...
Here is an example of the file:
If a user attempts impersonation and they are not in the file, or the service they attempt to impersonate is not in their list of services than they will receive the CAS Unavailable screen.
This file can be edited and on a running system and the changes will be loaded immediately.
If a service requires Duo to login, then it will also require Duo to impersonate. There was thought of making impersonate require Duo for any service, but that is not implemented for now.