How to control the authorization of a user to a folder (who been authenticated using sso) Single Sign on?

Hi,
How to control the authorization of a user to a folder (who been authenticated using sso) Single Sign on? For Ex:-
I have a "WFM" folder is there and users from work flow manager( WFM ) can access these files but users from IMS( ID Manager Support) group are supposed to be restricted. If WFM user login then the header value "WFM = TRUE" will be set (see header info in below sample). From this i know this user is a WFM user.  For Ex:- assume a support guy logged-in then this value will be "IMS = TRUE". This user when tried to access a file  in "~/WFM/WorkFlow1.aspx" he should be restricted (and all files under WFM folder). How can i do it programatically? Is there any good sample restricting urser to access files of a different user group(s) folder? According to requirement I can not set the location tag's in web.config and don't want to have a web.config in each folder (Ex:- one web.config i ...