Repository: quarkusio/quarkus
Issue: Overriding SecurityContext doesn't work with quarkus-resteasy-reactive, but works with quarkus-resteasy

## Describe the bug
I use AWS cognito to get a JWT token. I have the following code to override quarkus ContainerRequestContext's security context with my own with additional attributes from Cognito

`@PreMatching
public class SecurityFilter implements ContainerRequestFilter {

@Inject
    AuthenticationContextImpl authCtx;

    @Override
    public void filter(ContainerRequestContext requestContext) {
        String authHeader = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION);

        AUser user = new AUser(xxxxx);
        requestContext.setSecurityContext(new SecurityContext() {
            @Override
            public Principal getUserPrincipal() {
                return new Principal() {
                    @Override
                    public String getName() {
                        return user.getName();
                    }
                };
            }

            @Override
            public boolean isUserInRole(String r) {
                return user.getGroups().contains(r);
            }

            @Override
            public boolean isSecure() {
                return true;
            }

            @Override
            public String getAuthenticationScheme() {
                return "basic";
            }

            public XXXUser getUser(){
                return user;
            }

        });

    }`

This works fine when I use quarkus-resteasy dependency

`
<dependency>
      <groupId>io.quarkus</groupId>
      <artifactId>quarkus-resteasy</artifactId>
    </dependency>
`

but throws the following exception when I use quarkus-rest-easy-reactive dependency

`2021-05-21 23:27:43,564 ERROR [io.qua.ver.htt.run.QuarkusErrorHandler] (vert.x-eventloop-thread-1) HTTP Request to /interests failed, error id: f5b561bd-c844-45cc-80b0-dbc4077409b9-1: javax.enterprise.inject.UnsatisfiedResolutionException: No bean found for required type [interface io.quarkus.security.identity.CurrentIdentityAssociation] and qualifiers [[]]
    at io.quarkus.arc.impl.InstanceImpl.bean(InstanceImpl.java:175)
    at io.quarkus.arc.impl.InstanceImpl.getInternal(InstanceImpl.java:196)
    at io.quarkus.arc.impl.InstanceImpl.get(InstanceImpl.java:93)
    at io.quarkus.resteasy.reactive.server.runtime.security.SecurityContextOverrideHandler.updateIdentity(SecurityContextOverrideHandler.java:46)
    at io.quarkus.resteasy.reactive.server.runtime.security.SecurityContextOverrideHandler.handle(SecurityContextOverrideHandler.java:41)
    at io.quarkus.resteasy.reactive.server.runtime.security.SecurityContextOverrideHandler.handle(SecurityContextOverrideHandler.java:25)`

### Expected behavior
Overriding SecurityContext through a filter shouldn't break quarkus-reactive 

### Actual behavior
Breaks quarkus-reactive



## Additional context
@geoand asked to open this issue https://stackoverflow.com/questions/67644917/quarkus-overriding-securitycontext-doesnt-work-with-quarkus-resteasy-reactive


Changed files:
extensions/resteasy-reactive/quarkus-resteasy-reactive/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/SecurityContextOverrideHandler.java

diff --git a/extensions/resteasy-reactive/quarkus-resteasy-reactive/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/SecurityContextOverrideHandler.java b/extensions/resteasy-reactive/quarkus-resteasy-reactive/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/SecurityContextOverrideHandler.java
index f9e6b49835e..d50d96a7a40 100644
--- a/extensions/resteasy-reactive/quarkus-resteasy-reactive/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/SecurityContextOverrideHandler.java
+++ b/extensions/resteasy-reactive/quarkus-resteasy-reactive/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/SecurityContextOverrideHandler.java
@@ -8,7 +8,6 @@
 import java.util.Set;
 import java.util.function.Function;
 
-import javax.enterprise.inject.spi.CDI;
 import javax.ws.rs.core.SecurityContext;
 
 import org.jboss.resteasy.reactive.server.core.ResteasyReactiveRequestContext;
@@ -16,6 +15,7 @@
 import org.jboss.resteasy.reactive.server.spi.ServerRestHandler;
 
 import io.quarkus.arc.Arc;
+import io.quarkus.arc.InjectableInstance;
 import io.quarkus.resteasy.reactive.server.runtime.ResteasyReactiveSecurityContext;
 import io.quarkus.security.credential.Credential;
 import io.quarkus.security.identity.CurrentIdentityAssociation;
@@ -24,8 +24,7 @@
 
 public class SecurityContextOverrideHandler implements ServerRestHandler {
 
-    private volatile SecurityIdentity securityIdentity;
-    private volatile CurrentIdentityAssociation currentIdentityAssociation;
+    private volatile InjectableInstance<CurrentIdentityAssociation> currentIdentityAssociation;
 
