code: public GuacamoleTunnel connect(ModeledAuthenticatedUser user,
              ModeledConnection connection, GuacamoleClientInformation info,
              Map<String, String> tokens) throws GuacamoleException {
  
          // Connect only if READ permission is granted
          if (hasObjectPermission(user, connection.getIdentifier(), ObjectPermission.Type.READ))
              return tunnelService.getGuacamoleTunnel(user, connection, info, tokens);
  
          // The user does not have permission to connect
          throw new GuacamoleSecurityException("Permission denied.");
  
      }
docs: Connects to the given connection as the given user, using the given
  client information. If the user does not have permission to read the
  connection, permission will be denied.
  
  @param user
  The user connecting to the connection.
  
  @param connection
  The connection being connected to.
  
  @param info
  Information associated with the connecting client.
  
  @param tokens
  A Map containing the token names and corresponding values to be
  applied as parameter tokens when establishing the connection.
  
  @return
  A connected GuacamoleTunnel associated with a newly-established
  connection.
  
  @throws GuacamoleException
  If permission to connect to this connection is denied.