code: public static void ensureServiceSsoAccessIsAllowed(final RegisteredService registeredService, final Service service,
                                                         final TicketGrantingTicket ticketGrantingTicket,
                                                         final boolean credentialsProvided) {
  
          if (!registeredService.getAccessStrategy().isServiceAccessAllowedForSso()) {
              LOGGER.debug("Service [{}] is configured to not use SSO", service.getId());
              if (ticketGrantingTicket.getProxiedBy() != null) {
                  LOGGER.warn("Service [{}] is not allowed to use SSO for proxying.", service.getId());
                  throw new UnauthorizedSsoServiceException();
              }
              if (ticketGrantingTicket.getProxiedBy() == null && ticketGrantingTicket.getCountOfUses() > 0 && !credentialsProvided) {
                  LOGGER.warn("Service [{}] is not allowed to use SSO. The ticket-granting ticket [{}] is not proxied and it's been used at least once. "
                      + "The authentication request must provide credentials before access can be granted", ticketGrantingTicket.getId(), service.getId());
                  throw new UnauthorizedSsoServiceException();
              }
          }
          LOGGER.debug("Current authentication via ticket [{}] allows service [{}] to participate in the existing SSO session",
              ticketGrantingTicket.getId(), service.getId());
      }
docs: Ensure service sso access is allowed.
  
  @param registeredService    the registered service
  @param service              the service
  @param ticketGrantingTicket the ticket granting ticket
  @param credentialsProvided  the credentials provided