public Map<String, String> processAttributes(
            Map<String, String> attributes) throws GuacamoleException {

        // Get the value of the KSM config attribute in the provided map
        String ksmConfigValue = attributes.get(
                KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);

        // If the placeholder value was provided, do not update the attribute
        if (KsmAttributeService.KSM_ATTRIBUTE_PLACEHOLDER_VALUE.equals(ksmConfigValue)) {

            // Remove the attribute from the map so it won't be updated
            attributes = new HashMap<>(attributes);
            attributes.remove(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE);

        }

        // Check if the attribute is set to a non-empty value
        else if (ksmConfigValue != null && !ksmConfigValue.trim().isEmpty()) {

            // If it's already base64-encoded, it's a KSM configuration blob,
            // so validate it immediately
            if (isBase64(ksmConfigValue)) {

                // Attempt to validate the config as a base64-econded KSM config blob
                try {
                    KsmConfig.parseKsmConfig(ksmConfigValue);

                    // If it validates, the entity can be left alone - it's already valid
                    return attributes;
                }

                catch (GuacamoleException exception) {

                    // If the parsing attempt fails, throw a translatable error for display
                    // on the frontend
                    throw new TranslatableGuacamoleClientException(
                            "Invalid base64-encoded JSON KSM config provided for "
                            + KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE + " attribute",
                            "CONNECTION_GROUP_ATTRIBUTES.ERROR_INVALID_KSM_CONFIG_BLOB",
                            exception);
                }
            }

            // It wasn't a valid base64-encoded string, it should be a one-time token, so
            // attempt to validat it as such, and if valid, update the attribute to the
            // base64 config blob generated by the token
            try {

                // Create an initially empty storage to be populated using the one-time token
                InMemoryStorage storage = new InMemoryStorage();

                // Populate the in-memory storage using the one-time-token
                SecretsManager.initializeStorage(storage, ksmConfigValue, null);

                // Create an options object using the values we extracted from the one-time token
                SecretsManagerOptions options = new SecretsManagerOptions(
                    storage, null,
                    configurationService.getAllowUnverifiedCertificate());

                // Attempt to fetch secrets using the options we created. This will both validate
                // that the configuration works, and potentially populate missing fields that the
                // initializeStorage() call did not set.
                SecretsManager.getSecrets(options);

                // Create a map to store the extracted values from the KSM storage
                Map<String, String> configMap = new HashMap<>();

                // Go through all the expected fields, extract from the KSM storage,
                // and write to the newly created map
                EXPECTED_KSM_FIELDS.forEach(configKey -> {

                    // Only write the value into the new map if non-null
                    String value = storage.getString(configKey);
                    if (value != null)
                        configMap.put(configKey, value);

                });

                // JSON-encode the value, and then base64 encode that to get the format
                // that KSM would expect
                String jsonString = objectMapper.writeValueAsString(configMap);
                String base64EncodedJson = Base64.getEncoder().encodeToString(
                        jsonString.getBytes(StandardCharsets.UTF_8));

                // Finally, try to parse the newly generated token as a KSM config. If this
                // works, the config should be fully functional
                KsmConfig.parseKsmConfig(base64EncodedJson);

                // Make a copy of the existing attributes, modifying just the value for
                // KSM_CONFIGURATION_ATTRIBUTE
                attributes = new HashMap<>(attributes);
                attributes.put(
                        KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, base64EncodedJson);

            }

            // The KSM SDK only throws raw Exceptions, so we can't be more specific
            catch (Exception exception) {

                // If the parsing attempt fails, throw a translatable error for display
                // on the frontend
                throw new TranslatableGuacamoleClientException(
                        "Invalid one-time KSM token provided for "
                        + KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE + " attribute",
                        "CONNECTION_GROUP_ATTRIBUTES.ERROR_INVALID_KSM_ONE_TIME_TOKEN",
                        exception);
            }
        }

        return attributes;

    }
Given a map of attribute values, check for the presence of the
KSM_CONFIGURATION_ATTRIBUTE attribute. If it's set, check if it's a valid
KSM one-time token. If so, attempt to translate it to a base-64-encoded
json KSM config blob. If it's already a KSM config blob, validate it as
config blob. If either validation fails, a GuacamoleException will be thrown.
The processed attribute values will be returned.

@param attributes
    The attributes for which the KSM configuration attribute
    parsing/validation should be performed.

@throws GuacamoleException
    If the KSM_CONFIGURATION_ATTRIBUTE is set, but fails to validate as
    either a KSM one-time-token, or a KSM base64-encoded JSON config blob.
extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/conf/KsmAttributeService.java