Rest API & Kerberos

OK, I'm trying to authenticate a session via Kerberos and then pass that session on to a REST API service

 

The Kerberos part is working fine.

 

This issue is that I don't want to create and leave open multiple (kerberos) sessions, I need to check if a session is already authenticated, if it is then send the user to the REST API back end. If they are not authenticated then to go to the access policy (via the F5 Virtual server) to get authenticated and then return to be send onward to the REST API.

 

I can check if a session is authenticated via an iRule to look for the MRHSession cookie, that's easily done but I'm having real difficulties when I find out it's an un-authenticated session to then invoke the AP to perform the Kerberos part.

 

Any help or pointing in the right direction would be useful.