anchor.diff:  
   For these purposes, Resource Server supports mapping the JWT claim set with `MappedJwtClaimSetConverter`.
   
  -[[oauth2resourceserver-claimsetmapping-singleclaim]]
  +[[oauth2resourceserver-jwt-claimsetmapping-singleclaim]]
   ==== Customizing the Conversion of a Single Claim
   
   By default, `MappedJwtClaimSetConverter` will attempt to coerce claims into the following types:
  
positive.code: 
  From here, consider jumping to:
  
  <<oauth2resourceserver-jwkseturi,How to Configure without Tying Resource Server startup to an authorization server's availability>>
  
  <<oauth2resourceserver-sansboot,How to Configure without Spring Boot>>
  
  [[oauth2resourceserver-jwkseturi]]
  === Specifying the Authorization Server JWK Set Uri Directly
  
  If the authorization server doesn't support the Provider Configuration endpoint, or if Resource Server must be able to start up independently from the authorization server, then `issuer-uri` can be exchanged for `jwk-set-uri`:
  
negative.code: [[oauth2resourceserver]]
  == OAuth 2.0 Resource Server
  
  Spring Security supports protecting endpoints using two forms of OAuth 2.0 https://tools.ietf.org/html/rfc6750.html[Bearer Tokens]:
  
  * https://tools.ietf.org/html/rfc7519[JWT]
  * Opaque Tokens
  
  This is handy in circumstances where an application has delegated its authority management to an https://tools.ietf.org/html/rfc6749[authorization server] (for example, Okta or Ping Identity).
  This authorization server can be consulted by resource servers to authorize requests.
  
  [NOTE]
  ====
  Working samples for both {gh-samples-url}/boot/oauth2resourceserver[JWTs] and {gh-samples-url}/boot/oauth2resourceserver-opaque[Opaque Tokens] are available in the {gh-samples-url}[Spring Security repository].
  ====
  
  === Dependencies
  