code: def _internal_verify_cas(ticket, service, suffix):
      
  
      params = {'ticket': ticket, 'service': service}
      if settings.CAS_PROXY_CALLBACK:
          params['pgtUrl'] = settings.CAS_PROXY_CALLBACK
  
      url = (urljoin(settings.CAS_SERVER_URL, suffix) + '?' +
             urlencode(params))
  
      page = urlopen(url)
  
      username = None
  
      try:
          response = page.read()
          tree = ElementTree.fromstring(response)
          document = minidom.parseString(response)
  
          if tree[0].tag.endswith('authenticationSuccess'):
              if settings.CAS_RESPONSE_CALLBACKS:
                  cas_response_callbacks(tree)
  
              username = tree[0][0].text
  
              pgt_el = document.getElementsByTagName('cas:proxyGrantingTicket')
  
              if pgt_el:
                  pgt = pgt_el[0].firstChild.nodeValue
                  try:
                      pgtIou = _get_pgtiou(pgt)
                      tgt = Tgt.objects.get(username=username)
                      tgt.tgt = pgtIou.tgt
                      tgt.save()
                      pgtIou.delete()
                  except Tgt.DoesNotExist:
                      Tgt.objects.create(username=username, tgt=pgtIou.tgt)
                      logger.info('Creating TGT ticket for {user}'.format(
                          user=username
                      ))
                      pgtIou.delete()
                  except Exception as e:
                      logger.warning('Failed to do proxy authentication. {message}'.format(
                          message=e
                      ))
  
          else:
              failure = document.getElementsByTagName('cas:authenticationFailure')
              if failure:
                  logger.warn('Authentication failed from CAS server: %s',
                              failure[0].firstChild.nodeValue)
  
      except Exception as e:
          logger.error('Failed to verify CAS authentication: {message}'.format(
              message=e
          ))
  
      finally:
          page.close()
  
      return username
docs: Verifies CAS 2.0 and 3.0 XML-based authentication ticket.
  
      Returns username on success and None on failure.