auth-flow.txt

participant user
participant client.org
participant content.org
participant CAS

user->client.org: select something
client.org->content.org: GET info.json
note left of content.org
   HTTP 401
   unauthorized
end note
note left of content.org
   The info.json response body must be the
   same regardless of the status code
end note
client.org->client.org: check info.json\nfor auth services
note over client.org
   login service detected
end note
client.org->+content.org: window.open(loginService)
activate client.org
note right of client.org
   client.org has no access to
   the opened login window, but
   can wait for it to close
end note
content.org->CAS: redirect
deactivate content.org
user->+CAS: Log in
CAS->+content.org: redirect
deactivate CAS
content.org->content.org: set cookie
content.org->content.org: window.close()
deactivate content.org
client.org->client.org: detect window closed
client.org->content.org: GET tokenService
content.org->client.org: postMessage(token)
client.org->content.org: GET info.json with token
note left of content.org
   HTTP 200 OK
end note
note left of client.org
   Client now knows it can request 
   the content resources (e.g., tiles) 
   descibed by the info.json
end note
client.org->content.org: image requests with cookie