Using Central Authentication Service (CAS) with GlassFish?

Question

Using an Existing Module ...

Is there a authentication module for GlassFish 3 that integrates CAS into the server? Preferably this module conforms with JSR 196. How can I provide group information (user A is in Group X, Y, Z) with such a module? I would need a separate group database or webservice.

... or Writing a New Module?

If no such module exists: How can I write a JSR 196 module? I know the document from Oracle about GlassFish and JSR 196, but I don't understand where group information comes from. There is a class javax.security.auth.message.callback.GroupPrincipalCallback but how to wire it with the rest?

Do I need an authentication module and a custom realm?