It's the application (client) which should call this url, isn't it ? Not the ressource owner, right ? In this case, why having a ```casEntryPoint``` and a ```casFilter``` ?
The ```casEntryPoint``` will redirect the user to the CAS server for authentication and the ```casFilter``` will authenticate the user from a service ticket.

I'm not understanding this part... I would expect a filter waiting for an *access token*...