There is no possibility to define a RunAs user through CMIS.
At the moment we have a custom webscript in Alfresco which logs in as the RunAs user and returns the ticket.
Then we use the ticket in the password field and do our stuff.
It would be nice to extent the Authentication mechanism to supply extra parameters and control them server side so this is not needed.
If this is already possible, then I didn't knew that and I'd love to have some info how to do that.