LexikJWTAuthenticationBundle always get null user over token storage

Question

I'm working with symfony at backend (api). The authentication process is handled by FosUserBundle, LexikJWTAuthenticationBundle and LdapTools... all works fine.

The problem is when I'm about to get the Authenticated user in a controller or service.

The user is authenticated by the Authorization header, does not exist 401 Exception

$this->container->get('security.token_storage')->getToken()->getUser()//null

$preAuthToken = $this->container->get('security.token_storage')->getToken();
$tmp = $this->container->get('lexik_jwt_authentication.jwt_manager')->decode($preAuthToken);//i can get the username and roles

But the real proble is with the security system

if ($this->isGranted('ROLE_USER')) {
     echo 'never gets here!!';
     } else {
  echo 'always';
}

The security system always fails because the user returned by getUser() is always null.

My question is: the LexikJWTAuthenticationBundle should not inject or replace the current user, token after a successfull authentication?

or should I do it programatically? I dont want to fall in bad practices..

thanks in advance!

security.yml info

security:
    encoders:
        FOS\UserBundle\Model\UserInterface: bcrypt
        LdapTools\Bundle\LdapToolsBundle\Security\User\LdapUser: plaintext

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: ROLE_ADMIN

    providers:
        ldap:
            id: ldap_tools.security.user.ldap_user_provider

        fos_userbundle:
            id: fos_user.user_provider.username_email

    firewalls:
        refresh:
            pattern: ^/api/token/refresh
            stateless: true
            anonymous: true

        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        api_login:
            pattern:  ^/login
            stateless: true
            provider: fos_userbundle
            anonymous: true
            form_login:
                check_path:               /login
                require_previous_session: false
                username_parameter:       username
                password_parameter:       password
                success_handler:          lexik_jwt_authentication.handler.authentication_success
                failure_handler:          AppBundle\Handler\AuthenticationFailureHandler
                require_previous_session: false
            guard:
                authenticators:
                    - ldap_tools.security.ldap_guard_authenticator
            logout: true

        api:
            pattern:   ^/
            stateless: true
            lexik_jwt: ~

    access_control:
        - { path: ^/login$,           role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/,                 role: IS_AUTHENTICATED_FULLY }

Auth. failure handler(just in case)

public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
    {
        $token = $exception->getToken();

        if (is_string($exception->getToken()->getUser())) {
            $usuario = $this->container->get('fos_user.user_manager')->findUserByUsername($token->getUsername());
            if ($usuario) {
                $token = new UsernamePasswordToken($usuario, 'yes', 'public', $usuario->getRoles());
            } else {
                return $this->container->get('lexik_jwt_authentication.handler.authentication_failure')->onAuthenticationFailure($request, $exception);
            }

        }
        return $this->handleAuthenticationFail($request, $token, $exception);
    }

    public function handleAuthenticationFail(Request $request, TokenInterface $token, AuthenticationException $exception)
    {

        $username = $token->getUsername();

        $password = $request->get('password');
        if ($this->ldapManager->authenticate($username, $password)) {
            return $this->container->get('lexik_jwt_authentication.handler.authentication_success')->handleAuthenticationSuccess($token->getUser());
        }

        return $this->container->get('lexik_jwt_authentication.handler.authentication_failure')->onAuthenticationFailure($request, $exception);
    }