IE pre-authenticates with Kerberos in all situations, even when the server does not require any more authentication (the authorization header is sent in all request with the associated kerberos token). The current implementation in jboss-negotiation 3.0.4 (NegotiationMechanism.java) does not take into account if the user was already authenticated and, therefore, a new re-negotiation is done for every request if the token is there. This is an overwhelming extra work for the infrastructure (AD/Kerberos server mainly).