[PJUG Javamail] Servlet Specification: Session Tracking

[Christian Pich]

I have a question concerning the servlet session object:

I would like to be able to know how many sessions are currently active
on my server, that is how many users are actively doing business.
Now there is this class, HttpSessionContext that seems to do exactly answer
this question, however this class is deprecated (at least in version 
servlet 2.4).
Sun only puts out the comment it is deprecate because of security 
resaons. Now
hat are the security reasons?
Couldn't Sun include that bit of information here?
Just as I hate when a method is deprecated and no comment is provided
how to get the business done otherwise?

It boils down that the servlet specification does not allow you to 
inquire at any point in
time what sessions are managed by the app server. Other cases of 
depraction are:
You cannot obtain all the roles a principal has, you can only check if a 
principal has given role.

I am sure there are good reasons ...

Now, how can I track all my users anyway?
It appears to me that the servlet API provides a listener called
|HttpSessionBindingListener| 
<http://java.sun.com/j2ee/sdk_1.2.1/techdocs/api/javax/servlet/http/HttpSessionBindingListener.html>
that gets called every time a new session is created or removed.
It comes down to the fact that I have to keep track of these events and 
store
each session myself. Doesn't that seem awkward?

Is there a library that does this for me? Any other suggestions or comments?

Christian