protected boolean isPrincipalAuthorizedForImpersonation(final String surrogate, final Principal principal,
                                                            final Optional<? extends Service> givenService) {
        val core = casProperties.getAuthn().getSurrogate().getCore();
        if (!core.getPrincipalAttributeNames().isEmpty() && !core.getPrincipalAttributeValues().isEmpty()) {
            return core.getPrincipalAttributeNames()
                .stream()
                .filter(name -> principal.getAttributes().containsKey(name))
                .anyMatch(name -> {
                    val attributeValues = principal.getAttributes().get(name);
                    return RegexUtils.findFirst(core.getPrincipalAttributeValues(), attributeValues).isPresent();
                });
        }
        return false;
    }
This is {@link BaseSurrogateAuthenticationService}.

@author Misagh Moayyed
@since 5.2.0
support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/surrogate/BaseSurrogateAuthenticationService.java