private Map<String, String> getTokens(AssertedIdentity identity) {
        return Collections.unmodifiableMap(identity.getAttributes().entrySet()
                .stream()
                .filter((entry) -> !entry.getValue().isEmpty())
                .collect(Collectors.toMap(
                    (entry) -> TokenName.canonicalize(entry.getKey(), SAML_ATTRIBUTE_TOKEN_PREFIX),
                    (entry) -> entry.getValue().get(0)
                )));
    }
Returns a Map of all parameter tokens that should be made available for
substitution based on the given {@link AssertedIdentity}. The resulting
Map will contain one parameter token for each SAML attribute in the
SAML response that originally asserted the user's identity. Attributes
that have multiple values will be reduced to a single value, taking the
first available value and discarding the remaining values.

@param identity
    The {@link AssertedIdentity} representing the user identity
    asserted by the SAML IdP.

@return
    A Map of key and single value pairs that should be made available
    for substitution as parameter tokens.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/user/SAMLAuthenticatedUser.java