CAS 11.2.1, SSO works
Any user who doesn't have any rights (at least I can't find EveryOne in roles in folder Cognos) but knows address of CAS can put adress in browser and open it. He see nothing except empty folders but is it possible to make some settings that users who doesn't have rights could't open portal at all?
May be some SQL queries for Content Store exists which shows EveryOne in roles (and I simply don't find EveryOne in all roles)
Also PAL (IBM Planning analytics) using CAS for authentication. Group EveryOne has some rights in it, and any user who doesn't have any rights in CAS can see objects of Group EveryOne because user who authorized from CAS is in EveyOne now