Regardless of your deployment environment, you can set the session timeout either via deployment standard descriptor web.xml:
<web-app>
<session-config>
<session-timeout> 1 </session-timeout >
</session-config>
</web-app>
OR via programmaticaly via HttpSession interface:
http://java.sun.com/j2ee/sdk_1.3/techdocs/api/javax/servlet/http/HttpSession.ht ml#setMaxInactiveInterval(int)
Of course, you can get hold of the HTTPSession via HttpServletRequest interface:
http://java.sun.com/j2ee/sdk_1.3/techdocs/api/javax/servlet/http/HttpServletReq uest.html#getSession()
Hope this helps.