diff --git a/WebRoot/js/zimbraAdmin/common/ZaAuthenticate.js b/WebRoot/js/zimbraAdmin/common/ZaAuthenticate.js
index 7974dd7018..41c0496743 100644
--- a/WebRoot/js/zimbraAdmin/common/ZaAuthenticate.js
+++ b/WebRoot/js/zimbraAdmin/common/ZaAuthenticate.js
@@ -63,16 +63,19 @@ function (uname, pword, twoFactorCode, trustedDevice, callback) {
         soapDoc.set("name", uname);
         soapDoc.set("password", pword);
     } else {
-        soapDoc.getMethod().setAttribute("refresh", "1");
+        //soapDoc.getMethod().setAttribute("refresh", "1");
     }
     if(twoFactorCode) {
         soapDoc.set("twoFactorCode", twoFactorCode);
+        soapDoc.set("csrfToken", window.csrfToken);
+        soapDoc.set("authToken", window.authToken);
+    } else {
+        soapDoc.set("csrfTokenSecured", 1);
     }
     if(trustedDevice) {
         soapDoc.set("trustedDevice", trustedDevice);
     }
     soapDoc.set("virtualHost", location.hostname);
-    soapDoc.set("csrfTokenSecured", 1);
     var command = new ZmCsfeCommand();
     params.soapDoc = soapDoc;
     params.asyncMode = true;
diff --git a/WebRoot/js/zimbraAdmin/common/ZaController.js b/WebRoot/js/zimbraAdmin/common/ZaController.js
index ae0688fb61..5fa0f6e6cd 100644
--- a/WebRoot/js/zimbraAdmin/common/ZaController.js
+++ b/WebRoot/js/zimbraAdmin/common/ZaController.js
@@ -556,6 +556,15 @@ function (resp) {
                 this._loginDialog.registerCallback(this.loginCallback, this);
                 this._loginDialog.clearError();
                 this._loginDialog.showTwoFactorCode();
+                if(body.AuthResponse && body.AuthResponse.csrfToken && 
+                    body.AuthResponse.csrfToken._content) {
+                    window.csrfToken = body.AuthResponse.csrfToken._content;
+                }
+
+                if(body.AuthResponse && body.AuthResponse.authToken && 
+                    body.AuthResponse.authToken[0]._content) {
+                    window.authToken = body.AuthResponse.authToken[0]._content;
+                }
             } else {
                 if(body.AuthResponse && body.AuthResponse.csrfToken && 
                     body.AuthResponse.csrfToken._content) {
diff --git a/WebRoot/js/zimbraAdmin/common/ZaLoginDialog.js b/WebRoot/js/zimbraAdmin/common/ZaLoginDialog.js
index 8be51cae2b..046b85bf27 100644
--- a/WebRoot/js/zimbraAdmin/common/ZaLoginDialog.js
+++ b/WebRoot/js/zimbraAdmin/common/ZaLoginDialog.js
@@ -200,6 +200,8 @@ function() {
 		}
 		if(ZLoginFactory.isShown(ZLoginFactory.TWO_FACTOR_CODE_FORM)) {
 			twoFactorCode = ZLoginFactory.get(ZLoginFactory.TWO_FACTOR_CODE).value;
+			username = "";
+			password = "";
 		}
 		if(ZLoginFactory.isShown(ZLoginFactory.TRUST_DEVICE)) {
 			trustedDevice = ZLoginFactory.get(ZLoginFactory.TRUST_DEVICE).value;