killbill-uncached

diff --git a/server/src/main/java/com/ning/billing/server/modules/KillbillServerModule.java b/server/src/main/java/com/ning/billing/server/modules/KillbillServerModule.java
index 366ebef..2327c27 100644
--- a/server/src/main/java/com/ning/billing/server/modules/KillbillServerModule.java
+++ b/server/src/main/java/com/ning/billing/server/modules/KillbillServerModule.java
@@ -21,7 +21,6 @@ import javax.sql.DataSource;
 
 import com.ning.billing.clock.Clock;
 import com.ning.billing.clock.ClockMock;
-import com.ning.billing.clock.DefaultClock;
 import com.ning.billing.entitlement.glue.DefaultEntitlementModule;
 import org.skife.config.ConfigSource;
 import org.skife.config.SimplePropertyConfigSource;
@@ -69,7 +68,6 @@ import com.ning.billing.util.glue.CustomFieldModule;
 import com.ning.billing.util.glue.ExportModule;
 import com.ning.billing.util.glue.GlobalLockerModule;
 import com.ning.billing.util.glue.KillBillShiroAopModule;
-import com.ning.billing.util.glue.KillBillShiroModule;
 import com.ning.billing.util.glue.MetricsModule;
 import com.ning.billing.util.glue.NonEntityDaoModule;
 import com.ning.billing.util.glue.NotificationQueueModule;
@@ -171,7 +169,7 @@ public class KillbillServerModule extends AbstractModule {
         install(new DefaultOSGIModule(configSource));
         install(new UsageModule(configSource));
         install(new RecordIdModule());
-        install(new KillBillShiroWebModule(servletContext));
+        install(new KillBillShiroWebModule(servletContext, configSource));
         install(new KillBillShiroAopModule());
         install(new SecurityModule());
         installClock();

diff --git a/server/src/main/java/com/ning/billing/server/modules/KillBillShiroWebModule.java b/server/src/main/java/com/ning/billing/server/modules/KillBillShiroWebModule.java
index 0dfade8..5a63c4e 100644
--- a/server/src/main/java/com/ning/billing/server/modules/KillBillShiroWebModule.java
+++ b/server/src/main/java/com/ning/billing/server/modules/KillBillShiroWebModule.java
@@ -22,8 +22,11 @@ import org.apache.shiro.cache.CacheManager;
 import org.apache.shiro.guice.web.ShiroWebModule;
 import org.apache.shiro.session.mgt.SessionManager;
 import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
+import org.skife.config.ConfigSource;
+import org.skife.config.ConfigurationObjectFactory;
 
 import com.ning.billing.jaxrs.resources.JaxrsResource;
+import com.ning.billing.util.config.RbacConfig;
 import com.ning.billing.util.glue.EhCacheManagerProvider;
 import com.ning.billing.util.glue.IniRealmProvider;
 import com.ning.billing.util.glue.JDBCSessionDaoProvider;
@@ -37,12 +40,18 @@ import com.google.inject.binder.AnnotatedBindingBuilder;
 // See com.ning.billing.util.glue.KillBillShiroModule for Kill Bill library.
 public class KillBillShiroWebModule extends ShiroWebModule {
 
-    public KillBillShiroWebModule(final ServletContext servletContext) {
+    private final ConfigSource configSource;
+
+    public KillBillShiroWebModule(final ServletContext servletContext, final ConfigSource configSource) {
         super(servletContext);
+        this.configSource = configSource;
     }
 
