You can enable the router(s) to use WPA2 Enterprise and then point them towards a RADIUS (FreeRADIUS, Windows Server 2008, other) box - then it's down to you to configure the RADIUS box to authenticate "as you want".
There are various tutorials, but most relate to EAP-TLS certificates - but there are DOMAIN\USER related tutorials out there