[Suggestion] AD Authentication

Hi all!
I'm facing a situation on a project where the customer wants to have a login function based on AD. That's pretty fine and straighforward, but he also wants to authorize permissions on page based on the AD users, but without using AD groups, because he doesn't want to change the actual AD structure. So I was thinking about creating a parallel database just to syncronize the AD users and a Users table for example. But I was thinking if there's another way to achieve the same result. In short, having permissions management through AD users without creating groups for exceptions and so on.
 
Any ideias?
 
Thanks!
...