Well, I'm not sure how portable it is, but if you are running the authentication on an NT server/machine (I'm not really sure from the above) then you could use the lanman module to check the group out.

Basically you would query like so:

Win32::Lanman::NetGroupGetUsers($server, $group, \@users);
[download]

Where $server is the domain server, $group the group you want to query, and @users the list of users that is returned. I'm sure you could run through that list to check the user, and then if succesful check username and password etc using the same module, or one of the many(?) others that do the same.

Probably the best place to ask this (if you are indeed authenticating on an NT machine) is the activestate win32 admin mailing list