The following flow diagram outlines how the authentication handler in CAS checks the tamuStatus attribute for passwordExpired. If the flag is present, the login attempt will fail with an appropriate error message issued on the login page. If the flag is not present, login will complete normally by returning to the application with a service ticket.
