code: public AuthenticatedUser authenticateUser(Credentials credentials)
              throws GuacamoleException {
  
          String username = null;
  
          // Validate OpenID token in request, if present, and derive username
          HttpServletRequest request = credentials.getRequest();
          if (request != null) {
              String token = request.getParameter(TokenField.PARAMETER_NAME);
              if (token != null)
                  username = tokenService.processUsername(token);
          }
  
          // If the username was successfully retrieved from the token, produce
          // authenticated user
          if (username != null) {
  
              // Create corresponding authenticated user
              AuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
              authenticatedUser.init(username, credentials);
              return authenticatedUser;
  
          }
  
          // Request OpenID token
          throw new GuacamoleInvalidCredentialsException("Invalid login.",
              new CredentialsInfo(Arrays.asList(new Field[] {
  
                  // OpenID-specific token (will automatically redirect the user
                  // to the authorization page via JavaScript)
                  new TokenField(
                      confService.getAuthorizationEndpoint(),
                      confService.getScope(),
                      confService.getClientID(),
                      confService.getRedirectURI(),
                      nonceService.generate(confService.getMaxNonceValidity() * 60000L)
                  )
  
              }))
          );
  
      }
docs: Returns an AuthenticatedUser representing the user authenticated by the
  given credentials.
  
  @param credentials
  The credentials to use for authentication.
  
  @return
  An AuthenticatedUser representing the user authenticated by the
  given credentials.
  
  @throws GuacamoleException
  If an error occurs while authenticating the user, or if access is
  denied.