I am going to prepare a security framework based on Weblogic 7.0.
I need to customize the authentication and authorization behavior.
So, I think I should replace the default security providers of
weblogic with my own. But I want to keep more information for signed
in users like their IPs, also I need to have the list of current
users in my code. In general I want to manage active users and access
to their information (more than what J2EE API allows) via an API in
my program.

Could you help me ?