diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java
new file mode 100644
index 000000000..397c42f11
--- /dev/null
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmConnectionGroup.java
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.vault.ksm.user;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.guacamole.net.auth.ConnectionGroup;
+import org.apache.guacamole.net.auth.DelegatingConnectionGroup;
+import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
+
+ /**
+  * A KSM-specific connection group implementation that always exposes
+  * the KSM_CONFIGURATION_ATTRIBUTE attribute, even when no value is set.
+  * This ensures that the attribute will always show up in the UI, even
+  * for connection groups that don't already have it set.
+  */
+ public class KsmConnectionGroup extends DelegatingConnectionGroup {
+
+    /**
+     * Create a new KsmConnectionGroup instance, wrapping the provided
+     * ConnectionGroup.
+     *
+     * @param connectionGroup
+     *     The ConnectionGroup instance to wrap.
+     */
+    public KsmConnectionGroup(ConnectionGroup connectionGroup) {
+
+        // Wrap the provided connection group
+        super(connectionGroup);
+    }
+
+    @Override
+    public Map<String, String> getAttributes() {
+
+        // All attributes defined on the underlying connection group
+        Map<String, String> attributes = super.getAttributes();
+
+        // If the attribute is already present, there's no need to add it - return
+        // the existing attributes as they are
+        if (attributes.containsKey(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE))
+            return attributes;
+
+        // Make a copy of the existing attributes and add KSM_CONFIGURATION_ATTRIBUTE
+        attributes = new HashMap<>(attributes);
+        attributes.put(KsmAttributeService.KSM_CONFIGURATION_ATTRIBUTE, null);
+        return attributes;
+
+    }
+
+    /**
+     * Return the underlying ConnectionGroup that's wrapped by this KsmConnectionGroup.
+     *
+     * @return
+     *     The underlying ConnectionGroup that's wrapped by this KsmConnectionGroup.
+     */
+    ConnectionGroup getUnderlyConnectionGroup() {
+        return getDelegateConnectionGroup();
+    }
+
+ }
\ No newline at end of file
diff --git a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
index fc4a96213..b924bc524 100644
--- a/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
+++ b/extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/user/KsmDirectoryService.java
@@ -31,7 +31,7 @@ import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.language.TranslatableGuacamoleClientException;
 import org.apache.guacamole.net.auth.Attributes;
 import org.apache.guacamole.net.auth.ConnectionGroup;
-import org.apache.guacamole.net.auth.DelegatingDirectory;
+import org.apache.guacamole.net.auth.DecoratingDirectory;
 import org.apache.guacamole.net.auth.Directory;
 import org.apache.guacamole.vault.ksm.conf.KsmAttributeService;
 import org.apache.guacamole.vault.ksm.conf.KsmConfig;
@@ -227,8 +227,10 @@ public class KsmDirectoryService extends VaultDirectoryService {
             Directory<ConnectionGroup> underlyingDirectory) throws GuacamoleException {
 
         // A ConnectionGroup directory that will intercept add and update calls to
-        // validate KSM configurations, and translate one-time-tokens, if possible
-        return new DelegatingDirectory<ConnectionGroup>(underlyingDirectory) {
+        // validate KSM configurations, and translate one-time-tokens, if possible,
+        // as well as ensuring that all ConnectionGroups returned include the
+        // KSM_CONFIGURATION_ATTRIBUTE attribute, so it will be available in the UI.
+        return new DecoratingDirectory<ConnectionGroup>(underlyingDirectory) {
 
             @Override
             public void add(ConnectionGroup connectionGroup) throws GuacamoleException {
@@ -248,6 +250,23 @@ public class KsmDirectoryService extends VaultDirectoryService {
                 super.update(connectionGroup);
             }
 
+            @Override
+            protected ConnectionGroup decorate(ConnectionGroup connectionGroup) throws GuacamoleException {
+
+                // Wrap the existing connection group in a KsmConnection to ensure the presence of the
+                // KSM_CONFIGURATION_ATTRIBUTE attribute
+                return new KsmConnectionGroup(connectionGroup);
+
+            }
+
+            @Override
+            protected ConnectionGroup undecorate(ConnectionGroup connectionGroup) throws GuacamoleException {
+
+                // Return the underlying connection group that the KsmConnectionGroup wraps
+                return ((KsmConnectionGroup) connectionGroup).getUnderlyConnectionGroup();
+
+            }
+
         };
     }
 }