protected boolean doRejectedAttributesRefusePrincipalAccess(final RegisteredServiceAccessStrategyRequest request) {
        LOGGER.debug("These rejected attributes [{}] are examined against [{}] before service can proceed.",
            rejectedAttributes, request.getAttributes());
        return !rejectedAttributes.isEmpty() && requiredAttributesFoundInMap(request, rejectedAttributes);
    }
Defines the attribute aggregation behavior when checking for required attributes.
Default requires that all attributes be present and match the principal's.
core/cas-server-core-services-api/src/main/java/org/apereo/cas/services/util/RegisteredServiceAccessStrategyEvaluator.java