@Override
    public boolean isServiceAccessAllowed(final RegisteredService registeredService, final Service service) {
        return Optional.ofNullable(ClientInfoHolder.getClientInfo())
            .stream()
            .anyMatch(info -> {
                var match = true;
                if (StringUtils.isNoneBlank(this.ipAddress)) {
                    LOGGER.debug("Evaluating IP address [{}] against pattern [{}]",
                        info.getClientIpAddress(), this.ipAddress);
                    match = RegexUtils.find(this.ipAddress, info.getClientIpAddress());
                }
                if (match && StringUtils.isNoneBlank(this.userAgent)) {
                    LOGGER.debug("Evaluating user agent [{}] against pattern [{}]",
                        info.getUserAgent(), this.userAgent);
                    match = RegexUtils.find(this.userAgent, info.getUserAgent());
                }
                if (match && !headers.isEmpty()) {
                    LOGGER.debug("Evaluating request headers [{}] against pattern [{}]",
                        info.getHeaders(), this.headers);
                    match = headers.entrySet()
                        .stream()
                        .filter(header -> info.getHeaders().containsKey(header.getKey()))
                        .allMatch(header -> {
                            val headerValue = info.getHeaders().get(header.getKey());
                            return RegexUtils.find(header.getValue(), headerValue.toString());
                        });
                }
                return match;
            });
    }
This is {@link HttpRequestRegisteredServiceAccessStrategy} that reaches out
to a remote endpoint, passing the CAS principal id to determine if access is allowed.
If the status code returned in the final response is not accepted by the policy here,
access shall be denied.

@author Misagh Moayyed
@since 5.0.0
core/cas-server-core-services-api/src/main/java/org/apereo/cas/services/HttpRequestRegisteredServiceAccessStrategy.java