SecurityIdentity is not re-used when using SubjectCreatingPolicyInterceptor in a CXF endpoint

@Stateless
@WebService(name = "echo",
        targetNamespace = "http://com.sample.redhat/ws",
        serviceName = "echo-service")
@Policy(placement = Policy.Placement.BINDING, uri = "WssUsernameToken10.xml")
@SOAPBinding(style = SOAPBinding.Style.RPC)
@EndpointProperties(value = {
    @EndpointProperty(key = "ws-security.validate.token", value = "false")
})
@InInterceptors(interceptors = {
    "org.jboss.wsf.stack.cxf.security.authentication.SubjectCreatingPolicyInterceptor"
})
public class Echo {

    @Resource SessionContext ctx;
    
    @WebMethod
    @PermitAll
    public String echo(String input) {
        Message message = PhaseInterceptorChain.getCurrentMessage();
        SecurityContext context = message.get(SecurityContext.class);
        System.err.println("CXF user=" + context.getUserPrincipal().getName()); // CXF user
        System.err.println("JavaEE user=" + ctx.getCallerPrincipal().getName()); // JavaEE user

        SecurityDomain sd = SecurityDomain.getCurrent();
        if (sd != null && sd.getCurrentSecurityIdentity() != null) {
            SecurityIdentity si = sd.getCurrentSecurityIdentity();
            System.err.println("SecurityIdentity=" + si);
            System.err.println("attributes=" + StreamSupport.stream(si.getAttributes().entries().spliterator(), false).collect(Collectors.toMap(Attributes.Entry::getKey, Function.identity())));
            System.err.println("private-credentials=" + si.getPrivateCredentials().size());
            System.err.println("public-credentials=" + si.getPublicCredentials().size());
            System.err.println("created-time=" + si.getCreationTime());
            System.err.println("roles=" + StreamSupport.stream(si.getRoles().spliterator(), false).collect(Collectors.toList()));
        }

        String userName = ctx.getCallerPrincipal().getName();
        return userName + " -> " +  input;
    }
}