anchor.diff:              )
               .oauth2ResourceServer(oauth2 -> oauth2
                   .jwt(jwt -> jwt
  -                    .jwtAuthenticationConverter(grantedAuthoritiesExtractor())
  +                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
                   )
               );
       }
   }
   
  -Converter<Jwt, AbstractAuthenticationToken> grantedAuthoritiesExtractor() {
  -    JwtAuthenticationConverter jwtAuthenticationConverter =
  -            new JwtAuthenticationConverter();
  -
  -    jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter
  -            (new GrantedAuthoritiesExtractor());
  -
  +JwtAuthenticationConverter jwtAuthenticationConverter() {
  +    JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
  +    grantedAuthoritiesConverter.setAuthoritiesClaimName("authorities");
  +
  +    JwtAuthenticationConverter authenticationConverter = new JwtAuthenticationConverter();
  +    jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(authoritiesConverter);
       return jwtAuthenticationConverter;
  -}
  -----
  -
  -.Kotlin
  -[source,kotlin,role="secondary"]
  -----
  -@EnableWebSecurity
  -class DirectlyConfiguredJwkSetUri : WebSecurityConfigurerAdapter() {
  -    override fun configure(http: HttpSecurity) {
  -        http {
  -            authorizeRequests {
  -                authorize(anyRequest, authenticated)
  -            }
  -            oauth2ResourceServer {
  -                jwt {
  -                    jwtAuthenticationConverter = grantedAuthoritiesExtractor()
  -                }
  -            }
  -        }
  -    }
  -
  -    private fun grantedAuthoritiesExtractor(): JwtAuthenticationConverter {
  -        val jwtAuthenticationConverter = JwtAuthenticationConverter()
  -        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(GrantedAuthoritiesExtractor())
  -        return jwtAuthenticationConverter
  -    }
   }
   ----
   
  
positive.code: For example, some authorization servers don't use the `scope` attribute, but instead have their own custom attribute.
  Or, at other times, the resource server may need to adapt the attribute or a composition of attributes into internalized authorities.
  
  To this end, the DSL exposes `jwtAuthenticationConverter()`:
  
  .Authorities Extractor Configuration
  ====
  .Java
  [source,java,role="primary"]
  ----
  @EnableWebSecurity
  public class DirectlyConfiguredJwkSetUri extends WebSecurityConfigurerAdapter {
      protected void configure(HttpSecurity http) {
          http
              .authorizeRequests(authorize -> authorize
  
negative.code:     <intercept-uri pattern="/messages/**" access="hasAuthority('SCOPE_messages')"/>
      <oauth2-resource-server>
          <jwt jwk-set-uri="https://idp.example.org/.well-known/jwks.json"
                  jwt-authentication-converter-ref="jwtAuthenticationConverter"/>
      </oauth2-resource-server>
  </http>
  
  <bean id="jwtAuthenticationConverter"
          class="org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter">
      <property name="jwtGrantedAuthoritiesConverter" ref="jwtGrantedAuthoritiesConverter"/>
  </bean>
  
  <bean id="jwtGrantedAuthoritiesConverter"
          class="org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter">
      <property name="authoritiesClaimName" value="authorities"/>
  </bean>
  ----
  ====
  
  You can also configure the authority prefix to be different as well.
  Instead of prefixing each authority with `SCOPE_`, you can change it to `ROLE_` like so:
  
  .Authorities Prefix Configuration
  ====
  .Java
  [source,java,role="primary"]
  ----
  JwtAuthenticationConverter jwtAuthenticationConverter() {
      JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
      grantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
  
      JwtAuthenticationConverter authenticationConverter = new JwtAuthenticationConverter();
      jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(authoritiesConverter);
      return jwtAuthenticationConverter;
  }
  ----
  
  .Xml
  [source,xml,role="secondary"]
  ----
  <http>
      <intercept-uri pattern="/contacts/**" access="hasAuthority('SCOPE_contacts')"/>
      <intercept-uri pattern="/messages/**" access="hasAuthority('SCOPE_messages')"/>
      <oauth2-resource-server>
          <jwt jwk-set-uri="https://idp.example.org/.well-known/jwks.json"
                  jwt-authentication-converter-ref="jwtAuthenticationConverter"/>
      </oauth2-resource-server>
  </http>
  
  <bean id="jwtAuthenticationConverter"
          class="org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter">
      <property name="jwtGrantedAuthoritiesConverter" ref="jwtGrantedAuthoritiesConverter"/>
  </bean>
  
  <bean id="jwtGrantedAuthoritiesConverter"
          class="org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter">
      <property name="authorityPrefix" value="ROLE_"/>
  </bean>
  ----
  ====
  
  Or, you can remove the prefix altogether by calling `JwtGrantedAuthoritiesConverter#setAuthorityPrefix("")`.
  
  For more flexibility, the DSL supports entirely replacing the converter with any class that implements `Converter<Jwt, AbstractAuthenticationToken>`:
  
  