It's a service defined by spring-security-cas, and has nothing to do with OAuth other than that it's required in this context to secure an OAuth related resource. We can call it whatever, but I would like to keep it clear that it's a part of the Cas client and not the OAuth library itself.