anchor.diff:  ```java
   @Bean
   JwtDecoder jwtDecoder() {
  -    NimbusJwtDecoder jwtDecoder = new NimbusJwtDecoder(JwtProcessors.withJwkSetUri(jwkSetUri).build());
  +    NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri).build();
   
       MappedJwtClaimSetConverter converter = MappedJwtClaimSetConverter
               .withDefaults(Collections.singletonMap("sub", this::lookupUserIdBySub));
  
positive.code: MappedJwtClaimSetConverter.withDefaults(Collections.singletonMap("legacyclaim", legacy -> null));
  ```
  
  [[oauth2resourceserver-claimsetmapping-rename]]
  ==== Renaming a Claim
  
  In more sophisticated scenarios, like consulting multiple claims at once or renaming a claim, Resource Server accepts any class that implements `Converter<Map<String, Object>, Map<String,Object>>`:
  
negative.code: [[oauth2resourceserver]]
  == OAuth 2.0 Resource Server
  
  Spring Security supports protecting endpoints using two forms of OAuth 2.0 https://tools.ietf.org/html/rfc6750.html[Bearer Tokens]:
  
  * https://tools.ietf.org/html/rfc7519[JWT]
  * Opaque Tokens
  
  This is handy in circumstances where an application has delegated its authority management to an https://tools.ietf.org/html/rfc6749[authorization server] (for example, Okta or Ping Identity).
  This authorization server can be consulted by resource servers to authorize requests.
  
  [NOTE]
  ====
  Working samples for both {gh-samples-url}/boot/oauth2resourceserver[JWTs] and {gh-samples-url}/boot/oauth2resourceserver-opaque[Opaque Tokens] are available in the {gh-samples-url}[Spring Security repository].
  ====
  
  === Dependencies
  