1) I see you are using the DefaultGateway class. Using this class will allow calls on any java class. It is better to use the AdvancedGateway for better security.
2) Extend OpenAMF's SpringbeanInvoker and overwrite the method
Code:
protected Object invokeServiceMethod(Object service, Class serviceClass, String methodName, List parameters) throws SecurityException, NoSuchMethodException, IllegalAccessException, IllegalArgumentException, InvocationTargetException
Do some session stuff with the Session object by calling getHttpServletRequest():
Code:
getHttpServletRequest().getSession(); //get the session object through the request. Access other params from the HttpServletRequest object also.
request.getServiceName(); //get the called service name
methodName; //name of method called on service object
Then replace the Spring invoker in the openAMF-config with your own.
Code:
<invoker>
<name>Spring</name>
<!-- <class>org.openamf.invoker.SpringBeanInvoker</class> -->
<class>your.package.name.openamf.invoker.CustomSpringBeanInvoker</class>
</invoker>
Now your own SpringbeanInvoker will be called allowing you to do some session management.