The normal way is to maintain session information in a relational database, but it seems that in your case you really want a Storable. The missing link with using the ::Session modules (already mentioned) is that they are a bit DBI orientated. However, that can still be resolved by creating a DBI interface to your storable to be used by your session objects.

Update: I just ran into Apache::Session::Serialize::Storable which seems to have addressed all this (and transparently to the programmer).