...
- Identify protocols to support
- Identify requirement specifying protocols supported by VNFs
NEW - Requirement: R-xxxxxx
...
DISCUSS - Requirement: R-86835
The VNF MUST set the default settings for user access to deny authorization, except for a super user type of account. When a VNF is added to the network, nothing should be able to use it until the super user configures the VNF to allow other users (human and application) have access.
PROPOSE NO The VNF MUST set the access default settings to deny authorization, except for a super user type of account. When a VNF is added to the network, nothing should be able to use it until the super user configures the VNF to allow other users (human and application) have access.
CHANGE - Requirement: R-931076
The VNF MUST support account names that contain at least A-Z, a-z, 0-9 character sets and be at least 6 characters in length.
The VNF MUST support account names that contain at least A-Z, a-z, and 0-9 character sets and be at least 6 characters in length.
...
The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, support multifactor authentication on all protected interfaces exposed by the VNF for use by human users.
PROPOSE NO CHANGE - Requirement: R-79107
The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, support the ability to disable the userID after a configurable number of consecutive unsuccessful authentication attempts using the same userID.
The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, support the ability to lock out the userID after a configurable number of consecutive unsuccessful authentication attempts using the same userID. The locking mechanism must be reversible by an administrator and should be reversible after a configurable time period.
NEED TO DISCUSS - Requirement: R-78010
The VNF MUST integrate with standard identity and access management protocols such as LDAP, TACACS+, Windows Integrated Authentication (Kerberos), SAML federation, or OAuth 2.0.
- Identify protocols to support
- "OAuth 2.0 with an operator provided Authorization Server"
- 2/11 Need feedback from Vendors
MAY REMOVE BASED ON CHANGES to R-78010 - Requirement: R-85419
The VNF SHOULD support OAuth 2.0 authorization using an external Authorization Server.PROPOSE NO
- 2/11 should be combined, dependent on feedback from vendors on R-78010
CHANGE - Requirement: R-581188
A failed authentication attempt MUST NOT identify the reason for the failure to the user, only that the authentication failed.PROPOSE
The VNF MUST NOT identify the reason for a failed authentication, only that the authentication failed.
CHANGE - Requirement: R-479386
The VNF MUST NOT display “Welcome” notices or messages that could be misinterpreted as extending an invitation to unauthorized users.
The VNF MUST provide the capability of setting a configurable message to be displayed after successful login.PROPOSE NO
- Ask Trevor Lovett if the supported character sets specified in the VNF requirements
CHANGE - Requirement: R-231402
The VNF MUST provide a means for the user to explicitly logout, thus ending that session for that authenticated user.PROPOSE NO
The VNF MUST provide a means to explicitly logout, thus ending that session.
NEW REQUIREMENT
The VNF MUST provide explicit confirmation of a session termination such as a message, new page, or rerouting to a login page.
CHANGE - Requirement: R-45719
The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, or enforce a configurable “terminate idle sessions” policy by terminating the session after a configurable period of inactivity.
The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, enforce a configurable “terminate idle sessions” policy by terminating the session after a configurable period of inactivity.
...