@Override
    public SAMLAuthenticatedUser authenticateUser(Credentials credentials)
            throws GuacamoleException {

        // Use established SAML identity if already provided by the SAML IdP
        AssertedIdentity identity = sessionManager.getIdentity(
                getSessionIdentifier(credentials));

        if (identity != null) {
            SAMLAuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
            authenticatedUser.init(identity, credentials);
            return authenticatedUser;
        }

        // Redirect to SAML IdP if no SAML identity is associated with the
        // Guacamole authentication request
        throw new GuacamoleInvalidCredentialsException("Redirecting to SAML IdP.",
                new CredentialsInfo(Arrays.asList(new Field[] {
                    new RedirectField(AUTH_SESSION_QUERY_PARAM, getLoginURI(),
                            new TranslatableMessage("LOGIN.INFO_IDP_REDIRECT_PENDING"))
                }))
        );

    }
Return the value of the session identifier associated with the given
credentials, or null if no session identifier is found in the
credentials.

@param credentials
    The credentials from which to extract the session identifier.

@return
    The session identifier associated with the given credentials, or
    null if no identifier is found.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/src/main/java/org/apache/guacamole/auth/saml/AuthenticationProviderService.java