code: private final String decryptPassword(String encryptedPassword)
              throws GuacamoleException {
  
          // If we get nothing, we return nothing.
          if (encryptedPassword == null || encryptedPassword.isEmpty()) {
              logger.warn("No or empty encrypted password, no password will be available.");
              return null;
          }
  
          final PrivateKey clearpassKey = confService.getClearpassKey();
          if (clearpassKey == null) {
              logger.debug("No private key available to decrypt password.");
              return null;
          }
  
          try {
  
              final Cipher cipher = Cipher.getInstance(clearpassKey.getAlgorithm());
  
              if (cipher == null)
                  throw new GuacamoleServerException("Failed to initialize cipher object with private key.");
  
              // Initialize the Cipher in decrypt mode.
              cipher.init(Cipher.DECRYPT_MODE, clearpassKey);
  
              // Decode and decrypt, and return a new string.
              final byte[] pass64 = BaseEncoding.base64().decode(encryptedPassword);
              final byte[] cipherData = cipher.doFinal(pass64);
              return new String(cipherData, Charset.forName("UTF-8"));
  
          }
          catch (BadPaddingException e) {
              throw new GuacamoleServerException("Bad padding when decrypting cipher data.", e);
          }
          catch (IllegalBlockSizeException e) {
              throw new GuacamoleServerException("Illegal block size while opening private key.", e);
          }
          catch (InvalidKeyException e) {
              throw new GuacamoleServerException("Specified private key for ClearPass decryption is invalid.", e);
          }
          catch (NoSuchAlgorithmException e) {
              throw new GuacamoleServerException("Unexpected algorithm for the private key.", e);
          }
          catch (NoSuchPaddingException e) {
              throw new GuacamoleServerException("No such padding trying to initialize cipher with private key.", e);
          }
  
      }
docs: Takes an encrypted string representing a password provided by
  the CAS ClearPass service and decrypts it using the private
  key configured for this extension.  Returns null if it is
  unable to decrypt the password.
  
  @param encryptedPassword
  A string with the encrypted password provided by the
  CAS service.
  
  @return
  The decrypted password, or null if it is unable to
  decrypt the password.
  
  @throws GuacamoleException
  If unable to get Guacamole configuration data