Note that from the user's perspective, you have reinvented SPNEGO. This is implemented in all interesting browsers, and is how Microsoft implements Kerberos in IIS. I have a feeling that your solution is implementable on top of the existing SPNEGO infrastructure, which is IE, Chrome & FF http://en.wikipedia.org/wiki/SPNEGO .