Authorisation endpoint

Description

The Authorisation endpoint is a key component of the SEAL (Service Enabler Architecture Layer) identity management framework, introduced in 3GPP Release 19. SEAL provides common services for vertical applications, and identity management is one of its enablers. The Authorisation endpoint is a protocol endpoint on the SEAL identity management server that allows the SEAL identity management client to request an authorisation grant. This process follows the OAuth 2.0 framework defined in IETF RFC 6749, where the client obtains an access token to access protected resources. The endpoint is responsible for authenticating the client, validating its request, and issuing an authorisation grant (e.g., an authorization code or access token). The SEAL identity management client, typically residing in the UE or application server, uses this endpoint to obtain the necessary credentials to access SEAL services. The endpoint is specified in 3GPP TS 24.482 (Identity management - SEAL) and TS 24.547 (Identity management - Mission Critical Services). The Authorisation endpoint ensures that only authorized clients can access SEAL services, providing a secure and standardized way to manage identities and permissions across different vertical domains. It supports various grant types as defined in RFC 6749, such as authorization code and client credentials, depending on the deployment scenario. The endpoint interacts with other SEAL identity management functions like authentication and token issuance to provide a complete authorization solution.

Purpose & Motivation

The Authorisation endpoint exists to provide a standardized, secure mechanism for SEAL clients to obtain authorization to access SEAL services. Before its introduction, vertical applications had to implement their own authorization mechanisms, leading to interoperability issues and potential security vulnerabilities. By leveraging OAuth 2.0 (RFC 6749), the endpoint ensures a well-understood and widely adopted security model. It solves the problem of fragmented identity management across different vertical industries by providing a common authorization framework within SEAL. This is particularly important for mission-critical services where secure and reliable access control is paramount. The endpoint also simplifies the integration of third-party applications by offering a standard protocol for authorization, reducing development effort and time-to-market. It was motivated by the need for a unified identity management solution in 3GPP that can be reused across various services, such as MCX (Mission Critical Services) and other vertical applications.