Section: 13.4.1.1.3 Access token requests in deployments with several NRFs
Content: As described in clause 6.2.6.1 of TS 23.501[ System architecture for the 5G System (5GS) ]  [1], an operator network can deploy multiple NRFs, for example due to network slicing or network segmentation. An NF Service Consumer shall send its access token requests to the NRF where it is registered as OAuth 2.0 client. The NRF authenticates the NF Service Consumer, and may verify the input parameters in the access token request as described under Step 1 in clause 13.4.1.1.2. After successful authentication and verification of the input parameters, the NRF may forward the access token request to another NRF. If an NRF receives an access token request for an NF Service Producer that is not registered at this NRF, the NRF determines the target NRF where the NF Service Producer is registered as specified in TS 29.510[ 5G System; Network function repository services; Stage 3 ]  [68] clause 5.4.2.2.2 step 2a, and forwards the access token request to the target NRF. There can also be several hops of NRFs between the NRF that receives the access token request from the NF Service Consumer and the target NRF where the NF Service Producer is registered. One possible hierarchical NRF deployment is the local NRF deployment. An NF Service Producer’s local NRF is the NRF where the NF Service Producer registered its NF profile. In the local NRF deployment, the NF Service Producer is configured with the public key which corresponds to the private key that its local NRF uses for signing the access token. Thus, when the local NRF receives an access token request from an NF Service Consumer, the local NRF checks if the NF Service Consumer is authorized to receive the requested service and, if yes, issues and signs the access token. In the case when the access token request from the NF Service Consumer was forwarded by another NRF, the local NRF of the NF Service Producer needs to trust the NRF which forwarded the access token request.