public Optional<UserIdentity> getAuthFlowUserIdentity(final HttpServletRequest request,
                                                          final String code,
                                                          final AuthenticationState state) {
        final OpenIdConfiguration openIdConfiguration = openIdConfigProvider.get();

        if (IdpType.NO_IDP.equals(idpType)) {
            throw new IllegalStateException(
                    "Attempting to do OIDC auth flow with identityProviderType set to NONE.");
        }

        final String tokenEndpoint = openIdConfiguration.getTokenEndpoint();

        final TokenResponse tokenResponse = new OpenIdTokenRequestHelper(
                tokenEndpoint, openIdConfiguration, objectMapper, jerseyClientFactory)
                .withCode(code)
                .withGrantType(OpenId.GRANT_TYPE__AUTHORIZATION_CODE)
                .withRedirectUri(state.getRedirectUri())
                .sendRequest(true);

        final Optional<UserIdentity> optUserIdentity = jwtContextFactory.getJwtContext(tokenResponse.getIdToken())
                .flatMap(jwtContext ->
                        createUserIdentity(request, state, tokenResponse, jwtContext))
                .or(() -> {
                    throw new AuthenticationException("Unable to authenticate ID token");
                });

        LOGGER.debug(() -> "Got auth flow user identity "
                           + optUserIdentity.map(Objects::toString).orElse("EMPTY"));

        return optUserIdentity;
    }
Extracts the authenticated user's identity from http request when that
request is part of a UI based authentication flow with the IDP
stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/AbstractUserIdentityFactory.java