public Optional<UserIdentity> getOrSetSessionUser(final HttpServletRequest request,
                                                      final Optional<UserIdentity> userIdentity) {
        Optional<UserIdentity> result = userIdentity;

        if (userIdentity.isEmpty()) {
            // Provide identity from the session if we are allowing this to happen.
            result = UserIdentitySessionUtil.get(request.getSession(false));

            if (LOGGER.isDebugEnabled()) {
                LOGGER.debug("User identity from session: [{}]", result.orElse(null));
            }

        } else if (UserIdentitySessionUtil.requestHasSessionCookie(request)) {
            // Set the user ref in the session.
            UserIdentitySessionUtil.set(request.getSession(true), userIdentity.get());
        }

        return result;
    }
This method attempts to get a token from the request headers and, if present, use that to login.
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/OpenIdManager.java