I have a tomcat webapp that is comprised of a lot of one-shot,
context-free servlets. The only context they need is the security (ie
jsessionid) which is static for the session, of course. I use the
DatasourceRealm at the moment.

Because of the lack of real context I would like the security system
to validate against an external server. This would allow me to restart
tomcat between requests and the clients would recover okay. But I
think all of the realms only check the username and password at login.
The jsessionid is held in tomcat memory and is lost on a tomcat
restart. I think this includes any custom realm I might write.

Am I right about this? Is there a realm (or something else) that
allows me to do something more interesting with the jsessionid? I
don't mind writing it myself. I am envisaging replacing the jsessionid
lookup with an RMI call to my external security server process. Login
validation would go there as well.

Are the hooks available to implement something like this?

I keep finding things about session replication, which must be doing
something like this to work, but I do not need session replication as
such, I have no session to replicate.

All suggestions gratefully received.
Roger