validation list usage scenario

is it secure to have a user profile name associated with a validation list
entry name, and then have the user enter the same password in the
validation list as they do for their IBM i user profile.

The PHP code of a web site could store the validation list user and
password in $_SESSION variables. Then as part of validating to the
validation list, check if the validation list user name has an IBM i user
profile associated with it.

If it does, call QSYGETPH with that user profile name and the validation
list password. If the password is accepted, call QWTSETP to switch to run
the PHP code as that user profile.

assuming you are running HTTPS, what are security problems with doing this?

thanks,