I think I tried the cache approach mentioned by Anthony in Stack Overflow combined with automated client-side requests (for updating a user state). The outcome is a plugin published here (with license AGPLv3):
http://code.google.com/p/plugin-whoisonline/ The wiki contains the code for a simple use case. --
