protected boolean isServiceAuthorizedForImpersonation(final Principal principal,
                                                          final Optional<? extends Service> givenService) throws Throwable {
        if (givenService.isPresent()) {
            val service = givenService.get();
            val registeredService = servicesManager.findServiceBy(service);
            val accessGranted = principalAccessStrategyEnforcer.authorize(
                RegisteredServicePrincipalAccessStrategyEnforcer.PrincipalAccessStrategyContext.builder()
                    .registeredService(registeredService)
                    .principalId(principal.getId())
                    .principalAttributes(principal.getAttributes())
                    .service(service)
                    .applicationContext(applicationContext)
                    .build());
            return accessGranted
                && registeredService instanceof final WebBasedRegisteredService wbrs
                && wbrs.getSurrogatePolicy().isEnabled();
        }
        return true;
    }
This is {@link BaseSurrogateAuthenticationService}.

@author Misagh Moayyed
@since 5.2.0
support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/surrogate/BaseSurrogateAuthenticationService.java