Section: 13.4.1.3.1.1 With mutual authentication between NF Service Consumer and NRF at the transport layer
Content: This clause covers the scenario where the NF Service Consumer and the NRF are connected over a mutually authenticated TLS connection. Figure 13.4.1.3.1.1-1: Authorization and service invocation procedure, for indirect communication without delegated discovery, with mutual authentication between NF and NRF at the transport layer Discovery of the NF Service Producer: 0. Optionally, the NF Service Consumer may discover the NF Service Producer before requesting authorization to invoke the services of the NF Service Producer. E.g. if the NF Service Consumer has not yet discovered the NF Service Producer, then it may run the discovery procedure. NF Service Consumer authorization: 1-2. After mutual authentication between NF Service Consumer and NRF at the transport layer, the NF Service Consumer and NRF perform the "Access token request before service access" procedure as described in clause 13.4.1.1. If the NF Service Consumer has already discovered the NF Service Producer, it can also perform the "Access token request for a specific NF Service Producer/NF Service Producer instance" procedure as described in clause 13.4.1.1. Service request: The NF Service Consumer, SCP, NRF and NF Service Producer perform the procedure "Indirect Communication without delegated discovery Procedure" described in clause 4.17.11 of TS 23.502[ Procedures for the 5G System (5GS) ]  [8]. The following steps describe how the access token received from steps 1 and 2 is used in this procedure. 3. If no cached data is available, the NF Service Consumer discovers the NF Service Producer via the SCP. 4. The NF Service Consumer sends a service request for the specific service to the SCP. The service request includes the access token as received in step 2, and may include the NF Service Consumer CCA as defined in clause 13.3.8. If the CCA is included, the NF type of the expected audience in the CCA shall contain the NF type of the NF Service Producer . If the NF Service Consumer allows reselection of a target NF Service Producer by the SCP, the expected audience in the CCA shall also contain NF type "NRF". NOTE: In the same deployment, the NF Service Consumer can delegate the reselection of the target NF Service Producer to the SCP for some requests, and not for other requests. 5. The SCP selects a NF Service Producer instance, performs the API root modifications and forwards the received request to the selected NF Service Producer instance. The request contains the access token and may contain the NF Service Consumer CCA if received in step 4. 6. To authorize the access, the NF Service Producer authenticates the service consumer NF using one of the methods described in clause 13.3.2.2 and if successful, it validates the access token as described in clause 13.4.1.1 by verifying the signature and checking if the requested service is part of the token's scope. 7. If the checks in step 6 are successful, the NF Service Producer processes the service request and provides a service response. 8. The SCP performs reverse API root modifications and forwards the service response.