I haven't implemented something similar in JBOSS but we have a few successful implementations together with Jetty.

Most likely you are not authenticating the user and when you open a connection you are opening it as a single user/service account and then you will be limited to 5 connections. You should be able to determine this by inspecting the first frame that is being sent over the socket which will contain a OnAuthenticationInformation message that will tell you who you are authenticated as. This first frame should ideally contain the username of the user you are authenticating. You would want separate sessions anyway as it will share selection state.

Otherwise the limit is working as intended, it is there to prevent people from essentially just putting a proxy in front of the engine and serve up Qlik sessions to an unlimited amount of users while only consuming a single token.

So the process should go something like this,

1. Authenticate the user somehow, tickets/headers etc

2. Once authenticated a Set-Cookie response will be issued when requesting a resource from behind the QPS (for example if you have a ticket you can open a socket with ?qlikTicket=<ticket> and it will consume the ticket and send back a session cookie in the upgrade response.

3. Make sure the session cookie is part of the request that opens the socket, performs the handshake.

3.5 For Tyrus this means you need supply your own configuration class. http://chariotsolutions.com/blog/post/form-based-login-for-java-websocket-client/ Should help you with that

4. This will associate the session with the correct user.