I think your solution sounds good. Here is how I have done it in the past in case it helps you. Use webservices so that one of your applications will be your login application. Only one application will contain the webservice. This application will use it's standard login, only logging the user into it.
On the other application, check to see it the user is logged in on every page load(preferably in a page baseclass). If the user is not logged in, use the webservice that will log him into the login application. If that returns successful, log the user into the this app programmatically. This way you can use the builtin login functionality of each application without having to modify them.