@POST
    public APIAuthenticationResult createToken(@FormParam("username") String username,
            @FormParam("password") String password,
            @FormParam("token") String token,
            @Context HttpServletRequest consumedRequest,
            MultivaluedMap<String, String> parameters)
            throws GuacamoleException {

        // Reconstitute the HTTP request with the map of parameters
        HttpServletRequest request = new APIRequest(consumedRequest, parameters);

        // Build credentials from request
        Credentials credentials = getCredentials(request, username, password);

        // Create/update session producing possibly-new token
        token = authenticationService.authenticate(credentials, token);

        // Pull corresponding session
        GuacamoleSession session = authenticationService.getGuacamoleSession(token);
        if (session == null)
            throw new GuacamoleResourceNotFoundException("No such token.");

        // Build list of all available auth providers
        List<DecoratedUserContext> userContexts = session.getUserContexts();
        List<String> authProviderIdentifiers = new ArrayList<String>(userContexts.size());
        for (UserContext userContext : userContexts)
            authProviderIdentifiers.add(userContext.getAuthenticationProvider().getIdentifier());

        // Return possibly-new auth token
        AuthenticatedUser authenticatedUser = session.getAuthenticatedUser();
        return new APIAuthenticationResult(
            token,
            authenticatedUser.getIdentifier(),
            authenticatedUser.getAuthenticationProvider().getIdentifier(),
            authProviderIdentifiers
        );

    }
Authenticates a user, generates an auth token, associates that auth token
with the user's UserContext for use by further requests. If an existing
token is provided, the authentication procedure will attempt to update
or reuse the provided token.

@param username
    The username of the user who is to be authenticated.

@param password
    The password of the user who is to be authenticated.

@param token
    An optional existing auth token for the user who is to be
    authenticated.

@param consumedRequest
    The HttpServletRequest associated with the login attempt. The
    parameters of this request may not be accessible, as the request may
    have been fully consumed by JAX-RS.

@param parameters
    A MultivaluedMap containing all parameters from the given HTTP
    request. All request parameters must be made available through this
    map, even if those parameters are no longer accessible within the
    now-fully-consumed HTTP request.

@return
    An authentication response object containing the possible-new auth
    token, as well as other related data.

@throws GuacamoleException
    If an error prevents successful authentication.
guacamole/src/main/java/org/apache/guacamole/rest/auth/TokenRESTService.java