     @Override
     protected void configureShiroWeb() {
+        final RbacConfig config = new ConfigurationObjectFactory(configSource).build(RbacConfig.class);
+        bind(RbacConfig.class).toInstance(config);
+
         bindRealm().toProvider(IniRealmProvider.class).asEagerSingleton();
 
         if (KillBillShiroModule.isLDAPEnabled()) {

diff --git a/server/src/test/java/com/ning/billing/jaxrs/TestJaxrsBase.java b/server/src/test/java/com/ning/billing/jaxrs/TestJaxrsBase.java
index 4bc4e4c..8b0e3a0 100644
--- a/server/src/test/java/com/ning/billing/jaxrs/TestJaxrsBase.java
+++ b/server/src/test/java/com/ning/billing/jaxrs/TestJaxrsBase.java
@@ -228,7 +228,7 @@ public class TestJaxrsBase extends KillbillClient {
             install(new UsageModule(configSource));
             install(new RecordIdModule());
             installClock();
-            install(new KillBillShiroWebModule(servletContext));
+            install(new KillBillShiroWebModule(servletContext, configSource));
             install(new KillBillShiroAopModule());
             install(new SecurityModule());
         }

diff --git a/util/src/main/java/com/ning/billing/util/config/RbacConfig.java b/util/src/main/java/com/ning/billing/util/config/RbacConfig.java
new file mode 100644
index 0000000..63226fe
--- /dev/null
+++ b/util/src/main/java/com/ning/billing/util/config/RbacConfig.java
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2010-2013 Ning, Inc.
+ *
+ * Ning licenses this file to you under the Apache License, version 2.0
+ * (the "License"); you may not use this file except in compliance with the
+ * License.  You may obtain a copy of the License at:
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+
+package com.ning.billing.util.config;
+
+import org.skife.config.Config;
+import org.skife.config.Default;
+import org.skife.config.Description;
+import org.skife.config.TimeSpan;
+
+public interface RbacConfig extends KillbillConfig {
+
+    @Config("killbill.rbac.globalSessionTimeout")
+    @Default("1h")
+    @Description("System-wide default time that any session may remain idle before expiring")
+    public TimeSpan getGlobalSessionTimeout();
+}

diff --git a/util/src/main/java/com/ning/billing/util/glue/JDBCSessionDaoProvider.java b/util/src/main/java/com/ning/billing/util/glue/JDBCSessionDaoProvider.java
index de5299a..3237ebb 100644
--- a/util/src/main/java/com/ning/billing/util/glue/JDBCSessionDaoProvider.java
+++ b/util/src/main/java/com/ning/billing/util/glue/JDBCSessionDaoProvider.java
@@ -23,17 +23,20 @@ import org.apache.shiro.session.mgt.DefaultSessionManager;
 import org.apache.shiro.session.mgt.SessionManager;
 import org.skife.jdbi.v2.IDBI;
 
+import com.ning.billing.util.config.RbacConfig;
 import com.ning.billing.util.security.shiro.dao.JDBCSessionDao;
 
 public class JDBCSessionDaoProvider implements Provider<JDBCSessionDao> {
 
     private final SessionManager sessionManager;
     private final IDBI dbi;
+    private final RbacConfig rbacConfig;
 
     @Inject
-    public JDBCSessionDaoProvider(final IDBI dbi, final SessionManager sessionManager) {
+    public JDBCSessionDaoProvider(final IDBI dbi, final SessionManager sessionManager, final RbacConfig rbacConfig) {
         this.sessionManager = sessionManager;
         this.dbi = dbi;
+        this.rbacConfig = rbacConfig;
     }
 
     @Override
@@ -41,7 +44,9 @@ public class JDBCSessionDaoProvider implements Provider<JDBCSessionDao> {
         final JDBCSessionDao jdbcSessionDao = new JDBCSessionDao(dbi);
 
         if (sessionManager instanceof DefaultSessionManager) {
-            ((DefaultSessionManager) sessionManager).setSessionDAO(jdbcSessionDao);
+            final DefaultSessionManager defaultSessionManager = (DefaultSessionManager) sessionManager;
+            defaultSessionManager.setSessionDAO(jdbcSessionDao);
+            defaultSessionManager.setGlobalSessionTimeout(rbacConfig.getGlobalSessionTimeout().getMillis());
         }
 
         return jdbcSessionDao;

