Jasig/cas — pull request #255 by joemccall86 (2013-05-17 00:57:13+00:00)
Title: CAS-1288: Leverage OAuth server support on Spring Security OAuth library and add missing grant types

# Summary
Uses spring-security-oauth to implement oauth support. A working integration test of this can be found at [joemccall86/cas-oauth-demo](https://github.com/joemccall86/cas-oauth-demo). Run `mvn install` on this fork to get the custom version of CAS in your local maven repository, then follow the instructions in `README.textile` to run the demo. More valid usernames can be added in `oauthConfiguration.xml`.

What works:
- [x] Authorization Code Grant Type
- [x] Implicit Grant Type
- [x] Token store based solely on ticket registry, no external map required
- [x] Working with pac4j client

To be done:
- [ ] Password Grant Type
- [ ] Refresh Token Support
- [ ] Client Credentials Grant Type
- [ ] Support different access tokens per-service, not just per-user
- [ ] Careful removal of existing code without breaking the profile
- [ ] Better error page
- [ ] Integrate the confirm page with spring webflow to re-enable session termination post webflow
- [ ] Update documentation to be clearer on the role of services and descriptions
- [ ] Internationalization of confirm page

There's probably more to mention in both categories, but I wanted to get this code up for everyone to look at while I'm working on the other stuff. The key part that took me a while to realize was that OAuth2.0 models **authentication** and **authorization**, while Cas only represents **authentication**. To properly support authorization, we need to give the client a spot in `oauthConfiguration.xml` to define what clients are authorized for what service, and same for the users.

Feel free to post any questions and I'll do my best to answer them.

# Resources
- [Oauth2.0 Spec](http://tools.ietf.org/html/rfc6749)
- [Spring Security](https://github.com/SpringSource/spring-security)
- [Spring Security OAuth](https://github.com/SpringSource/spring-security-oauth)
- [Pac4j](https://github.com/leleuj/pac4j)
- [cas-pac4j-oauth-demo](https://github.com/leleuj/cas-pac4j-oauth-demo) (use joemccall86 fork for this test until the merge request is accepted)