@Override
    public final boolean canImpersonate(final String surrogate, final Principal principal,
                                        final Optional<? extends Service> service) throws Throwable {
        val serviceAuthorized = isServiceAuthorizedForImpersonation(principal, service);
        return serviceAuthorized && (surrogate.equalsIgnoreCase(principal.getId())
            || isPrincipalAuthorizedForImpersonation(surrogate, principal, service)
            || isWildcardedAccount(surrogate, principal, service)
            || canImpersonateInternal(surrogate, principal, service));
    }
This is {@link BaseSurrogateAuthenticationService}.

@author Misagh Moayyed
@since 5.2.0
support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/surrogate/BaseSurrogateAuthenticationService.java