Try to debug it a little - try to access the cmis url directly over tomcat, avoiding apache. There it should accept the ROLE_TICKET. I think that OpenCMIS itself has no CAS Plugin, so you're on the right way when you try to avoid CAS when accessing the CMIS endpoint (you want the ROLE_TICKET user).
Is the ticket you describe a valid alf_ticket?
I use a "dummy" webscript consisting just of a free marker template to obtain a valid ticket and some user data via the configured SSO mechanism
autoticket.desc.xml
<webscript>
<shortname>AutoTicket</shortname>
<description>returns SSO ticket</description>
<url>/autoticket</url>
<format default="json">extension</format>
<authentication>user</authentication>
</webscript>
autoticket.get.json.ftl
alfUserData={
"ticket":"${sessionticket.ticket}",
"firstName":"${person.properties.firstName}",
"lastName":"${person.properties.lastName}",
"userName":"${person.properties.userName}",
"email":"${person.properties.email!''}"
};
I needed the json form, because I'm using it in an angular SPA, but you can also return XML or HTML (see WebScript documentation)
When you invoke this webscript over .../alfresco/wcservice/autoticket.json it uses the configured SSO mechanism. Then use this ticket, when accessing cmis - avoid CAS then.
${sessionticket.ticket} is only valid for new alfresco versions. In older versions it was ${session.ticket}
Maybe this helps.
