How do I create a CAS server?

First line of https://drupal.org/node/1084302 reads "Before you begin, you will need access to a working CAS server". I don't.

This is misleading, and I will work on updating that documentation. When you enable the CAS Server module, the Drupal site becomes your CAS server, you don't need an additional one. You mention it seems silly to use a Drupal install just to become a CAS server. Maybe, but some users may want the added functionality and user management that Drupal can bring along.

If you're looking for a solution that doesn't require you install Java/Tomcat or a Drupal site just for the server, you can try looking at RubyCAS, which may be easier to set up. There's a detailed installation guide.

Generally the way I use it, is to think about the "primary drupal site" and make that the cas server one, and then use the cas client to attach other drupal sites to the same authentication mechanism. The primary reason to do a tomcat cas server is to integrate with other authentication sources such as radius, ldap or active directory. I'm not familiar with the RubyCAS implementation, so I don't know whether it provides an account source rather than using another.

The primary question here though is how you want to provision accounts and do you have an existing account source (ldap, active directory, kerberos) that you want to leverage or are you looking just to connect two existing drupal sites together using CAS. If it's the latter, pick one to be the server (always HTTPS and perhaps where you want private content to be stored) and another to be the client.

Anyway, understanding why you want to use cas is probably the best way for us to give better help.

There is no technical need to create a separate site to only have logins. The only requirement for a cas server is that it is accessible over https. It sounds like in your environment your two choices are https://shop.site.com or https://www.site.com. Either will technically work, but if you have users that have existing accounts at either place already, I'd choose where the accounts are, because otherwise you'll need to have them reset their passwords. The "request accounts" link should point to whichever site has the cas server.

The basic idea is to put the cas server on the site that makes the most sense to house the login/password/profile information and then set up cas clients on other sites that point to the cas server site. Not sure if that helps... but feel free to to ask pointed questions.

It is a problem insomuch as you will need somehow to get the cas username associated with those accounts in all the sites that are not cas servers. That table cannot exist on the cas server site but only on the cas client sites. The cas clients need this in order to map the right "remote login" to the right drupal uid. Cas is designed so that you can share login credentials even across different sites.

The problem here is that the cas username stored in the cas_user table needs to be shared. It might be possible to configure this to be shared across all sites except the www.site.com, but we don't really have a way to automatically create the mapping for new users that arrive on www.site.com on all of the other sites. This may require some custom code to achieve.

First, I do not think you should be sharing cas_login_data as logging into one site should NOT log you into the other. You should make sure that on site2 you have the check for exisiting login option set in cas. Also, turn on debugging on site2 by configuring a log file for additional debugging info.