    def login_user(self, username, password, otp, context, **kwargs):
        user = authenticate(request=context.get('request'),
                            username=username, password=password)
        if not user:
            login_reject.send(sender=self.__class__, username=username, reason='creds')
            raise FormattedException(m='incorrect_username_or_password', d={'reason': 'incorrect_username_or_password'},
                                     status_code=HTTP_401_UNAUTHORIZED)

        if not user.email_verified and not user.is_superuser:
            login_reject.send(sender=self.__class__, username=username, reason='email')
            raise FormattedException(m='email_verification_required', d={'reason': 'email_verification_required'},
                                     status_code=HTTP_401_UNAUTHORIZED)

        if not user.can_login():
            login_reject.send(sender=self.__class__, username=username, reason='closed')
            raise FormattedException(m='login_not_open', d={'reason': 'login_not_open'},
                                     status_code=HTTP_401_UNAUTHORIZED)

        if user.totp_status == TOTPStatus.ENABLED:
            if not otp or otp == '':
                login_reject.send(sender=self.__class__, username=username, reason='no_2fa')
                raise FormattedException(m='2fa_required', d={'reason': '2fa_required'},
                                         status_code=HTTP_401_UNAUTHORIZED)
            totp = pyotp.TOTP(user.totp_secret)
            if not totp.verify(otp, valid_window=1):
                login_reject.send(sender=self.__class__, username=username, reason='incorrect_2fa')
                raise FormattedException(m='incorrect_2fa', d={'reason': 'incorrect_2fa'},
                                         status_code=HTTP_401_UNAUTHORIZED)
        login.send(sender=self.__class__, user=user)
        return user
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.