I am relatively new to the Spring Framework and Spring security.
I have used a custom authentication scheme, HTML:
If you need to use additional form parameters in order to manipulate the username and password, you can implement your own AuthenticationProcessingFilter
http://static.springsource.org/spring-security/site/apidocs/org/springframework/security/ui/webapp/AuthenticationProcessingFilter.html
This class will have full access to the HttpRequest and therefore all the additional parameters you submit. If your goal is to somehow use these values to modify the username and password, this is where you would do it.