Is it possible to restrict impersonation to a client or set of clients in a realm? i.e. not all Clients in a realm.