anchor.diff:  
   One way to differentiate tenants is by the issuer claim. Since the issuer claim accompanies signed JWTs, this can be done with the `JwtIssuerAuthenticationManagerResolver`, like so:
   
  -[source,java]
  +.Multitenancy Tenant by JWT Claim
  +====
  +.Java
  +[source,java,role="primary"]
   ----
   JwtIssuerAuthenticationManagerResolver authenticationManagerResolver = new JwtIssuerAuthenticationManagerResolver
       ("https://idp.example.org/issuerOne", "https://idp.example.org/issuerTwo");
  
positive.code: 
  And then specify this `AuthenticationManagerResolver` in the DSL:
  
  [source,java]
  ----
  http
      .authorizeRequests(authorize -> authorize
  
negative.code:     );
  ----
  
  .Xml
  [source,xml,role="secondary"]
  ----
  <http>
      <oauth2-resource-server authentication-manager-resolver-ref="authenticationManagerResolver"/>
  </http>
  
  <bean id="authenticationManagerResolver"
          class="org.springframework.security.oauth2.server.resource.authentication.JwtIssuerAuthenticationManagerResolver">
      <constructor-arg>
          <list>
              <value>https://idp.example.org/issuerOne</value>
              <value>https://idp.example.org/issuerTwo</value>
          </list>
      </constructor-arg>
  </bean>
  ----
  ====
  
  This is nice because the issuer endpoints are loaded lazily.
  In fact, the corresponding `JwtAuthenticationProvider` is instantiated only when the first request with the corresponding issuer is sent.
  This allows for an application startup that is independent from those authorization servers being up and available.
  