Merge pull request #27814 from vespa-engine/bjorncs/token-data-plane-separate-port

Bjorncs/token data plane separate port

37 files changed, 879 insertions, 585 deletions

diff --git a/config-model/src/main/java/com/yahoo/config/model/deploy/TestProperties.java b/config-model/src/main/java/com/yahoo/config/model/deploy/TestProperties.java
index 2b55b1f1d10..66a23c79fbb 100644
--- a/config-model/src/main/java/com/yahoo/config/model/deploy/TestProperties.java
+++ b/config-model/src/main/java/com/yahoo/config/model/deploy/TestProperties.java
@@ -88,6 +88,7 @@ public class TestProperties implements ModelContext.Properties, ModelContext.Fea
     private boolean allowMoreThanOneContentGroupDown = false;
     private boolean enableConditionalPutRemoveWriteRepair = false;
     private List<DataplaneToken> dataplaneTokens;
+    private boolean enableDataplaneProxy;
 
     @Override public ModelContext.FeatureFlags featureFlags() { return this; }
     @Override public boolean multitenant() { return multitenant; }
@@ -148,6 +149,7 @@ public class TestProperties implements ModelContext.Properties, ModelContext.Fea
     @Override public boolean allowMoreThanOneContentGroupDown(ClusterSpec.Id id) { return allowMoreThanOneContentGroupDown; }
     @Override public boolean enableConditionalPutRemoveWriteRepair() { return enableConditionalPutRemoveWriteRepair; }
     @Override public List<DataplaneToken> dataplaneTokens() { return dataplaneTokens; }
+    @Override public boolean enableDataplaneProxy() { return enableDataplaneProxy; }
 
     public TestProperties sharedStringRepoNoReclaim(boolean sharedStringRepoNoReclaim) {
         this.sharedStringRepoNoReclaim = sharedStringRepoNoReclaim;
@@ -393,6 +395,11 @@ public class TestProperties implements ModelContext.Properties, ModelContext.Fea
         return this;
     }
 
+    public TestProperties setEnableDataplaneProxy(boolean enable) {
+        this.enableDataplaneProxy = enable;
+        return this;
+    }
+
     public static class Spec implements ConfigServerSpec {
 
         private final String hostName;
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/builder/xml/dom/DomHandlerBuilder.java b/config-model/src/main/java/com/yahoo/vespa/model/builder/xml/dom/DomHandlerBuilder.java
index ed53a1d2267..9b5a1429cb7 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/builder/xml/dom/DomHandlerBuilder.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/builder/xml/dom/DomHandlerBuilder.java
@@ -15,7 +15,7 @@ import com.yahoo.vespa.model.container.component.UserBindingPattern;
 import com.yahoo.vespa.model.container.xml.BundleInstantiationSpecificationBuilder;
 import org.w3c.dom.Element;
 
-import java.util.OptionalInt;
+import java.util.Collection;
 import java.util.Set;
 
 import static com.yahoo.vespa.model.container.ApplicationContainerCluster.METRICS_V2_HANDLER_BINDING_1;
@@ -38,12 +38,9 @@ public class DomHandlerBuilder extends VespaDomBuilder.DomConfigProducerBuilderB
                    VIP_HANDLER_BINDING);
 
     private final ApplicationContainerCluster cluster;
-    private final OptionalInt portBindingOverride;
+    private final Set<Integer> portBindingOverride;
 
-    public DomHandlerBuilder(ApplicationContainerCluster cluster) {
-        this(cluster, OptionalInt.empty());
-    }
-    public DomHandlerBuilder(ApplicationContainerCluster cluster, OptionalInt portBindingOverride) {
+    public DomHandlerBuilder(ApplicationContainerCluster cluster, Set<Integer> portBindingOverride) {
         this.cluster = cluster;
         this.portBindingOverride = portBindingOverride;
     }
@@ -51,23 +48,24 @@ public class DomHandlerBuilder extends VespaDomBuilder.DomConfigProducerBuilderB
     @Override
     protected Handler doBuild(DeployState deployState, TreeConfigProducer<AnyConfigProducer> parent, Element handlerElement) {
         Handler handler = createHandler(handlerElement);
-        OptionalInt port = portBindingOverride.isPresent() && deployState.isHosted() && deployState.featureFlags().useRestrictedDataPlaneBindings()
-                ? portBindingOverride
-                : OptionalInt.empty();
+        var ports = deployState.isHosted() && deployState.featureFlags().useRestrictedDataPlaneBindings()
+                ? portBindingOverride : Set.<Integer>of();
 
-        for (Element binding : XML.getChildren(handlerElement, "binding"))
-            addServerBinding(handler, userBindingPattern(XML.getValue(binding), port), deployState.getDeployLogger());
+        for (Element xmlBinding : XML.getChildren(handlerElement, "binding"))
+            for (var binding : userBindingPattern(XML.getValue(xmlBinding), ports))
+                addServerBinding(handler, binding, deployState.getDeployLogger());
 
         DomComponentBuilder.addChildren(deployState, parent, handlerElement, handler);
 
         return handler;
     }
 
-    private static UserBindingPattern userBindingPattern(String path, OptionalInt port) {
+    private static Collection<UserBindingPattern> userBindingPattern(String path, Set<Integer> portBindingOverride) {
         UserBindingPattern bindingPattern = UserBindingPattern.fromPattern(path);
-        return port.isPresent()
-                ? bindingPattern.withPort(port.getAsInt())
-                : bindingPattern;
+        if (portBindingOverride.isEmpty()) return Set.of(bindingPattern);
+        return portBindingOverride.stream()
+                .map(bindingPattern::withPort)
+                .toList();
     }
 
     Handler createHandler(Element handlerElement) {
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/clients/ContainerDocumentApi.java b/config-model/src/main/java/com/yahoo/vespa/model/clients/ContainerDocumentApi.java
index 8163c268d09..a5a567b18f8 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/clients/ContainerDocumentApi.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/clients/ContainerDocumentApi.java
@@ -14,7 +14,8 @@ import com.yahoo.vespa.model.container.component.UserBindingPattern;
 import java.nio.file.Path;
 import java.util.Collection;
 import java.util.Collections;
-import java.util.OptionalInt;
+import java.util.List;
+import java.util.Set;
 
 /**
  * @author Einar M R Rosenvinge
@@ -28,7 +29,7 @@ public class ContainerDocumentApi {
 
     private final boolean ignoreUndefinedFields;
 
-    public ContainerDocumentApi(ContainerCluster<?> cluster, HandlerOptions handlerOptions, boolean ignoreUndefinedFields, OptionalInt portOverride) {
+    public ContainerDocumentApi(ContainerCluster<?> cluster, HandlerOptions handlerOptions, boolean ignoreUndefinedFields, Set<Integer> portOverride) {
         this.ignoreUndefinedFields = ignoreUndefinedFields;
         addRestApiHandler(cluster, handlerOptions, portOverride);
         addFeedHandler(cluster, handlerOptions, portOverride);
@@ -39,7 +40,7 @@ public class ContainerDocumentApi {
         c.addPlatformBundle(VESPACLIENT_CONTAINER_BUNDLE);
     }
 
-    private static void addFeedHandler(ContainerCluster<?> cluster, HandlerOptions handlerOptions, OptionalInt portOverride) {
+    private static void addFeedHandler(ContainerCluster<?> cluster, HandlerOptions handlerOptions, Set<Integer> portOverride) {
         String bindingSuffix = ContainerCluster.RESERVED_URI_PREFIX + "/feedapi";
         var executor = new Threadpool("feedapi-handler", handlerOptions.feedApiThreadpoolOptions);
         var handler = newVespaClientHandler("com.yahoo.vespa.http.server.FeedHandler",
@@ -48,7 +49,7 @@ public class ContainerDocumentApi {
     }
 
 
-    private static void addRestApiHandler(ContainerCluster<?> cluster, HandlerOptions handlerOptions, OptionalInt portOverride) {
+    private static void addRestApiHandler(ContainerCluster<?> cluster, HandlerOptions handlerOptions, Set<Integer> portOverride) {
         var handler = newVespaClientHandler("com.yahoo.document.restapi.resource.DocumentV1ApiHandler",
                                             DOCUMENT_V1_PREFIX + "/*", handlerOptions, null, portOverride);
         cluster.addComponent(handler);
@@ -65,34 +66,34 @@ public class ContainerDocumentApi {
                                                  String bindingSuffix,
                                                  HandlerOptions handlerOptions,
                                                  Threadpool executor,
-                                                 OptionalInt portOverride) {
+                                                 Set<Integer> portOverride) {
         Handler handler = createHandler(componentId, executor);
         if (handlerOptions.bindings.isEmpty()) {
-            handler.addServerBindings(
-                    bindingPattern(bindingSuffix, portOverride),
-                    bindingPattern(bindingSuffix + '/', portOverride));
+            handler.addServerBindings(bindingPattern(bindingSuffix, portOverride));
+            handler.addServerBindings(bindingPattern(bindingSuffix + '/', portOverride));
         } else {
             for (String rootBinding : handlerOptions.bindings) {
                 String pathWithoutLeadingSlash = bindingSuffix.substring(1);
-                handler.addServerBindings(
-                        userBindingPattern(rootBinding + pathWithoutLeadingSlash, portOverride),
-                        userBindingPattern(rootBinding + pathWithoutLeadingSlash + '/', portOverride));
+                handler.addServerBindings(userBindingPattern(rootBinding + pathWithoutLeadingSlash, portOverride));
+                handler.addServerBindings(userBindingPattern(rootBinding + pathWithoutLeadingSlash + '/', portOverride));
             }
         }
         return handler;
     }
 
-    private static BindingPattern bindingPattern(String path, OptionalInt port) {
-        return port.isPresent()
-                ? SystemBindingPattern.fromHttpPortAndPath(Integer.toString(port.getAsInt()), path)
-                : SystemBindingPattern.fromHttpPath(path);
+    private static List<BindingPattern> bindingPattern(String path, Set<Integer> ports) {
+        if (ports.isEmpty()) return List.of(SystemBindingPattern.fromHttpPath(path));
+        return ports.stream()
+                .map(p -> (BindingPattern)SystemBindingPattern.fromHttpPortAndPath(p, path))
+                .toList();
     }
 
-    private static UserBindingPattern userBindingPattern(String path, OptionalInt port) {
+    private static List<BindingPattern> userBindingPattern(String path, Set<Integer> ports) {
         UserBindingPattern bindingPattern = UserBindingPattern.fromPattern(path);
-        return port.isPresent()
-                ? bindingPattern.withPort(port.getAsInt())
-                : bindingPattern;
+        if (ports.isEmpty()) return List.of(bindingPattern);
+        return ports.stream()
+                .map(p -> (BindingPattern)bindingPattern.withPort(p))
+                .toList();
     }
 
     private static Handler createHandler(String className, Threadpool executor) {
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/DataplaneProxy.java b/config-model/src/main/java/com/yahoo/vespa/model/container/DataplaneProxy.java
index fe7d9581e46..13aa65909bd 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/DataplaneProxy.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/DataplaneProxy.java
@@ -7,20 +7,23 @@ import com.yahoo.vespa.model.container.component.SimpleComponent;
 
 public class DataplaneProxy extends SimpleComponent implements DataplaneProxyConfig.Producer {
 
-    private final Integer port;
+    private final int mtlsPort;
+    private final int tokenPort;
     private final String serverCertificate;
     private final String serverKey;
 
-    public DataplaneProxy(Integer port, String serverCertificate, String serverKey) {
+    public DataplaneProxy(int mtlsPort, int tokenPort, String serverCertificate, String serverKey) {
         super(DataplaneProxyConfigurator.class.getName());
-        this.port = port;
+        this.mtlsPort = mtlsPort;
+        this.tokenPort = tokenPort;
         this.serverCertificate = serverCertificate;
         this.serverKey = serverKey;
     }
 
     @Override
     public void getConfig(DataplaneProxyConfig.Builder builder) {
-        builder.port(port);
+        builder.mtlsPort(mtlsPort);
+        builder.tokenPort(tokenPort);
         builder.serverCertificate(serverCertificate);
         builder.serverKey(serverKey);
     }
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/component/Handler.java b/config-model/src/main/java/com/yahoo/vespa/model/container/component/Handler.java
index 9f2bfe9251b..31031aa5bf2 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/component/Handler.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/component/Handler.java
@@ -7,6 +7,7 @@ import com.yahoo.vespa.model.container.ContainerThreadpool;
 
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.LinkedHashSet;
 import java.util.List;
@@ -51,6 +52,8 @@ public class Handler extends Component<Component<?, ?>, ComponentModel> {
         serverBindings.addAll(Arrays.asList(bindings));
     }
 
+    public void addServerBindings(Collection<BindingPattern> bps) { serverBindings.addAll(bps); }
+
     public void removeServerBinding(BindingPattern binding) {
         serverBindings.remove(binding);
     }
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/component/SystemBindingPattern.java b/config-model/src/main/java/com/yahoo/vespa/model/container/component/SystemBindingPattern.java
index 606557670a5..0fb3ec389e0 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/component/SystemBindingPattern.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/component/SystemBindingPattern.java
@@ -15,6 +15,7 @@ public class SystemBindingPattern extends BindingPattern {
     public static SystemBindingPattern fromPattern(String binding) { return new SystemBindingPattern(binding);}
     public static SystemBindingPattern fromHttpPortAndPath(String port, String path) { return new SystemBindingPattern("http", "*", port, path); }
     public static SystemBindingPattern fromHttpPortAndPath(int port, String path) { return new SystemBindingPattern("http", "*", Integer.toString(port), path); }
+    public SystemBindingPattern withPort(int port) { return new SystemBindingPattern(scheme(), host(), Integer.toString(port), path()); }
 
     @Override
     public String toString() {
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ConnectorFactory.java b/config-model/src/main/java/com/yahoo/vespa/model/container/http/ConnectorFactory.java
index 697cfc95039..4929c09d561 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ConnectorFactory.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/http/ConnectorFactory.java
@@ -8,6 +8,7 @@ import com.yahoo.vespa.model.container.component.SimpleComponent;
 import com.yahoo.vespa.model.container.http.ssl.DefaultSslProvider;
 import com.yahoo.vespa.model.container.http.ssl.SslProvider;
 
+import java.util.List;
 import java.util.Optional;
 
 /**
@@ -40,6 +41,9 @@ public class ConnectorFactory extends SimpleComponent implements ConnectorConfig
     public void getConfig(ConnectorConfig.Builder connectorBuilder) {
         connectorBuilder.listenPort(listenPort);
         connectorBuilder.name(name);
+        connectorBuilder.accessLog(new ConnectorConfig.AccessLog.Builder()
+                                           .remoteAddressHeaders(List.of("x-forwarded-for"))
+                                           .remotePortHeaders(List.of("X-Forwarded-Port")));
         sslProviderComponent.amendConnectorConfig(connectorBuilder);
     }
 
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/http/JettyHttpServer.java b/config-model/src/main/java/com/yahoo/vespa/model/container/http/JettyHttpServer.java
index 6a2d9685a33..0388230fa6a 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/http/JettyHttpServer.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/http/JettyHttpServer.java
@@ -63,17 +63,8 @@ public class JettyHttpServer extends SimpleComponent implements ServerConfig.Pro
                 .searchHandlerPaths(List.of("/search"))
         );
         if (isHostedVespa) {
-            // Proxy-protocol v1/v2 is used in hosted Vespa for remote address/port
-            builder.accessLog(new ServerConfig.AccessLog.Builder()
-                    .remoteAddressHeaders(List.of())
-                    .remotePortHeaders(List.of()));
-
             // Enable connection log hosted Vespa
             builder.connectionLog(new ServerConfig.ConnectionLog.Builder().enabled(true));
-        } else {
-            builder.accessLog(new ServerConfig.AccessLog.Builder()
-                    .remoteAddressHeaders(List.of("x-forwarded-for"))
-                    .remotePortHeaders(List.of("X-Forwarded-Port")));
         }
         configureJettyThreadpool(builder);
         builder.stopTimeout(300);
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/CloudSslProvider.java b/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/CloudSslProvider.java
index b231a4ad847..ab163719aac 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/CloudSslProvider.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/CloudSslProvider.java
@@ -2,8 +2,6 @@
 package com.yahoo.vespa.model.container.http.ssl;
 
 import com.yahoo.jdisc.http.ConnectorConfig;
-import com.yahoo.jdisc.http.ssl.impl.CloudSslContextProvider;
-import com.yahoo.jdisc.http.ssl.impl.ConfiguredSslContextFactoryProvider;
 
 import java.util.Optional;
 
