code: public LDAPAuthenticatedUser authenticateUser(Credentials credentials)
              throws GuacamoleException {
  
          // Attempt bind
          LDAPConnection ldapConnection;
          try {
              ldapConnection = bindAs(credentials);
          }
          catch (GuacamoleException e) {
              logger.error("Cannot bind with LDAP server: {}", e.getMessage());
              logger.debug("Error binding with LDAP server.", e);
              ldapConnection = null;
          }
  
          // If bind fails, permission to login is denied
          if (ldapConnection == null)
              throw new GuacamoleInvalidCredentialsException("Permission denied.", CredentialsInfo.USERNAME_PASSWORD);
  
          try {
  
              // Retrieve group membership of the user that just authenticated
              Set<String> effectiveGroups =
                      userGroupService.getParentUserGroupIdentifiers(ldapConnection,
                              ldapConnection.getAuthenticationDN());
  
              // Return AuthenticatedUser if bind succeeds
              LDAPAuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
              authenticatedUser.init(credentials, getAttributeTokens(ldapConnection, credentials.getUsername()), effectiveGroups);
              return authenticatedUser;
  
          }
          // Always disconnect
          finally {
              ldapService.disconnect(ldapConnection);
          }
  
      }
docs: Returns an AuthenticatedUser representing the user authenticated by the
  given credentials. Also adds custom LDAP attributes to the
  AuthenticatedUser.
  
  @param credentials
  The credentials to use for authentication.
  
  @return
  An AuthenticatedUser representing the user authenticated by the
  given credentials.
  
  @throws GuacamoleException
  If an error occurs while authenticating the user, or if access is
  denied.