Surely this would be handled by the pam code already wouldn't it? Assuming that there are several modules all required and they each can ask the user for some auth token... (not that I've actually tried it of course).