You will need to run as another rails app discourse_cas_sso then configure discourse to use single sign on (SSO) with this app. Then set discourse to require a login to access the site (login required) setting. If they access the discourse site directly or via some landing page they will be bounced through discourse_cas_sso and logged in. The information passed back to discourse will either create an account for them or log them into their existing account.
While the usename of the person is used to log them into CAS it is the email address that is used in discourse to uniquely identify the user with SSO. This means that your CAS server will need to return the users email address which is generally not the default. Also you need to set discourse to not allow the user to change their email address.
Another thing to note is that the usecase for CAS is that it is the one and only source of authentication and this works well with how SSO works in discourse . This means that your admin account is discourse needs to be a valid account in your CAS authentication system as must all other accounts that access your discourse.
I hope this helps.