The default implementation can be customized to use a mutable login ID instead of the Curam username and the ability to add extra verifications is available by implementing the custom authenticator (Custom Verifications should be referenced for further details).