@Override
    public void handleEvent(Object event) throws GuacamoleException {

        // If the authentication attempt is incomplete or credentials cannot be
        // extracted, there's nothing to do
        if (event instanceof AuthenticationRequestReceivedEvent
                || !(event instanceof CredentialEvent))
            return;

        // Look for a session identifier associated with these credentials
        String sessionIdentifier = getSessionIdentifier(
                ((CredentialEvent) event).getCredentials());

        // If no session is associated with these credentials, there's
        // nothing to do
        if (sessionIdentifier == null)
            return;

        // If the SSO auth succeeded, but other auth providers failed to
        // authenticate the user associated with the credentials in this
        // failure event, they may wish to make another login attempt. To
        // avoid an infinite login attempt loop, re-enable the session
        // associated with these credentials, allowing the auth attempt to be
        // resumed without requiring another round trip to the SSO service.
        if (event instanceof AuthenticationFailureEvent) {
            Throwable failure = ((AuthenticationFailureEvent) event).getFailure();

            // If and only if the failure was associated with missing or
            // credentials, or a non-security related request issue,
            // reactivate the session
            if (failure instanceof GuacamoleInsufficientCredentialsException
                    || ((failure instanceof GuacamoleClientException)
                    && !(failure instanceof GuacamoleSecurityException))) {

                reactivateSession(sessionIdentifier);
                return;

            }

        }

        // Invalidate the session in all other cases
        invalidateSession(sessionIdentifier);

    }
A Listener that will reactivate or invalidate SSO auth sessions depending on
overall auth success or failure.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-base/src/main/java/org/apache/guacamole/auth/sso/SSOAuthenticationEventListener.java