I can't point you to any articles or tried-and-tested approaches, but your question is interesting.
Here is a thought off the top of my head - how about storing some kind of Map (keyed by user id) of user information in the application context? This would work (a) if all the activity is confined to a single web application, and (b) if there is one running instance in your application server. However, on (b) - you mention the word "cluster" - and whereas application servers usually provide session replication across members of a cluster, none that I know of provide context replication. Mind you, I have led a sheltered life.
I would probably go for a database approach, though. Instead of fighting through an EJB layer, could you go for a separate, light-weight database server located close to (preferably on the same machine as) your application server? Its sole purpose would be to accumulate your user's "session" information which hasn't yet been committed to the real database.
Let us know what architecture you opt for in the end.