public static void set(final HttpServletRequest request, final UserIdentity userIdentity) {
        // Set the user ref in the session.
        final HttpSession session = request.getSession(true);
        set(session, userIdentity);
        // Now we have the session make note of the user-agent for logging and sessionListServlet duties
        UserAgentSessionUtil.setUserAgentInSession(request, session);
    }
Set the userIdentity on the session, creating the session as required
stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/UserIdentitySessionUtil.java