As discussed with @rwinch, we can add a SecurityContextRepository implementation that stores the SecurityContext as a request attribute.

Comment From: rwinch

The new repository can be used leveraging the following configuration:

@Bean
DefaultSecurityFilterChain configure(HttpSecurity http) throws Exception {
    http
        // ...
        .securityContext(securityContext -> securityContext
            .securityContextRepository(new RequestAttributeSecurityContextRepository()).and()
        );
    return http.build();
}