Replace TMG and custom HTTP header component

We are working to replace TMG and a 'custom component' that (when an HTTP request is made) inserts 'application and role' information obtained from the users Active Directory group membership.  It inserts this data (i.e. Role:AA, AB) into the header of the request which is then 'inspected' down the pipeline to determine a users access.

My question is does NGINX allow for this same functionality?  If so what product does that?

Thank you!