# File lib/picnic/authentication.rb, line 197
      def service(*a)
        $LOG.debug "Running CAS filter for request #{a.inspect}..."
        
        if @env['PATH_INFO'] =~ /^\/public\/.*/
          $LOG.debug "Access to items in /public subdirectory does not require CAS authentication."
          return super(*a)
        end
        if @state[:cas_username]
          $LOG.debug "Local CAS session exists for user #{@state[:cas_username]}."
          return super(*a)
        end
                
        client = CASClient::Client.new($CONF[:authentication].merge(:logger => $LOG))
        
        ticket = @input[:ticket]
        
        cas_login_url = client.add_service_to_login_url(read_service_url(@env))
        
        if ticket
          if ticket =~ /^PT-/
            st = CASClient::ProxyTicket.new(ticket, read_service_url(@env), @input[:renew])
          else
            st = CASClient::ServiceTicket.new(ticket, read_service_url(@env), @input[:renew])
          end
          
          $LOG.debug "Got CAS ticket: #{st.inspect}"
          
          client.validate_service_ticket(st)
          if st.is_valid?
            $LOG.info "CAS ticket #{st.ticket.inspect} is valid. Opening local CAS session for user #{st.response.user.inspect}."
            @state[:cas_username] = st.response.user
            return super(*a)
          else
            $LOG.warn "CAS ticket #{st.ticket.inspect} is INVALID. Redirecting back to CAS server at #{cas_login_url.inspect} for authentication."
            @state[:cas_username] = nil
            redirect cas_login_url
            s = self
          end
        else
          $LOG.info "User is unauthenticated and no CAS ticket found. Redirecting to CAS server at #{cas_login_url.inspect} for authentication."
          @state[:cas_username] = nil
          redirect cas_login_url
          s = self
        end
        s
      end