authentication - Spring Security : sharing security between my CRM webapp and my Front webapp -

i've 2 distinct webapp:

• a crm webapp show customer resume office users
• a portal webapp customer users

my crm webapp use combination of ldapmanager , inmemorymanager basicauthenticationfilter , basicauthenticationentrypoint portal use classic jdbc manager standard usernamepasswordauthenticationfilter

now, need access transparently portal crm webapp.

for example, work in office on crm webapp. customer call me , ask explanations mentionned in portal.

i possible office user access portal customer http link in crm customer account page.

so bypass loginurlauthenticationentrypoint , access directly customer account.

edit after michael help, realize need keep trace of crm user access portal account :
questions :
- should use preauthenticatedmanager or runasmanager?
- need declare 2nd entrypoint?
- authenticationfilters?
- possible recover user basic authenticated crm webapp in new portal abstractpreauthenticatedprocessingfilter ?

i have following assumption / conclusion explanation:

1) crm user repository , portal user repository have different users

2) crm users should not know portal users passwords

i not think need use runasmanager. (when use runasmanager mean first authenticate crm user in portal , replace authentication portal user authentication. not think can authenticate crm user against portal user repository.)

i suggest create own “authenticateas” functionality: when crm user press on link in crm page of portal user authenticated in portal portal user without providing password.

how works?

1) when crm user presses link parameter encrypted portal user name added url.

2) when request encrypted portal user name access portal application, new created preauthenticatedprocessingfilter decrypt user name , authenticate user

that’s :)

couple of comments:

1) please use aes-258 algorithm encrypt / decrypt user name

2) please ensure key encrypt / decrypt can not accessed htttp

3) can extend abstractpreauthenticatedprocessingfilter preauthenticatedprocessingfilter

4) suggest create 2 roles in portal application: user_write_role , user_read_role. when crm user access using “authenticateas” authentication - should user_read_role. when portal user access using regular authentication - should user_ write_role.

5) should think how crm user perform logout portal user (otherwise work on first user). simplest way can think - preauthenticatedprocessingfilter should process each request (even authenticated) , if contains parameter user name clean portal user session , perform new authentication.

please tell me think suggestion , tell me if need additional clarifications.

best regards,

michael

p.s. added after question edited. simplest way track crm users on portal add additional encrypted parameter url crm user name