@Override
    public boolean canImpersonateInternal(final String surrogate, final Principal principal, final Optional<? extends Service> service) {
        val ldapProperties = casProperties.getAuthn().getSurrogate().getLdap();
        for (val ldap : ldapProperties) {
            try (val connectionFactory = new LdapConnectionFactory(LdapUtils.newLdaptiveConnectionFactory(ldap))) {
                val id = principal.getId();
                val searchFilter = LdapUtils.newLdaptiveSearchFilter(ldap.getSurrogateSearchFilter(),
                    CollectionUtils.wrapList(LdapUtils.LDAP_SEARCH_FILTER_DEFAULT_PARAM_NAME, "surrogate"),
                    CollectionUtils.wrapList(id, surrogate));
                LOGGER.debug("Using LDAP search filter [{}] to authorize principal [{}] to impersonate [{}]", searchFilter, id, surrogate);
                var response = connectionFactory.executeSearchOperation(ldap.getBaseDn(), searchFilter, ldap.getPageSize());
                LOGGER.debug("LDAP search response: [{}]", response);
                if (LdapUtils.containsResultEntry(response) && doesSurrogateAccountExistInLdap(surrogate, connectionFactory, ldap)) {
                    return true;
                }
            } catch (final Throwable e) {
                LoggingUtils.error(LOGGER, e);
            }
        }
        return false;
    }
This is {@link SurrogateLdapAuthenticationService}.

@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-surrogate-authentication-ldap/src/main/java/org/apereo/cas/authentication/surrogate/SurrogateLdapAuthenticationService.java