JAAS Integration with XWiki

We are standardizing on the Java Authentication and Authorization Service (JAAS). I thought I heard that XWiki supports the Pluggable Authentication Modules (PAM) standard, but haven't found any reference to it in the docs. Further, there are some articles out about integrating JAAS into Tomcat, which is another thing to think about. We actually are considering at least two methods here - a centralized PIN server and a RADIUS server for SecurID access, and both have clients that implement the JAAS interfaces. There are a couple of strategies that I could probably try: one is just to use the JAAS/Tomcat integration route. That would seem to give the most bang-per-buck, but that would (I think) not allow controls at the level of granularity that XWiki does, or would actually take controls away from the XWiki rights system. Another (actually my first idea) is to implement the various com.xpn.xwiki.user.api interfaces (XWikiAuthService, XWikiGroupService, and XWikiRightService) with JAAS calls. Anyone have any experience with this? brain[sic]