In this example the user is requested to provide a password, and the external application (/path/to/script2.py) is additionally used to check whether the user should be allowed access.

<authentication-methods login-grace-time="600">
  <authentication action="allow">
    <auth-password />
    <mapper command="/path/to/python /path/to/script2.py"/>
  </authentication>
</authentication-methods>