J2EE role with SSO tickets

We are implementing EP and R/3 on MySAP ERP 2004. There are separate J2EE engines for portal and R/3. The R/3 j2ee accepts tickets from the portal and passes to ABAP instance. We are looking to deploy WebDynpro applications outside of the portal. Can the R/3 J2EE both issue tickets with authentication and accept tickets from the portal? Or should only the portal j2EE issue the login tickets?