i've been doing more research. it seems that all <passivation-config> was deprecated (no longer used).
so, i looked to the source code of undertow, and i find the InMemorySessionManager has an option for: exictOldestUnusedSessionOnMax.
if this gets set to false, it rejects the connections per my understanding of lines 132-135 in the code:
the question remains; how to set this to false...?
This behavior was changed in this commit. Apart from the misspelling (seems like a cross between evict and expire), I think the default behavior (WildFly does not currently contain a mechanism to override it) should really be false, since this new behavior is counter to the servlet specification which states that sessions should remain active until the configured session-timeout.
Regarding passivation, this was deprecated in WF8, since the value is easily implied by max-active-sessions. If this is non-zero, and your web application is distributable (requiring your session attributes to be serializable), then any sessions in excess of max-active-sessions will passivate.
This is VERY helpful, thanks. However, I don't see where exictOldestUnusedSessionOnMax ever gets set to false. The factory that creates the InMemorySessionManager doesn't seem to allow use of the new constructor.
This is what I meant by: "WildFly does not currently contain a mechanism to override it". I've opened: