How to secure a Shiro client application with CAS (using pac4j)

Add CAS single sign-on to an Apache Shiro application: a pac4j implementation authenticates, the buji-pac4j bridge fills the Shiro subject and roles.