If you set to login through CAS, and don't have enough permissions for the admin interface, you get into a loop in which you cannot re-try with other credentials, unless you clean the CAS cookies. This also happens when the user doesn't match any user in Koha's DB. This can be very problematic.
The only solution I find, is providing a message with a logout from CAS button/option: - In case the user is not a valid Koha user 'The CAS user is not a valid Koha user, please logout if you want to try another user' - In case the user does not have the right permissions 'The CAS user doesn't have the required permissions, please logout if you want to try another user'