Setting session timeout globaly. It can be done by implementing ServletContextListener
@Override
public void contextInitialized(ServletContextEvent servletContextEvent) {      
    servletContextEvent.getServletContext().setSessionTimeout(timeinminutes);
}

For specific User we can get the session from Request (HttpServletRequest) 
e.g request.getSession().setMaxInactiveInterval(timeinsecond);