When an user access myFileGateway web interface, he will input credencials as below.
 
User ID: client username
Password: password local in user tables + token 6 digits
 

The Sign In button is already calling a plug-in (external code), that is receiving this credentials.
It splits the password, validates the token successfully. This is working fine.
The problem is when this code is trying to validate the password on B2B.
 
SI stores a base64 encoded SHA1 hash of the password into database instead of raw password to protect credentials. Before hashing a password a string of random characters is appended to it (a different random string is used for every password) and the password hashed. 
It is stored on YFS_USER table.
 
First, they tried to follow this method and compare the password returned from YFS_USER table. But is not possible because we cant recover the random string that was appended (and for me, doen't make sense try to do this, since the system can not allow this kind of vulnerability, which would basically open the security mode of the application)
 
So, the second plan, is verify if there is any method or class , which we could pass the credentials, and B2B returns true of false, or validates those credentials.

The perfect solution would be an extra field so we can enable a multi-factor authentication. This extra field could be validate thought pre authentication user exit.