SpecificImpersonationPolicy to match target user to group

[Cantor, Scott]

The supported way to invoke the resolver is:

1. Populate and place an AttributeResolverContext somewhere in the tree with all desired fields set.
2. Call AttributeResolverContext's resolveAttributes() helper method with an instance of the service (the shibboleth.AttributeResolverService bean should be of the proper type I believe).
3. Remove the context when done with the results.

-- Scott