContext userContext, APIUser object)
            throws GuacamoleException {

        // If a user is editing themselves ...
        if (object.getUsername().equals(userContext.self().getIdentifier())) {

            // ... they may only edit preference attributes
            object.setAttributes(filterAttributes(userContext.getUserPreferenceAttributes(),
                    object.getAttributes()));

        }

        else {

            // In all other cases, filter object attributes by defined schema
            object.setAttributes(filterAttributes(userContext.getUserAttributes(),
                    object.getAttributes()));

        }

    }
Translator which converts between User objects and APIUser objects.
guacamole/src/main/java/org/apache/guacamole/rest/user/UserObjectTranslator.java