Currently suggested for Dolphin (Java SE 7).
The current idea is that the session service would be an MBean in the JMImplementation domain. To create a session you call a method on this MBean, which specifies what sort of session it is. Each session is also an MBean, and the exact MBean class corresponds to the type of session. Sessions are also registered in the JMImplementation domain. This means that you can tell what sessions are in progress with MBeanServer.queryNames, you can see a session's status with MBeanServer.getAttribute, you can be notified of changes in the status with MBeanServer.addNotificationListener, and you can renew the lease with MBeanServer.invoke. Possibly, you can terminate a session by unregistering its MBean, though there are questions about how a client can know whether a session terminated successfully if the MBean is no longer present.
There may be security considerations related to the fact that every client can see all sessions unless its permissions have been carefully configured to prevent this.