anchor.diff:         "iat": 1311280970,
          "sub": "24400320",
          "upn": "jdoe@server.example.com",
  -       "groups": ["red-group", "green-group", "admin-group"],
  -       "roles": ["auditor", "administrator"]
  -}
  -```
  -This specification defines a JsonWebToken java.security.Principal interface extension that makes this set of required
  -claims available via get style accessors. The JsonWebToken interface definition is:
  +       "groups": ["red-group", "green-group", "admin-group", "admin"],
  +}
  +```
  +This specification defines a JsonWebToken java.security.Principal interface extension that makes
  +this set of required claims available via get style accessors. The JsonWebToken interface definition is:
   
   ```java
   package org.eclipse.microprofile.jwt;
   public interface JsonWebToken extends Principal {
   
       /**
  -     * Returns the unique name of this principal. This either comes from the upn claim, or if that is missing, the
  -     * preferred_username claim. Note that for guaranteed interoperability a upn claim should be used.
  +     * Returns the unique name of this principal. This either comes from the upn
  +     * claim, or if that is missing, the preferred_username claim. Note that for
  +     * guaranteed interoperability a upn claim should be used.
        *
        * @return the unique name of this principal.
        */
  
positive.code: 
  ```
  
  #### Injection of JWTClaimPrincipal
  
  ```java
  @Path("/endp")
  @DenyAll
  public class RolesEndpoint {
  
  ...
  
      @JWTClaim("raw_token")
      private String token;;
  ```
  
  #### javax.ws.rs.core.SecurityContext.getUserPrincipal()
  The Principal returned from these methods MUST be an instance of org.eclipse.microprofile.jwt.JsonWebToken.
  
  #### javax.ws.rs.core.SecurityContext#isUserInRole(String)
  This method MUST return true for any role name that is included in the MP-JWT "groups" claim, as well as for any
  role name that has been mapped to a group name in the MP-JWT "group" claim.
  
  ### Mapping from @RolesAllowed
  Any role names used in @RolesAllowed or equivalent security constraint metadata that match role names in either
  the MP-JWT "roles" claim, or role names that have been mapped to group names in the MP-JWT "group" claim, MUST result
  in an allowing authorization decision wherever the security constraint has been applied.
  
  ### Recommendations for Optional Container Integration
  This section describes the expected behaviors
  
  #### javax.security.enterprise.identitystore.IdentityStore.getCallerGroups(CredentialValidationResult)
  This method should return the set of names found in the "groups" claim in the JWT if it exists, an empty set otherwise.
  
  #### javax.ejb.SessionContext.getCallerPrincipal()
  The java.security.Principal returned from this method MUST be an instance of org.eclipse.microprofile.jwt.JsonWebToken.
  #### javax.ejb.SessionContext#isCallerInRole(String)
  This method MUST return true for any role name that is included in the MP-JWT "roles" claim, as well as for any
  role name that has been mapped to a group name in the MP-JWT "group" claim.
  
  #### javax.servlet.http.HttpServletRequest.getUserPrincipal()
  The java.security.Principal returned from this method MUST be an instance of org.eclipse.microprofile.jwt.JsonWebToken.
  #### javax.servlet.http.HttpServletRequest#isUserInRole(String)
  This method MUST return true for any role name that is included in the MP-JWT "roles" claim, as well as for any
  role name that has been mapped to a group name in the MP-JWT "group" claim.
  
  #### javax.security.jacc.PolicyContext.getContext("javax.security.auth.Subject.container")
  The javax.security.auth.Subject returned by the PolicyContext.getContext(String key) method with the standard
  "javax.security.auth.Subject.container" key, MUST return a Subject that has a java.security.Principal of type
  org.eclipse.microprofile.jwt.JsonWebToken amongst it's set of Principals returned by getPrincipals(). Similarly,
  Subject#getPrincipals(JsonWebToken.class) must return a set with at least one value. This means that following code
  snipet must not throw an AssertionError:
  
  ```java
  
negative.code: issue tokens using the JWT format in a way that service providers can understand in order to introspect the token and
  gather information about a subject. To that end, the requirements for the MicroProfile JWT are:
  
  1. An authentication token.
  2. An authorization token that contains Java EE application level roles indirectly granted via groups.
  3. Can be mapped to IdentityStore in JSR375.
  4. Can support additional standard claims described in https://www.iana.org/assignments/jwt/jwt.xhtml as
  well as non-standard claims.
  
  To meet those requirements, we introduce 2 new claims to the MP-JWT:
  
  * "upn": A human readable claim that uniquely identifies the subject or user principal of token, across
  the MicroProfile services the token will be accessed with.
  * "groups": The token subject's group membership that will be mapped to Java EE application
  level roles.
  
  ### Required Claims
  The required minimum set of MP-JWT claims is then:
  
  typ:: This JOSE header parameter identifies the token as an RFC7519 and must be "JWT" https://tools.ietf.org/html/rfc7519#section-5.1[RFC7519, Section 5.1]
  alg:: This JOSE header parameter identifies the cryptographic algorithm used to secure the JWT. MP-JWT requires the
  