Hello
Sorry for late answer.
org.ops4j.pax.web.service.jetty.internal.HttpServiceContext (extension of org.eclipse.jetty.servlet.ServletContextHandler), when created uses "SESSIONS | SECURITY".
Session handler is created as:
- org.ops4j.pax.web.service.jetty.internal.LateInvalidatingHashSessionManager, or
- org.eclipse.jetty.server.session.JDBCSessionManager
(that's hardcoded in org.ops4j.pax.web.service.jetty.internal.HttpServiceContext#newSessionHandler()).
The chosen session manager depends on what's returned by org.eclipse.jetty.server.Server#getSessionIdManager(). LateInvalidatingHashSessionManager is chosen by default, without explicit configuration. The JDBCSessionManager is chosen if SessionIDManager is org.eclipse.jetty.server.session.JDBCSessionIdManager.
regards
Grzegorz Grzybek