private Optional<UserIdentity> doFetchVerifiedIdentity(final String apiKeyStr) {
        // This has to be unsecured as we are trying to authenticate
        if (!apiKeyGenerator.isApiKey(apiKeyStr)) {
            LOGGER.debug("apiKey is not an API key");
            return Optional.empty();
        } else {
            final String prefix = ApiKeyGenerator.extractPrefixPart(apiKeyStr);

            final List<HashedApiKey> apiKeys = apiKeyDao.fetchValidApiKeysByPrefix(prefix);

            if (apiKeys.isEmpty()) {
                LOGGER.debug("No valid API keys found matching prefix '{}'", prefix);
                return Optional.empty();
            } else {
                Optional<UserIdentity> optUserIdentity = Optional.empty();
                // In most cases, there will be only one apiKey fetched for a given prefix
                // as the chance of a prefix clash is ~1:1,000,000. If there are multiple,
                // then we just test each one using its algorithm to see if the stored hash
                // matches the hash of the passed api key.
                for (final HashedApiKey apiKey : apiKeys) {
                    final boolean isHashMatch = verifyApiKeyHash(
                            apiKeyStr,
                            apiKey.getApiKeyHash(),
                            apiKey.getHashAlgorithm());
                    if (isHashMatch) {
                        final Optional<User> optionalUser = Optional.ofNullable(apiKey.getOwner())
                                .flatMap(userCache::getByRef);
                        optUserIdentity = optionalUser
                                .map(user -> {
                                    verifyEnabledOrThrow(user);
                                    return user.asRef();
                                })
                                .map(BasicUserIdentity::new);
                        LOGGER.debug("optUserIdentity: {}", optUserIdentity);
                        break;
                    }
                }
                LOGGER.debug("Found {} valid API key(s) matching prefix: '{}', matched identity: {}",
                        apiKeys.size(), prefix, optUserIdentity);
                return optUserIdentity;
            }
        }
    }
Fetch the verified {@link UserIdentity} for the passed API key.
If the hash of the API key matches one in the database and that key is enabled
and not expired then the {@link UserIdentity} will be returned, else an empty {@link Optional}
is returned.
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/apikey/ApiKeyService.java