APM Two-Factor Authentication with AD and HTTP AAA

Have you figured out any way to do this yet? I'm in the process of developing a similar solution for our environment, and the method I'm considering is to use an additional external logon pages (since we're already using a single external logon page for current login), and then use an iRule to parse the response from the second page (and maybe use a sideband connection to check the answers) and perform the verification and set a session variable to use in a VPE object to decide whether to allow or deny the user.

Still in the developing stages, but if you've figured this out, I'd love to hear how you've done it.