Login to different J2EE applications

Question

Dear developers:
How can we design the login process for J2EE applications, so that a user (who has already logged into one application) won't be required to log in again to the second application.
The reason we are trying to do this, is because we have different application for different scope, such as Sales application and Purchasing application. Some users will be using both applications.
I think, to achieve this, session information of one application must be carried to the second application. But...... it looks like SUN Servlet 2.1 spec won't allow this to happen.
How can we design the systems, so the users will be required to login only once????
Sincerely,
Josh

Answer 1

Can you have a single point of entry for both systems and then use controller classes to route the requests appropriately?
Maybe when the user logs into the system you can bind some kind of user profile object to their session which will keep track of whether they are a sales application user or a purchasing application user or both. Then when the user submits a request, your single point of entry can apply the appropriate filters to ensure the user is accessing a page which they are entitled to view. If they do not have proper permissions then you can forward their request to some error page notifying them of their lack of privileges.
Let me know if I can clarify this at all.
Chris L.