SEC-1986: Add remember-me support for CAS

Jérôme Leleu (Migrated from SEC-1986) said:

Hi,

So far, the remember-me feature which can be enabled in CAS server is not handled in Spring Security when using the spring-security-cas module. In remember-me mode or not, the user is always considered fully authenticated.
That's what I'd like to change.

For that, I propose the following improvments :

• every time a vote is required regarding IS_AUTHENTICATED_REMEMBERED, IS_AUTHENTICATED_FULLY, isRemembered() or isFullyAuthenticated(), the user is considered in remember-me mode if the CasAuthenticationToken has a specific attribute setted to true (longTermAuthenticationRequestTokenUsed by default) : it matches the configuration done on the CAS server side for the remember-me feature
• every time a user is not granted an access (due to the previous vote or another one) and if this user is already authenticated in remember-me mode, a CAS round trip is done with the renew parameter setted to true to force CAS server to reauthenticate the user.

I'm preparing a pull request on my fork : https://github.com/leleuj/spring-security. I'm working on integration tests right now.

Regarding code, in the spring-security-cas project, I created a org.springframework.security.cas.rememberme package and :

• a CasAuthenticationTokenEvaluator class which says if a CasAuthenticationToken is in remember-me mode or not
• a CasRememberMeAuthenticationTrustResolverImpl class which inherits from AuthenticationTrustResolverImpl and uses the CasAuthenticationTokenEvaluator, to define if the user is in remember-me mode
• a CasRememberMeAccessDeniedHandlerImpl class which inherits from AccessDeniedHandlerImpl and uses the CasAuthenticationTokenEvaluator, to make a CAS round-trip with renew=true if the user is already authenticated in remember-me mode
• a CasRememberMeBeanPostProcessor to replace default beans by CAS remember-me aware beans if the user has define a minimal spring configuration with

Before finishing and sending this pull request, I'd like to get a feedback from the Spring Security team.

Thanks.
Best regards,
Jérôme

Start by reviewing the spring-security-cas module and the proposed org.springframework.security.cas.rememberme package, especially CasAuthenticationTokenEvaluator, CasRememberMeAuthenticationTrustResolverImpl, CasRememberMeAccessDeniedHandlerImpl, and CasRememberMeBeanPostProcessor. Check the integration tests mentioned in the issue; done means remember-me authentication is distinguished from full authentication and denied access can trigger CAS reauthentication with renew=true.