@@ -16,10 +14,6 @@ import static com.yahoo.jdisc.http.ConnectorConfig.Ssl.ClientAuth;
  * @author andreer
  */
 public class CloudSslProvider extends SslProvider {
-    public static final String COMPONENT_ID_PREFIX = "configured-ssl-provider@";
-    public static final String MTLSONLY_COMPONENT_CLASS = ConfiguredSslContextFactoryProvider.class.getName();
-    public static final String TOKEN_COMPONENT_CLASS = CloudSslContextProvider.class.getName();
-
     private final String privateKey;
     private final String certificate;
     private final String caCertificatePath;
@@ -28,7 +22,7 @@ public class CloudSslProvider extends SslProvider {
 
     public CloudSslProvider(String servername, String privateKey, String certificate, String caCertificatePath,
                             String caCertificate, ClientAuth.Enum clientAuthentication, boolean enableTokenSupport) {
-        super(COMPONENT_ID_PREFIX, servername, componentClass(enableTokenSupport), null);
+        super("cloud-ssl-provider@", servername, componentClass(enableTokenSupport), null);
         this.privateKey = privateKey;
         this.certificate = certificate;
         this.caCertificatePath = caCertificatePath;
@@ -37,7 +31,9 @@ public class CloudSslProvider extends SslProvider {
     }
 
     private static String componentClass(boolean enableTokenSupport) {
-        return enableTokenSupport ? TOKEN_COMPONENT_CLASS : MTLSONLY_COMPONENT_CLASS;
+        return enableTokenSupport
+                ? "com.yahoo.jdisc.http.ssl.impl.CloudTokenSslContextProvider"
+                : "com.yahoo.jdisc.http.ssl.impl.ConfiguredSslContextFactoryProvider";
     }
 
     @Override
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/HostedSslConnectorFactory.java b/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/HostedSslConnectorFactory.java
index 2b13cd21e99..cebe08288f6 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/HostedSslConnectorFactory.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/HostedSslConnectorFactory.java
@@ -7,6 +7,7 @@ import com.yahoo.security.tls.TlsContext;
 import com.yahoo.vespa.model.container.http.ConnectorFactory;
 
 import java.time.Duration;
+import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 
@@ -22,6 +23,8 @@ public class HostedSslConnectorFactory extends ConnectorFactory {
     private final boolean proxyProtocolEnabled;
     private final boolean proxyProtocolMixedMode;
     private final Duration endpointConnectionTtl;
+    private final List<String> remoteAddressHeaders;
+    private final List<String> remotePortHeaders;
 
     public static Builder builder(String name, int listenPort) { return new Builder(name, listenPort); }
 
@@ -32,6 +35,8 @@ public class HostedSslConnectorFactory extends ConnectorFactory {
         this.proxyProtocolEnabled = builder.proxyProtocolEnabled;
         this.proxyProtocolMixedMode = builder.proxyProtocolMixedMode;
         this.endpointConnectionTtl = builder.endpointConnectionTtl;
+        this.remoteAddressHeaders = List.copyOf(builder.remoteAddressHeaders);
+        this.remotePortHeaders = List.copyOf(builder.remotePortHeaders);
     }
 
     private static SslProvider createSslProvider(Builder builder) {
@@ -62,15 +67,21 @@ public class HostedSslConnectorFactory extends ConnectorFactory {
                 .proxyProtocol(new ConnectorConfig.ProxyProtocol.Builder()
                                        .enabled(proxyProtocolEnabled).mixedMode(proxyProtocolMixedMode))
                 .idleTimeout(Duration.ofSeconds(30).toSeconds())
-                .maxConnectionLife(endpointConnectionTtl != null ? endpointConnectionTtl.toSeconds() : 0);
+                .maxConnectionLife(endpointConnectionTtl != null ? endpointConnectionTtl.toSeconds() : 0)
+                .accessLog(new ConnectorConfig.AccessLog.Builder()
+                                  .remoteAddressHeaders(remoteAddressHeaders)
+                                  .remotePortHeaders(remotePortHeaders));
+
     }
 
     public enum SslClientAuth { WANT, NEED, WANT_WITH_ENFORCER }
     public static class Builder {
         final String name;
         final int port;
+        final List<String> remoteAddressHeaders = new ArrayList<>();
+        final List<String> remotePortHeaders = new ArrayList<>();
         SslClientAuth clientAuth;
-        List<String> tlsCiphersOverride;
+        List<String> tlsCiphersOverride = List.of();
         boolean proxyProtocolEnabled;
         boolean proxyProtocolMixedMode;
         Duration endpointConnectionTtl;
@@ -88,6 +99,8 @@ public class HostedSslConnectorFactory extends ConnectorFactory {
         public Builder tlsCaCertificatesPath(String path) { this.tlsCaCertificatesPath = path; return this; }
         public Builder tlsCaCertificatesPem(String pem) { this.tlsCaCertificatesPem = pem; return this; }
         public Builder tokenEndpoint(boolean enable) { this.tokenEndpoint = enable; return this; }
+        public Builder remoteAddressHeader(String header) { this.remoteAddressHeaders.add(header); return this; }
+        public Builder remotePortHeader(String header) { this.remotePortHeaders.add(header); return this; }
 
         public HostedSslConnectorFactory build() { return new HostedSslConnectorFactory(this); }
     }
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/processing/ProcessingChains.java b/config-model/src/main/java/com/yahoo/vespa/model/container/processing/ProcessingChains.java
index 330e1f96dc7..b05466d54ab 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/processing/ProcessingChains.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/processing/ProcessingChains.java
@@ -6,6 +6,8 @@ import com.yahoo.vespa.model.container.component.BindingPattern;
 import com.yahoo.vespa.model.container.component.SystemBindingPattern;
 import com.yahoo.vespa.model.container.component.chain.Chains;
 
+import java.util.List;
+
 /**
  * Root config producer for processing
  *
@@ -13,7 +15,7 @@ import com.yahoo.vespa.model.container.component.chain.Chains;
  */
 public class ProcessingChains extends Chains<ProcessingChain> {
 
-    public static final BindingPattern[] defaultBindings = new BindingPattern[]{SystemBindingPattern.fromHttpPath("/processing/*")};
+    public static final List<BindingPattern> defaultBindings = List.of(SystemBindingPattern.fromHttpPath("/processing/*"));
 
 
     public ProcessingChains(TreeConfigProducer<? super Chains> parent, String subId) {
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/CloudDataPlaneFilter.java b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/CloudDataPlaneFilter.java
index efa5ee01506..2d0d47288d1 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/CloudDataPlaneFilter.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/CloudDataPlaneFilter.java
@@ -5,7 +5,6 @@ import com.yahoo.component.ComponentSpecification;
 import com.yahoo.component.chain.dependencies.Dependencies;
 import com.yahoo.component.chain.model.ChainedComponentModel;
 import com.yahoo.config.model.deploy.DeployState;
-import com.yahoo.config.provision.DataplaneToken;
 import com.yahoo.container.bundle.BundleInstantiationSpecification;
 import com.yahoo.jdisc.http.filter.security.cloud.config.CloudDataPlaneFilterConfig;
 import com.yahoo.security.X509CertificateUtils;
@@ -13,7 +12,6 @@ import com.yahoo.vespa.model.container.ApplicationContainerCluster;
 import com.yahoo.vespa.model.container.http.Client;
 import com.yahoo.vespa.model.container.http.Filter;
 
-import java.time.Instant;
 import java.util.Collection;
 import java.util.List;
 
@@ -24,15 +22,11 @@ class CloudDataPlaneFilter extends Filter implements CloudDataPlaneFilterConfig.
 
     private final Collection<Client> clients;
     private final boolean clientsLegacyMode;
-    private final String tokenContext;
 
     CloudDataPlaneFilter(ApplicationContainerCluster cluster, DeployState state) {
         super(model());
         this.clients = List.copyOf(cluster.getClients());
         this.clientsLegacyMode = cluster.clientsLegacyMode();
-        // Token domain must be identical to the domain used for generating the tokens
-        this.tokenContext = "Vespa Cloud tenant data plane:%s"
-                .formatted(state.getProperties().applicationId().tenant().value());
     }
 
     private static ChainedComponentModel model() {
@@ -51,21 +45,11 @@ class CloudDataPlaneFilter extends Filter implements CloudDataPlaneFilterConfig.
                     .map(x -> new CloudDataPlaneFilterConfig.Clients.Builder()
                             .id(x.id())
                             .certificates(x.certificates().stream().map(X509CertificateUtils::toPem).toList())
-                            .tokens(tokensConfig(x.tokens()))
                             .permissions(x.permissions()))
                     .toList();
-            builder.clients(clientsCfg).legacyMode(false).tokenContext(tokenContext);
+            builder.clients(clientsCfg).legacyMode(false);
         }
     }
 
-    private static List<CloudDataPlaneFilterConfig.Clients.Tokens.Builder> tokensConfig(Collection<DataplaneToken> tokens) {
-        return tokens.stream()
-                .map(token -> new CloudDataPlaneFilterConfig.Clients.Tokens.Builder()
-                        .id(token.tokenId())
-                        .fingerprints(token.versions().stream().map(DataplaneToken.Version::fingerprint).toList())
-                        .checkAccessHashes(token.versions().stream().map(DataplaneToken.Version::checkAccessHash).toList())
-                        .expirations(token.versions().stream().map(v -> v.expiration().map(Instant::toString).orElse("<none>")).toList()))
-                .toList();
-    }
 
 }
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/CloudTokenDataPlaneFilter.java b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/CloudTokenDataPlaneFilter.java
new file mode 100644
index 00000000000..5b57682e759
--- /dev/null
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/CloudTokenDataPlaneFilter.java
@@ -0,0 +1,61 @@
+// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+package com.yahoo.vespa.model.container.xml;
+
+import com.yahoo.component.ComponentSpecification;
+import com.yahoo.component.chain.dependencies.Dependencies;
+import com.yahoo.component.chain.model.ChainedComponentModel;
+import com.yahoo.config.model.deploy.DeployState;
+import com.yahoo.config.provision.DataplaneToken;
+import com.yahoo.container.bundle.BundleInstantiationSpecification;
+import com.yahoo.jdisc.http.filter.security.cloud.config.CloudTokenDataPlaneFilterConfig;
+import com.yahoo.vespa.model.container.ApplicationContainerCluster;
+import com.yahoo.vespa.model.container.http.Client;
+import com.yahoo.vespa.model.container.http.Filter;
+
+import java.time.Instant;
+import java.util.Collection;
+import java.util.List;
+
+class CloudTokenDataPlaneFilter extends Filter implements CloudTokenDataPlaneFilterConfig.Producer {
+    private final Collection<Client> clients;
+    private final String tokenContext;
+
+    CloudTokenDataPlaneFilter(ApplicationContainerCluster cluster, DeployState state) {
+        super(model());
+        this.clients = List.copyOf(cluster.getClients());
+        // Token domain must be identical to the domain used for generating the tokens
+        this.tokenContext = "Vespa Cloud tenant data plane:%s"
+                .formatted(state.getProperties().applicationId().tenant().value());
+    }
+
+    private static ChainedComponentModel model() {
+        return new ChainedComponentModel(
+                new BundleInstantiationSpecification(
+                        new ComponentSpecification("com.yahoo.jdisc.http.filter.security.cloud.CloudTokenDataPlaneFilter"),
+                        null,
+                        new ComponentSpecification("jdisc-security-filters")),
+                Dependencies.emptyDependencies());
+    }
+
+    @Override
+    public void getConfig(CloudTokenDataPlaneFilterConfig.Builder builder) {
+        var clientsCfg = clients.stream()
+                .map(x -> new CloudTokenDataPlaneFilterConfig.Clients.Builder()
+                        .id(x.id())
+                        .tokens(tokensConfig(x.tokens()))
+                        .permissions(x.permissions()))
+                .toList();
+        builder.clients(clientsCfg).tokenContext(tokenContext);
+    }
+
+    private static List<CloudTokenDataPlaneFilterConfig.Clients.Tokens.Builder> tokensConfig(Collection<DataplaneToken> tokens) {
+        return tokens.stream()
+                .map(token -> new CloudTokenDataPlaneFilterConfig.Clients.Tokens.Builder()
+                        .id(token.tokenId())
+                        .fingerprints(token.versions().stream().map(DataplaneToken.Version::fingerprint).toList())
+                        .checkAccessHashes(token.versions().stream().map(DataplaneToken.Version::checkAccessHash).toList())
+                        .expirations(token.versions().stream().map(v -> v.expiration().map(Instant::toString).orElse("<none>")).toList()))
+                .toList();
+    }
+
+}
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
index c97ea6671e8..1036a615bb5 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
@@ -139,9 +139,6 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
     // Default path to vip status file for container in Hosted Vespa.
     static final String HOSTED_VESPA_STATUS_FILE = Defaults.getDefaults().underVespaHome("var/vespa/load-balancer/status.html");
 
-    // Data plane port for hosted Vespa
-    public static final int HOSTED_VESPA_DATAPLANE_PORT = 4443;
-
     //Path to vip status file for container in Hosted Vespa. Only used if set, else use HOSTED_VESPA_STATUS_FILE
     private static final String HOSTED_VESPA_STATUS_FILE_SETTING = "VESPA_LB_STATUS_FILE";
 
@@ -461,15 +458,16 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
             addHostedImplicitHttpIfNotPresent(deployState, cluster);
             addHostedImplicitAccessControlIfNotPresent(deployState, cluster);
             addDefaultConnectorHostedFilterBinding(cluster);
-            addAdditionalHostedConnector(deployState, cluster);
+            addCloudMtlsConnector(deployState, cluster);
             addCloudDataPlaneFilter(deployState, cluster);
+            addCloudTokenSupport(deployState, cluster);
         }
     }
 
     private static void addCloudDataPlaneFilter(DeployState deployState, ApplicationContainerCluster cluster) {
         if (!deployState.isHosted() || !deployState.zone().system().isPublic()) return;
 
-        var dataplanePort = getDataplanePort(deployState);
+        var dataplanePort = getMtlsDataplanePort(deployState);
         // Setup secure filter chain
         var secureChain = new HttpFilterChain("cloud-data-plane-secure", HttpFilterChain.Type.SYSTEM);
         secureChain.addInnerComponent(new CloudDataPlaneFilter(cluster, deployState));
@@ -599,12 +597,12 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
                 .ifPresent(accessControl -> accessControl.configureDefaultHostedConnector(cluster.getHttp()));                                 ;
     }
 
-    private void addAdditionalHostedConnector(DeployState state, ApplicationContainerCluster cluster) {
+    private void addCloudMtlsConnector(DeployState state, ApplicationContainerCluster cluster) {
         JettyHttpServer server = cluster.getHttp().getHttpServer().get();
         String serverName = server.getComponentId().getName();
 
