Override login form submisssion
I'm working on something similar. I think you can do this using a validation rule. 

/**
 * Implements hook_form_alter().
 * We replace the local login validation handler with our own.
 */
 function beneficiaire_form_alter(&amp;$form, &amp;$form_state, $form_id) {
    // In this simple example we authenticate on username to see whether starts with dave
    if ($form_id == 'user_login' || $form_id == 'user_login_block') {
        $form['#validate'][] = 'beneficiaire_user_form_validate';
    }
 }

/**
 * Perform validation rules and set error states
 */
function beneficiaire_user_form_validate($form, &amp;$form_state) {
    if (!beneficiaire_authenticate($form_state)) {
        form_set_error('name', t('You are not on our super-secret list.'));
    }
}

/**
 * Custom user authentication function
 */
 function beneficiaire_authenticate(&amp;$form_state) {
     // Check the webservice here and return false if user not found.
 }