MVC Active Directory Authentication by Organizational Unit

Question

I want to recycle AD security in my .NET MVC web application and have virtually no local security tables, if possible.

I can easily achieve this using the Authorize tag:

[Authorize(Roles="GoldDigger")]
public ActionResult Go(int companyKey)
{
    var something = GetData(companyKey);
    return something;
}

However, I have users who have access to multiple companies (Acme, StoreCo, etc.), and are GoldDiggers in some but not all of those companies. Let's say I create an Active Directory OU Container for each company, so I have the following AD role structure:

• NTWRK\Acme\GoldDigger
• NTWRK\StoreCo\GoldDigger
• NTWRK\PetCo\GoldDigger
• NTWRK\Megalomart\GoldDigger

To my knowledge I can no longer use the Authorize tag because the AD role required is determined by the value of the CompanyKey parameter.

What are my best options at this point to avoid adding the following to the top of every controller method? Is it possible to force the context of the authorization to a particular (non-hard-coded) organizational unit at the beginning or earlier in the session?

if (!AuthenticateAdRoleByCompany(companyKey, "Role Name Here"))
{
    Explode();
    return;
}