         // If the deployment contains certificate/private key reference, setup TLS port
-        var builder = HostedSslConnectorFactory.builder(serverName, getDataplanePort(state))
+        var builder = HostedSslConnectorFactory.builder(serverName, getMtlsDataplanePort(state))
                 .proxyProtocol(true, state.getProperties().featureFlags().enableProxyProtocolMixedMode())
                 .tlsCiphersOverride(state.getProperties().tlsCiphersOverride())
                 .endpointConnectionTtl(state.getProperties().endpointConnectionTtl());
@@ -627,22 +625,6 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
                         .orElse(false);
                 builder.clientAuth(needAuth ? SslClientAuth.NEED : SslClientAuth.WANT);
             }
-
-            boolean enableTokenSupport = state.featureFlags().enableDataplaneProxy()
-                    && cluster.getClients().stream().anyMatch(c -> !c.tokens().isEmpty());
-
-            // Set up component to generate proxy cert if token support is enabled
-            if (enableTokenSupport) {
-                cluster.addSimpleComponent(DataplaneProxyCredentials.class);
-                cluster.addSimpleComponent(DataplaneProxyService.class);
-
-                var dataplaneProxy = new DataplaneProxy(
-                        getDataplanePort(state),
-                        endpointCert.certificate(),
-                        endpointCert.key());
-                cluster.addComponent(dataplaneProxy);
-                builder.tokenEndpoint(true);
-            }
         } else {
             builder.clientAuth(SslClientAuth.WANT_WITH_ENFORCER);
         }
@@ -651,6 +633,47 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
         server.addConnector(connectorFactory);
     }
 
+    private void addCloudTokenSupport(DeployState state, ApplicationContainerCluster cluster) {
+        var server = cluster.getHttp().getHttpServer().get();
+        boolean enableTokenSupport = state.isHosted() && state.zone().system().isPublic()
+                && state.featureFlags().enableDataplaneProxy()
+                && cluster.getClients().stream().anyMatch(c -> !c.tokens().isEmpty());
+        if (!enableTokenSupport) return;
+        var endpointCert = state.endpointCertificateSecrets().orElseThrow();
+        int tokenPort = getTokenDataplanePort(state).orElseThrow();
+
+        // Set up component to generate proxy cert if token support is enabled
+        cluster.addSimpleComponent(DataplaneProxyCredentials.class);
+        cluster.addSimpleComponent(DataplaneProxyService.class);
+        var dataplaneProxy = new DataplaneProxy(
+                getMtlsDataplanePort(state),
+                tokenPort,
+                endpointCert.certificate(),
+                endpointCert.key());
+        cluster.addComponent(dataplaneProxy);
+
+        // Setup dedicated connector
+        var connector = HostedSslConnectorFactory.builder(server.getComponentId().getName()+"-token", tokenPort)
+                .tokenEndpoint(true)
+                .proxyProtocol(false, false)
+                .endpointCertificate(endpointCert)
+                .remoteAddressHeader("X-Forwarded-For")
+                .remotePortHeader("X-Forwarded-Port")
+                .clientAuth(SslClientAuth.NEED)
+                .build();
+        server.addConnector(connector);
+
+        // Setup token filter chain
+        var tokenChain = new HttpFilterChain("cloud-token-data-plane-secure", HttpFilterChain.Type.SYSTEM);
+        tokenChain.addInnerComponent(new CloudTokenDataPlaneFilter(cluster, state));
+        cluster.getHttp().getFilterChains().add(tokenChain);
+
+        // Set as default filter for token port
+        cluster.getHttp().getHttpServer().orElseThrow().getConnectorFactories().stream()
+                .filter(c -> c.getListenPort() == tokenPort).findAny().orElseThrow()
+                .setDefaultRequestFilterChain(tokenChain.getComponentId());
+    }
+
     // Returns the client certificates of the clients defined for an application cluster
     private List<X509Certificate> getClientCertificates(ApplicationContainerCluster cluster) {
         return cluster.getClients()
@@ -810,7 +833,7 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
     }
 
     private void addUserHandlers(DeployState deployState, ApplicationContainerCluster cluster, Element spec, ConfigModelContext context) {
-        OptionalInt portBindingOverride = isHostedTenantApplication(context) ? OptionalInt.of(getDataplanePort(deployState)) : OptionalInt.empty();
+        var portBindingOverride = isHostedTenantApplication(context) ? getDataplanePorts(deployState) : Set.<Integer>of();
         for (Element component: XML.getChildren(spec, "handler")) {
             cluster.addComponent(
                     new DomHandlerBuilder(cluster, portBindingOverride).build(deployState, cluster, component));
@@ -1099,12 +1122,12 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
     }
 
     private void addSearchHandler(DeployState deployState, ApplicationContainerCluster cluster, Element searchElement, ConfigModelContext context) {
-        BindingPattern bindingPattern = SearchHandler.DEFAULT_BINDING;
+        var bindingPatterns = List.<BindingPattern>of(SearchHandler.DEFAULT_BINDING);
         if (isHostedTenantApplication(context) && deployState.featureFlags().useRestrictedDataPlaneBindings()) {
-            bindingPattern = SearchHandler.bindingPattern(Optional.of(Integer.toString(getDataplanePort(deployState))));
+            bindingPatterns = SearchHandler.bindingPattern(getDataplanePorts(deployState));
         }
         SearchHandler searchHandler = new SearchHandler(cluster,
-                                                        serverBindings(deployState, context, searchElement, bindingPattern),
+                                                        serverBindings(deployState, context, searchElement, bindingPatterns),
                                                         ContainerThreadpool.UserOptions.fromXml(searchElement).orElse(null));
         cluster.addComponent(searchHandler);
 
@@ -1112,41 +1135,43 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
         searchHandler.addComponent(Component.fromClassAndBundle(SearchHandler.EXECUTION_FACTORY, PlatformBundles.SEARCH_AND_DOCPROC_BUNDLE));
     }
 
-    private List<BindingPattern> serverBindings(DeployState deployState, ConfigModelContext context, Element searchElement, BindingPattern... defaultBindings) {
+    private List<BindingPattern> serverBindings(DeployState deployState, ConfigModelContext context, Element searchElement, Collection<BindingPattern> defaultBindings) {
         List<Element> bindings = XML.getChildren(searchElement, "binding");
         if (bindings.isEmpty())
-            return List.of(defaultBindings);
+            return List.copyOf(defaultBindings);
 
         return toBindingList(deployState, context, bindings);
     }
 
     private List<BindingPattern> toBindingList(DeployState deployState, ConfigModelContext context, List<Element> bindingElements) {
         List<BindingPattern> result = new ArrayList<>();
-        OptionalInt portOverride = isHostedTenantApplication(context) && deployState.featureFlags().useRestrictedDataPlaneBindings() ? OptionalInt.of(getDataplanePort(deployState)) : OptionalInt.empty();
+        var portOverride = isHostedTenantApplication(context) && deployState.featureFlags().useRestrictedDataPlaneBindings() ? getDataplanePorts(deployState) : Set.<Integer>of();
         for (Element element: bindingElements) {
             String text = element.getTextContent().trim();
             if (!text.isEmpty())
-                result.add(userBindingPattern(text, portOverride));
+                result.addAll(userBindingPattern(text, portOverride));
         }
 
         return result;
     }
-    private static UserBindingPattern userBindingPattern(String path, OptionalInt portOverride) {
+    private static Collection<UserBindingPattern> userBindingPattern(String path, Set<Integer> portBindingOverride) {
         UserBindingPattern bindingPattern = UserBindingPattern.fromPattern(path);
-        return portOverride.isPresent()
-                ? bindingPattern.withPort(portOverride.getAsInt())
-                : bindingPattern;
+        if (portBindingOverride.isEmpty()) return Set.of(bindingPattern);
+        return portBindingOverride.stream()
+                .map(bindingPattern::withPort)
+                .toList();
     }
 
+
     private ContainerDocumentApi buildDocumentApi(DeployState deployState, ApplicationContainerCluster cluster, Element spec, ConfigModelContext context) {
         Element documentApiElement = XML.getChild(spec, "document-api");
         if (documentApiElement == null) return null;
 
         ContainerDocumentApi.HandlerOptions documentApiOptions = DocumentApiOptionsBuilder.build(documentApiElement);
         Element ignoreUndefinedFields = XML.getChild(documentApiElement, "ignore-undefined-fields");
-        OptionalInt portBindingOverride = deployState.featureFlags().useRestrictedDataPlaneBindings() && isHostedTenantApplication(context)
-                ? OptionalInt.of(getDataplanePort(deployState))
-                : OptionalInt.empty();
+        var portBindingOverride = deployState.featureFlags().useRestrictedDataPlaneBindings() && isHostedTenantApplication(context)
+                ? getDataplanePorts(deployState)
+                : Set.<Integer>of();
         return new ContainerDocumentApi(cluster, documentApiOptions,
                                         "true".equals(XML.getValue(ignoreUndefinedFields)), portBindingOverride);
     }
@@ -1406,8 +1431,18 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
 
     }
 
-    private static int getDataplanePort(DeployState deployState) {
-        return deployState.featureFlags().enableDataplaneProxy() ? 8443 : HOSTED_VESPA_DATAPLANE_PORT;
+    private static Set<Integer> getDataplanePorts(DeployState ds) {
+        var tokenPort = getTokenDataplanePort(ds);
+        var mtlsPort = getMtlsDataplanePort(ds);
+        return tokenPort.isPresent() ? Set.of(mtlsPort, tokenPort.getAsInt()) : Set.of(mtlsPort);
+    }
+
+    private static int getMtlsDataplanePort(DeployState ds) {
+        return ds.featureFlags().enableDataplaneProxy() ? 8443 : 4443;
+    }
+
+    private static OptionalInt getTokenDataplanePort(DeployState ds) {
+        return ds.featureFlags().enableDataplaneProxy() ? OptionalInt.of(8444) : OptionalInt.empty();
     }
 
 }
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/SearchHandler.java b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/SearchHandler.java
index ebb22b2b73b..6cfef153fee 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/SearchHandler.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/SearchHandler.java
@@ -10,8 +10,8 @@ import com.yahoo.vespa.model.container.component.SystemBindingPattern;
 import com.yahoo.vespa.model.container.component.chain.ProcessingHandler;
 import com.yahoo.vespa.model.container.search.searchchain.SearchChains;
 
+import java.util.Collection;
 import java.util.List;
-import java.util.Optional;
 
 import static com.yahoo.container.bundle.BundleInstantiationSpecification.fromSearchAndDocproc;
 
@@ -28,7 +28,7 @@ class SearchHandler extends ProcessingHandler<SearchChains> {
     static final String EXECUTION_FACTORY_CLASSNAME = EXECUTION_FACTORY.getName();
 
     static final BundleInstantiationSpecification HANDLER_SPEC = fromSearchAndDocproc(HANDLER_CLASSNAME);
-    static final BindingPattern DEFAULT_BINDING = bindingPattern(Optional.empty());
+    static final BindingPattern DEFAULT_BINDING = SystemBindingPattern.fromHttpPath("/search/*");
 
     SearchHandler(ApplicationContainerCluster cluster,
                   List<BindingPattern> bindings,
@@ -37,12 +37,11 @@ class SearchHandler extends ProcessingHandler<SearchChains> {
         bindings.forEach(this::addServerBindings);
     }
 
-    static BindingPattern bindingPattern(Optional<String> port) {
-        String path = "/search/*";
-        return port
-                .filter(s -> !s.isBlank())
-                .map(s -> SystemBindingPattern.fromHttpPortAndPath(s, path))
-                .orElseGet(() -> SystemBindingPattern.fromHttpPath(path));
+    static List<BindingPattern> bindingPattern(Collection<Integer> ports) {
+        if (ports.isEmpty()) return List.of(DEFAULT_BINDING);
+        return ports.stream()
+                .map(s -> (BindingPattern)SystemBindingPattern.fromHttpPortAndPath(s, DEFAULT_BINDING.path()))
+                .toList();
     }
 
     private static class Threadpool extends ContainerThreadpool {
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/container/xml/CloudDataPlaneFilterTest.java b/config-model/src/test/java/com/yahoo/vespa/model/container/xml/CloudDataPlaneFilterTest.java
index 02ff7b8a03f..94d92b355f9 100644
--- a/config-model/src/test/java/com/yahoo/vespa/model/container/xml/CloudDataPlaneFilterTest.java
+++ b/config-model/src/test/java/com/yahoo/vespa/model/container/xml/CloudDataPlaneFilterTest.java
@@ -6,7 +6,6 @@ import com.yahoo.config.model.builder.xml.test.DomBuilderTest;
 import com.yahoo.config.model.deploy.DeployState;
 import com.yahoo.config.model.deploy.TestProperties;
 import com.yahoo.config.model.test.MockApplicationPackage;
-import com.yahoo.config.provision.DataplaneToken;
 import com.yahoo.config.provision.Environment;
 import com.yahoo.config.provision.RegionName;
 import com.yahoo.config.provision.SystemName;
@@ -35,17 +34,14 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.security.KeyPair;
 import java.security.cert.X509Certificate;
-import java.time.Duration;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
-import java.util.Collection;
 import java.util.List;
 import java.util.Optional;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertIterableEquals;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
@@ -89,7 +85,6 @@ public class CloudDataPlaneFilterTest extends ContainerModelBuilderTestBase {
         CloudDataPlaneFilterConfig.Clients client = clients.get(0);
         assertEquals("foo", client.id());
         assertIterableEquals(List.of("read", "write"), client.permissions());
-        assertTrue(client.tokens().isEmpty());
         assertIterableEquals(List.of(X509CertificateUtils.toPem(certificate)), client.certificates());
 
         ConnectorConfig connectorConfig = connectorConfig();
@@ -123,43 +118,6 @@ public class CloudDataPlaneFilterTest extends ContainerModelBuilderTestBase {
     }
 
