How to use URL based authorization with Windows authentication?

Hi there!
In an ASP.Net 2.0 intranet web application we use Windows authentication, impersonation and a custom role provider. Apparently, Windows authentication performs file based authorization only which uses file system ACLs to grant or deny acces to folders and web pages.
That leads to some problems compared with URL based authorization:
<location> nodes in Web.config don't work.
Our custom role hierarchy has no connection to Windows groups (and we cannot recreate our role hierarchy inside the Active Directory), so role based authorization with ACLs is pretty useless. We have to restrict access to virtual resources (e.g. handlers) that don't have counterparts in a file system, too.
Is it possible to use some kind of (declarative) URL based authorization inspite of Windows authentication?
Thanks and best regards,
Thomas
...