Agree on security type, get server challenge and get password from user.