anchor.diff:  For example, some authorization servers don't use the `scope` attribute, but instead have their own custom attribute.
   Or, at other times, the resource server may need to adapt the attribute or a composition of attributes into internalized authorities.
   
  -To this end, the DSL exposes `jwtAuthenticationConverter()`:
  -
  -.Authorities Extractor Configuration
  +To this end, the DSL exposes `jwtAuthenticationConverter()`, which is responsible for converting a `Jwt` into an `Authentication`.
  +
  +As part of its configuration, we can supply a subsidiary converter to go from `Jwt` to a `Collection` of granted authorities.
  +Let's say that that your authorization server communicates authorities in a custom claim called `authorities`.
  +In that case, you can configure the claim that `JwtAuthenticationConverter` should inspect, like so:
  +
  +.Authorities Claim Configuration
   ====
   .Java
   [source,java,role="primary"]
   ----
   @EnableWebSecurity
  -public class DirectlyConfiguredJwkSetUri extends WebSecurityConfigurerAdapter {
  +public class CustomAuthoritiesClaimName extends WebSecurityConfigurerAdapter {
       protected void configure(HttpSecurity http) {
           http
               .authorizeRequests(authorize -> authorize
  
positive.code:     <intercept-uri pattern="/messages/**" access="hasAuthority('SCOPE_messages')"/>
      <oauth2-resource-server>
          <jwt jwk-set-uri="https://idp.example.org/.well-known/jwks.json"
                  jwt-authentication-converter-ref="grantedAuthoritiesExtractor"/>
      </oauth2-resource-server>
  </http>
  
  <bean id="grantedAuthoritiesExtractor"
          class="org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter">
      <property name="jwtGrantedAuthoritiesConverter">
          <bean class="my.custom.GrantedAuthoritiesConverter"/>
      </property>
  </bean>
  ----
  ====
  
  which is responsible for converting a `Jwt` into an `Authentication`.
  As part of its configuration, we can supply a subsidiary converter to go from `Jwt` to a `Collection` of granted authorities.
  
  That final converter might be something like `GrantedAuthoritiesExtractor` below:
  
  [source,java]
  ----
  static class GrantedAuthoritiesExtractor
          implements Converter<Jwt, Collection<GrantedAuthority>> {
  
      public Collection<GrantedAuthority> convert(Jwt jwt) {
          Collection<?> authorities = (Collection<?>)
                  jwt.getClaims().getOrDefault("mycustomclaim", Collections.emptyList());
  
          return authorities.stream()
                  .map(Object::toString)
                  .map(SimpleGrantedAuthority::new)
                  .collect(Collectors.toList());
      }
  }
  ----
  
  For more flexibility, the DSL supports entirely replacing the converter with any class that implements `Converter<Jwt, AbstractAuthenticationToken>`:
  
  
negative.code:             )
              .oauth2ResourceServer(oauth2 -> oauth2
                  .jwt(jwt -> jwt
                      .jwtAuthenticationConverter(jwtAuthenticationConverter())
                  )
              );
      }
  }
  
  JwtAuthenticationConverter jwtAuthenticationConverter() {
      JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
      grantedAuthoritiesConverter.setAuthoritiesClaimName("authorities");
  
      JwtAuthenticationConverter authenticationConverter = new JwtAuthenticationConverter();
      jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(authoritiesConverter);
      return jwtAuthenticationConverter;
  }
  ----
  
  