At the beginning the user doesn't have any session. When the user starts the JS-application it navigates the user agent to the CAS where he gets authenticated via his credentials. After successful authentication he will be redirected to the JS-application with the access token in the fragment.
After short time the access token is not valid anymore and the application needs a new access token. For that the application navigates the user agent to the CAS again. The questions is: what should the CAS do?
The user already has a session at the CAS. Is it allowed to use this session to authenticate the user? In this case the user does not have to provide his credentials again.
The central authentication service could ask for the user's credentials again.
In my opinion asking the user for his credentials once in an hour is somewhat strange so I would prefer the first solution. But would it be a valid way to get a new access token regarding the OAuth2 RFC?
The RFC states "
The implicit grant [...] relies on the presence of the resource owner". I think the first solution does not rely on the presence of the resource owner. For example, the resource owner could leave his computer for some hours but the JS applicatino is still running. If an access token becomes invalid the JS application can get a new access token just by navigating to the CAS which automatically authenticates via the session and redirects back to the JS application. This is done automatically without the presence of the resource owner.
The CAS could only be sure that the resource owner is present if it would ask for the credentials again. But that would mean to ask for the credentials every 30 minutes.
If these options don't apply, how could step (B) in Figure 4 in 4.2 of the RFC6749 be realized to renew access tokens?