Look at the tcl api documentation for
ad_set_client_property and
ad_get_client_property. OpenACS4 already has session management built in, and these procedures keep track of variables for each session. Depending on what you use for the -persistent and -deferred flags, they can be written to the database immediately, when the session closes, or not at all.
I'd also recommend that newcomers to OpenACS4 read the Request Processor Design document that describes all the data available from the ad_conn command. Among other things, this is your interface to the session_id and user_id cookies that the system is managing on your behalf.
