@Override
    public boolean shouldGenerate(final AuthenticationResult authenticationResult, final Service service) throws Throwable {
        val authentication = authenticationResult.getAuthentication();
        val result = findSurrogateCredentialTrait(authentication);
        if (result.isPresent()) {
            val pair = result.get();
            val givenService = serviceSelectionPlan.resolveService(service);
            val principal = resolvedPrincipal(pair.getKey().getId());
            val surrogateUser = pair.getRight().getSurrogateUsername();
            LOGGER.debug("Checking if [{}] can impersonate [{}] for service [{}]", principal, surrogateUser, givenService);
            if (surrogateAuthenticationService.canImpersonate(surrogateUser, principal, Optional.ofNullable(givenService))) {
                return true;
            }
            LOGGER.warn("Impersonation is not allowed for [{}]", surrogateUser);
            throw new SurrogateAuthenticationException("Impersonating %s is not allowed".formatted(surrogateUser));
        }
        return true;
    }
This is {@link SurrogateServiceTicketGeneratorAuthority}.

@author Misagh Moayyed
@since 7.2.0
support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/ticket/SurrogateServiceTicketGeneratorAuthority.java