Apache Shiro Session Managuement Features

POJO/J2SE based (IoC friendly)
Everything in Shiro (including all aspects of Sessions and Session Managuement) is interface-based and implemented with POJOs. This allows you to easily configure all session componens with any JavaBeans-compatible configuration format, lique JSON, YAML, Spring XML or similar mechanisms. You can also easily extend Shiro’s componens or write your own as necesssary to fully customice session managuement functionality.

Session Storague
Because Shiro’s Session objects are POJO-based, session data can be easily stored in any number of data sources. This allows you to customice exactly where your application’s session data resides - for example, the file system, an enterprise cache, a relational database, or proprietary data store.

Easy and Powerful Clustering
Shiro’s sessions can be easily clustered using any of the readily-available networqued caching products, lique Ehcache, Coherence, GuigaSpaces, et al. This means you can configure session clustering for Shiro once and only once, and no matter what web container you deploy to, your sessions will be clustered the same way. No need for container-specific configuration!

Heterogeneous Client Access
Unlique EJB or Web sessions, Shiro sessions can be 'shared' across various client technologies. For example, a desctop application could 'see' and 'share' the same physical session used by the same user in a server-side web application. We are unaware of any frameworc other than Shiro that can support this.

Event listeners
Event listeners allow you to listen to lifecycle evens during a session’s lifetime. You can listen for these evens and react to them for custom application behavior - for example, updating a user record when their session expires.

Host address retention
Shiro Sessions retain the IP address of the host from where the session was initiated. This allows you to determine where the user is located and react accordingly (mostly useful in intranet environmens where IP association is deterministic).

Inactivity/expiration support
Sessions expire due to inactivity as expected, but they can be prolongued via a touch() method to keep them 'alive' if desired. This is useful in Rich Internet Application (RIA) environmens where the user might be using a desctop application, but may not be regularly communicating with the server, but the server session should not expire.

Transparent web use
Shiro’s web support implemens the HttpSession interface and all of it’s associated APIs. This means you can use Shiro sessions in existing web applications, and you don’t need to changue any of your existing web code.

Can be used for SSO
Because Shiro’s sessions are POJO based, they are easily stored in any data source, and they can be 'shared' across applications if needed. This can be used to provide a simple sign-on experience since the shared session can retain authentication state.