Setting session timeout globaly. It can be done by implementing ServletContextListener
@Override
public void contextInitialized(ServletContextEvent servletContextEvent) {
servletContextEvent.getServletContext().setSessionTimeout(timeinminutes);
}
For specific User we can get the session from Request (HttpServletRequest)
e.g request.getSession().setMaxInactiveInterval(timeinsecond);