anchor.diff:              )
               .oauth2ResourceServer(oauth2 -> oauth2
                   .jwt(jwt -> jwt
  -                    .jwtAuthenticationConverter(grantedAuthoritiesExtractor())
  +                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
                   )
               );
       }
   }
   
  -Converter<Jwt, AbstractAuthenticationToken> grantedAuthoritiesExtractor() {
  -    JwtAuthenticationConverter jwtAuthenticationConverter =
  -            new JwtAuthenticationConverter();
  -
  -    jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter
  -            (new GrantedAuthoritiesExtractor());
  -
  +JwtAuthenticationConverter jwtAuthenticationConverter() {
  +    JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
  +    grantedAuthoritiesConverter.setAuthoritiesClaimName("authorities");
  +
  +    JwtAuthenticationConverter authenticationConverter = new JwtAuthenticationConverter();
  +    jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(authoritiesConverter);
       return jwtAuthenticationConverter;
  -}
  -----
  -
  -.Kotlin
  -[source,kotlin,role="secondary"]
  -----
  -@EnableWebSecurity
  -class DirectlyConfiguredJwkSetUri : WebSecurityConfigurerAdapter() {
  -    override fun configure(http: HttpSecurity) {
  -        http {
  -            authorizeRequests {
  -                authorize(anyRequest, authenticated)
  -            }
  -            oauth2ResourceServer {
  -                jwt {
  -                    jwtAuthenticationConverter = grantedAuthoritiesExtractor()
  -                }
  -            }
  -        }
  -    }
  -
  -    private fun grantedAuthoritiesExtractor(): JwtAuthenticationConverter {
  -        val jwtAuthenticationConverter = JwtAuthenticationConverter()
  -        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(GrantedAuthoritiesExtractor())
  -        return jwtAuthenticationConverter
  -    }
   }
   ----
   
  
positive.code:     <intercept-uri pattern="/messages/**" access="hasAuthority('SCOPE_messages')"/>
      <oauth2-resource-server>
          <jwt jwk-set-uri="https://idp.example.org/.well-known/jwks.json"
                  jwt-authentication-converter-ref="grantedAuthoritiesExtractor"/>
      </oauth2-resource-server>
  </http>
  
  <bean id="grantedAuthoritiesExtractor"
          class="org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter">
      <property name="jwtGrantedAuthoritiesConverter">
          <bean class="my.custom.GrantedAuthoritiesConverter"/>
      </property>
  </bean>
  ----
  ====
  
  which is responsible for converting a `Jwt` into an `Authentication`.
  As part of its configuration, we can supply a subsidiary converter to go from `Jwt` to a `Collection` of granted authorities.
  
  That final converter might be something like `GrantedAuthoritiesExtractor` below:
  
  [source,java]
  ----
  static class GrantedAuthoritiesExtractor
          implements Converter<Jwt, Collection<GrantedAuthority>> {
  
      public Collection<GrantedAuthority> convert(Jwt jwt) {
          Collection<?> authorities = (Collection<?>)
                  jwt.getClaims().getOrDefault("mycustomclaim", Collections.emptyList());
  
          return authorities.stream()
                  .map(Object::toString)
                  .map(SimpleGrantedAuthority::new)
                  .collect(Collectors.toList());
      }
  }
  ----
  
  For more flexibility, the DSL supports entirely replacing the converter with any class that implements `Converter<Jwt, AbstractAuthenticationToken>`:
  
  
negative.code: For example, some authorization servers don't use the `scope` attribute, but instead have their own custom attribute.
  Or, at other times, the resource server may need to adapt the attribute or a composition of attributes into internalized authorities.
  
  To this end, the DSL exposes `jwtAuthenticationConverter()`, which is responsible for converting a `Jwt` into an `Authentication`.
  
  As part of its configuration, we can supply a subsidiary converter to go from `Jwt` to a `Collection` of granted authorities.
  Let's say that that your authorization server communicates authorities in a custom claim called `authorities`.
  In that case, you can configure the claim that `JwtAuthenticationConverter` should inspect, like so:
  
  .Authorities Claim Configuration
  ====
  .Java
  [source,java,role="primary"]
  ----
  @EnableWebSecurity
  public class CustomAuthoritiesClaimName extends WebSecurityConfigurerAdapter {
      protected void configure(HttpSecurity http) {
          http
              .authorizeRequests(authorize -> authorize
  