What you suggest in that thread is to login to App1 then login to App2. For clarification does this mean I’d have to setup App2 with accounts-password package and configure it to point to App1 DB?
Yes. If you want to authenticate from the client you will need to have an auth DB associated with both connections. I had assumed you want the same authenticated user connected to App1 would do the connecting to App2 through their client? If so, then both apps would need auth support for the client connections.
An alternative is to connect server to server App1 <==> App2. Then you could write a publish function on App1 that fetched the data from App2 and would be able to filter for the user logged into App1. Then App2 would only need to connect securely to App1 and would not need to know anything about users.
App2 could have a publish function with arguments, the args being how to filter down the data.
App1 would validate the user then make a secure call to App2 (with filtering args) and then publish that collection to the user.