public GuacamoleTunnel connect(ModeledAuthenticatedUser user,
            ModeledConnectionGroup connectionGroup, GuacamoleClientInformation info,
            Map<String, String> tokens) throws GuacamoleException {

        // Connect only if READ permission is granted
        if (hasObjectPermission(user, connectionGroup.getIdentifier(), ObjectPermission.Type.READ))
            return tunnelService.getGuacamoleTunnel(user, connectionGroup, info, tokens);

        // The user does not have permission to connect
        throw new GuacamoleSecurityException("Permission denied.");

    }
Connects to the given connection group as the given user, using the
given client information. If the user does not have permission to read
the connection group, permission will be denied.

@param user
    The user connecting to the connection group.

@param connectionGroup
    The connectionGroup being connected to.

@param info
    Information associated with the connecting client.

@param tokens
    A Map containing the token names and corresponding values to be
    applied as parameter tokens when establishing the connection.

@return
    A connected GuacamoleTunnel associated with a newly-established
    connection.

@throws GuacamoleException
    If permission to connect to this connection is denied.
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connectiongroup/ConnectionGroupService.java