Is there any way to hook the point when channel port listener accepts a new connection?

[yingyuan cheng]

After an user is authenticated, he should be authenticated again by
his interactive shell before starting a tunnel for him. How can I
fulfill this task? I think I should add a hook when a listening
channel accepts a new connection. Is there easier way?

Thanks.

leo