diff --git a/util/src/main/java/com/ning/billing/util/glue/KillBillShiroModule.java b/util/src/main/java/com/ning/billing/util/glue/KillBillShiroModule.java
index ee99ac1..db117d1 100644
--- a/util/src/main/java/com/ning/billing/util/glue/KillBillShiroModule.java
+++ b/util/src/main/java/com/ning/billing/util/glue/KillBillShiroModule.java
@@ -21,7 +21,10 @@ import org.apache.shiro.guice.ShiroModule;
 import org.apache.shiro.mgt.SecurityManager;
 import org.apache.shiro.session.mgt.DefaultSessionManager;
 import org.apache.shiro.session.mgt.SessionManager;
+import org.skife.config.ConfigSource;
+import org.skife.config.ConfigurationObjectFactory;
 
+import com.ning.billing.util.config.RbacConfig;
 import com.ning.billing.util.security.shiro.dao.JDBCSessionDao;
 import com.ning.billing.util.security.shiro.realm.KillBillJndiLdapRealm;
 
@@ -42,7 +45,16 @@ public class KillBillShiroModule extends ShiroModule {
         return Boolean.parseBoolean(System.getProperty(KILLBILL_RBAC_PROPERTY, "true"));
     }
 
+    private final ConfigSource configSource;
+
+    public KillBillShiroModule(final ConfigSource configSource) {
+        this.configSource = configSource;
+    }
+
     protected void configureShiro() {
+        final RbacConfig config = new ConfigurationObjectFactory(configSource).build(RbacConfig.class);
+        bind(RbacConfig.class).toInstance(config);
+
         bindRealm().toProvider(IniRealmProvider.class).asEagerSingleton();
 
         if (isLDAPEnabled()) {

diff --git a/util/src/test/java/com/ning/billing/util/glue/TestUtilModuleNoDB.java b/util/src/test/java/com/ning/billing/util/glue/TestUtilModuleNoDB.java
index a5b8594..adf1d24 100644
--- a/util/src/test/java/com/ning/billing/util/glue/TestUtilModuleNoDB.java
+++ b/util/src/test/java/com/ning/billing/util/glue/TestUtilModuleNoDB.java
@@ -51,7 +51,7 @@ public class TestUtilModuleNoDB extends TestUtilModule {
 
         installAuditMock();
 
-        install(new KillBillShiroModule());
+        install(new KillBillShiroModule(configSource));
         install(new KillBillShiroAopModule());
         install(new SecurityModule());
     }

diff --git a/util/src/test/java/com/ning/billing/util/security/TestPermissionAnnotationMethodInterceptor.java b/util/src/test/java/com/ning/billing/util/security/TestPermissionAnnotationMethodInterceptor.java
index 2330078..55358a2 100644
--- a/util/src/test/java/com/ning/billing/util/security/TestPermissionAnnotationMethodInterceptor.java
+++ b/util/src/test/java/com/ning/billing/util/security/TestPermissionAnnotationMethodInterceptor.java
@@ -74,7 +74,7 @@ public class TestPermissionAnnotationMethodInterceptor extends UtilTestSuiteNoDB
         // Shutdown the cache manager to avoid duplicate exceptions
         CacheManager.getInstance().shutdown();
         final Injector injector = Guice.createInjector(Stage.PRODUCTION,
-                                                       new KillBillShiroModule(),
+                                                       new KillBillShiroModule(configSource),
                                                        new KillBillShiroAopModule(),
                                                        new SecurityModule(),
                                                        new AbstractModule() {
@@ -102,7 +102,7 @@ public class TestPermissionAnnotationMethodInterceptor extends UtilTestSuiteNoDB
         // Shutdown the cache manager to avoid duplicate exceptions
         CacheManager.getInstance().shutdown();
         final Injector injector = Guice.createInjector(Stage.PRODUCTION,
-                                                       new KillBillShiroModule(),
+                                                       new KillBillShiroModule(configSource),
                                                        new KillBillShiroAopModule(),
                                                        new SecurityModule(),
                                                        new AbstractModule() {