A mixed CAS (gateway mode) + HTTP Basic credentials provider should be created.

If the user is already logged into CAS, the credentials provider returns his credentials.
If not, CAS does not redirect on the CAS login page, and a HTTP Basic authentication is triggered.