private void addConnectableTokens(
            GuacamoleConfiguration config, KsmClient ksm, Map<String, Future<String>> tokens,
            Map<String, String> parameters, TokenFilter filter) throws GuacamoleException {

        // Retrieve and define server-specific tokens, if any
        String hostname = parameters.get("hostname");
        if (hostname != null && !hostname.isEmpty())
            addRecordTokens(tokens, "KEEPER_SERVER_",
                    ksm.getRecordByHost(filter.filter(hostname)));

        // Tokens specific to RDP
        if ("rdp".equals(config.getProtocol())) {

            // Retrieve and define gateway server-specific tokens, if any
            String gatewayHostname = parameters.get("gateway-hostname");
            if (gatewayHostname != null && !gatewayHostname.isEmpty())
                addRecordTokens(tokens, "KEEPER_GATEWAY_",
                        ksm.getRecordByHost(filter.filter(gatewayHostname)));

            // Retrieve and define domain tokens, if any
            String domain = parameters.get("domain");
            String filteredDomain = null;
            if (domain != null && !domain.isEmpty()) {
                filteredDomain = filter.filter(domain);
                addRecordTokens(tokens, "KEEPER_DOMAIN_",
                        ksm.getRecordByDomain(filteredDomain));
            }

            // Retrieve and define gateway domain tokens, if any
            String gatewayDomain = parameters.get("gateway-domain");
            String filteredGatewayDomain = null;
            if (gatewayDomain != null && !gatewayDomain.isEmpty()) {
                filteredGatewayDomain = filter.filter(gatewayDomain);
                addRecordTokens(tokens, "KEEPER_GATEWAY_DOMAIN_",
                        ksm.getRecordByDomain(filteredGatewayDomain));
            }

            // If domain matching is disabled for user records,
            // explicitly set the domains to null when storing
            // user records to enable username-only matching
            if (!confService.getMatchUserRecordsByDomain()) {
                filteredDomain = null;
                filteredGatewayDomain = null;
            }

            // Retrieve and define user-specific tokens, if any
            String username = parameters.get("username");
            if (username != null && !username.isEmpty())
                addRecordTokens(tokens, "KEEPER_USER_",
                        ksm.getRecordByLogin(filter.filter(username),
                        filteredDomain));

            // Retrieve and define gateway user-specific tokens, if any
            String gatewayUsername = parameters.get("gateway-username");
            if (gatewayUsername != null && !gatewayUsername.isEmpty())
                addRecordTokens(tokens, "KEEPER_GATEWAY_USER_",
                        ksm.getRecordByLogin(
                            filter.filter(gatewayUsername),
                            filteredGatewayDomain));
        }

        else {

            // Retrieve and define user-specific tokens, if any
            // NOTE that non-RDP connections do not have a domain
            // field in the connection parameters, so the domain
            // will always be null
            String username = parameters.get("username");
            if (username != null && !username.isEmpty())
                addRecordTokens(tokens, "KEEPER_USER_",
                        ksm.getRecordByLogin(filter.filter(username), null));
        }
    }
Use the provided KSM client to add parameter tokens tokens to the
provided token map. The supplied filter will be used to replace
existing tokens in the provided connection parameters before KSM
record lookup. The supplied GuacamoleConfiguration instance will
be used to check the protocol, in case RDP-specific behavior is
needed.
@param config
   The GuacamoleConfiguration associated with the Connectable for which
   tokens are being added.

@param ksm
    The KSM client to use when fetching records.

@param tokens
    The tokens to which any fetched KSM record values should be added.

@param parameters
    The connection parameters associated with the Connectable for which
    tokens are being added.

@throws GuacamoleException
    If an error occurs while attempting to fetch KSM records or check
    configuration settings.
extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java