User provides an username/password. Should validate those and only then proceed to step 2.
User provides an additional authentication token.
If succeeds user is authenticated against SharePoint and redirected to home page.
Are there any good practises & samples for such scenario, beside creating a custom membership provider?