title: SSO and REST Api Authentication on multiple Application
body: <p>at our company we have multiple web applications deployed that are secured through SSO using CAS server. 
  A user requests an url of an application, and if not already authenticated, gets redirected to the CAS server login page. In case of successful authentication the user will be redirected back to the originally requested url. common workflow and works perfectly.</p>
  
  <p>but, we also want to protect our REST Apis using CAS Server. 
  Our prefered flow would be as follows:</p>
  
  <ul>
  <li>a user creates a token for an application REST Api</li>
  <li>using this token the user can request a temporary access token (like the CAS token)</li>
  <li>in each request to the REST Api, the user includes the temporary access token either as a HTTP Header or a request parameter</li>
  <li>the REST Api application checks the provided temporary token against the CAS server for validity</li>
  </ul>
  
  <p>sounds like OAuth, which CAS server does support, except that the user is not asked for a credentials at any time, but we'd also like to provide authentication for services i.e., other applications calling our APIs:</p>
  
  <ul>
  <li>developer asks for a REST Api token (which is associated with a CAS user)</li>
  <li>application requests a temporary access token using the Api token</li>
  <li>further requests to the Api include the temporary access token either as a HTTP header or a request parameter</li>
  <li>REST Api application checks temporary access token against CAS server for validity</li>
  </ul>
  
  <p>We want our REST Api applications to know nothing about user credentials, they don't even have access to the user database, which works just fine for humans using the application (redirect to CAS login page).</p>
  
  <p>I don't know how we can implement this flow without having to heavily customize CAS server and implement this behavior by ourselves.</p>
  
  <p>Google uses JWT for <a href="https://developers.google.com/accounts/docs/OAuth2ServiceAccount?hl=de" rel="noreferrer">OAuth 2.0 for Server to Server Applications</a>, which seems like the way to go.</p>
  
  <p>I'd appreciate it if anyone can provide some hints or alternatives (to CAS server). Maybe someone has already implemented this pattern using CAS server and can provide some information on this issue.</p>
  
  <p>Best Regards,
  Marco</p>