anchor.diff:      );
   ----
   
  +.Xml
  +[source,xml,role="secondary"]
  +----
  +<http>
  +    <oauth2-resource-server authentication-manager-resolver-ref="authenticationManagerResolver"/>
  +</http>
  +
  +<bean id="authenticationManagerResolver"
  +        class="org.springframework.security.oauth2.server.resource.authentication.JwtIssuerAuthenticationManagerResolver">
  +    <constructor-arg>
  +        <list>
  +            <value>https://idp.example.org/issuerOne</value>
  +            <value>https://idp.example.org/issuerTwo</value>
  +        </list>
  +    </constructor-arg>
  +</bean>
  +----
  +====
  +
   This is nice because the issuer endpoints are loaded lazily.
   In fact, the corresponding `JwtAuthenticationProvider` is instantiated only when the first request with the corresponding issuer is sent.
   This allows for an application startup that is independent from those authorization servers being up and available.
  
positive.code:     }
  }
  ----
  ====
  
  Or similarly with method security:
  
negative.code: For example, you may have a need to read the bearer token from a custom header.
  To achieve this, you can wire a `HeaderBearerTokenResolver` instance into the DSL, as you can see in the following example:
  
  .Custom Bearer Token Header
  ====
  .Java
  [source,java,role="primary"]
  ----
  http
      .oauth2ResourceServer(oauth2 -> oauth2
  