@Override
    public Map<String, String> getAuthHeaders(final UserIdentity userIdentity) {

        if (userIdentity == null) {
            LOGGER.debug("Null user supplied");
            return Collections.emptyMap();

        } else {
            LOGGER.trace(() -> LogUtil.message("IdpType: {}, userIdentity type: {}",
                    idpType, userIdentity.getClass().getSimpleName()));

            if (IdpType.NO_IDP.equals(idpType)) {
                return Collections.emptyMap();

            } else if (IdpType.TEST_CREDENTIALS.equals(idpType)
                       && !serviceUserFactory.isServiceUser(userIdentity, getServiceUserIdentity())) {
                // The processing user is a bit special so even when using hard-coded default open id
                // creds the proc user uses tokens created by the internal IDP.
                LOGGER.debug("Using default token");
                return jwtContextFactory.createAuthorisationEntries(defaultOpenIdCredentials.getApiKey());

            } else if (userIdentity instanceof final HasJwt hasJwt) {
                LOGGER.debug(() -> LogUtil.message("Getting auth headers as {}, {}",
                        HasJwt.class.getSimpleName(),
                        userIdentity.getClass().getSimpleName()));

                // The JWT may be of the type that requires refreshing so check that first
                if (userIdentity instanceof final HasRefreshable hasRefreshable) {
                    final Refreshable refreshable = hasRefreshable.getRefreshable();
                    refreshable.refreshIfRequired(RefreshMode.JUST_IN_TIME, refreshManager::addOrUpdate);
                }

                // This is for stroom's internal IDP processing user identity (which we don't need to refresh as
                // ProcessingUserIdentityProviderImpl handles that) or for users that have come from
                // an AWS ALB with an access token that we don't update.
                final String accessToken = Objects.requireNonNull(hasJwt.getJwt(),
                        () -> "Null access token for userIdentity " + userIdentity);
                return jwtContextFactory.createAuthorisationEntries(accessToken);

            } else {
                LOGGER.debug(() -> "Wrong type of userIdentity " + userIdentity.getClass());
                return Collections.emptyMap();
            }
        }
    }
Map the IDP identity provided by the {@link JwtContext} and the
{@link TokenResponse}to a local user. This is for use in a UI based
authentication flow.

@param jwtContext    The identity on the IDP to map to a local user.
@param request       The HTTP request
@param tokenResponse The token received from the IDP.
@return A local {@link UserIdentity} if the identity can be mapped.
stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/AbstractUserIdentityFactory.java