@Override
    public Map<String, Future<String>> getTokens(UserContext userContext, Connectable connectable,
            GuacamoleConfiguration config, TokenFilter filter) throws GuacamoleException {

        Map<String, Future<String>> tokens = new HashMap<>();
        Map<String, String> parameters = config.getParameters();

        // Only use the user-specific KSM config if explicitly enabled in the global
        // configuration, AND for the specific connectable being connected to
        String userKsmConfig = getUserKSMConfig(userContext, connectable);
        if (userKsmConfig != null && !userKsmConfig.trim().isEmpty())
            addConnectableTokens(
                    config, getClient(userKsmConfig), tokens, parameters, filter);

        // Add connection group or globally defined tokens after the user-specific
        // ones to ensure that the user config will be overriden on collision
        String ksmConfig = getConnectionGroupKsmConfig(userContext, connectable);
        addConnectableTokens(
            config, getClient(ksmConfig), tokens, parameters, filter);

        return tokens;

    }
Use the provided KSM client to add parameter tokens tokens to the
provided token map. The supplied filter will be used to replace
existing tokens in the provided connection parameters before KSM
record lookup. The supplied GuacamoleConfiguration instance will
be used to check the protocol, in case RDP-specific behavior is
needed.
@param config
   The GuacamoleConfiguration associated with the Connectable for which
   tokens are being added.

@param ksm
    The KSM client to use when fetching records.

@param tokens
    The tokens to which any fetched KSM record values should be added.

@param parameters
    The connection parameters associated with the Connectable for which
    tokens are being added.

@throws GuacamoleException
    If an error occurs while attempting to fetch KSM records or check
    configuration settings.
extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java