If you define a chain provider for login form with at least two entities not having the same table, only the class defined in the fsi_admin_security.model.user parameter will be checked against the provided credentials. Obviously this should be changed, so all defined entities will be checked against.
Example - ChangePasswordController.