@Override
    public boolean canImpersonateInternal(final String surrogate, final Principal principal, final Optional<? extends Service> service) {
        if (this.eligibleAccounts.containsKey(principal.getId())) {
            val surrogates = this.eligibleAccounts.get(principal.getId());
            LOGGER.debug("Surrogate accounts authorized for [{}] are [{}]", principal.getId(), surrogates);
            return surrogates.contains(surrogate);
        }
        LOGGER.warn("[{}] is not eligible to authenticate as [{}]", principal.getId(), surrogate);
        return false;
    }
This is {@link SimpleSurrogateAuthenticationService}.

@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/surrogate/SimpleSurrogateAuthenticationService.java