If you can't use OmniFaces, how about using an idleMonitor to check the session status every x milliseconds? The below will fire when the user comes back to the web page after being away for 5 minutes. The only problem is it won't fire if the user sits there moving the mouse around the web page without actually doing anything, but the session would still timeout.
<p:idleMonitor timeout="18000000">
<p:ajax event="active" listener="#{Logincontroller.checksessiontimeout}" />
</p:idleMonitor>