private Optional<UserIdentity> createUserIdentity(final HttpServletRequest request,
                                                      final AuthenticationState state,
                                                      final TokenResponse tokenResponse,
                                                      final JwtContext jwtContext) {
        Optional<UserIdentity> optUserIdentity = Optional.empty();
        final JwtClaims jwtClaims = jwtContext.getJwtClaims();

        final String nonce = (String) jwtClaims.getClaimsMap()
                .get(OpenId.NONCE);
        final boolean match = nonce != null && nonce.equals(state.getNonce());
        if (match) {
            optUserIdentity = mapAuthFlowIdentity(jwtContext, request, tokenResponse);
            optUserIdentity.ifPresent(userIdentity -> {
                if (userIdentity instanceof final HasRefreshable hasRefreshable) {
                    NullSafe.consume(hasRefreshable.getRefreshable(),
                            refreshable ->
                                    refreshable.refreshIfRequired(
                                            RefreshMode.JUST_IN_TIME, refreshManager::addOrUpdate));
                }
            });
        } else {
            // If the nonces don't match we need to redirect to log in again.
            // Maybe the request uses an out-of-date stroomSessionId?
            LOGGER.info(() -> "Received a bad nonce!");
        }

        return optUserIdentity;
    }
Refresh the user identity including any tokens associated with that user.

@param userIdentity
stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/AbstractUserIdentityFactory.java