Statement is incorrect. Portlets are not just small web applicaitons. They can be typical sophisticated and/or robust application. Idea of putting such applications into portlets to have a complete control or usages of all such application through a single portal. Ofcourse we can also implement Oracle's SSO(Single Sign On) to have a single crendential authentication across all the portlets on a portal.