@Test
    void access_control_client_auth_can_be_overridden() {
        AthenzDomain tenantDomain = AthenzDomain.from("my-tenant-domain");
        DeployState state = new DeployState.Builder().properties(
                new TestProperties()
                        .setAthenzDomain(tenantDomain)
                        .setHostedVespa(true)
                        .allowDisableMtls(true)
                        .setEndpointCertificateSecrets(Optional.of(new EndpointCertificateSecrets("CERT", "KEY"))))
                .build();
        Http http = createModelAndGetHttp(state,
                "  <http>",
                "    <filtering>",
                "      <access-control tls-handshake-client-auth=\"want\"/>",
                "    </filtering>",
                "  </http>");
        assertTrue(http.getAccessControl().isPresent());
        assertEquals(AccessControl.ClientAuthentication.want, http.getAccessControl().get().clientAuthentication);
        var tlsPort = http.getHttpServer().get().getConnectorFactories().stream()
                .filter(connectorFactory -> connectorFactory.getListenPort() == 4443).findFirst().orElseThrow();
        var builder = new ConnectorConfig.Builder();
        tlsPort.getConfig(builder);
        var connectorConfig = new ConnectorConfig(builder);
        assertFalse(connectorConfig.tlsClientAuthEnforcer().enable());
        assertEquals(WANT_AUTH, connectorConfig.ssl().clientAuth());
    }
@author gjoranv
@author bjorncs
@author mortent
config-model/src/test/java/com/yahoo/vespa/model/container/xml/AccessControlTest.java