Exactly,...the user is identified and then requested to enter a password.  You are identifying the user, then you proceed to ask them a password.  I.e. Identifying the user is something you are, then asking them for a password is something you know.