Not sure if this would meet your requirements but look at the require_login module. I'v done CAS and Shib authenticated sites using this module.
My solution was to have an excluded custom login page that was set up as the user login path in this module. This page generally had the welcome / security blurb and a button that linked to the Authentication agent (CAS / Shib). I seem to remember having to custom craft this to include the page to return to after login.
The part that might not work for you is that if a user had authenticated via CAS on another site and then came to this site, they did not see this page but where autologged into Drupal.. after all CAS, Shib, and the like are Single Sign On solution.. ;)
This might work for you with the Gateway option off.
Otherwise you might have to look at creating a custom event subscriber that handles the CAS authentication. E.g., if a user logs in and they are a CAS user, send them to the login page. Set some flag on the login page and then allow them to "login".