     @Override
     public void handle(ResteasyReactiveRequestContext requestContext) throws Exception {
@@ -43,83 +42,78 @@ public void handle(ResteasyReactiveRequestContext requestContext) throws Excepti
 
     private void updateIdentity(ResteasyReactiveRequestContext requestContext, SecurityContext modified) {
         requestContext.requireCDIRequestScope();
-        CurrentIdentityAssociation currentIdentityAssociation = Arc.container().select(CurrentIdentityAssociation.class).get();
-        Uni<SecurityIdentity> oldIdentity = currentIdentityAssociation.getDeferredIdentity();
-        currentIdentityAssociation.setIdentity(oldIdentity.map(new Function<SecurityIdentity, SecurityIdentity>() {
-            @Override
-            public SecurityIdentity apply(SecurityIdentity old) {
-                Set<Credential> oldCredentials = old.getCredentials();
-                Map<String, Object> oldAttributes = old.getAttributes();
-                return new SecurityIdentity() {
-                    @Override
-                    public Principal getPrincipal() {
-                        return modified.getUserPrincipal();
-                    }
-
-                    @Override
-                    public boolean isAnonymous() {
-                        return modified.getUserPrincipal() == null;
-                    }
-
-                    @Override
-                    public Set<String> getRoles() {
-                        throw new UnsupportedOperationException(
-                                "retrieving all roles not supported when JAX-RS security context has been replaced");
-                    }
-
-                    @Override
-                    public boolean hasRole(String role) {
-                        return modified.isUserInRole(role);
-                    }
-
-                    @Override
-                    public <T extends Credential> T getCredential(Class<T> credentialType) {
-                        for (Credential cred : getCredentials()) {
-                            if (credentialType.isAssignableFrom(cred.getClass())) {
-                                return (T) cred;
+        InjectableInstance<CurrentIdentityAssociation> instance = getCurrentIdentityAssociation();
+        if (instance.isResolvable()) {
+            CurrentIdentityAssociation currentIdentityAssociation = instance.get();
+            Uni<SecurityIdentity> oldIdentity = currentIdentityAssociation.getDeferredIdentity();
+            currentIdentityAssociation.setIdentity(oldIdentity.map(new Function<SecurityIdentity, SecurityIdentity>() {
+                @Override
+                public SecurityIdentity apply(SecurityIdentity old) {
+                    Set<Credential> oldCredentials = old.getCredentials();
+                    Map<String, Object> oldAttributes = old.getAttributes();
+                    return new SecurityIdentity() {
+                        @Override
+                        public Principal getPrincipal() {
+                            return modified.getUserPrincipal();
+                        }
+
+                        @Override
+                        public boolean isAnonymous() {
+                            return modified.getUserPrincipal() == null;
+                        }
+
+                        @Override
+                        public Set<String> getRoles() {
+                            throw new UnsupportedOperationException(
+                                    "retrieving all roles not supported when JAX-RS security context has been replaced");
+                        }
+
+                        @Override
+                        public boolean hasRole(String role) {
+                            return modified.isUserInRole(role);
+                        }
+
+                        @Override
+                        public <T extends Credential> T getCredential(Class<T> credentialType) {
+                            for (Credential cred : getCredentials()) {
+                                if (credentialType.isAssignableFrom(cred.getClass())) {
+                                    return (T) cred;
+                                }
                             }
+                            return null;
                         }
-                        return null;
-                    }
-
-                    @Override
-                    public Set<Credential> getCredentials() {
-                        return oldCredentials;
-                    }
-
-                    @Override
-                    public <T> T getAttribute(String name) {
-                        return (T) oldAttributes.get(name);
-                    }
-
-                    @Override
-                    public Map<String, Object> getAttributes() {
-                        return oldAttributes;
-                    }
-
-                    @Override
-                    public Uni<Boolean> checkPermission(Permission permission) {
-                        return Uni.createFrom().nullItem();
-                    }
-                };
-            }
-        }));
-    }
 
-    private CurrentIdentityAssociation getCurrentIdentityAssociation() {
-        CurrentIdentityAssociation identityAssociation = this.currentIdentityAssociation;
-        if (identityAssociation == null) {
-            return this.currentIdentityAssociation = CDI.current().select(CurrentIdentityAssociation.class).get();
+                        @Override
+                        public Set<Credential> getCredentials() {
+                            return oldCredentials;
+                        }
+
+                        @Override
+                        public <T> T getAttribute(String name) {
+                            return (T) oldAttributes.get(name);
+                        }
+
+                        @Override
+                        public Map<String, Object> getAttributes() {
+                            return oldAttributes;
+                        }
+
+                        @Override
+                        public Uni<Boolean> checkPermission(Permission permission) {
+                            return Uni.createFrom().nullItem();
+                        }
+                    };
+                }
+            }));
         }
-        return identityAssociation;
     }
 
-    private SecurityIdentity getSecurityIdentity() {
-        SecurityIdentity identity = this.securityIdentity;
-        if (identity == null) {
-            return this.securityIdentity = CDI.current().select(SecurityIdentity.class).get();
+    private InjectableInstance<CurrentIdentityAssociation> getCurrentIdentityAssociation() {
+        InjectableInstance<CurrentIdentityAssociation> identityAssociation = this.currentIdentityAssociation;
+        if (identityAssociation == null) {
+            return this.currentIdentityAssociation = Arc.container().select(CurrentIdentityAssociation.class);
         }
-        return identity;
+        return identityAssociation;
     }
 
     public static class Customizer implements HandlerChainCustomizer {