Core answer
Start here. This is the direct spoken answer to practice first.
Overview
The current identity is represented by Authentication inside a SecurityContext, not by a domain user loaded everywhere.
SecurityContext contains the current Authentication. That authentication represents the principal, granted authorities, and mechanism-specific details; credentials are usually cleared after successful authentication. SecurityContextHolder provides access to the context and uses thread-local storage by default in Servlet applications. In MVC code I prefer supported argument resolution such as @AuthenticationPrincipal when only the current principal is needed.