Short Answer: `CasAuthenticationProvider` requires an `authenticationUserDetailsService` that is not null. Startup will fail if it's not specified.

Long Answer: Cas models *authentication*, so the only information we would get from Cas is that he user says who he says he is. The `UserDetailsService` is required by spring-security to determine what his *authorization* is. In our case, `ROLE_USER` by default. I haven't looked into a more generic way of implementing this for ease of testing.

To quote the Spring Security documentation: 
> The CasAuthenticationProvider uses a UserDetailsService instance to load the authorities for a user, once they have been authenticated by CAS. We've shown a simple in-memory setup here. Note that the CasAuthenticationProvider does not actually use the password for authentication, but it does use the authorities.

http://static.springsource.org/spring-security/site/docs/3.2.x/reference/cas.html