How to develop a second factor authentication plugin/extension?

Hi  the extension is something I am building and yes it can be run on a separate tomcat.

I was able to get to a point where I created a pool, virtual server and access policy. but kind of stuck how to configure the policy to include it.