code: public void verifyAuthenticatedUser(AuthenticatedUser authenticatedUser)
              throws GuacamoleException {
  
          // Pull the original HTTP request used to authenticate
          Credentials credentials = authenticatedUser.getCredentials();
          HttpServletRequest request = credentials.getRequest();
  
          // Ignore anonymous users
          if (authenticatedUser.getIdentifier().equals(AuthenticatedUser.ANONYMOUS_IDENTIFIER))
              return;
  
          // Retrieve signed Duo response from request
          String signedResponse = request.getParameter(DuoSignedResponseField.PARAMETER_NAME);
  
          // If no signed response, request one
          if (signedResponse == null) {
  
              // Create field which requests a signed response from Duo that
              // verifies the identity of the given user via the configured
              // Duo API endpoint
              Field signedResponseField = new DuoSignedResponseField(
                      confService.getAPIHostname(),
                      duoService.createSignedRequest(authenticatedUser));
  
              // Create an overall description of the additional credentials
              // required to verify identity
              CredentialsInfo expectedCredentials = new CredentialsInfo(
                          Collections.singletonList(signedResponseField));
  
              // Request additional credentials
              throw new GuacamoleInsufficientCredentialsException(
                      "LOGIN.INFO_DUO_AUTH_REQUIRED", expectedCredentials);
  
          }
  
          // If signed response does not verify this user's identity, abort auth
          if (!duoService.isValidSignedResponse(authenticatedUser, signedResponse))
              throw new GuacamoleClientException("LOGIN.INFO_DUO_VALIDATION_CODE_INCORRECT");
  
      }
docs: Verifies the identity of the given user via the Duo multi-factor
  authentication service. If a signed response from Duo has not already
  been provided, a signed response from Duo is requested in the
  form of additional expected credentials. Any provided signed response
  is cryptographically verified. If no signed response is present, or the
  signed response is invalid, an exception is thrown.
  
  @param authenticatedUser
  The user whose identity should be verified against Duo.
  
  @throws GuacamoleException
  If required Duo-specific configuration options are missing or
  malformed, or if the user's identity cannot be verified.