CAS documentation has moved over to, starting with CAS version 4.x. The wiki will no longer be maintained. For the most recent version of the documentation, please refer to the aforementioned link.

Trusted Authentication Handler

Including the Handler

In the pom.xml file for your CAS Maven2 WAR Overlay, add the following dependency:


Set Up CAS

Set up the login webflow

The CAS 3 Login Webflow needs to be modified. This webflow is located in /WEB-INF/login-webflow.xml. There is one new action state to place before the state viewLoginForm.

<action-state id="remoteAuthenticate">
  <action bean="principalFromRemoteAction" />
  <transition on="success" to="sendTicketGrantingTicket" />
  <transition on="error" to="viewLoginForm" />

In 3.4.2 and later, change <action bean="principalFromRemoteAction" /> to <evaluate expression="principalFromRemoteAction" />.

And 3 existing transitions need to be update:

In 3.4.12 (before?) ignore the above 3 transition declarations. Update the "generateLoginTicket" action-state to have the following transition.

<transition on="generated" to="remoteAuthenticate" />


Add the bean needed for the login flow :

<bean id="principalFromRemoteAction" class="org.jasig.cas.adaptors.trusted.web.flow.PrincipalFromRequestRemoteUserNonInteractiveCredentialsAction"
p:centralAuthenticationService-ref="centralAuthenticationService" />


In the bean authenticationManager, add:

Build the cas-webapp

Inside the ${project.home}/cas-server-webapp/ folder, run the command :

mvn package

You may now deploy the new webapp.

Tomcat & Apache integration issue

If you are using, a frontal Apache with mod_jk and Apache is handling the REMOTE_USER, you have to check the AJP connector in your Tomcat server.xml file. You should add the parameter tomcatAuthentication to false

Connector port="8009"
  enableLookups="false" redirectPort="8443" debug="0"
  tomcatAuthentication="false" />