     @Test
-    void generates_correct_config_for_tokens() throws IOException {
-        var certFile = securityFolder.resolve("foo.pem");
-        var clusterElem = DomBuilderTest.parse(
-                """ 
-                        <container version='1.0'>
-                          <clients>
-                            <client id="foo" permissions="read,write">
-                                <certificate file="%s"/>
-                            </client>
-                            <client id="bar" permissions="read">
-                                <token id="my-token"/>
-                            </client>
-                          </clients>
-                        </container>
-                        """
-                        .formatted(applicationFolder.toPath().relativize(certFile).toString()));
-        createCertificate(certFile);
-        buildModel(clusterElem);
-
-        var cfg = root.getConfig(CloudDataPlaneFilterConfig.class, cloudDataPlaneFilterConfigId);
-        var tokenClient = cfg.clients().stream().filter(c -> c.id().equals("bar")).findAny().orElse(null);
-        assertNotNull(tokenClient);
-        assertEquals(List.of("read"), tokenClient.permissions());
-        assertTrue(tokenClient.certificates().isEmpty());
-        var expectedTokenCfg = tokenConfig(
-                "my-token", List.of("myfingerprint1", "myfingerprint2"), List.of("myaccesshash1", "myaccesshash2"),
-                List.of("<none>", "2243-10-17T00:00:00Z"));
-        assertEquals(List.of(expectedTokenCfg), tokenClient.tokens());
-    }
-
-    private static CloudDataPlaneFilterConfig.Clients.Tokens tokenConfig(
-            String id, Collection<String> fingerprints, Collection<String> accessCheckHashes, Collection<String> expirations) {
-        return new CloudDataPlaneFilterConfig.Clients.Tokens.Builder()
-                .id(id).fingerprints(fingerprints).checkAccessHashes(accessCheckHashes).expirations(expirations).build();
-    }
-
-    @Test
     public void it_rejects_files_without_certificates() throws IOException {
         Path certFile = securityFolder.resolve("foo.pem");
         Element clusterElem = DomBuilderTest.parse(
@@ -231,9 +189,6 @@ public class CloudDataPlaneFilterTest extends ContainerModelBuilderTestBase {
                 .properties(
                         new TestProperties()
                                 .setEndpointCertificateSecrets(Optional.of(new EndpointCertificateSecrets("CERT", "KEY")))
-                                .setDataplaneTokens(List.of(new DataplaneToken("my-token", List.of(
-                                        new DataplaneToken.Version("myfingerprint1", "myaccesshash1", Optional.empty()),
-                                        new DataplaneToken.Version("myfingerprint2", "myaccesshash2", Optional.of(Instant.EPOCH.plus(Duration.ofDays(100000))))))))
                                 .setHostedVespa(true))
                 .zone(new Zone(SystemName.PublicCd, Environment.dev, RegionName.defaultName()))
                 .build();
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/container/xml/CloudTokenDataPlaneFilterTest.java b/config-model/src/test/java/com/yahoo/vespa/model/container/xml/CloudTokenDataPlaneFilterTest.java
new file mode 100644
index 00000000000..15e1d61c951
--- /dev/null
+++ b/config-model/src/test/java/com/yahoo/vespa/model/container/xml/CloudTokenDataPlaneFilterTest.java
@@ -0,0 +1,105 @@
+// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+package com.yahoo.vespa.model.container.xml;
+
+import com.yahoo.config.model.api.EndpointCertificateSecrets;
+import com.yahoo.config.model.builder.xml.test.DomBuilderTest;
+import com.yahoo.config.model.deploy.DeployState;
+import com.yahoo.config.model.deploy.TestProperties;
+import com.yahoo.config.model.test.MockApplicationPackage;
+import com.yahoo.config.provision.DataplaneToken;
+import com.yahoo.config.provision.Environment;
+import com.yahoo.config.provision.RegionName;
+import com.yahoo.config.provision.SystemName;
+import com.yahoo.config.provision.Zone;
+import com.yahoo.jdisc.http.filter.security.cloud.config.CloudTokenDataPlaneFilterConfig;
+import com.yahoo.vespa.model.container.ContainerModel;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.w3c.dom.Element;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Collection;
+import java.util.List;
+import java.util.Optional;
+
+import static com.yahoo.vespa.model.container.xml.CloudDataPlaneFilterTest.createCertificate;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+public class CloudTokenDataPlaneFilterTest extends ContainerModelBuilderTestBase {
+
+    @TempDir
+    public File applicationFolder;
+
+    Path securityFolder;
+    private static final String filterConfigId = "container/filters/chain/cloud-token-data-plane-secure/component/" +
+            "com.yahoo.jdisc.http.filter.security.cloud.CloudTokenDataPlaneFilter";
+
+    @BeforeEach
+    public void setup() throws IOException {
+        securityFolder = applicationFolder.toPath().resolve("security");
+        Files.createDirectories(securityFolder);
+    }
+
+    @Test
+    void generates_correct_config_for_tokens() throws IOException {
+        var certFile = securityFolder.resolve("foo.pem");
+        var clusterElem = DomBuilderTest.parse(
+                """ 
+                        <container version='1.0'>
+                          <clients>
+                            <client id="foo" permissions="read,write">
+                                <certificate file="%s"/>
+                            </client>
+                            <client id="bar" permissions="read">
+                                <token id="my-token"/>
+                            </client>
+                          </clients>
+                        </container>
+                        """
+                        .formatted(applicationFolder.toPath().relativize(certFile).toString()));
+        createCertificate(certFile);
+        buildModel(clusterElem);
+
+        var cfg = root.getConfig(CloudTokenDataPlaneFilterConfig.class, filterConfigId);
+        var tokenClient = cfg.clients().stream().filter(c -> c.id().equals("bar")).findAny().orElse(null);
+        assertNotNull(tokenClient);
+        assertEquals(List.of("read"), tokenClient.permissions());
+        var expectedTokenCfg = tokenConfig(
+                "my-token", List.of("myfingerprint1", "myfingerprint2"), List.of("myaccesshash1", "myaccesshash2"),
+                List.of("<none>", "2243-10-17T00:00:00Z"));
+        assertEquals(List.of(expectedTokenCfg), tokenClient.tokens());
+    }
+
+    private static CloudTokenDataPlaneFilterConfig.Clients.Tokens tokenConfig(
+            String id, Collection<String> fingerprints, Collection<String> accessCheckHashes, Collection<String> expirations) {
+        return new CloudTokenDataPlaneFilterConfig.Clients.Tokens.Builder()
+                .id(id).fingerprints(fingerprints).checkAccessHashes(accessCheckHashes).expirations(expirations).build();
+    }
+
+    public List<ContainerModel> buildModel(Element... clusterElem) {
+        var applicationPackage = new MockApplicationPackage.Builder()
+                .withRoot(applicationFolder)
+                .build();
+
+        DeployState state = new DeployState.Builder()
+                .applicationPackage(applicationPackage)
+                .properties(
+                        new TestProperties()
+                                .setEnableDataplaneProxy(true)
+                                .setEndpointCertificateSecrets(Optional.of(new EndpointCertificateSecrets("CERT", "KEY")))
+                                .setDataplaneTokens(List.of(new DataplaneToken("my-token", List.of(
+                                        new DataplaneToken.Version("myfingerprint1", "myaccesshash1", Optional.empty()),
+                                        new DataplaneToken.Version("myfingerprint2", "myaccesshash2", Optional.of(Instant.EPOCH.plus(Duration.ofDays(100000))))))))
+                                .setHostedVespa(true))
+                .zone(new Zone(SystemName.PublicCd, Environment.dev, RegionName.defaultName()))
+                .build();
+        return createModel(root, state, null, clusterElem);
+    }
+}
diff --git a/configdefinitions/src/vespa/CMakeLists.txt b/configdefinitions/src/vespa/CMakeLists.txt
index 85fc1158afe..29ed0f53421 100644
--- a/configdefinitions/src/vespa/CMakeLists.txt
+++ b/configdefinitions/src/vespa/CMakeLists.txt
@@ -89,3 +89,4 @@ install_config_definition(hugging-face-embedder.def embedding.huggingface.huggin
 install_config_definition(hugging-face-tokenizer.def language.huggingface.config.hugging-face-tokenizer.def)
 install_config_definition(bert-base-embedder.def embedding.bert-base-embedder.def)
 install_config_definition(cloud-data-plane-filter.def jdisc.http.filter.security.cloud.config.cloud-data-plane-filter.def)
+install_config_definition(cloud-token-data-plane-filter.def jdisc.http.filter.security.cloud.config.cloud-token-data-plane-filter.def)
diff --git a/configdefinitions/src/vespa/cloud-data-plane-filter.def b/configdefinitions/src/vespa/cloud-data-plane-filter.def
index d73c5a49c81..47478a28039 100644
--- a/configdefinitions/src/vespa/cloud-data-plane-filter.def
+++ b/configdefinitions/src/vespa/cloud-data-plane-filter.def
@@ -2,11 +2,6 @@
 namespace=jdisc.http.filter.security.cloud.config
 
 legacyMode bool default=false
-tokenContext string default=""
 clients[].id string
 clients[].permissions[] string
 clients[].certificates[] string
-clients[].tokens[].id string
-clients[].tokens[].fingerprints[] string
-clients[].tokens[].checkAccessHashes[] string
-clients[].tokens[].expirations[] string
diff --git a/configdefinitions/src/vespa/cloud-token-data-plane-filter.def b/configdefinitions/src/vespa/cloud-token-data-plane-filter.def
new file mode 100644
index 00000000000..3219ae4fa48
--- /dev/null
+++ b/configdefinitions/src/vespa/cloud-token-data-plane-filter.def
@@ -0,0 +1,10 @@
+# Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+namespace=jdisc.http.filter.security.cloud.config
+
+tokenContext string default=""
+clients[].id string
+clients[].permissions[] string
+clients[].tokens[].id string
+clients[].tokens[].fingerprints[] string
+clients[].tokens[].checkAccessHashes[] string
+clients[].tokens[].expirations[] string
diff --git a/configdefinitions/src/vespa/dataplane-proxy.def b/configdefinitions/src/vespa/dataplane-proxy.def
index 9ce3e4b4b7b..dd1d734a91c 100644
--- a/configdefinitions/src/vespa/dataplane-proxy.def
+++ b/configdefinitions/src/vespa/dataplane-proxy.def
@@ -2,7 +2,8 @@
 namespace=cloud.config
 
 # The port Jdisc will be listening on
-port                int
+tokenPort           int
+mtlsPort            int
 
 # Server certificate and key to be used when creating server socket
 serverCertificate   string
diff --git a/container-core/abi-spec.json b/container-core/abi-spec.json
index 757afeb64e2..6d7e3c86351 100644
--- a/container-core/abi-spec.json
+++ b/container-core/abi-spec.json
@@ -1027,6 +1027,45 @@
     ],
     "fields" : [ ]
   },
+  "com.yahoo.jdisc.http.ConnectorConfig$AccessLog$Builder" : {
+    "superClass" : "java.lang.Object",
+    "interfaces" : [
+      "com.yahoo.config.ConfigBuilder"
+    ],
+    "attributes" : [
+      "public",
+      "final"
+    ],
+    "methods" : [
+      "public void <init>()",
+      "public void <init>(com.yahoo.jdisc.http.ConnectorConfig$AccessLog)",
+      "public com.yahoo.jdisc.http.ConnectorConfig$AccessLog$Builder remoteAddressHeaders(java.lang.String)",
+      "public com.yahoo.jdisc.http.ConnectorConfig$AccessLog$Builder remoteAddressHeaders(java.util.Collection)",
+      "public com.yahoo.jdisc.http.ConnectorConfig$AccessLog$Builder remotePortHeaders(java.lang.String)",
+      "public com.yahoo.jdisc.http.ConnectorConfig$AccessLog$Builder remotePortHeaders(java.util.Collection)",
+      "public com.yahoo.jdisc.http.ConnectorConfig$AccessLog build()"
+    ],
+    "fields" : [
+      "public java.util.List remoteAddressHeaders",
+      "public java.util.List remotePortHeaders"
+    ]
+  },
+  "com.yahoo.jdisc.http.ConnectorConfig$AccessLog" : {
+    "superClass" : "com.yahoo.config.InnerNode",
+    "interfaces" : [ ],
+    "attributes" : [
+      "public",
+      "final"
+    ],
+    "methods" : [
+      "public void <init>(com.yahoo.jdisc.http.ConnectorConfig$AccessLog$Builder)",
+      "public java.util.List remoteAddressHeaders()",
+      "public java.lang.String remoteAddressHeaders(int)",
+      "public java.util.List remotePortHeaders()",
+      "public java.lang.String remotePortHeaders(int)"
+    ],
+    "fields" : [ ]
+  },
   "com.yahoo.jdisc.http.ConnectorConfig$Builder" : {
     "superClass" : "java.lang.Object",
     "interfaces" : [
@@ -1069,6 +1108,8 @@
       "public com.yahoo.jdisc.http.ConnectorConfig$Builder http2(java.util.function.Consumer)",
       "public com.yahoo.jdisc.http.ConnectorConfig$Builder serverName(com.yahoo.jdisc.http.ConnectorConfig$ServerName$Builder)",
       "public com.yahoo.jdisc.http.ConnectorConfig$Builder serverName(java.util.function.Consumer)",
+      "public com.yahoo.jdisc.http.ConnectorConfig$Builder accessLog(com.yahoo.jdisc.http.ConnectorConfig$AccessLog$Builder)",
+      "public com.yahoo.jdisc.http.ConnectorConfig$Builder accessLog(java.util.function.Consumer)",
       "public final boolean dispatchGetConfig(com.yahoo.config.ConfigInstance$Producer)",
       "public final java.lang.String getDefMd5()",
       "public final java.lang.String getDefName()",
@@ -1084,7 +1125,8 @@
       "public com.yahoo.jdisc.http.ConnectorConfig$HealthCheckProxy$Builder healthCheckProxy",
       "public com.yahoo.jdisc.http.ConnectorConfig$ProxyProtocol$Builder proxyProtocol",
       "public com.yahoo.jdisc.http.ConnectorConfig$Http2$Builder http2",
-      "public com.yahoo.jdisc.http.ConnectorConfig$ServerName$Builder serverName"
+      "public com.yahoo.jdisc.http.ConnectorConfig$ServerName$Builder serverName",
+      "public com.yahoo.jdisc.http.ConnectorConfig$AccessLog$Builder accessLog"
     ]
   },
   "com.yahoo.jdisc.http.ConnectorConfig$HealthCheckProxy$Builder" : {
@@ -1438,7 +1480,8 @@
       "public double maxConnectionLife()",
       "public boolean http2Enabled()",
       "public com.yahoo.jdisc.http.ConnectorConfig$Http2 http2()",
-      "public com.yahoo.jdisc.http.ConnectorConfig$ServerName serverName()"
+      "public com.yahoo.jdisc.http.ConnectorConfig$ServerName serverName()",
+      "public com.yahoo.jdisc.http.ConnectorConfig$AccessLog accessLog()"
     ],
     "fields" : [
       "public static final java.lang.String CONFIG_DEF_MD5",
@@ -1771,45 +1814,6 @@
     ],
     "fields" : [ ]
   },
-  "com.yahoo.jdisc.http.ServerConfig$AccessLog$Builder" : {
-    "superClass" : "java.lang.Object",
-    "interfaces" : [
-      "com.yahoo.config.ConfigBuilder"
-    ],
-    "attributes" : [
-      "public",
-      "final"
-    ],
-    "methods" : [
-      "public void <init>()",
-      "public void <init>(com.yahoo.jdisc.http.ServerConfig$AccessLog)",
-      "public com.yahoo.jdisc.http.ServerConfig$AccessLog$Builder remoteAddressHeaders(java.lang.String)",
-      "public com.yahoo.jdisc.http.ServerConfig$AccessLog$Builder remoteAddressHeaders(java.util.Collection)",
-      "public com.yahoo.jdisc.http.ServerConfig$AccessLog$Builder remotePortHeaders(java.lang.String)",
-      "public com.yahoo.jdisc.http.ServerConfig$AccessLog$Builder remotePortHeaders(java.util.Collection)",
-      "public com.yahoo.jdisc.http.ServerConfig$AccessLog build()"
-    ],
-    "fields" : [
-      "public java.util.List remoteAddressHeaders",
-      "public java.util.List remotePortHeaders"
-    ]
-  },
-  "com.yahoo.jdisc.http.ServerConfig$AccessLog" : {
-    "superClass" : "com.yahoo.config.InnerNode",
-    "interfaces" : [ ],
-    "attributes" : [
-      "public",
-      "final"
-    ],
-    "methods" : [
-      "public void <init>(com.yahoo.jdisc.http.ServerConfig$AccessLog$Builder)",
-      "public java.util.List remoteAddressHeaders()",
-      "public java.lang.String remoteAddressHeaders(int)",
-      "public java.util.List remotePortHeaders()",
-      "public java.lang.String remotePortHeaders(int)"
-    ],
-    "fields" : [ ]
-  },
   "com.yahoo.jdisc.http.ServerConfig$Builder" : {
     "superClass" : "java.lang.Object",
     "interfaces" : [
@@ -1839,8 +1843,6 @@
       "public com.yahoo.jdisc.http.ServerConfig$Builder jmx(java.util.function.Consumer)",
       "public com.yahoo.jdisc.http.ServerConfig$Builder metric(com.yahoo.jdisc.http.ServerConfig$Metric$Builder)",
       "public com.yahoo.jdisc.http.ServerConfig$Builder metric(java.util.function.Consumer)",
-      "public com.yahoo.jdisc.http.ServerConfig$Builder accessLog(com.yahoo.jdisc.http.ServerConfig$AccessLog$Builder)",
-      "public com.yahoo.jdisc.http.ServerConfig$Builder accessLog(java.util.function.Consumer)",
       "public com.yahoo.jdisc.http.ServerConfig$Builder connectionLog(com.yahoo.jdisc.http.ServerConfig$ConnectionLog$Builder)",
       "public com.yahoo.jdisc.http.ServerConfig$Builder connectionLog(java.util.function.Consumer)",
       "public final boolean dispatchGetConfig(com.yahoo.config.ConfigInstance$Producer)",
@@ -1856,7 +1858,6 @@
       "public java.util.List defaultFilters",
       "public com.yahoo.jdisc.http.ServerConfig$Jmx$Builder jmx",
       "public com.yahoo.jdisc.http.ServerConfig$Metric$Builder metric",
-      "public com.yahoo.jdisc.http.ServerConfig$AccessLog$Builder accessLog",
       "public com.yahoo.jdisc.http.ServerConfig$ConnectionLog$Builder connectionLog"
     ]
   },
@@ -2070,7 +2071,6 @@
       "public double stopTimeout()",
       "public com.yahoo.jdisc.http.ServerConfig$Jmx jmx()",
       "public com.yahoo.jdisc.http.ServerConfig$Metric metric()",
-      "public com.yahoo.jdisc.http.ServerConfig$AccessLog accessLog()",
       "public com.yahoo.jdisc.http.ServerConfig$ConnectionLog connectionLog()"
     ],
     "fields" : [
diff --git a/container-core/src/main/java/com/yahoo/jdisc/http/server/jetty/AccessLogRequestLog.java b/container-core/src/main/java/com/yahoo/jdisc/http/server/jetty/AccessLogRequestLog.java
index 5b51eeee7d6..7a305c23ba3 100644
--- a/container-core/src/main/java/com/yahoo/jdisc/http/server/jetty/AccessLogRequestLog.java
+++ b/container-core/src/main/java/com/yahoo/jdisc/http/server/jetty/AccessLogRequestLog.java
@@ -7,8 +7,6 @@ import com.yahoo.container.logging.AccessLogEntry;
 import com.yahoo.container.logging.RequestLog;
 import com.yahoo.container.logging.RequestLogEntry;
 import com.yahoo.jdisc.http.HttpRequest;
-import com.yahoo.jdisc.http.ServerConfig;
-import jakarta.servlet.http.HttpServletRequest;
 import org.eclipse.jetty.http2.HTTP2Stream;
 import org.eclipse.jetty.http2.server.HttpTransportOverHTTP2;
 import org.eclipse.jetty.server.HttpChannel;
@@ -27,6 +25,7 @@ import java.util.function.BiConsumer;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
+import static com.yahoo.jdisc.http.server.jetty.RequestUtils.getConnector;
 import static com.yahoo.jdisc.http.server.jetty.RequestUtils.getConnectorLocalPort;
 
