How a server can make a session with a client in RMI

Solution 1:

I named this the Remote Session pattern in my 2001 book.

The idea is to have a singleton RMI object, bound in the Registry, with nothing but a login() method. That method, if successful, returns a new RemoteSession object for every call, that contains the API you need for the session. RemoteSession is another remote interface of course. It also contains a logout() method, which unexports the object, and it also implements Unreferenced, as another way of terminating the session.

Each instance of RemoteSession can maintain client state, so it is a session object, and as the only way to get a RemoteSession object is via login(), it is secure to a first approximation.