Use AuthorizationMode to configure behaviour of PeerAuthorizerTrustManager

2 files changed, 5 insertions, 4 deletions

diff --git a/jrt/src/com/yahoo/jrt/CryptoEngine.java b/jrt/src/com/yahoo/jrt/CryptoEngine.java
index e0f15bf118e..cc59c29bc3b 100644
--- a/jrt/src/com/yahoo/jrt/CryptoEngine.java
+++ b/jrt/src/com/yahoo/jrt/CryptoEngine.java
@@ -2,11 +2,11 @@
 package com.yahoo.jrt;
 
 
+import com.yahoo.security.tls.AuthorizationMode;
 import com.yahoo.security.tls.MixedMode;
 import com.yahoo.security.tls.ReloadingTlsContext;
 import com.yahoo.security.tls.TlsContext;
 import com.yahoo.security.tls.TransportSecurityUtils;
-import com.yahoo.security.tls.authz.PeerAuthorizerTrustManager.Mode;
 
 import java.nio.channels.SocketChannel;
 
@@ -23,7 +23,8 @@ public interface CryptoEngine extends AutoCloseable {
         if (!TransportSecurityUtils.isTransportSecurityEnabled()) {
             return new NullCryptoEngine();
         }
-        TlsContext tlsContext = new ReloadingTlsContext(TransportSecurityUtils.getConfigFile().get(), Mode.DRY_RUN);
+        AuthorizationMode mode = TransportSecurityUtils.getInsecureAuthorizationMode().orElse(AuthorizationMode.ENFORCE);
+        TlsContext tlsContext = new ReloadingTlsContext(TransportSecurityUtils.getConfigFile().get(), mode);
         TlsCryptoEngine tlsCryptoEngine = new TlsCryptoEngine(tlsContext);
         if (!TransportSecurityUtils.isInsecureMixedModeEnabled()) {
             return tlsCryptoEngine;
diff --git a/jrt/tests/com/yahoo/jrt/CryptoUtils.java b/jrt/tests/com/yahoo/jrt/CryptoUtils.java
index b0a8a4b0efb..1c2280567cb 100644
--- a/jrt/tests/com/yahoo/jrt/CryptoUtils.java
+++ b/jrt/tests/com/yahoo/jrt/CryptoUtils.java
@@ -3,9 +3,9 @@ package com.yahoo.jrt;
 
 import com.yahoo.security.KeyUtils;
 import com.yahoo.security.X509CertificateBuilder;
+import com.yahoo.security.tls.AuthorizationMode;
 import com.yahoo.security.tls.DefaultTlsContext;
 import com.yahoo.security.tls.TlsContext;
-import com.yahoo.security.tls.authz.PeerAuthorizerTrustManager.Mode;
 import com.yahoo.security.tls.policy.AuthorizedPeers;
 import com.yahoo.security.tls.policy.HostGlobPattern;
 import com.yahoo.security.tls.policy.PeerPolicy;
@@ -49,7 +49,7 @@ class CryptoUtils {
                                             Field.CN, new HostGlobPattern("dummy"))))));
 
     static TlsContext createTestTlsContext() {
-        return new DefaultTlsContext(singletonList(certificate), keyPair.getPrivate(), singletonList(certificate), authorizedPeers, Mode.ENFORCE);
+        return new DefaultTlsContext(singletonList(certificate), keyPair.getPrivate(), singletonList(certificate), authorizedPeers, AuthorizationMode.ENFORCE);
     }
 
 }