Update How-to: Implement Multitenancy

Issue gh-663

docs/modules/ROOT/pages/guides/how-to-multitenancy.adoc

@@ -7,11 +7,28 @@
 This guide shows how to customize Spring Authorization Server to support multiple issuers per host in a multi-tenant hosting configuration.
 The purpose of this guide is to demonstrate a general pattern for building multi-tenant capable components for Spring Authorization Server, which can also be applied to other components to suit your needs.
 
+* xref:guides/how-to-multitenancy.adoc#multi-tenant-enable-multiple-issuers[Enable multiple issuers]
 * xref:guides/how-to-multitenancy.adoc#multi-tenant-define-tenant-identifier[Define the tenant identifier]
 * xref:guides/how-to-multitenancy.adoc#multi-tenant-create-component-registry[Create a component registry]
 * xref:guides/how-to-multitenancy.adoc#multi-tenant-create-components[Create multi-tenant components]
 * xref:guides/how-to-multitenancy.adoc#multi-tenant-add-tenants-dynamically[Add tenants dynamically]
 
+[[multi-tenant-enable-multiple-issuers]]
+== Enable multiple issuers
+
+Support for using multiple issuers per host is disabled by default.
+To enable, add the following configuration:
+
+.AuthorizationServerSettingsConfig
+[source,java]
+----
+include::{examples-dir}/main/java/sample/multitenancy/AuthorizationServerSettingsConfig.java[]
+----
+
+<1> Set to `true` to allow usage of multiple issuers per host.
+
+WARNING: Do not allow for any arbitrary issuer to be used. An allowlist of approved issuers should be enforced.
+
 [[multi-tenant-define-tenant-identifier]]
 == Define the tenant identifier
 

docs/src/main/java/sample/multitenancy/AuthorizationServerSettingsConfig.java

@@ -23,8 +23,10 @@ import org.springframework.security.oauth2.server.authorization.settings.Authori
 public class AuthorizationServerSettingsConfig {
 
 	@Bean
-	AuthorizationServerSettings authorizationServerSettings() {
-		return AuthorizationServerSettings.builder().multipleIssuersAllowed(true).build();
+	public AuthorizationServerSettings authorizationServerSettings() {
+		return AuthorizationServerSettings.builder()
+				.multipleIssuersAllowed(true)	// <1>
+				.build();
 	}
 
 }