CAS seamless login not working as expected

Description:

Seamless login is not working via CAS as I would expect.

In the scenario where the user has a valid CAS session (and TGT cookie), but no RocketChat session (and is logged out), the following URL takes me to the RocketChat login screen:

https://auth.example.com:8443/cas/login?service=https://chat.example.com/home

However, if the user has a valid RocketChat session, then this call works.

I would expect it to work in both cases, however it looks like Rocket.Chat generates and verifies some sort of unique token in the service URL. This unique token only seems to get generated when a user clicks the CAS Login button (e.g. https://auth.example.com:8443/cas/login?service=https://chat.example.com/_cas/qDtdvkL5e8ZkXRtFQ)

Server Setup Information:

• Version of Rocket.Chat Server: 0.58.2
• Operating System: Mac OSX El Capitan
• Deployment Method(snap/docker/tar/etc): Tar
• Number of Running Instances: 1
• DB Replicaset Oplog: Disabled
• Node Version: v4.2.4
• CAS Version: 5.1.3

Steps to Reproduce:

1. Login via CAS
2. Log out of Rocket.Chat (whilst keeping CAS session active)
3. Try accessing https://<cas_host>/cas/login?service=https://<rocket_chat_host>/home

Expected behavior:

User is logged in automatically due to the existence of CAS session

Actual behavior:

User is taken to the login screen

Start by tracing Rocket.Chat's CAS login flow from the /cas/login service URL and the generated /_cas token described in the report. Reproduce the flow with an active CAS TGT after logging out of Rocket.Chat; done means the direct CAS URL logs the user in automatically, with regression coverage for that sequence.