anchor.diff:  ----
   import static org.hamcrest.Matchers.equalTo;
   
  -import java.util.Arrays;
  -import java.util.HashSet;
  -
  -import org.hamcrest.Matchers;
  +import java.util.Set;
  +
   import org.junit.jupiter.api.Test;
   
   import io.quarkus.test.common.QuarkusTestResource;
  
positive.code: 
      @Test
      public void testBearerToken() {
          RestAssured.given().auth().oauth2(getAccessToken("alice", new HashSet<>(Arrays.asList("user"))))
              .when().get("/api/users/preferredUserName")
              .then()
              .statusCode(200)
              // the test endpoint returns the name extracted from the injected SecurityIdentity Principal
  
negative.code: Additionally a custom `SecurityIdentityAugmentor` can also be used to add the roles as documented xref:security.adoc#security-identity-customization[here].
  
  [[token-verification-introspection]]
  === Token Verification And Introspection
  
  If the token is a JWT token then, by default, it will be verified with a `JsonWebKey` (JWK) key from a local `JsonWebKeySet` retrieved from the OpenID Connect Provider's JWK endpoint. The token's key identifier `kid` header value will be used to find the matching JWK key.
  If no matching `JWK` is available locally then `JsonWebKeySet` will be refreshed by fetching the current key set from the JWK endpoint. The `JsonWebKeySet` refresh can be repeated again only after the `quarkus.oidc.token.forced-jwk-refresh-interval` (default is 10 minutes) expires.
  