Instead of jury-rigging your own solution, you should look at existing open-source solutions to this very problem. Like OpenID, for example.
OpenID works basically like this:
The client connects to the server, telling it its username.
The server connects the authentication provider, asking it to verify a specific users login attempt. The login attempt also ...