Custom Role Provider in tandem with authorization elements of web.config

I have an application with which I would like to use multiple membership and role providers, specifically an SQL set and an active directory set. I have it working so that a username and password will be checked against active directory for authentication, and if that fails then check against SQL. In my web.config I am able to specify location elements to restrict access based on roles in the SQL role provider and I'd like to try and emulate the same with Active Directory (i.e. add the groups in the MemberOf property in Active Directory to the users roles so the permissions still use what is in the web.config) I am able to query AD and build a list of all the groups a user is a member of, but really have no idea how to add these to a list of roles for the user so the web.config will allow or deny access to a page or folder. Can some one point me in the right direction of what I need to be looking for? How does the web.config know which role a person is in, and how can I ...