Spring Security applying HttpSecurity filter before building user principal

Question

I have a springboot application that is using Keycloak to handle JWT authentication. If I use @PreAuthorize on my controller method, everything works as expected, but the U