public Map<String, UserGroup> getUserGroups(LDAPAuthenticatedUser user)
            throws GuacamoleException {

        ConnectedLDAPConfiguration config = user.getLDAPConfiguration();
        
        // Do not return any user groups if base DN is not specified
        Dn groupBaseDN = config.getGroupBaseDN();
        if (groupBaseDN == null)
            return Collections.emptyMap();

        // Gather all attributes relevant for a group
        String memberAttribute = config.getMemberAttribute();
        Collection<String> groupAttributes = new HashSet<>(config.getGroupNameAttributes());
        groupAttributes.add(memberAttribute);

        // Retrieve all visible user groups which are not guacConfigGroups
        Collection<String> attributes = config.getGroupNameAttributes();
        List<Entry> results = queryService.search(
            config,
            config.getLDAPConnection(),
            groupBaseDN,
            getGroupSearchFilter(config),
            attributes,
            null,
            groupAttributes
        );

        // Convert retrieved user groups to map of identifier to Guacamole
        // user group object
        return queryService.asMap(results, entry -> {

            // Translate entry into UserGroup object having proper identifier
            try {
                String name = queryService.getIdentifier(entry, attributes);
                if (name != null)
                    return new SimpleUserGroup(name);
            }
            catch (LdapInvalidAttributeValueException e) {
                return null;
            }

            // Ignore user groups which lack a name attribute
            logger.debug("User group \"{}\" is missing a name attribute "
                    + "and will be ignored.", entry.getDn().toString());
            return null;

        });

    }
Returns all Guacamole user groups accessible to the given user.

@param user
    The AuthenticatedUser object associated with the user who is
    currently authenticated with Guacamole.

@return
    All user groups accessible to the user currently bound under the
    given LDAP connection, as a map of user group identifier to
    corresponding UserGroup object.

@throws GuacamoleException
    If an error occurs preventing retrieval of user groups.
extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/group/UserGroupService.java