Custom JAAS Logon Module - Dynamic Group Assignment

Dear Experts,

What are the different approaches for dynamically assigning portal groups with a custom JASS Logon Module?

Our users are from LDAP, and upon logging onto the portal, we want to dynamically assign them to a Group in the Portal.

Either based on what ECC backend role they are assigned to or determined from the LDAP group?

Are there examples out there on how to connect to ECC with JCO from the Logon Module to call a BAPI?

Or an example of how to read the LDAP group from the Logon Module?

Thanks in advance.