GUACAMOLE-2219: Fix vault token resolution for BALANCING connection groups

When connecting through a BALANCING connection group, the JDBC layer
internally selects and connects a child connection, bypassing the
vault extension's TokenInjectingConnection wrapper. This means
addTokens(Connection) is never called for the selected child, and
vault-managed tokens (e.g. KEEPER_USER_PASSWORD) are not resolved,
causing authentication failures on the child connection.

This commit addresses two issues:

1. VaultUserContext.addTokens(ConnectionGroup) now detects BALANCING
   groups and pre-resolves vault tokens for all child connections,
   ensuring tokens are available when the JDBC layer applies them
   to the selected child's configuration.

2. KsmSecretService.getTokens() now guards against null
   GuacamoleConfiguration, which is always null for connection
   groups since they have no protocol configuration. Previously
   this caused a NullPointerException.

Author: subbareddyalamur1

extensions/guacamole-vault/modules/guacamole-vault-base/src/main/java/org/apache/guacamole/vault/user/VaultUserContext.java

@@ -27,6 +27,7 @@
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Set;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.Future;
 import java.util.stream.Collectors;
@@ -357,6 +358,72 @@ protected void addTokens(ConnectionGroup connectionGroup,
                 connectionGroup, confService.getTokenMapping(), filter,
                 null, new TokenFilter(tokens))));
 
+        // For BALANCING groups, the JDBC layer selects and connects a child
+        // connection internally, bypassing the vault's addTokens(Connection).
+        // Pre-resolve vault tokens for child connections here so they are
+        // available when the JDBC layer applies tokens to the child's config.
+        if (connectionGroup.getType() == ConnectionGroup.Type.BALANCING) {
+
+            Set<String> childIds;
+            try {
+                childIds = connectionGroup.getConnectionIdentifiers();
+            }
+            catch (GuacamoleException e) {
+                logger.debug("Unable to retrieve child connection identifiers "
+                        + "for BALANCING group \"{}\": {}", identifier,
+                        e.getMessage());
+                return;
+            }
+
+            for (String childId : childIds) {
+                try {
+
+                    Connection child = getPrivileged()
+                            .getConnectionDirectory().get(childId);
+                    if (child == null)
+                        continue;
+
+                    GuacamoleConfiguration childConfig =
+                            child.getConfiguration();
+                    if (childConfig == null)
+                        continue;
+
+                    logger.debug("Resolving vault tokens for BALANCING "
+                            + "child connection \"{}\" (\"{}\").",
+                            child.getIdentifier(), child.getName());
+
+                    TokenFilter childFilter = createFilter();
+                    childFilter.setToken(CONNECTION_NAME_TOKEN,
+                            child.getName());
+                    childFilter.setToken(CONNECTION_IDENTIFIER_TOKEN,
+                            child.getIdentifier());
+
+                    Map<String, String> parameters =
+                            childConfig.getParameters();
+
+                    String hostname = parameters.get("hostname");
+                    if (hostname != null && !hostname.isEmpty())
+                        childFilter.setToken(CONNECTION_HOSTNAME_TOKEN,
+                                hostname);
+
+                    String username = parameters.get("username");
+                    if (username != null && !username.isEmpty())
+                        childFilter.setToken(CONNECTION_USERNAME_TOKEN,
+                                username);
+
+                    tokens.putAll(resolve(getTokens(child,
+                            confService.getTokenMapping(), childFilter,
+                            childConfig, new TokenFilter(tokens))));
+
+                }
+                catch (GuacamoleException e) {
+                    logger.debug("Unable to resolve vault tokens for "
+                            + "child connection \"{}\": {}",
+                            childId, e.getMessage());
+                }
+            }
+        }
+
     }
 
     /**

extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmSecretService.java

@@ -520,6 +520,11 @@ public Map<String, Future<String>> getTokens(UserContext userContext, Connectabl
             GuacamoleConfiguration config, TokenFilter filter) throws GuacamoleException {
 
         Map<String, Future<String>> tokens = new HashMap<>();
+
+        // Connection groups have no GuacamoleConfiguration — nothing to resolve
+        if (config == null)
+            return tokens;
+
         Map<String, String> parameters = config.getParameters();
 
         // Only use the user-specific KSM config if explicitly enabled in the global