Java Security

Hello All,
Here is the problem I have. We have a J2EE application running on tomcat. It is an enterprise style application. The user information, role and access information will be in Oracle tables, not in the configuration files. I plan to use the JDBC relm for authentication. We do not want to maintain any of this information in configuration files as we want to give user friendly screens to our customers so they can change things without using a programmer.
I would like to use form based authentication for the basic username/password authentication and then based on the user names, custom build a menu for the user. I believe I need a hook into the j_security_check process or a way to do post-j_security_check-processing to give the user these roles and redirect them to a menu page.
Does anyone know of a way to do this?
Please help,
PK.