private String createLogoutUri(final String endpoint,
                                   final String clientId,
                                   final AuthenticationState state) {
        UriBuilder redirect = UriBuilder.fromUri(state.getRedirectUri());
        redirect = UriBuilderUtil.addParam(redirect, OpenId.STATE, state.getId());

        UriBuilder uriBuilder = UriBuilder.fromUri(endpoint);
        uriBuilder = UriBuilderUtil.addParam(uriBuilder, OpenId.CLIENT_ID, clientId);
        uriBuilder = UriBuilderUtil.addParam(uriBuilder, OpenId.POST_LOGOUT_REDIRECT_URI, redirect.build().toString());
        final String uriStr = uriBuilder.build().toString();
        LOGGER.debug("Sending user to logout screen with uri: {}", uriStr);
        return uriStr;
    }
This method attempts to get a token from the request headers and, if present, use that to login.
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/OpenIdManager.java