@Override
    public AuthorizationResult evaluate(final AuthorizableResource resource, final AuthorizationRequest request) {
        val facade = new DefaultGrouperFacade();
        val subjectGroups = facade.getGroupsForSubjectId(request.getPrincipal().getId());
        val subjectGroupNames = subjectGroups.stream()
            .flatMap(wsGetGroupsResult -> Stream.of(wsGetGroupsResult.getWsGroups()))
            .map(g -> GrouperFacade.getGrouperGroupAttribute(groupField, g))
            .collect(Collectors.toSet());
        return subjectGroupNames.containsAll(groups) ? AuthorizationResult.granted("OK") : AuthorizationResult.denied("Denied");
    }
This is {@link RequiredGrouperGroupsAuthorizationPolicy}.

@author Misagh Moayyed
@since 7.2.0
support/cas-server-support-heimdall/src/main/java/org/apereo/cas/heimdall/authorizer/resource/policy/RequiredGrouperGroupsAuthorizationPolicy.java