Hi,

I want to extend DNN authentication provider to support two factor authentication. I want to use existing authentication functionality and add the second factor - based on calling a stored procedure taking username and contents of a second password box (PIN). I tried to archive this via modification of existing Login.ascx and Login.ascx.vb. I added the second password box and a call to the stored procedure. I process results of this call and use it in this way:
Instead of:  authenticated = (loginStatus <> UserLoginStatus.LOGIN_FAILURE)

I got: authenticated = ((loginStatus <> UserLoginStatus.LOGIN_FAILURE) AND customAuthenticationResult)

However even when user supplies invalid PIN so customAuthenticationResult is false and authenticated is also false, login process ends up positively - user is logged in. How should I do it in order to make it work as expected, ie user is authenticated only when password and PIN are correct.