 /**
@@ -44,13 +43,9 @@ class AccessLogRequestLog extends AbstractLifeCycle implements org.eclipse.jetty
     private static final List<String> LOGGED_REQUEST_HEADERS = List.of("Vespa-Client-Version");
 
     private final RequestLog requestLog;
-    private final List<String> remoteAddressHeaders;
-    private final List<String> remotePortHeaders;
 
-    AccessLogRequestLog(RequestLog requestLog, ServerConfig.AccessLog config) {
+    AccessLogRequestLog(RequestLog requestLog) {
         this.requestLog = requestLog;
-        this.remoteAddressHeaders = config.remoteAddressHeaders();
-        this.remotePortHeaders = config.remotePortHeaders();
     }
 
     @Override
@@ -144,16 +139,16 @@ class AccessLogRequestLog extends AbstractLifeCycle implements org.eclipse.jetty
         }
     }
 
-    private String getRemoteAddress(HttpServletRequest request) {
-        for (String header : remoteAddressHeaders) {
+    private String getRemoteAddress(Request request) {
+        for (String header : getConnector(request).connectorConfig().accessLog().remoteAddressHeaders()) {
             String value = request.getHeader(header);
             if (value != null) return value;
         }
         return request.getRemoteAddr();
     }
 
-    private int getRemotePort(HttpServletRequest request) {
-        for (String header : remotePortHeaders) {
+    private int getRemotePort(Request request) {
+        for (String header : getConnector(request).connectorConfig().accessLog().remotePortHeaders()) {
             String value = request.getHeader(header);
             if (value != null) {
                 OptionalInt maybePort = parsePort(value);
diff --git a/container-core/src/main/java/com/yahoo/jdisc/http/server/jetty/JettyHttpServer.java b/container-core/src/main/java/com/yahoo/jdisc/http/server/jetty/JettyHttpServer.java
index 3ebb65e7979..7d84ee6f8a3 100644
--- a/container-core/src/main/java/com/yahoo/jdisc/http/server/jetty/JettyHttpServer.java
+++ b/container-core/src/main/java/com/yahoo/jdisc/http/server/jetty/JettyHttpServer.java
@@ -68,7 +68,7 @@ public class JettyHttpServer extends AbstractServerProvider {
 
         server = new Server();
         server.setStopTimeout((long)(serverConfig.stopTimeout() * 1000.0));
-        server.setRequestLog(new AccessLogRequestLog(requestLog, serverConfig.accessLog()));
+        server.setRequestLog(new AccessLogRequestLog(requestLog));
         setupJmx(server, serverConfig);
         configureJettyThreadpool(server, serverConfig);
         JettyConnectionLogger connectionLogger = new JettyConnectionLogger(serverConfig.connectionLog(), connectionLog);
diff --git a/container-core/src/main/java/com/yahoo/jdisc/http/ssl/impl/CloudSslContextProvider.java b/container-core/src/main/java/com/yahoo/jdisc/http/ssl/impl/CloudTokenSslContextProvider.java
index cdfd4aa938e..fe71d1b24c6 100644
--- a/container-core/src/main/java/com/yahoo/jdisc/http/ssl/impl/CloudSslContextProvider.java
+++ b/container-core/src/main/java/com/yahoo/jdisc/http/ssl/impl/CloudTokenSslContextProvider.java
@@ -1,6 +1,7 @@
 // Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 package com.yahoo.jdisc.http.ssl.impl;
 
+import com.yahoo.component.annotation.Inject;
 import com.yahoo.jdisc.http.ConnectorConfig;
 import com.yahoo.jdisc.http.server.jetty.DataplaneProxyCredentials;
 
@@ -14,29 +15,23 @@ import java.util.Optional;
  *
  * @author mortent
  */
-public class CloudSslContextProvider extends ConfiguredSslContextFactoryProvider {
+public class CloudTokenSslContextProvider extends ConfiguredSslContextFactoryProvider {
 
     private final DataplaneProxyCredentials dataplaneProxyCredentials;
 
-    public CloudSslContextProvider(ConnectorConfig connectorConfig, DataplaneProxyCredentials dataplaneProxyCredentials) {
+    @Inject
+    public CloudTokenSslContextProvider(ConnectorConfig connectorConfig,
+                                        DataplaneProxyCredentials dataplaneProxyCredentials) {
         super(connectorConfig);
         this.dataplaneProxyCredentials = dataplaneProxyCredentials;
     }
 
     @Override
     Optional<String> getCaCertificates(ConnectorConfig.Ssl sslConfig) {
-        String proxyCert;
         try {
-            proxyCert = Files.readString(dataplaneProxyCredentials.certificateFile(), StandardCharsets.UTF_8);
+            return Optional.of(Files.readString(dataplaneProxyCredentials.certificateFile(), StandardCharsets.UTF_8));
         } catch (IOException e) {
             throw new IllegalArgumentException("Dataplane proxy certificate not available", e);
         }
-        if (!sslConfig.caCertificate().isBlank()) {
-            return Optional.of(sslConfig.caCertificate() + "\n" + proxyCert);
-        } else if (!sslConfig.caCertificateFile().isBlank()) {
-            return Optional.of(readToString(sslConfig.caCertificateFile()) + "\n" + proxyCert);
-        } else {
-            return Optional.of(proxyCert);
-        }
     }
 }
diff --git a/container-core/src/main/resources/configdefinitions/jdisc.http.jdisc.http.connector.def b/container-core/src/main/resources/configdefinitions/jdisc.http.jdisc.http.connector.def
index 3c01012fd9e..5a2bad63682 100644
--- a/container-core/src/main/resources/configdefinitions/jdisc.http.jdisc.http.connector.def
+++ b/container-core/src/main/resources/configdefinitions/jdisc.http.jdisc.http.connector.def
@@ -138,3 +138,9 @@ serverName.fallback string default=""
 
 # The list of accepted server names. Empty list to accept any. Elements follows format of 'serverName.default'.
 serverName.allowed[] string
+
+# HTTP request headers that contain remote address
+accessLog.remoteAddressHeaders[]      string
+
+# HTTP request headers that contain remote port
+accessLog.remotePortHeaders[]         string
diff --git a/container-core/src/main/resources/configdefinitions/jdisc.http.jdisc.http.server.def b/container-core/src/main/resources/configdefinitions/jdisc.http.jdisc.http.server.def
index c15cb6b2cc4..a85641f61e9 100644
--- a/container-core/src/main/resources/configdefinitions/jdisc.http.jdisc.http.server.def
+++ b/container-core/src/main/resources/configdefinitions/jdisc.http.jdisc.http.server.def
@@ -52,11 +52,5 @@ metric.searchHandlerPaths[]           string
 # User-agent names to ignore wrt statistics (crawlers etc)
 metric.ignoredUserAgents[]            string
 
-# HTTP request headers that contain remote address
-accessLog.remoteAddressHeaders[]      string
-
-# HTTP request headers that contain remote port
-accessLog.remotePortHeaders[]         string
-
 # Whether to enable jdisc connection log
 connectionLog.enabled                 bool default=false
diff --git a/container-core/src/test/java/com/yahoo/jdisc/http/server/jetty/AccessLogRequestLogTest.java b/container-core/src/test/java/com/yahoo/jdisc/http/server/jetty/AccessLogRequestLogTest.java
index 766c7918882..122db0f765d 100644
--- a/container-core/src/test/java/com/yahoo/jdisc/http/server/jetty/AccessLogRequestLogTest.java
+++ b/container-core/src/test/java/com/yahoo/jdisc/http/server/jetty/AccessLogRequestLogTest.java
@@ -4,7 +4,6 @@ package com.yahoo.jdisc.http.server.jetty;
 import com.yahoo.container.logging.AccessLogEntry;
 import com.yahoo.container.logging.RequestLog;
 import com.yahoo.container.logging.RequestLogEntry;
-import com.yahoo.jdisc.http.ServerConfig;
 import org.eclipse.jetty.server.Request;
 import org.eclipse.jetty.server.Response;
 import org.junit.jupiter.api.Test;
@@ -117,11 +116,7 @@ public class AccessLogRequestLogTest {
     }
 
     private void doAccessLoggingOfRequest(RequestLog requestLog, Request jettyRequest) {
-        ServerConfig.AccessLog config = new ServerConfig.AccessLog(
-                new ServerConfig.AccessLog.Builder()
-                        .remoteAddressHeaders(List.of("x-forwarded-for", "y-ra"))
-                        .remotePortHeaders(List.of("X-Forwarded-Port", "y-rp")));
-        new AccessLogRequestLog(requestLog, config).log(jettyRequest, createResponseMock());
+        new AccessLogRequestLog(requestLog).log(jettyRequest, createResponseMock());
     }
 
     private static JettyMockRequestBuilder createRequestBuilder() {
diff --git a/container-core/src/test/java/com/yahoo/jdisc/http/server/jetty/JettyMockRequestBuilder.java b/container-core/src/test/java/com/yahoo/jdisc/http/server/jetty/JettyMockRequestBuilder.java
index e62825fc2a8..8b13f30bcd7 100644
--- a/container-core/src/test/java/com/yahoo/jdisc/http/server/jetty/JettyMockRequestBuilder.java
+++ b/container-core/src/test/java/com/yahoo/jdisc/http/server/jetty/JettyMockRequestBuilder.java
@@ -85,7 +85,11 @@ public class JettyMockRequestBuilder {
         HttpChannel channel = mock(HttpChannel.class);
         HttpConnection connection = mock(HttpConnection.class);
         JDiscServerConnector connector = mock(JDiscServerConnector.class);
-        when(connector.connectorConfig()).thenReturn(new ConnectorConfig(new ConnectorConfig.Builder().listenPort(localPort)));
+        when(connector.connectorConfig()).thenReturn(new ConnectorConfig(
+                new ConnectorConfig.Builder().listenPort(localPort)
+                        .accessLog(new ConnectorConfig.AccessLog.Builder()
+                                           .remoteAddressHeaders(List.of("x-forwarded-for", "y-ra"))
+                                           .remotePortHeaders(List.of("X-Forwarded-Port", "y-rp")))));
         when(connector.getLocalPort()).thenReturn(localPort);
         when(connection.getCreatedTimeStamp()).thenReturn(System.currentTimeMillis());
         when(connection.getConnector()).thenReturn(connector);
diff --git a/container-disc/src/main/java/com/yahoo/container/jdisc/DataplaneProxyService.java b/container-disc/src/main/java/com/yahoo/container/jdisc/DataplaneProxyService.java
index 47050168b80..74e6954e1e1 100644
--- a/container-disc/src/main/java/com/yahoo/container/jdisc/DataplaneProxyService.java
+++ b/container-disc/src/main/java/com/yahoo/container/jdisc/DataplaneProxyService.java
@@ -103,7 +103,8 @@ public class DataplaneProxyService extends AbstractComponent {
                                                    proxyCredentialsKey,
                                                    serverCertificateFile,
                                                    serverKeyFile,
-                                                   config.port(),
+                                                   config.mtlsPort(),
+                                                   config.tokenPort(),
                                                    root
                                            ));
                 if (configChanged && state == NginxState.RUNNING) {
@@ -191,7 +192,8 @@ public class DataplaneProxyService extends AbstractComponent {
             Path clientKey,
             Path serverCert,
             Path serverKey,
-            int vespaPort,
+            int vespaMtlsPort,
+            int vespaTokenPort,
             Path root) {
 
         try {
@@ -200,7 +202,8 @@ public class DataplaneProxyService extends AbstractComponent {
             nginxTemplate = replace(nginxTemplate, "client_key", clientKey.toString());
             nginxTemplate = replace(nginxTemplate, "server_cert", serverCert.toString());
             nginxTemplate = replace(nginxTemplate, "server_key", serverKey.toString());
-            nginxTemplate = replace(nginxTemplate, "vespa_port", Integer.toString(vespaPort));
+            nginxTemplate = replace(nginxTemplate, "vespa_mtls_port", Integer.toString(vespaMtlsPort));
+            nginxTemplate = replace(nginxTemplate, "vespa_token_port", Integer.toString(vespaTokenPort));
             nginxTemplate = replace(nginxTemplate, "prefix", root.toString());
 
