Section: 16.2 Authorization for network slice access
Content: This clause specifies the relationship between primary authentication (as described in Clause 6.1) and authorization for network slice access (as described in TS 23.502[ Procedures for the 5G System (5GS) ]  [8]) for a UE. Authorization from a home/serving PLMN is required for a UE to gain access to a network slice, identified by an S-NSSAI. An authorized S-NSSAI (i.e. allowed S-NSSAI) shall be granted to a UE only after the UE has completed successfully primary authentication. At the end of the primary authentication, the AMF and UE may receive a list of allowed S-NSSAI, which the UE is authorized to access. For certain S-NSSAIs, additional Network Slice Specific Authentication and Authorization (NSSAA) is required. This clause in addition specifies the pre-requisite for an NSSAA procedure that is described in clause 16.3, with reference to the following figure 16.2-1. Figure 16.2-1: Relationship between primary authentication and NSSAA 1. UE sends a Registration Request with a list of S-NSSAIs. UE shall not include those S-NSSAIs for which NSSAA procedures are ongoing, regardless of access types (c.f. TS 23.501[ System architecture for the 5G System (5GS) ] [2], clause 5.15.5.2.1 and TS 23.502[ Procedures for the 5G System (5GS) ] [8], clause 4.2.2.2.2). 2. For an initial Registration Request, the AMF/SEAF shall invoke Primary authentication as described in clause 6.1.2 of the present document. For a subsequent Registration Request, the Primary authentication may be skipped if the UE has already been authenticated and the AMF has valid security context. 3. AMF shall determine whether NSSAA is required for each of S-NSSAIs, based on information stored locally or from UDM. For example, the NSSAA for an S-NSSAI may be omitted 1) if it is not required based on the subscription information, 2) if UE has previously performed NSSAA successfully, regardless of access type and the result is still valid, or 3) NSSAA for UE is ongoing 4. AMF sends the Registration Accept message to the UE (c.f. TS 23.501[ System architecture for the 5G System (5GS) ] [2], clause 5.15.5.2.1 and TS 23.502[ Procedures for the 5G System (5GS) ] [8], clause 4.2.2.2.2, step 21). Optionally UE sends a Registration Complete. 5. The EAP based NSSAA procedure for each S-NSSAI if required, as determined in step 3, is executed in this step. 6. Based on the results of step 5, AMF sends UE Configuration Update to update the requested S-NSSAI status based on the NSSAA results. The procedure for step 5, i.e., the NSSAA procedure is specified in clause 16.3.