private Credentials getCredentials(HttpServletRequest request,
            String username, String password) {

        // If no username/password given, try Authorization header
        if (username == null && password == null) {

            String authorization = request.getHeader("Authorization");
            if (authorization != null && authorization.startsWith("Basic ")) {

                try {

                    // Decode base64 authorization
                    String basicBase64 = authorization.substring(6);
                    String basicCredentials = new String(
                            BaseEncoding.base64().decode(basicBase64), "UTF-8");

                    // Pull username/password from auth data
                    int colon = basicCredentials.indexOf(':');
                    if (colon != -1) {
                        username = basicCredentials.substring(0, colon);
                        password = basicCredentials.substring(colon + 1);
                    }
                    else
                        logger.debug("Invalid HTTP Basic \"Authorization\" header received.");

                }

                // UTF-8 support is required by the Java specification
                catch (UnsupportedEncodingException e) {
                    throw new UnsupportedOperationException("Unexpected lack of UTF-8 support.", e);
                }

            }

        } // end Authorization header fallback

        // Build credentials
        return new Credentials(username, password, request);

    }
Returns the credentials associated with the given request, using the
provided username and password.

@param request
    The request to use to derive the credentials.

@param username
    The username to associate with the credentials, or null if the
    username should be derived from the request.

@param password
    The password to associate with the credentials, or null if the
    password should be derived from the request.

@return
    A new Credentials object whose contents have been derived from the
    given request, along with the provided username and password.
guacamole/src/main/java/org/apache/guacamole/rest/auth/TokenRESTService.java