You are messing up everything.
What is the best method to grant overall access to objects mentioned above?
No, there is no such method at all
They are different objects and require different treatment.
for the database object you have but little choice.
You can create it with every request and use it throughout processing (of course you will need to make it global to use inside other classes).
Or use it as a static singleton object, which will be called each time you need to interact with database. It will establish a database connection at the first call and eventually use it until the end of the processing request. With another request it will start over.
For the user object both transparent serializing in a session and dependency injection are good.
However, creating a user object on each request is not that bad idea. In your place I won't torture sessions such a way.