Don't know if you're approach would work or not, but an alternative might be to use the @Interceptors annotation to control access. That way you could use the built in LDAP module for authentication and use the interceptor to check the user against the roles in the database.
Regards,
Nick
[Message sent by forum member 'nickwi' ]
http://forums.java.net/jive/thread.jspa?messageID=374301