APEX

Hi All,
We have the following scenario where my company wishes to begin using APEX for more and more applications. Now, rather than having end users have a different account for each application they are allowed access to, we want to have one global "APEX" account for a user. Users will then be assigned rights to access each of the individual applications.

The ideal solution would be similar to Oracle APPS where you login to a single page and are presented with a list of applications you can access. Then select the one you wish to use this session. Now, I am comfortable with creating the tables to manage this etc however I am unable to make it so I can authenticate a different application. ie, say APP1 is my login application and I have APP2 and APP3. I would want a user to be able to login to APP1 and then click a link to APP2 or APP3, authenticating them into that application without the need to enter any additional details. I tried passing the username/password directly to the login API with the other applications ID but get an error [ERR-10768 Application ID and current security group ID are not consistent].
Another thing is different apps will have additional fields required on the user tables but I envisage this being implemented by a local table in that schema linking the userID to any additional application-specific rights.
Is all this at all possible to do? I am guessing I will need application-level authorization on each application? I have the theory, it's just putting it into practice that's a problem, lol! :)

Another (less favourable) option would be to have each application use authentication on the same tables and then as above, link to the app-specific tables. This would however mean giving the users many links to each individual application.

The first option is the ideal and any help on an implementation technique would be greatly appreciated. I hope I've explained myself fully! :)