Jasig/java-cas-client — pull request #1 by ZerothAngel (2012-03-08 03:11:39+00:00)
Title: Tomcat integration: Store principal in session

With the standard container-managed auth methods (BASIC, DIGEST, FORM), once the user has authenticated, getUserPrincipal() and friends will always return the authenticated principal, regardless of whether or not a URL falls under a security-constraint.

The Soulwing CAS client, when integrated with Tomcat, also behaves this way.

When switching [Jenkins](http://jenkins-ci.org/) from Soulwing to the JA-SIG CAS client, I noticed I wasn't being logged in. After some debugging, I realized that getUserPrincipal() was only returning the principal in Jenkins's /loginEntry URL -- not for any others.

This can be easily fixed by simply calling AuthenticationBase.register(), which will take care of stuffing the principal into the request as well as the session (if it exists).