SpecificImpersonationPolicy to match target user to group

[Cantor, Scott]

> I created the AttributeResolutionContext under the
> AccessControlContext as it seemed a logical spot; my first attempt
> I put it under the ProfileRequestContext but that interfered with
> the eventual attribute release for the SAML itself.

It can't interfere unless you skip the final step and remove it when you're done. Putting it someplace else works, but is just playing with fire one way or the other.

If you needed to keep the results around longer term, that's what the AttributeContext is for, but it still creates a problem of putting it some place it won't collide. The only "guaranteed" thing we won't ever collide with is the ScratchContext class.

-- Scott