public Set<String> processGroups(JwtClaims claims) throws GuacamoleException {
        String groupsClaim = confService.getGroupsClaimType();

        if (claims != null) {
            try {
                // Pull groups from claims
                List<String> oidcGroups = claims.getStringListClaimValue(groupsClaim);
                if (oidcGroups != null && !oidcGroups.isEmpty())
                    return Collections.unmodifiableSet(new HashSet<>(oidcGroups));
            }   
            catch (MalformedClaimException e) {
                logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage());
                logger.debug("Malformed claim within received JWT.", e);
            }
        }

        // Could not retrieve groups from JWT
        return Collections.emptySet();
    }
Parses the given JwtClaims, returning the groups contained
therein, as defined by the groups claim type given in
guacamole.properties. If the groups claim type is missing or
is invalid, an empty set is returned.

@param claims
    A valid JwtClaims to extract groups from.

@return
    A Set of String representing the groups the user is member of
    from the OpenID provider point of view, or an empty Set if
    claim is not valid or the groups claim type is missing,

@throws GuacamoleException
    If guacamole.properties could not be parsed.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java