Index: /main/waeup.cas/trunk/waeup/cas/server.py
===================================================================
--- /main/waeup.cas/trunk/waeup/cas/server.py	(revision 10397)
+++ /main/waeup.cas/trunk/waeup/cas/server.py	(revision 10398)
@@ -100,4 +100,25 @@
 
 
+def check_session_cookie(db, cookie_value):
+    """Check whether `cookie_value` represents a valid ticket granting
+    ticket in `db`.
+    """
+    if cookie_value is None:
+        return False
+    print("VAL1: ", cookie_value)
+    try:
+        # turn value into unicode (py2.x) / str (py3.x)
+        cookie_value = cookie_value.decode('utf-8')
+    except AttributeError:                         # pragma: no cover
+        pass
+    print("VAL2: ", cookie_value)
+    q = db.query(TicketGrantingCookie).filter(
+        TicketGrantingCookie.value == cookie_value)
+    result = [x for x in q]
+    if len(result):
+        return result[0]
+    return None
+
+
 class CASServer(object):
     """A WSGI CAS server.
@@ -142,13 +163,26 @@
         password = req.POST.get('password', None)
         valid_lt = check_login_ticket(self.db, req.POST.get('lt'))
-        if username and password and valid_lt:
+        tgc = req.cookies.get('cas-tgc', None)
+        print('TGC: ', tgc)
+        tgc = check_session_cookie(self.db, tgc)
+        print("TGC2: ", tgc)
+        print([(x, y) for x, y, in req.headers.items()])
+        if username and password and valid_lt or tgc:
             # act as credentials acceptor
-            cred_ok, reason = self.auth.check_credentials(username, password)
+            if tgc:
+                cred_ok, reason = True, ''
+                if not service:
+                    msg = 'You logged in already.'
+            else:
+                cred_ok, reason = self.auth.check_credentials(
+                    username, password)
             if cred_ok:
                 if service is None:
                     # show logged-in screen
                     html = self._get_template('login_successful.html')
+                    html = html.replace('MSG_TEXT', msg)
                     resp = Response(html)
-                    resp = set_session_cookie(resp, self.db)
+                    if not tgc:
+                        resp = set_session_cookie(resp, self.db)
                     return resp
                 else:
Index: /main/waeup.cas/trunk/waeup/cas/templates/login_successful.html
===================================================================
--- /main/waeup.cas/trunk/waeup/cas/templates/login_successful.html	(revision 10397)
+++ /main/waeup.cas/trunk/waeup/cas/templates/login_successful.html	(revision 10398)
@@ -1,7 +1,8 @@
 <html>
   <head>
-    <title>Single Sign-On initiated</title>
+    <title>WAeUP Central Authentication Services</title>
   </head>
   <body>
+    <div>MSG_TEXT</div>
     <h1>Logged in</h1>
     <div>You successfully initiated single sign-on!</div>
Index: /main/waeup.cas/trunk/waeup/cas/tests/test_server.py
===================================================================
--- /main/waeup.cas/trunk/waeup/cas/tests/test_server.py	(revision 10397)
+++ /main/waeup.cas/trunk/waeup/cas/tests/test_server.py	(revision 10398)
@@ -12,6 +12,6 @@
     CASServer, create_service_ticket, create_login_ticket,
     create_tgc_value, check_login_ticket, set_session_cookie,
+    check_session_cookie,
     )
-
 
 RE_ALPHABET = re.compile('^[a-zA-Z0-9\-]*$')
@@ -184,4 +184,16 @@
         assert b'ticket=ST-' in resp.body
 
+    def test_login_cred_acceptor_sso_no_service(self):
+        # 2.2.4: successful login via single sign on
+        db = self.raw_app.db
+        tgc = create_tgc_value()
+        db.add(tgc)
+        value = str(tgc.value)
+        resp = self.app.get('/login', headers={'Cookie': 'cas-tgc=%s' % value})
+        assert resp.status == '200 OK'
+        assert b'already' in resp.body
+        assert 'Set-Cookie' not in resp.headers
+        return
+
     def test_login_cred_acceptor_failed(self):
         # 2.2.4: failed login yields a message
@@ -269,2 +281,13 @@
             TicketGrantingCookie.value == value)
         assert len(list(q)) == 1
+
+    def test_check_session_cookie(self):
+        db = DB('sqlite:///')
+        tgc = create_tgc_value()
+        db.add(tgc)
+        value = tgc.value
+        assert check_session_cookie(db, value) == tgc
+        assert check_session_cookie(db, 'foo') is None
+        assert check_session_cookie(db, b'foo') is None
+        value2 = value.encode('utf-8')
+        assert check_session_cookie(db, value2) == tgc
