Is it possible to modify authentication authorities at authentication time?

[icfantv]

We're authenticating against LDAP and our Authentication object's GrantedAuthorities are correctly populating with a user's roles from our LDAP database.

What I'd like to know is if there's a way to dynamically modify those roles (authorities) on the fly before the Authentication object is constructed (the only way GrantedAuthorities can be set on an Authentication object is at object construction time).

I'm thinking there's got to be some class I can extend and register to execute this behavior, I just don't know what class and what method.

Thanks.