@Override
    protected void addTokens(Connection connection, Map<String, String> tokens)
            throws GuacamoleException {

        String name = connection.getName();
        String identifier = connection.getIdentifier();
        logger.debug("Injecting tokens from vault for connection \"{}\" "
                + "(\"{}\").", identifier, name);

        // Add general and connection-specific tokens
        TokenFilter filter = createFilter();
        filter.setToken(CONNECTION_NAME_TOKEN, connection.getName());
        filter.setToken(CONNECTION_IDENTIFIER_TOKEN, identifier);
        // Add hostname and username tokens if available (implementations are
        // not required to expose connection configuration details)

        GuacamoleConfiguration config = getConnectionConfiguration(connection);
        Map<String, String> parameters = config.getParameters();

        String hostname = parameters.get("hostname");
        if (hostname != null && !hostname.isEmpty())
            filter.setToken(CONNECTION_HOSTNAME_TOKEN, hostname);
        else
            logger.debug("Hostname for connection \"{}\" (\"{}\") not "
                    + "available. \"{}\" token will not be populated in "
                    + "secret names.", identifier, name,
                    CONNECTION_HOSTNAME_TOKEN);

        String username = parameters.get("username");
        if (username != null && !username.isEmpty())
            filter.setToken(CONNECTION_USERNAME_TOKEN, username);
        else
            logger.debug("Username for connection \"{}\" (\"{}\") not "
                    + "available. \"{}\" token will not be populated in "
                    + "secret names.", identifier, name,
                    CONNECTION_USERNAME_TOKEN);

        // Substitute tokens producing secret names, retrieving and storing
        // those secrets as parameter tokens
        tokens.putAll(resolve(getTokens(connection, confService.getTokenMapping(),
                filter, config, new TokenFilter(tokens))));

    }
Retrieves the GuacamoleConfiguration of the given Connection. If
possible, privileged access to the configuration is obtained first. Note
that the underlying extension is not required to allow privileged
access, nor is it required to expose the underlying configuration at
all.

@param connection
    The connection to retrieve the configuration from.

@return
    The GuacamoleConfiguration associated with the given connection,
    which may be partial or empty.

@throws GuacamoleException
    If an error prevents privileged retrieval of the configuration.
extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java