anchor.diff:  For example, some authorization servers don't use the `scope` attribute, but instead have their own custom attribute.
   Or, at other times, the resource server may need to adapt the attribute or a composition of attributes into internalized authorities.
   
  -To this end, the DSL exposes `jwtAuthenticationConverter()`, which is responsible for <<oauth2resourceserver-jwt-architecture-jwtauthenticationconverter,converting a `Jwt` into an `Authentication`>>.
  -
  -As part of its configuration, we can supply a subsidiary converter to go from `Jwt` to a `Collection` of granted authorities.
  +To this end, Spring Security ships with `JwtAuthenticationConverter`, which is responsible for <<oauth2resourceserver-jwt-architecture-jwtauthenticationconverter,converting a `Jwt` into an `Authentication`>>.
  +By default, Spring Security will wire the `JwtAuthenticationProvider` with a default instance of `JwtAuthenticationConverter`.
  +
  +As part of configuring a `JwtAuthenticationConverter`, you can supply a subsidiary converter to go from `Jwt` to a `Collection` of granted authorities.
  +
   Let's say that that your authorization server communicates authorities in a custom claim called `authorities`.
   In that case, you can configure the claim that <<oauth2resourceserver-jwt-architecture-jwtauthenticationconverter,`JwtAuthenticationConverter`>> should inspect, like so:
   
  
positive.code: static class CustomAuthenticationConverter implements Converter<Jwt, AbstractAuthenticationToken> {
      public AbstractAuthenticationToken convert(Jwt jwt) {
          return new CustomAuthenticationToken(jwt);
      }
  }
  ----
  
negative.code: .Java
  [source,java,role="primary"]
  ----
  @Bean
  public JwtAuthenticationConverter jwtAuthenticationConverter() {
      JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
      grantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
  
  