anchor.diff:  
   import java.util.HashMap;
   
  +import org.eclipse.microprofile.jwt.Claims;
  +
   /**
    * A simple utility class to generate and print a JWT token string to stdout. Can be run with:
    * mvn exec:java -Dexec.mainClass=org.acme.jwt.GenerateToken -Dexec.classpathScope=test
    */
   public class GenerateToken {
  +    /**
  +     *
  +     * @param args - [0]: optional name of classpath resource for json document of claims to add; defaults to "/JwtClaims.json"
  +     *             [1]: optional time in seconds for expiration of generated token; defaults to 300
  +     * @throws Exception
  +     */
       public static void main(String[] args) throws Exception {
  -        String claimsJson = "/Claims1.json";
  +        String claimsJson = "/JwtClaims.json";
           if (args.length > 0) {
               claimsJson = args[0];
           }
           HashMap<String, Long> timeClaims = new HashMap<>();
  +        if (args.length > 1) {
  +            long duration = Long.parseLong(args[1]);
  +            long exp = TokenUtils.currentTimeInSecs() + duration;
  +            timeClaims.put(Claims.exp.name(), exp);
  +        }
           String token = TokenUtils.generateTokenString(claimsJson, timeClaims);
           System.out.println(token);
       }
   }
  +----
  +
  +To get these classes to compile and run, you need to add the following dependency to your using-jwt-rbac/pom.xml:
  +
  +.nimbus-jose-jwt library dependency
  +[source, xml]
  +----
  +    <dependency>
  +      <groupId>com.nimbusds</groupId>
  +      <artifactId>nimbus-jose-jwt</artifactId>
  +      <version>6.7</version>
  +      <scope>test</scope>
  +    </dependency>
   ----
   
   Now we need the content of the RSA private key that corresponds to the public key we have in the TokenSecuredResource application. Take the following PEM content and place it into using-jwt-rbac/src/test/resources/privateKey.pem.
  
positive.code: }
  ----
  <1> This new endpoint will be located at /secured/roles-allowed
  <2> @RolesAllowed is a JSR 250 common security annotation that indicates that the given endpoint is accessible by a caller if they have either a "Echoer" or "Subscriber" role assigned.
  
  After you make this addition to your `TokenSecuredResource`, rerun the `mvn compile quarkus:dev` command, and then try `curl -v http://127.0.0.1:8080/secured/roles-allowed; echo` to attempt to access the new endpoint. Your output should be:
  
  
negative.code: ----
  mvn exec:java -Dexec.mainClass=org.acme.jwt.GenerateToken -Dexec.classpathScope=test
  ----
  
  TIP: You may need to run `mvn test-compile` before this if your working strictly from the command line and not an IDE that
  automatically compiles code and you write it.
  
  .Sample JWT Generation Output
  [source, bash]
  