             // TODO: verify that all template vars have been expanded
diff --git a/container-disc/src/test/java/com/yahoo/container/jdisc/DataplaneProxyServiceTest.java b/container-disc/src/test/java/com/yahoo/container/jdisc/DataplaneProxyServiceTest.java
index 351890e2a3a..893a527e631 100644
--- a/container-disc/src/test/java/com/yahoo/container/jdisc/DataplaneProxyServiceTest.java
+++ b/container-disc/src/test/java/com/yahoo/container/jdisc/DataplaneProxyServiceTest.java
@@ -168,7 +168,8 @@ public class DataplaneProxyServiceTest {
     private DataplaneProxyConfig proxyConfig() {
         X509CertificateWithKey selfSigned = X509CertificateUtils.createSelfSigned("cn=test", Duration.ofMinutes(10));
         return new DataplaneProxyConfig.Builder()
-                .port(1234)
+                .mtlsPort(1234)
+                .tokenPort(1235)
                 .serverCertificate(X509CertificateUtils.toPem(selfSigned.certificate()))
                 .serverKey(KeyUtils.toPem(selfSigned.privateKey()))
                 .build();
diff --git a/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/ClientPrincipal.java b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/ClientPrincipal.java
new file mode 100644
index 00000000000..bfb9bb920db
--- /dev/null
+++ b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/ClientPrincipal.java
@@ -0,0 +1,30 @@
+// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+
+package com.yahoo.jdisc.http.filter.security.cloud;
+
+import com.yahoo.jdisc.http.filter.DiscFilterRequest;
+
+import java.security.Principal;
+import java.util.Set;
+import java.util.logging.Logger;
+
+/**
+ * @author bjorncs
+ */
+record ClientPrincipal(Set<String> ids, Set<Permission> permissions) implements Principal {
+
+    private static final Logger log = Logger.getLogger(ClientPrincipal.class.getName());
+
+    ClientPrincipal { ids = Set.copyOf(ids); permissions = Set.copyOf(permissions); }
+    @Override public String getName() {
+        return "ids=%s,permissions=%s".formatted(ids, permissions.stream().map(Permission::asString).toList());
+    }
+
+    static void attachToRequest(DiscFilterRequest req, Set<String> ids, Set<Permission> permissions) {
+        var p = new ClientPrincipal(ids, permissions);
+        req.setUserPrincipal(p);
+        log.fine(() -> "Client with ids=%s, permissions=%s"
+                .formatted(ids, permissions.stream().map(Permission::asString).toList()));
+    }
+}
+
diff --git a/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/CloudDataPlaneFilter.java b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/CloudDataPlaneFilter.java
index 2dc80fc9d2b..379973cd8cf 100644
--- a/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/CloudDataPlaneFilter.java
+++ b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/CloudDataPlaneFilter.java
@@ -2,41 +2,25 @@
 package com.yahoo.jdisc.http.filter.security.cloud;
 
 import com.yahoo.component.annotation.Inject;
-import com.yahoo.component.provider.ComponentRegistry;
-import com.yahoo.container.jdisc.AclMapping;
-import com.yahoo.container.jdisc.RequestHandlerSpec;
-import com.yahoo.container.jdisc.RequestView;
-import com.yahoo.container.logging.AccessLogEntry;
 import com.yahoo.jdisc.Response;
 import com.yahoo.jdisc.http.filter.DiscFilterRequest;
 import com.yahoo.jdisc.http.filter.security.base.JsonSecurityRequestFilterBase;
 import com.yahoo.jdisc.http.filter.security.cloud.config.CloudDataPlaneFilterConfig;
-import com.yahoo.jdisc.http.server.jetty.DataplaneProxyCredentials;
 import com.yahoo.security.X509CertificateUtils;
-import com.yahoo.security.token.Token;
-import com.yahoo.security.token.TokenCheckHash;
-import com.yahoo.security.token.TokenDomain;
-import com.yahoo.security.token.TokenFingerprint;
 
-import java.security.Principal;
 import java.security.cert.X509Certificate;
-import java.time.Clock;
-import java.time.Instant;
 import java.util.ArrayList;
 import java.util.EnumSet;
-import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
-import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 import java.util.TreeSet;
 import java.util.logging.Logger;
-import java.util.stream.Collectors;
 
-import static com.yahoo.jdisc.http.filter.security.cloud.CloudDataPlaneFilter.Permission.READ;
-import static com.yahoo.jdisc.http.filter.security.cloud.CloudDataPlaneFilter.Permission.WRITE;
-import static com.yahoo.jdisc.http.server.jetty.AccessLoggingRequestHandler.CONTEXT_KEY_ACCESS_LOG_ENTRY;
+import static com.yahoo.jdisc.http.filter.security.cloud.Permission.READ;
+import static com.yahoo.jdisc.http.filter.security.cloud.Permission.WRITE;
+
 
 /**
  * Data plane filter for Cloud
@@ -50,91 +34,49 @@ import static com.yahoo.jdisc.http.server.jetty.AccessLoggingRequestHandler.CONT
 public class CloudDataPlaneFilter extends JsonSecurityRequestFilterBase {
 
     private static final Logger log = Logger.getLogger(CloudDataPlaneFilter.class.getName());
-    static final int CHECK_HASH_BYTES = 32;
 
     private final boolean legacyMode;
     private final List<Client> allowedClients;
-    private final TokenDomain tokenDomain;
-    private final Clock clock;
 
     @Inject
-    public CloudDataPlaneFilter(CloudDataPlaneFilterConfig cfg,
-                                ComponentRegistry<DataplaneProxyCredentials> optionalReverseProxy) {
-        this(cfg, reverseProxyCert(optionalReverseProxy).orElse(null), Clock.systemUTC());
-    }
-
-    CloudDataPlaneFilter(CloudDataPlaneFilterConfig cfg, X509Certificate reverseProxyCert, Clock clock) {
+    public CloudDataPlaneFilter(CloudDataPlaneFilterConfig cfg) {
         this.legacyMode = cfg.legacyMode();
-        this.tokenDomain = TokenDomain.of(cfg.tokenContext());
-        this.clock = clock;
         if (legacyMode) {
             allowedClients = List.of();
             log.fine(() -> "Legacy mode enabled");
         } else {
-            allowedClients = parseClients(cfg, reverseProxyCert, clock);
+            allowedClients = parseClients(cfg);
         }
     }
 
-    private static Optional<X509Certificate> reverseProxyCert(
-            ComponentRegistry<DataplaneProxyCredentials> optionalReverseProxy) {
-        return optionalReverseProxy.allComponents().stream().findAny().map(DataplaneProxyCredentials::certificate);
-    }
-
-    private static List<Client> parseClients(CloudDataPlaneFilterConfig cfg, X509Certificate reverseProxyCert, Clock clock) {
-        var now = clock.instant();
+    private static List<Client> parseClients(CloudDataPlaneFilterConfig cfg) {
         Set<String> ids = new HashSet<>();
         List<Client> clients = new ArrayList<>(cfg.clients().size());
-        boolean hasClientRequiringCertificate = false;
         if (cfg.clients().isEmpty()) throw new IllegalArgumentException("Empty clients configuration");
         for (var c : cfg.clients()) {
             if (ids.contains(c.id()))
                 throw new IllegalArgumentException("Clients definition has duplicate id '%s'".formatted(c.id()));
-            if (!c.certificates().isEmpty() && !c.tokens().isEmpty())
-                throw new IllegalArgumentException("Client '%s' has both certificate and token configured".formatted(c.id()));
-            if (c.certificates().isEmpty() && c.tokens().isEmpty())
-                throw new IllegalArgumentException("Client '%s' has neither certificate nor token configured".formatted(c.id()));
-            if (!c.tokens().isEmpty() && reverseProxyCert == null)
-                throw new IllegalArgumentException(
-                        "Client '%s' has token configured but reverse proxy certificate is missing".formatted(c.id()));
+            if (c.certificates().isEmpty())
+                throw new IllegalArgumentException("Client '%s' has no certificate configured".formatted(c.id()));
             ids.add(c.id());
-            EnumSet<Permission> permissions = c.permissions().stream().map(Permission::of)
-                    .collect(Collectors.toCollection(() -> EnumSet.noneOf(Permission.class)));
-            if (!c.certificates().isEmpty()) {
-                List<X509Certificate> certs;
-                try {
-                    certs = c.certificates().stream()
-                            .flatMap(pem -> X509CertificateUtils.certificateListFromPem(pem).stream()).toList();
-                } catch (Exception e) {
-                    throw new IllegalArgumentException(
-                            "Client '%s' contains invalid X.509 certificate PEM: %s".formatted(c.id(), e.toString()), e);
-                }
-                if (certs.isEmpty()) throw new IllegalArgumentException(
-                        "Client '%s' certificate PEM contains no valid X.509 entries".formatted(c.id()));
-                clients.add(new Client(c.id(), permissions, certs, Map.of()));
-                hasClientRequiringCertificate = true;
-            } else {
-                var tokens = new HashMap<TokenCheckHash, TokenVersion>();
-                for (var token : c.tokens()) {
-                    for (int version = 0; version < token.checkAccessHashes().size(); version++) {
-                        var tokenVersion = TokenVersion.of(
-                                token.id(), token.fingerprints().get(version), token.checkAccessHashes().get(version),
-                                token.expirations().get(version));
-                        tokens.put(tokenVersion.accessHash(), tokenVersion);
-                    }
-                }
-                // Add reverse proxy certificate as required certificate for client definition
-                clients.add(new Client(c.id(), permissions, List.of(reverseProxyCert), tokens));
+            List<X509Certificate> certs;
+            try {
+                certs = c.certificates().stream()
+                        .flatMap(pem -> X509CertificateUtils.certificateListFromPem(pem).stream()).toList();
+            } catch (Exception e) {
+                throw new IllegalArgumentException(
+                        "Client '%s' contains invalid X.509 certificate PEM: %s".formatted(c.id(), e.toString()), e);
             }
+            if (certs.isEmpty()) throw new IllegalArgumentException(
+                    "Client '%s' certificate PEM contains no valid X.509 entries".formatted(c.id()));
+            clients.add(new Client(c.id(), Permission.setOf(c.permissions()), certs));
         }
-        if (!hasClientRequiringCertificate)
-            throw new IllegalArgumentException("At least one client must require a certificate");
         log.fine(() -> "Configured clients with ids %s".formatted(ids));
         return clients;
     }
 
     @Override
     protected Optional<ErrorResponse> filter(DiscFilterRequest req) {
-        var now = clock.instant();
         var certs = req.getClientCertificateChain();
         log.fine(() -> "Certificate chain contains %d elements".formatted(certs.size()));
         if (certs.isEmpty()) {
@@ -143,109 +85,28 @@ public class CloudDataPlaneFilter extends JsonSecurityRequestFilterBase {
         }
         if (legacyMode) {
             log.fine("Legacy mode validation complete");
-            req.setUserPrincipal(new ClientPrincipal(Set.of(), Set.of(READ, WRITE)));
+            ClientPrincipal.attachToRequest(req, Set.of(), Set.of(READ, WRITE));
             return Optional.empty();
         }
-        RequestView view = req.asRequestView();
-        var permission = Optional.ofNullable((RequestHandlerSpec) req.getAttribute(RequestHandlerSpec.ATTRIBUTE_NAME))
-                .or(() -> Optional.of(RequestHandlerSpec.DEFAULT_INSTANCE))
-                .flatMap(spec -> {
-                    var action = spec.aclMapping().get(view);
-                    var maybePermission = Permission.of(action);
-                    if (maybePermission.isEmpty()) log.fine(() -> "Unknown action '%s'".formatted(action));
-                    return maybePermission;
-                 }).orElse(null);
-        if (permission == null) {
-            log.fine(() -> "No valid permission mapping defined for %s @ '%s'".formatted(view.method(), view.uri()));
-            return Optional.of(new ErrorResponse(Response.Status.FORBIDDEN, "Forbidden"));
-        }
+        var permission = Permission.getRequiredPermission(req).orElse(null);
+        if (permission == null) return Optional.of(new ErrorResponse(Response.Status.FORBIDDEN, "Forbidden"));
         var clientCert = certs.get(0);
-        var requestTokenHash = requestTokenHash(req).orElse(null);
         var clientIds = new TreeSet<String>();
         var permissions = new TreeSet<Permission>();
-        var matchedTokens = new HashSet<TokenVersion>();
         for (Client c : allowedClients) {
             if (!c.permissions().contains(permission)) continue;
             if (!c.certificates().contains(clientCert)) continue;
-            if (!c.tokens().isEmpty()) {
-                if (requestTokenHash == null) continue;
-                var matchedToken  = c.tokens().get(requestTokenHash);
-                if (matchedToken == null) continue;
-                var expiration = matchedToken.expiration().orElse(null);
-                if (expiration != null && now.isAfter(expiration)) continue;
-                matchedTokens.add(matchedToken);
-            }
             clientIds.add(c.id());
             permissions.addAll(c.permissions());
         }
-        if (matchedTokens.size() > 1) {
-            log.warning("Multiple tokens matched for request %s"
-                                .formatted(matchedTokens.stream().map(TokenVersion::id).toList()));
-            return Optional.of(new ErrorResponse(Response.Status.FORBIDDEN, "Forbidden"));
-        }
-        var matchedToken = matchedTokens.stream().findAny().orElse(null);
-        if (matchedToken != null) {
-            addAccessLogEntry(req, "token.id", matchedToken.id());
-            addAccessLogEntry(req, "token.hash", matchedToken.fingerprint().toDelimitedHexString());
-            addAccessLogEntry(req, "token.exp", matchedToken.expiration().map(Instant::toString).orElse("<none>"));
-        }
-        log.fine(() -> "Client with ids=%s, permissions=%s"
-                .formatted(clientIds, permissions.stream().map(Permission::asString).toList()));
         if (clientIds.isEmpty()) return Optional.of(new ErrorResponse(Response.Status.FORBIDDEN, "Forbidden"));
-        req.setUserPrincipal(new ClientPrincipal(clientIds, permissions));
+        ClientPrincipal.attachToRequest(req, clientIds, permissions);
         return Optional.empty();
     }
 
