@Override
    public SSOAuthenticatedUser authenticateUser(Credentials credentials)
            throws GuacamoleException {

        //
        // Overall flow:
        //
        // 1) An unauthenticated user makes a GET request to
        //    ".../api/ext/ssl/identity". After a series of redirects
        //    intended to prevent that identity from being inadvertently
        //    cached and inherited by future authentication attempts on the
        //    same client machine, an external SSL termination service requests
        //    and validates the user's certificate, those details are passed
        //    back to Guacamole via HTTP headers, and Guacamole produces a JSON
        //    response containing an opaque state value.
        //
        // 2) The user (still unauthenticated) resubmits the opaque state
        //    value from the received JSON as the "state" parameter of a
        //    standard Guacamole authentication request (".../api/tokens").
        //
        // 3) If the certificate received was valid, the user is authenticated
        //    according to the identity asserted by that certificate. If not,
        //    authentication is refused.
        //
        // NOTE: All SSL termination endpoints in front of Guacamole MUST
        // be configured to drop these headers from any inbound requests
        // or users may be able to assert arbitrary identities, since this
        // extension does not validate anything but the certificate timestamps.
        // It relies purely on SSL termination to validate that the certificate
        // was signed by the expected CA.
        //

        // We MUST have the domain associated with the request to ensure we
        // always get fresh SSL sessions when validating client certificates
        String host = credentials.getHeader("Host");
        if (host == null)
            return null;

        //
        // Handle only auth session tokens at the primary URI, using the
        // pre-verified information from those tokens to determine user
        // identity.
        //

        if (confService.isPrimaryHostname(host))
            return processIdentity(credentials);

        // All other requests are not allowed - redirect to proper hostname
        throw new GuacamoleInvalidCredentialsException("Authentication is "
                + "only allowed against the primary URL of this Guacamole "
                + "instance.",
            new CredentialsInfo(Arrays.asList(new Field[] {
                new RedirectField("primaryURI", confService.getPrimaryURI(),
                        new TranslatableMessage("LOGIN.INFO_REDIRECT_PENDING"))
            }))
        );

    }
Processes the given credentials, returning the identity represented by
the auth session token present in that request associated with the 
credentials. If no such token is present, or the token does not represent
a valid identity, null is returned.

@param credentials
    The credentials to extract the auth session token from.

@return
    The identity represented by the auth session token in the request,
    or null if there is no such token or the token does not represent a
    valid identity.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-ssl/src/main/java/org/apache/guacamole/auth/ssl/AuthenticationProviderService.java