As described in http://labs.jboss.com/community/wiki/HAWebSessionsviaDatabasePersistencethere there is a way to tell JBoss to store web sessions in a datasource without using the Tomcat PersistentManager but the code in SVN has a bug:

2009-11-04 13:25:29,945 WARN [org.jboss.web.tomcat.service.session.InstantSnapshotManager./bligoo] (ajp-192.168.1.127-8009-1) Failed to replicate session NbQHDZfTi7jV5MySSD6JPg__
java.lang.StringIndexOutOfBoundsException: String index out of range: 24
 at java.lang.AbstractStringBuilder.substring(AbstractStringBuilder.java:879)
 at java.lang.StringBuilder.substring(StringBuilder.java:55)
 at org.jboss.web.tomcat.service.session.persistent.RDBMSStoreBase.maskId(RDBMSStoreBase.java:1079)
 at org.jboss.web.tomcat.service.session.persistent.RDBMSStoreBase.maskId(RDBMSStoreBase.java:1061)
 at org.jboss.web.tomcat.service.session.persistent.RDBMSStoreBase.storeSessionData(RDBMSStoreBase.java:1007)
 at org.jboss.web.tomcat.service.session.persistent.PersistentStoreDistributedCacheManager.storeSessionData(PersistentStoreDistributedCacheManager.java:148)
 at org.jboss.web.tomcat.service.session.persistent.PersistentStoreDistributedCacheManager.storeSessionData(PersistentStoreDistributedCacheManager.java:41) at org.jboss.web.tomcat.service.session.ClusteredSession.processSessionReplication(ClusteredSession.java:1192)
 at org.jboss.web.tomcat.service.session.JBossCacheManager.processSessionRepl(JBossCacheManager.java:2182)
 at org.jboss.web.tomcat.service.session.JBossCacheManager.storeSession(JBossCacheManager.java:313)
 at org.jboss.web.tomcat.service.session.InstantSnapshotManager.snapshot(InstantSnapshotManager.java:51)
 at org.jboss.web.tomcat.service.session.ClusteredSessionValve.handleRequest(ClusteredSessionValve.java:147)
 at org.jboss.web.tomcat.service.session.ClusteredSessionValve.invoke(ClusteredSessionValve.java:94)
 at org.jboss.web.tomcat.service.session.LockingValve.invoke(LockingValve.java:62)
 at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:92)
 at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.process(SecurityContextEstablishmentValve.java:126)
 at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.invoke(SecurityContextEstablishmentValve.java:70)
 at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
 at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
 at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:158)
 at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:330)
 at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:436)
 at org.apache.coyote.ajp.AjpProtocol$AjpConnectionHandler.process(AjpProtocol.java:384)
 at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
 at java.lang.Thread.run(Thread.java:619)

The problem seems to be in the maskId function in org.jboss.web.tomcat.service.session.persistent.RDBMSStoreBase

1064 private static String maskId(String realId)
1065 {
1066 if (realId == null)
1067 {
1068 return null;
1069 }
1070 else
1071 {
1072 int length = realId.length();
1073 if (length <= 8)
1074 {
1075 return realId;
1076 }
1077 StringBuilder sb = new StringBuilder(realId.substring(0, 2));
1078 sb.append("****");
1079 sb.append(sb.substring(length - 6, length));
1080 return sb.toString();
1081 }
1082 }

The line 1079 should be

sb.append(realId.substring(length - 6, length));

Should I open a jira for it? Is this feature going to be included in 5.2.0GA (since is commited to trunk?)