anchor.diff:  
   And its configuration can be overridden using `introspectionUri()` and `introspectionClientCredentials()` or replaced using `introspector()`.
   
  +Or, if you're not using Spring Boot at all, then both of these components - the filter chain and a `OpaqueTokenIntrospector` can be specified in XML.
  +
  +The filter chain is specified like so:
  +
  +.Default Opaque Token Configuration
  +====
  +.Xml
  +[source,xml,role="primary"]
  +----
  +<http>
  +    <intercept-uri pattern="/**" access="authenticated"/>
  +    <oauth2-resource-server>
  +        <opaque-token introspector-ref="opaqueTokenIntrospector"/>
  +    </oauth2-resource-server>
  +</http>
  +----
  +====
  +
  +And the `OpaqueTokenIntrospector` like so:
  +
  +.Opaque Token Introspector
  +====
  +.Xml
  +[source,xml,role="primary"]
  +----
  +<bean id="opaqueTokenIntrospector"
  +        class="org.springframework.security.oauth2.server.resource.introspection.NimbusOpaqueTokenIntrospector">
  +    <constructor-arg value="${spring.security.oauth2.resourceserver.opaquetoken.introspection_uri}"/>
  +    <constructor-arg value="${spring.security.oauth2.resourceserver.opaquetoken.client_id}"/>
  +    <constructor-arg value="${spring.security.oauth2.resourceserver.opaquetoken.client_secret}"/>
  +</bean>
  +----
  +====
  +
   [[oauth2resourceserver-opaque-introspectionuri-dsl]]
   ==== Using `introspectionUri()`
   
  
positive.code:             .oauth2ResourceServer(OAuth2ResourceServerConfigurer::opaqueToken);
      }
  }
  ```
  
  Or similarly with method security:
  
  
negative.code:     return JwtDecoders.fromIssuerLocation(issuerUri);
  }
  ----
  ====
  
  [NOTE]
  Calling `{security-api-url}org/springframework/security/oauth2/jwt/JwtDecoders.html#fromIssuerLocation-java.lang.String-[JwtDecoders#fromIssuerLocation]` is what invokes the Provider Configuration or Authorization Server Metadata endpoint in order to derive the JWK Set Uri.
  