I think that HttpSessionBindingListeneris what you are looking for. I will not write down the complete code, just offer you a way you can do this:
() User class (DTO), sessions of users.
e.g private static Map<User, HttpSession> usersSessions= new HashMap<User, HttpSession>();
User class implemets HttpSessionBindingListener. valueBound(HttpSessionBindingEvent event), session usersSessions :
usersSessions.put(this, event.getSession());
valueUnbound(HttpSessionBindingEvent event) :
usersSessions.remove(this);, users session logout.
, Map active sessions , . IMO, .