-    private Optional<TokenCheckHash> requestTokenHash(DiscFilterRequest req) {
-        return Optional.ofNullable(req.getHeader("Authorization"))
-                .filter(h -> h.startsWith("Bearer "))
-                .map(t -> t.substring("Bearer ".length()).trim())
-                .map(t -> TokenCheckHash.of(Token.of(tokenDomain, t), CHECK_HASH_BYTES));
-    }
-
-    private static void addAccessLogEntry(DiscFilterRequest req, String key, String value) {
-        ((AccessLogEntry) req.getAttribute(CONTEXT_KEY_ACCESS_LOG_ENTRY)).addKeyValue(key, value);
-    }
-
-    public record ClientPrincipal(Set<String> ids, Set<Permission> permissions) implements Principal {
-        public ClientPrincipal { ids = Set.copyOf(ids); permissions = Set.copyOf(permissions); }
-        @Override public String getName() {
-            return "ids=%s,permissions=%s".formatted(ids, permissions.stream().map(Permission::asString).toList());
-        }
-    }
-
-    enum Permission { READ, WRITE;
-        String asString() {
-            return switch (this) {
-                case READ -> "read";
-                case WRITE -> "write";
-            };
-        }
-        static Permission of(String v) {
-            return switch (v) {
-                case "read" -> READ;
-                case "write" -> WRITE;
-                default -> throw new IllegalArgumentException("Invalid permission '%s'".formatted(v));
-            };
-        }
-        static Optional<Permission> of(AclMapping.Action a) {
-            if (a.equals(AclMapping.Action.READ)) return Optional.of(READ);
-            if (a.equals(AclMapping.Action.WRITE)) return Optional.of(WRITE);
-            return Optional.empty();
-        }
-    }
-
-    private record TokenVersion(String id, TokenFingerprint fingerprint, TokenCheckHash accessHash, Optional<Instant> expiration) {
-        static TokenVersion of(String id, String fingerprint, String accessHash, String expiration) {
-            return new TokenVersion(id, TokenFingerprint.ofHex(fingerprint), TokenCheckHash.ofHex(accessHash),
-                                    expiration.equals("<none>") ? Optional.empty() : Optional.of(Instant.parse(expiration)));
-        }
-    }
-
-    private record Client(String id, EnumSet<Permission> permissions, List<X509Certificate> certificates,
-                          Map<TokenCheckHash, TokenVersion> tokens) {
+    private record Client(String id, EnumSet<Permission> permissions, List<X509Certificate> certificates) {
         Client {
-            permissions = EnumSet.copyOf(permissions); certificates = List.copyOf(certificates); tokens = Map.copyOf(tokens);
+            permissions = EnumSet.copyOf(permissions); certificates = List.copyOf(certificates);
         }
     }
 }
diff --git a/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/CloudTokenDataPlaneFilter.java b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/CloudTokenDataPlaneFilter.java
new file mode 100644
index 00000000000..6597f10198d
--- /dev/null
+++ b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/CloudTokenDataPlaneFilter.java
@@ -0,0 +1,146 @@
+// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+package com.yahoo.jdisc.http.filter.security.cloud;
+
+import com.yahoo.component.annotation.Inject;
+import com.yahoo.container.logging.AccessLogEntry;
+import com.yahoo.jdisc.Response;
+import com.yahoo.jdisc.http.filter.DiscFilterRequest;
+import com.yahoo.jdisc.http.filter.security.base.JsonSecurityRequestFilterBase;
+import com.yahoo.jdisc.http.filter.security.cloud.config.CloudTokenDataPlaneFilterConfig;
+import com.yahoo.security.token.Token;
+import com.yahoo.security.token.TokenCheckHash;
+import com.yahoo.security.token.TokenDomain;
+import com.yahoo.security.token.TokenFingerprint;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.EnumSet;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.TreeSet;
+import java.util.logging.Logger;
+
+import static com.yahoo.jdisc.http.server.jetty.AccessLoggingRequestHandler.CONTEXT_KEY_ACCESS_LOG_ENTRY;
+
+/**
+ * Token data plane filter for Cloud
+ *
+ * @author bjorncs
+ */
+public class CloudTokenDataPlaneFilter extends JsonSecurityRequestFilterBase {
+
+    private static final Logger log = Logger.getLogger(CloudTokenDataPlaneFilter.class.getName());
+    static final int CHECK_HASH_BYTES = 32;
+
+    private final List<Client> allowedClients;
+    private final TokenDomain tokenDomain;
+    private final Clock clock;
+
+    @Inject
+    public CloudTokenDataPlaneFilter(CloudTokenDataPlaneFilterConfig cfg) {
+        this(cfg, Clock.systemUTC());
+    }
+
+    CloudTokenDataPlaneFilter(CloudTokenDataPlaneFilterConfig cfg, Clock clock) {
+        this.tokenDomain = TokenDomain.of(cfg.tokenContext());
+        this.clock = clock;
+        this.allowedClients = parseClients(cfg);
+    }
+
+    private static List<Client> parseClients(CloudTokenDataPlaneFilterConfig cfg) {
+        Set<String> ids = new HashSet<>();
+        List<Client> clients = new ArrayList<>(cfg.clients().size());
+        if (cfg.clients().isEmpty()) throw new IllegalArgumentException("Empty clients configuration");
+        for (var c : cfg.clients()) {
+            if (ids.contains(c.id()))
+                throw new IllegalArgumentException("Clients definition has duplicate id '%s'".formatted(c.id()));
+            if (c.tokens().isEmpty())
+                throw new IllegalArgumentException("Client '%s' has no tokens configured".formatted(c.id()));
+            ids.add(c.id());
+            var tokens = new HashMap<TokenCheckHash, TokenVersion>();
+            for (var token : c.tokens()) {
+                for (int version = 0; version < token.checkAccessHashes().size(); version++) {
+                    var tokenVersion = TokenVersion.of(
+                            token.id(), token.fingerprints().get(version), token.checkAccessHashes().get(version),
+                            token.expirations().get(version));
+                    tokens.put(tokenVersion.accessHash(), tokenVersion);
+                }
+            }
+            clients.add(new Client(c.id(), Permission.setOf(c.permissions()), tokens));
+        }
+        log.fine(() -> "Configured clients with ids %s".formatted(ids));
+        return List.copyOf(clients);
+    }
+
+    @Override
+    protected Optional<ErrorResponse> filter(DiscFilterRequest req) {
+        var now = clock.instant();
+        var bearerToken = requestBearerToken(req).orElse(null);
+        if (bearerToken == null) {
+            log.fine("Missing bearer token");
+            return Optional.of(new ErrorResponse(Response.Status.UNAUTHORIZED, "Unauthorized"));
+        }
+        var permission = Permission.getRequiredPermission(req).orElse(null);
+        if (permission == null) return Optional.of(new ErrorResponse(Response.Status.FORBIDDEN, "Forbidden"));
+        var requestTokenHash = requestTokenHash(bearerToken);
+        var clientIds = new TreeSet<String>();
+        var permissions = EnumSet.noneOf(Permission.class);
+        var matchedTokens = new HashSet<TokenVersion>();
+        for (Client c : allowedClients) {
+            if (!c.permissions().contains(permission)) continue;
+            var matchedToken  = c.tokens().get(requestTokenHash);
+            if (matchedToken == null) continue;
+            var expiration = matchedToken.expiration().orElse(null);
+            if (expiration != null && now.isAfter(expiration)) continue;
+            matchedTokens.add(matchedToken);
+            clientIds.add(c.id());
+            permissions.addAll(c.permissions());
+        }
+        if (clientIds.isEmpty()) return Optional.of(new ErrorResponse(Response.Status.FORBIDDEN, "Forbidden"));
+        if (matchedTokens.size() > 1) {
+            log.warning("Multiple tokens matched for request %s"
+                                .formatted(matchedTokens.stream().map(TokenVersion::id).toList()));
+            return Optional.of(new ErrorResponse(Response.Status.FORBIDDEN, "Forbidden"));
+        }
+        var matchedToken = matchedTokens.stream().findAny().get();
+        addAccessLogEntry(req, "token.id", matchedToken.id());
+        addAccessLogEntry(req, "token.hash", matchedToken.fingerprint().toDelimitedHexString());
+        addAccessLogEntry(req, "token.exp", matchedToken.expiration().map(Instant::toString).orElse("<none>"));
+        ClientPrincipal.attachToRequest(req, clientIds, permissions);
+        return Optional.empty();
+    }
+
+    private TokenCheckHash requestTokenHash(String bearerToken) {
+        return TokenCheckHash.of(Token.of(tokenDomain, bearerToken), CHECK_HASH_BYTES);
+    }
+
+    private static Optional<String> requestBearerToken(DiscFilterRequest req) {
+        return Optional.ofNullable(req.getHeader("Authorization"))
+                .filter(h -> h.startsWith("Bearer "))
+                .map(t -> t.substring("Bearer ".length()).trim())
+                .filter(t -> !t.isBlank());
+
+    }
+
+    private static void addAccessLogEntry(DiscFilterRequest req, String key, String value) {
+        ((AccessLogEntry) req.getAttribute(CONTEXT_KEY_ACCESS_LOG_ENTRY)).addKeyValue(key, value);
+    }
+
+    private record TokenVersion(String id, TokenFingerprint fingerprint, TokenCheckHash accessHash, Optional<Instant> expiration) {
+        static TokenVersion of(String id, String fingerprint, String accessHash, String expiration) {
+            return new TokenVersion(id, TokenFingerprint.ofHex(fingerprint), TokenCheckHash.ofHex(accessHash),
+                                    expiration.equals("<none>") ? Optional.empty() : Optional.of(Instant.parse(expiration)));
+        }
+    }
+
+    private record Client(String id, EnumSet<Permission> permissions, Map<TokenCheckHash, TokenVersion> tokens) {
+        Client {
+            permissions = EnumSet.copyOf(permissions); tokens = Map.copyOf(tokens);
+        }
+    }
+}
diff --git a/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/Permission.java b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/Permission.java
new file mode 100644
index 00000000000..4bab83f8576
--- /dev/null
+++ b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/Permission.java
@@ -0,0 +1,63 @@
+// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+
+package com.yahoo.jdisc.http.filter.security.cloud;
+
+import com.yahoo.container.jdisc.AclMapping;
+import com.yahoo.container.jdisc.RequestHandlerSpec;
+import com.yahoo.container.jdisc.RequestView;
+import com.yahoo.jdisc.http.filter.DiscFilterRequest;
+
+import java.util.Collection;
+import java.util.EnumSet;
+import java.util.Optional;
+import java.util.logging.Logger;
+import java.util.stream.Collectors;
+
+/**
+ * @author bjorncs
+ */
+enum Permission {
+    READ, WRITE;
+
+    private static final Logger log = Logger.getLogger(Permission.class.getName());
+
+    String asString() {
+        return switch (this) {
+            case READ -> "read";
+            case WRITE -> "write";
+        };
+    }
+
+    static Permission of(String v) {
+        return switch (v) {
+            case "read" -> READ;
+            case "write" -> WRITE;
+            default -> throw new IllegalArgumentException("Invalid permission '%s'".formatted(v));
+        };
+    }
+
+    static EnumSet<Permission> setOf(Collection<String> v) {
+        return v.stream().map(Permission::of).collect(Collectors.toCollection(() -> EnumSet.noneOf(Permission.class)));
+    }
+
+    static Optional<Permission> getRequiredPermission(DiscFilterRequest req) {
+        RequestView view = req.asRequestView();
+        var result = Optional.ofNullable((RequestHandlerSpec) req.getAttribute(RequestHandlerSpec.ATTRIBUTE_NAME))
+                .or(() -> Optional.of(RequestHandlerSpec.DEFAULT_INSTANCE))
+                .flatMap(spec -> {
+                    var action = spec.aclMapping().get(view);
+                    var maybePermission = Permission.of(action);
+                    if (maybePermission.isEmpty()) log.fine(() -> "Unknown action '%s'".formatted(action));
+                    return maybePermission;
+                });
+        if (result.isEmpty())
+            log.fine(() -> "No valid permission mapping defined for %s @ '%s'".formatted(view.method(), view.uri()));
+        return result;
+    }
+
+    static Optional<Permission> of(AclMapping.Action a) {
+        if (a.equals(AclMapping.Action.READ)) return Optional.of(READ);
+        if (a.equals(AclMapping.Action.WRITE)) return Optional.of(WRITE);
+        return Optional.empty();
+    }
+}
diff --git a/jdisc-security-filters/src/test/java/com/yahoo/jdisc/http/filter/security/cloud/CloudDataPlaneFilterTest.java b/jdisc-security-filters/src/test/java/com/yahoo/jdisc/http/filter/security/cloud/CloudDataPlaneFilterTest.java
index d9daf8b6f46..8d2fd1f569e 100644
--- a/jdisc-security-filters/src/test/java/com/yahoo/jdisc/http/filter/security/cloud/CloudDataPlaneFilterTest.java
+++ b/jdisc-security-filters/src/test/java/com/yahoo/jdisc/http/filter/security/cloud/CloudDataPlaneFilterTest.java
@@ -5,35 +5,24 @@ import com.yahoo.container.jdisc.AclMapping.Action;
 import com.yahoo.container.jdisc.HttpMethodAclMapping;
 import com.yahoo.container.jdisc.RequestHandlerSpec;
 import com.yahoo.container.jdisc.RequestHandlerTestDriver.MockResponseHandler;
-import com.yahoo.container.logging.AccessLogEntry;
 import com.yahoo.jdisc.http.HttpRequest.Method;
-import com.yahoo.jdisc.http.filter.security.cloud.CloudDataPlaneFilter.ClientPrincipal;
 import com.yahoo.jdisc.http.filter.security.cloud.config.CloudDataPlaneFilterConfig;
 import com.yahoo.jdisc.http.filter.util.FilterTestUtils;
 import com.yahoo.security.KeyUtils;
 import com.yahoo.security.X509CertificateBuilder;
 import com.yahoo.security.X509CertificateUtils;
-import com.yahoo.security.token.Token;
-import com.yahoo.security.token.TokenCheckHash;
-import com.yahoo.security.token.TokenDomain;
-import com.yahoo.security.token.TokenGenerator;
-import com.yahoo.test.ManualClock;
-import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 import javax.security.auth.x500.X500Principal;
 import java.math.BigInteger;
 import java.security.cert.X509Certificate;
-import java.time.Duration;
-import java.time.Instant;
 import java.util.List;
 import java.util.Set;
 
 import static com.yahoo.jdisc.Response.Status.FORBIDDEN;
 import static com.yahoo.jdisc.Response.Status.UNAUTHORIZED;
-import static com.yahoo.jdisc.http.filter.security.cloud.CloudDataPlaneFilter.CHECK_HASH_BYTES;
-import static com.yahoo.jdisc.http.filter.security.cloud.CloudDataPlaneFilter.Permission.READ;
-import static com.yahoo.jdisc.http.filter.security.cloud.CloudDataPlaneFilter.Permission.WRITE;
+import static com.yahoo.jdisc.http.filter.security.cloud.Permission.READ;
+import static com.yahoo.jdisc.http.filter.security.cloud.Permission.WRITE;
 import static com.yahoo.security.KeyAlgorithm.EC;
 import static com.yahoo.security.SignatureAlgorithm.SHA256_WITH_ECDSA;
 import static java.time.Instant.EPOCH;
@@ -50,21 +39,8 @@ class CloudDataPlaneFilterTest {
     private static final X509Certificate FEED_CERT = certificate("my-feed-client");
     private static final X509Certificate SEARCH_CERT = certificate("my-search-client");
     private static final X509Certificate LEGACY_CLIENT_CERT = certificate("my-legacy-client");
-    private static final X509Certificate REVERSE_PROXY_CERT = certificate("nginx");
     private static final String FEED_CLIENT_ID = "feed-client";
     private static final String MTLS_SEARCH_CLIENT_ID = "mtls-search-client";
-    private static final String TOKEN_SEARCH_CLIENT = "token-search-client";
-    private static final String TOKEN_CONTEXT = "my-token-context";
-    private static final String TOKEN_ID = "my-token-id";
-    private static final Instant TOKEN_EXPIRATION = EPOCH.plus(Duration.ofDays(1));
-    private static final Token VALID_TOKEN =
-            TokenGenerator.generateToken(TokenDomain.of(TOKEN_CONTEXT), "vespa_token_", CHECK_HASH_BYTES);
-    private static final Token UNKNOWN_TOKEN =
-            TokenGenerator.generateToken(TokenDomain.of(TOKEN_CONTEXT), "vespa_token_", CHECK_HASH_BYTES);
-
-    private ManualClock clock;
-
-    @BeforeEach void resetClock() { clock = new ManualClock(EPOCH); }
 
     @Test
     void accepts_any_trusted_client_certificate_in_legacy_mode() {
@@ -144,137 +120,13 @@ class CloudDataPlaneFilterTest {
         assertEquals(FORBIDDEN, responseHandler.getResponse().getStatus());
     }
 
