The representation of a session in an SSO in the clustered cache is done with a simple data object that encapsulates the session id and the address of the node where the session was active. This doesn't properly handle the case where multiple sessions using the same session id but with different webapps are associated with the sso. This kind of thing is common due to the use of the emptySessionPath="true" flag on the connectors in server.xml.

A fix will involve storing the hostname and the context path along with the session id.

Note that the 4.x branch TreeCacheSSOClusterManager.SessionAddress class cannot have its serialization characteristics changed, so the hostname/context path will need to be prepended to the existing sessionId field.

In AS 5 this information now forms part of a JBC FQN, so fix will be a bit different.