title: Shared session timeout in a EAI + sso scenario
body: <p>While using a SSO to integrate between disparate "web applications", the user might switch back and forth between these applications. As the user navigates between these applications, a local session gets created on each of the applications in addition to a session created at the Identity Provider that is used for sso. </p>
  
  <p>So, the issue is when applications have different session timeouts, leading to a broken user experience. Session timeout occurs in one application while the user is working on another application. When navigating back into the application the user had visited previously, an error occurs. This is confusing to the user, since they are not aware that they are working on different applications.</p>
  
  <p>One way to avoid the problem is to have a "global session" object that every application has access to. While the user is accessing any protected resource, the application checks if the global session exists and updates its timestamp before processing the request. The local sessions will never expire (or have a very long timeout). However, when the user logs out, global session object is evicted and the sign out happens on all the applications. </p>
  
  <p>This seems to be a bit heavy handed due to:</p>
  
  <ul>
  <li>Global session object becomes single point of failure</li>
  <li>The performance to make a "out of process" check for the global
     session object and update the timestamp on access of <em>every</em>
     protected request</li>
  </ul>
  
  <p>Any other thoughts on how to make this work?</p>