anchor.diff:  Additionally a custom `SecurityIdentityAugmentor` can also be used to add the roles as documented xref:security.adoc#security-identity-customization[here].
   
   [[token-verification-introspection]]
  -=== Token Verification And Introspection 
  +=== Token Verification And Introspection
   
   If the token is a JWT token then, by default, it will be verified with a `JsonWebKey` (JWK) key from a local `JsonWebKeySet` retrieved from the OpenID Connect Provider's JWK endpoint. The token's key identifier `kid` header value will be used to find the matching JWK key.
   If no matching `JWK` is available locally then `JsonWebKeySet` will be refreshed by fetching the current key set from the JWK endpoint. The `JsonWebKeySet` refresh can be repeated again only after the `quarkus.oidc.token.forced-jwk-refresh-interval` (default is 10 minutes) expires.
  
positive.code: import com.github.tomakehurst.wiremock.WireMockServer;
  import com.github.tomakehurst.wiremock.client.WireMock;
  
  import io.quarkus.test.common.QuarkusTestResource;
  import io.quarkus.test.junit.QuarkusTest;
  import io.quarkus.test.oidc.server.OidcWireMock;
  import io.quarkus.test.oidc.server.OidcWiremockTestResource;
  import io.restassured.RestAssured;
  
  @QuarkusTest
  @QuarkusTestResource(OidcWiremockTestResource.class)
  public class CustomOidcWireMockStubTest {
  
      @OidcWireMock
  
negative.code: ----
  %prod.quarkus.oidc.auth-server-url=http://localhost:8180/realms/quarkus
  quarkus.oidc.client-id=backend-service
  quarkus.oidc.credentials.secret=secret
  
  # Tell Dev Services for Keycloak to import the realm file
  # This property is not effective when running the application in JVM or Native modes
  