Distributed shared web sessions can passivate prematurely

When an EAR is configured to share web sessions across WARs, each WAR deployment will use the same distributed session manager factory instance. However, each deployment will use a separate session manager instance (created from the shared factory). Since session expiration and passivation is managed per session manager, it is possible that a session is scheduled to expire on one manager, regardless of whether it is subsequently referenced by another manager, and can thus attempt to expire prematurely, thus failing to expire when it should.

To fix this, each session manager instance must also share session expiration/eviction schedulers, where each manager registers deployment specific listeners on SessionManager.start() and unregisters on stop().