CAS主要分为两部分

CAS Server端: 需单独部署（作统一的认证处理中心），负责用户校验认证功能，认证方式可从XML中检索或从数据库中检索数据进行认证。

CAS Client端：与web应用整合，负责保护web资源，当有请求访问web受保护资源时，将请求重定向到CAS Server端进行用户认证 。

用户请求web应用，cas-client-core中的AuthenticationFilter会拦截请求，doFilter方法根据是否有登录过而决定是否要重定向。

public final void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {    HttpServletRequest request = (HttpServletRequest)servletRequest;    HttpServletResponse response = (HttpServletResponse)servletResponse;    HttpSession session = request.getSession(false);    Assertion assertion = session != null?(Assertion)session.getAttribute("_const_cas_assertion_"):null;    if(assertion != null) {        filterChain.doFilter(request, response);    } else {        String serviceUrl = this.constructServiceUrl(request, response);        String ticket = CommonUtils.safeGetParameter(request, this.getArtifactParameterName());        boolean wasGatewayed = this.gatewayStorage.hasGatewayedAlready(request, serviceUrl);        if(!CommonUtils.isNotBlank(ticket) && !wasGatewayed) {            this.log.debug("no ticket and no assertion found");            String modifiedServiceUrl;            if(this.gateway) {                this.log.debug("setting gateway attribute in session");                modifiedServiceUrl = this.gatewayStorage.storeGatewayInformation(request, serviceUrl);            } else {                modifiedServiceUrl = serviceUrl;            }            if(this.log.isDebugEnabled()) {                this.log.debug("Constructed service url: " + modifiedServiceUrl);            }            String urlToRedirectTo = CommonUtils.constructRedirectUrl(this.casServerLoginUrl, this.getServiceParameterName(), modifiedServiceUrl, this.renew, this.gateway);            if(this.log.isDebugEnabled()) {                this.log.debug("redirecting to \"" + urlToRedirectTo + "\"");            }            response.sendRedirect(urlToRedirectTo);        } else {            filterChain.doFilter(request, response);        }    }}

若是首次登录，则会重定向到Cas Server端。Cas Server端的验证配置主要在deployerConfigContext.xml中。

登录认证过程：

用户输入登录资料后，提交至Cas Server端后，Cas Server端会返回一个ticket,及将TGC写入到Cookie中，

浏览器得到ticket后，向Cas Client发起请求(带上ticket)，Cas Client端再向Cas Server端请求认证ticket

认证通过后，则Cas Client 端跳转成功页面。

附一张网上找的流程图：