Extend Crowd authentication mechanism?

I would like to extend how Crowd allows user to authenticate from other linked Atlassian Applications.

In addition of the default authentication mechanism I want to check a custom attribute in the user’s Crowd profile.
If this property has a certain value the user may authenticate.

Is this feasible in a custom Crowd add-on?

I thought of using the UserAuthenticatedEvent but of course this one doesn’t let me intercept the actual authentication.