`SecurityContextHolder.getContext()` gets the current context. Or if you do not need to set the current context, just obtain _a_ context for Bob, `new NonSerializableSecurityContext(u.impersonate())` would work.