-    @Test
-    void accepts_reverse_proxy_with_token() {
-        var entry = new AccessLogEntry();
-        var req = FilterTestUtils.newRequestBuilder()
-                .withMethod(Method.GET)
-                .withAccessLogEntry(entry)
-                .withClientCertificate(REVERSE_PROXY_CERT)
-                .withHeader("Authorization", "Bearer " + VALID_TOKEN.secretTokenString())
-                .build();
-        var responseHandler = new MockResponseHandler();
-        newFilterWithClientsConfig().filter(req, responseHandler);
-        assertNull(responseHandler.getResponse());
-        assertEquals(new ClientPrincipal(Set.of(TOKEN_SEARCH_CLIENT), Set.of(READ)), req.getUserPrincipal());
-        assertEquals(TOKEN_ID, entry.getKeyValues().get("token.id").get(0));
-        assertEquals(VALID_TOKEN.fingerprint().toDelimitedHexString(), entry.getKeyValues().get("token.hash").get(0));
-        assertEquals(TOKEN_EXPIRATION.toString(), entry.getKeyValues().get("token.exp").get(0));
-    }
-
-    @Test
-    void fails_for_reverse_proxy_with_token_wrong_permission() {
-        var req = FilterTestUtils.newRequestBuilder()
-                .withMethod(Method.POST)
-                .withClientCertificate(REVERSE_PROXY_CERT)
-                .withHeader("Authorization", "Bearer " + VALID_TOKEN.secretTokenString())
-                .build();
-        var responseHandler = new MockResponseHandler();
-        newFilterWithClientsConfig().filter(req, responseHandler);
-        assertNotNull(responseHandler.getResponse());
-        assertEquals(FORBIDDEN, responseHandler.getResponse().getStatus());
-    }
-
-    @Test
-    void fails_for_reverse_proxy_without_token() {
-        var req = FilterTestUtils.newRequestBuilder()
-                .withMethod(Method.GET)
-                .withClientCertificate(REVERSE_PROXY_CERT)
-                .build();
-        var responseHandler = new MockResponseHandler();
-        newFilterWithClientsConfig().filter(req, responseHandler);
-        assertNotNull(responseHandler.getResponse());
-        assertEquals(FORBIDDEN, responseHandler.getResponse().getStatus());
-    }
-
-    @Test
-    void fails_for_reverse_proxy_with_unknown_token() {
-        var req = FilterTestUtils.newRequestBuilder()
-                .withMethod(Method.GET)
-                .withClientCertificate(REVERSE_PROXY_CERT)
-                .withHeader("Authorization", "Bearer " + UNKNOWN_TOKEN.secretTokenString())
-                .build();
-        var responseHandler = new MockResponseHandler();
-        newFilterWithClientsConfig().filter(req, responseHandler);
-        assertNotNull(responseHandler.getResponse());
-        assertEquals(FORBIDDEN, responseHandler.getResponse().getStatus());
-    }
-
-    @Test
-    void fails_for_missing_certificate_with_token() {
-        var req = FilterTestUtils.newRequestBuilder()
-                .withMethod(Method.GET)
-                .withHeader("Authorization", "Bearer " + VALID_TOKEN.secretTokenString())
-                .build();
-        var responseHandler = new MockResponseHandler();
-        newFilterWithClientsConfig().filter(req, responseHandler);
-        assertNotNull(responseHandler.getResponse());
-        assertEquals(UNAUTHORIZED, responseHandler.getResponse().getStatus());
-    }
-
-    @Test
-    void fails_for_unknown_certificate_with_token() {
-        var req = FilterTestUtils.newRequestBuilder()
-                .withMethod(Method.GET)
-                .withClientCertificate(LEGACY_CLIENT_CERT)
-                .withHeader("Authorization", "Bearer " + VALID_TOKEN.secretTokenString())
-                .build();
-        var responseHandler = new MockResponseHandler();
-        newFilterWithClientsConfig().filter(req, responseHandler);
-        assertNotNull(responseHandler.getResponse());
-        assertEquals(FORBIDDEN, responseHandler.getResponse().getStatus());
-    }
-
-    @Test
-    void certificate_has_precedence_over_token() {
-        var req = FilterTestUtils.newRequestBuilder()
-                .withMethod(Method.POST)
-                .withClientCertificate(FEED_CERT)
-                .withHeader("Authorization", "Bearer " + VALID_TOKEN.secretTokenString())
-                .build();
-        var responseHandler = new MockResponseHandler();
-        newFilterWithClientsConfig().filter(req, responseHandler);
-        assertNull(responseHandler.getResponse());
-        assertEquals(new ClientPrincipal(Set.of(FEED_CLIENT_ID), Set.of(WRITE)), req.getUserPrincipal());
-    }
-
-    @Test
-    void fails_for_expired_token() {
-        var entry = new AccessLogEntry();
-        var req = FilterTestUtils.newRequestBuilder()
-                .withMethod(Method.GET)
-                .withAccessLogEntry(entry)
-                .withClientCertificate(REVERSE_PROXY_CERT)
-                .withHeader("Authorization", "Bearer " + VALID_TOKEN.secretTokenString())
-                .build();
-        var filter = newFilterWithClientsConfig();
-
-        var responseHandler = new MockResponseHandler();
-        filter.filter(req, responseHandler);
-        assertNull(responseHandler.getResponse());
-
-        clock.advance(Duration.ofDays(1));
-        responseHandler = new MockResponseHandler();
-        filter.filter(req, responseHandler);
-        assertNull(responseHandler.getResponse());
-
-        clock.advance(Duration.ofMillis(1));
-        responseHandler = new MockResponseHandler();
-        filter.filter(req, responseHandler);
-        assertNotNull(responseHandler.getResponse());
-        assertEquals(FORBIDDEN, responseHandler.getResponse().getStatus());
-    }
-
     private CloudDataPlaneFilter newFilterWithLegacyMode() {
-        return new CloudDataPlaneFilter(
-                new CloudDataPlaneFilterConfig.Builder()
-                        .legacyMode(true).build(), (X509Certificate) null, clock);
+        return new CloudDataPlaneFilter(new CloudDataPlaneFilterConfig.Builder().legacyMode(true).build());
     }
 
     private CloudDataPlaneFilter newFilterWithClientsConfig() {
         return new CloudDataPlaneFilter(
                 new CloudDataPlaneFilterConfig.Builder()
-                        .tokenContext(TOKEN_CONTEXT)
                         .clients(List.of(
                                 new CloudDataPlaneFilterConfig.Clients.Builder()
                                         .certificates(X509CertificateUtils.toPem(FEED_CERT))
@@ -283,18 +135,8 @@ class CloudDataPlaneFilterTest {
                                 new CloudDataPlaneFilterConfig.Clients.Builder()
                                         .certificates(X509CertificateUtils.toPem(SEARCH_CERT))
                                         .permissions(READ.asString())
-                                        .id(MTLS_SEARCH_CLIENT_ID),
-                                new CloudDataPlaneFilterConfig.Clients.Builder()
-                                        .tokens(new CloudDataPlaneFilterConfig.Clients.Tokens.Builder()
-                                                        .id(TOKEN_ID)
-                                                        .checkAccessHashes(TokenCheckHash.of(VALID_TOKEN, 32).toHexString())
-                                                        .fingerprints(VALID_TOKEN.fingerprint().toDelimitedHexString())
-                                                        .expirations(TOKEN_EXPIRATION.toString()))
-                                        .permissions(READ.asString())
-                                        .id(TOKEN_SEARCH_CLIENT)))
-                        .build(),
-                REVERSE_PROXY_CERT,
-                clock);
+                                        .id(MTLS_SEARCH_CLIENT_ID)))
+                        .build());
     }
 
     private static X509Certificate certificate(String name) {
diff --git a/jdisc-security-filters/src/test/java/com/yahoo/jdisc/http/filter/security/cloud/CloudTokenDataPlaneFilterTest.java b/jdisc-security-filters/src/test/java/com/yahoo/jdisc/http/filter/security/cloud/CloudTokenDataPlaneFilterTest.java
new file mode 100644
index 00000000000..a34d2eb67c3
--- /dev/null
+++ b/jdisc-security-filters/src/test/java/com/yahoo/jdisc/http/filter/security/cloud/CloudTokenDataPlaneFilterTest.java
@@ -0,0 +1,194 @@
+// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+package com.yahoo.jdisc.http.filter.security.cloud;
+
+import com.yahoo.container.jdisc.AclMapping.Action;
+import com.yahoo.container.jdisc.HttpMethodAclMapping;
+import com.yahoo.container.jdisc.RequestHandlerSpec;
+import com.yahoo.container.jdisc.RequestHandlerTestDriver.MockResponseHandler;
+import com.yahoo.container.logging.AccessLogEntry;
+import com.yahoo.jdisc.http.HttpRequest.Method;
+import com.yahoo.jdisc.http.filter.security.cloud.config.CloudTokenDataPlaneFilterConfig;
+import com.yahoo.jdisc.http.filter.util.FilterTestUtils;
+import com.yahoo.security.token.Token;
+import com.yahoo.security.token.TokenCheckHash;
+import com.yahoo.security.token.TokenDomain;
+import com.yahoo.security.token.TokenGenerator;
+import com.yahoo.test.ManualClock;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.util.List;
+import java.util.Set;
+
+import static com.yahoo.jdisc.Response.Status.FORBIDDEN;
+import static com.yahoo.jdisc.Response.Status.UNAUTHORIZED;
+import static com.yahoo.jdisc.http.filter.security.cloud.CloudTokenDataPlaneFilter.CHECK_HASH_BYTES;
+import static com.yahoo.jdisc.http.filter.security.cloud.Permission.READ;
+import static com.yahoo.jdisc.http.filter.security.cloud.Permission.WRITE;
+import static java.time.Instant.EPOCH;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * @author bjorncs
+ */
+class CloudTokenDataPlaneFilterTest {
+
+    private static final String TOKEN_SEARCH_CLIENT = "token-search-client";
+    private static final String TOKEN_FEED_CLIENT = "token-feed-client";
+    private static final String TOKEN_CONTEXT = "my-token-context";
+    private static final String READ_TOKEN_ID = "my-read-token-id";
+    private static final String WRITE_TOKEN_ID = "my-write-token-id";
+    private static final Instant TOKEN_EXPIRATION = EPOCH.plus(Duration.ofDays(1));
+    private static final Token READ_TOKEN =
+            TokenGenerator.generateToken(TokenDomain.of(TOKEN_CONTEXT), "vespa_token_", CHECK_HASH_BYTES);
+    private static final Token WRITE_TOKEN =
+            TokenGenerator.generateToken(TokenDomain.of(TOKEN_CONTEXT), "vespa_token_", CHECK_HASH_BYTES);
+    private static final Token UNKNOWN_TOKEN =
+            TokenGenerator.generateToken(TokenDomain.of(TOKEN_CONTEXT), "vespa_token_", CHECK_HASH_BYTES);
+    private ManualClock clock;
+
+    @BeforeEach void resetClock() { clock = new ManualClock(EPOCH); }
+
+    @Test
+    void supports_handler_with_custom_request_spec() {
+        // Spec that maps POST as action 'read'
+        var spec = RequestHandlerSpec.builder()
+                .withAclMapping(HttpMethodAclMapping.standard()
+                                        .override(Method.POST, Action.READ).build())
+                .build();
+        var req = FilterTestUtils.newRequestBuilder()
+                .withMethod(Method.POST)
+                .withHeader("Authorization", "Bearer " + READ_TOKEN.secretTokenString())
+                .withAttribute(RequestHandlerSpec.ATTRIBUTE_NAME, spec)
+                .build();
+        var responseHandler = new MockResponseHandler();
+        newFilterWithClientsConfig().filter(req, responseHandler);
+        assertNull(responseHandler.getResponse());
+        assertEquals(new ClientPrincipal(Set.of(TOKEN_SEARCH_CLIENT), Set.of(READ)), req.getUserPrincipal());
+    }
+
+    @Test
+    void fails_on_handler_with_custom_request_spec_with_invalid_action() {
+        var spec = RequestHandlerSpec.builder()
+                .withAclMapping(HttpMethodAclMapping.standard()
+                                        .override(Method.GET, Action.custom("custom")).build())
+                .build();
+        var req = FilterTestUtils.newRequestBuilder()
+                .withMethod(Method.GET)
+                .withHeader("Authorization", "Bearer " + READ_TOKEN.secretTokenString())
+                .withAttribute(RequestHandlerSpec.ATTRIBUTE_NAME, spec)
+                .build();
+        var responseHandler = new MockResponseHandler();
+        newFilterWithClientsConfig().filter(req, responseHandler);
+        assertNotNull(responseHandler.getResponse());
+        assertEquals(FORBIDDEN, responseHandler.getResponse().getStatus());
+    }
+
+    @Test
+    void accepts_valid_token() {
+        var entry = new AccessLogEntry();
+        var req = FilterTestUtils.newRequestBuilder()
+                .withMethod(Method.GET)
+                .withAccessLogEntry(entry)
+                .withHeader("Authorization", "Bearer " + READ_TOKEN.secretTokenString())
+                .build();
+        var responseHandler = new MockResponseHandler();
+        newFilterWithClientsConfig().filter(req, responseHandler);
+        assertNull(responseHandler.getResponse());
+        assertEquals(new ClientPrincipal(Set.of(TOKEN_SEARCH_CLIENT), Set.of(READ)), req.getUserPrincipal());
+        assertEquals(READ_TOKEN_ID, entry.getKeyValues().get("token.id").get(0));
+        assertEquals(READ_TOKEN.fingerprint().toDelimitedHexString(), entry.getKeyValues().get("token.hash").get(0));
+        assertEquals(TOKEN_EXPIRATION.toString(), entry.getKeyValues().get("token.exp").get(0));
+    }
+
+    @Test
+    void fails_for_token_with_invalid_permission() {
+        var req = FilterTestUtils.newRequestBuilder()
+                .withMethod(Method.GET)
+                .withHeader("Authorization", "Bearer " + WRITE_TOKEN.secretTokenString())
+                .build();
+        var responseHandler = new MockResponseHandler();
+        newFilterWithClientsConfig().filter(req, responseHandler);
+        assertNotNull(responseHandler.getResponse());
+        assertEquals(FORBIDDEN, responseHandler.getResponse().getStatus());
+    }
+
+    @Test
+    void fails_for_missing_token() {
+        var req = FilterTestUtils.newRequestBuilder()
+                .withMethod(Method.GET)
+                .build();
+        var responseHandler = new MockResponseHandler();
+        newFilterWithClientsConfig().filter(req, responseHandler);
+        assertNotNull(responseHandler.getResponse());
+        assertEquals(UNAUTHORIZED, responseHandler.getResponse().getStatus());
+    }
+
+    @Test
+    void fails_for_unknown_token() {
+        var req = FilterTestUtils.newRequestBuilder()
+                .withMethod(Method.GET)
+                .withHeader("Authorization", "Bearer " + UNKNOWN_TOKEN.secretTokenString())
+                .build();
+        var responseHandler = new MockResponseHandler();
+        newFilterWithClientsConfig().filter(req, responseHandler);
+        assertNotNull(responseHandler.getResponse());
+        assertEquals(FORBIDDEN, responseHandler.getResponse().getStatus());
+    }
+
+    @Test
+    void fails_for_expired_token() {
+        var entry = new AccessLogEntry();
+        var req = FilterTestUtils.newRequestBuilder()
+                .withMethod(Method.GET)
+                .withAccessLogEntry(entry)
+                .withHeader("Authorization", "Bearer " + READ_TOKEN.secretTokenString())
+                .build();
+        var filter = newFilterWithClientsConfig();
+
+        var responseHandler = new MockResponseHandler();
+        filter.filter(req, responseHandler);
+        assertNull(responseHandler.getResponse());
+
+        clock.advance(Duration.ofDays(1));
+        responseHandler = new MockResponseHandler();
+        filter.filter(req, responseHandler);
+        assertNull(responseHandler.getResponse());
+
+        clock.advance(Duration.ofMillis(1));
+        responseHandler = new MockResponseHandler();
+        filter.filter(req, responseHandler);
+        assertNotNull(responseHandler.getResponse());
+        assertEquals(FORBIDDEN, responseHandler.getResponse().getStatus());
+    }
+
+    private CloudTokenDataPlaneFilter newFilterWithClientsConfig() {
+        return new CloudTokenDataPlaneFilter(
+                new CloudTokenDataPlaneFilterConfig.Builder()
+                        .tokenContext(TOKEN_CONTEXT)
+                        .clients(List.of(
+                                new CloudTokenDataPlaneFilterConfig.Clients.Builder()
+                                        .tokens(new CloudTokenDataPlaneFilterConfig.Clients.Tokens.Builder()
+                                                        .id(READ_TOKEN_ID)
+                                                        .checkAccessHashes(TokenCheckHash.of(READ_TOKEN, 32).toHexString())
+                                                        .fingerprints(READ_TOKEN.fingerprint().toDelimitedHexString())
+                                                        .expirations(TOKEN_EXPIRATION.toString()))
+                                        .permissions(READ.asString())
+                                        .id(TOKEN_SEARCH_CLIENT),
+                                new CloudTokenDataPlaneFilterConfig.Clients.Builder()
+                                        .tokens(new CloudTokenDataPlaneFilterConfig.Clients.Tokens.Builder()
+                                                        .id(WRITE_TOKEN_ID)
+                                                        .checkAccessHashes(TokenCheckHash.of(WRITE_TOKEN, 32).toHexString())
+                                                        .fingerprints(WRITE_TOKEN.fingerprint().toDelimitedHexString())
+                                                        .expirations(TOKEN_EXPIRATION.toString()))
+                                        .permissions(WRITE.asString())
+                                        .id(TOKEN_FEED_CLIENT)))
+                        .build(),
+                clock);
+    }
+
+}