It was hard to come up with a title for this article... Essentially the problem that I have been repeatedly been asked to solve is: Company A wants to use Company B's web application within it's own web application. How can we make sure that only people from Company A will be able to access Company B's application?

Our latest software project used CAS for authentication and single sign-on. I couldn't find any good documentation on how Spring Security and CAS played together. There is some documentation about how to configure your application to use CAS but not much on what messages go back and forth by whom and when.