Current release version is 1.0 and it is strongly recommended to upgrade to this version. 

It uses CAS Java Client,

http://www.ja-sig.org/products/cas/client/javaclient/index.html

which is a less complicated client library with fewer dependencies compared to another Java client called CAS Client for Java. Although the latter is developed with Spring Framework in mind, I personally think it is too heavy to be integrated.

On the other hand, if a more integrated security solution is needed with support for CAS, the Acegi plugin for Grails is probably more suitable,

http://grails.org/AcegiSecurity+Plugin

In general, this plugin is for applications needing simple and easy authentication against CAS, without complex requirements on authorization as authorization is yet to be added in CAS (at least prior to CAS 3.1).

Simple Solution for Authorization 

First of all, as users of JA-SIG CAS may already know, CAS is only for authentication but not for authorization (up to 2.x). Therefore authorization is down to users to implement, if necessary. A common pattern is to use the interceptors available with Grails,

http://grails.org/Controllers+-+Interceptors

For instance, you can have a controller AccessController like this, with this plugin installed

import edu.yale.its.tp.cas.client.filter.CASFilter

class AccessController {

    def beforeInterceptor = [action: this.&check]

    def check() {
        def username = session?.getAttribute(CASFilter.CAS_FILTER_USER)
        // check username and return a boolean accordingly.
        // ...
    }
}

Please note it looks different from the example controller showed in Grails user guide for before interceptors because:

• it is not necessary to use 'except' to exclude a login or register page as some or all the resources in your application are protected by this plugin
• it is not necessary to have your own session attribute to save current username as the plugin (actually the CAS client library) has done that for you

To take the above example further, a simpler solution is available,

In Config.groovy you can have a list of users allowed to access your application,

users = ['foo', 'bar']

and then the 'check' method above will look like,

def check() {
        def username = session?.getAttribute(CASFilter.CAS_FILTER_USER)?.toLowerCase()
        return username in grailsApplication.config.users
    }

That could be helpful if your application has a simple authorization need.  

Handling Large Number of Protected URLs

The plugin can handle a list of urls using 'cas.urlPattern' but it can be quite messy to list every one of them. Thanks to this mailing list post, you can group all the urls to be protected by the plugin using Grails URL mappings feature and then feed the url pattern after mapping to the plugin.

CHANGELOG

• 1.0 release inline with Grails 1.0, fixed a problem reported here and adding 'cas.mocking' option as previously mentioned in TODO list.
• 0.2 updated release, added support for list as value of 'cas.urlPattern'. 
• 0.1 initial release, developed and tested against Grails 0.6.

TODO

• upgrade to coming new release of the cas client library which contains a simple authorization utility that can replace the trick mentioned in the example above. 

Also pls submit your suggestions to Grails users list.

Suggestions or Comments

Please feel free to submit them in Grails users mailing list.

http://grails.org/Mailing+lists

Alternatively you can contact the author of the plugin directly,  Chen Wang, contact at chenwang dot org