How to intercept IsInRole() withouth needing a role provider

Hello

We use in our ASP.NET applications Windows authentication. We also have our roles stored in the Active Directory and for each of the different environments (development, acceptance, quality ...) we need to add the environment identifier to the role name.

So assume that we have ROLE1 then in development it would be ROLE1D and in production it would be ROLE1P. This means that we need to find a way to intercept the calls to IsInRole() so that we can concatenate the environment identifier to the role.

What would be the best solution to implement this?

I could create a custom role provider but the problem is that I need to implement the GetRolesForUser() method. I could also create a new Principal type that derives from WindowsPrincipal and then set the HttpContext.Current.User in a HttpModule to my new Principal type (in the AuthenticateRequest).

Are there any better ways to accomplish what we are trying to do?
...