CAS credentials, ticker and several application with differenc access rights

[Matteo Matteo]

An idea:
We would like to use an application name in our credentials and according to this name we should check if our user has an access to an application. If yes - give him a granting ticket, if not - show an error page.
 What should I configure/change to be able to check if our user has an access when he's getting his granting ticket?
It should work like
We have 3 applications.
1. User loggs in into an application where he is granted.
2. He tries to go to the second or the third application but without success (CAS system does not authorize him there automatically, because he has no access to these applications)
Thanks
Matvey