RFC 6749

The OAuth 2.0 Authorization Framework
Standards Track
October 2012
RFC Library > OAuth & JOSE > RFC 6749
Abstract: OAuth 2.0 is an authorization framework that enables applications to obtain limited access to resources on behalf of a resource owner. In 3GPP 5G, OAuth 2.0 is used for NF service authorization via the NRF, as specified in TS 33.501 §13.4 and TS 29.510.
Canonical source: https://www.rfc-editor.org/rfc/rfc6749  |  IETF Datatracker

1. Introduction

▶

OAuth 2.0 separates the role of the client from the resource owner, introducing an authorization layer. Instead of using the resource owner's credentials, the client obtains an access token — a string representing specific scope, lifetime, and attributes.

In 5G SBA, OAuth 2.0 is adapted for NF-to-NF authorization. The NRF acts as the Authorization Server, issuing access tokens (JWT format) to consumer NFs for accessing producer NF services.

2. 5G OAuth 2.0 Architecture

▶
3GPP Grant Type: 5G SBA uses the OAuth 2.0 client_credentials grant (§4.4) exclusively. There is no 'resource owner' in the traditional sense — NFs authenticate with their TLS client certificate and request tokens based on NF type and service scope.
  NF Consumer              NRF (AuthZ Server)        NF Producer
(Client)                                          (Resource Server)
|                          |                        |
|  1. AccessToken Request  |                        |
|  (client_credentials     |                        |
|   grant, NF Instance ID, |                        |
|   target NF type/service)|                        |
|------------------------->|                        |
|                          |                        |
|  2. AccessToken Response |                        |
|  (JWT access token)      |                        |
|<-------------------------|                        |
|                          |                        |
|  3. Service Request + Bearer token               |
|-------------------------------------------------->|
|                          |                        |
|                          |  4. Validate JWT       |
|                          |  (verify signature,    |
|                          |   check claims)        |
|                          |                        |
|  5. Service Response                              |
|<--------------------------------------------------|

3. OAuth 2.0 Roles in 5G

▶
OAuth 2.0 Role 5G Mapping Description
Authorization Server NRF Issues access tokens to consumer NFs
Client NF Consumer (e.g., AMF) Requests tokens and accesses services
Resource Server NF Producer (e.g., SMF) Validates tokens and provides services
Resource Owner N/A (operator policy) Authorization is policy-based, not user-consent

4. Token Request (client_credentials)

▶

The NF consumer requests a token from the NRF using the Nnrf_AccessToken service (TS 29.510):

  • grant_type: client_credentials (MUST)
  • nfInstanceId: UUID of the requesting NF
  • nfType: Type of the requesting NF (e.g., AMF, SMF)
  • targetNfType: Type of the target NF to access
  • scope: Requested service operations (e.g., namf-comm, nsmf-pdusession)
  • targetNfInstanceId: Specific NF instance (optional)
  • requesterPlmn: PLMN ID of the requester (for roaming scenarios)

5. Security Considerations

▶
  • Access tokens MUST be transported over TLS 1.3 — never in plaintext
  • Token validation MUST check signature, expiry, issuer, audience, and scope claims
  • Short token lifetimes reduce the window of misuse (TS 33.501 recommends minutes, not hours)
  • Token revocation is not defined in base OAuth 2.0 — 5G relies on short lifetimes and NRF deregistration
  • The NRF MUST authenticate the requesting NF via mutual TLS before issuing tokens