...
The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, support the creation of multiple IDs so that individual accountability can be supported.
NO CHANGE - Requirement: R-75041
The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, support configurable password expiration.
NO CHANGE - Requirement: R-844011
The VNF MUST not store authentication credentials to itself in clear text or any reversible form and must use salting.
NO CHANGE - Requirement: R-46908
The VNF MUST, if not integrated with the Operator’s Identity and Access Management system, comply with “password complexity” policy. When passwords are used, they shall be complex and shall at least meet the following password construction requirements: (1) be a minimum configurable number of characters in length, (2) include 3 of the 4 following types of characters: upper-case alphabetic, lower-case alphabetic, numeric, and special, (3) not be the same as the UserID with which they are associated or other common strings as specified by the environment, (4) not contain repeating or sequential characters or numbers, (5) not to use special characters that may have command functions, and (6) new passwords must not contain sequences of three or more characters from the previous password.
NEED TO DISCUSS - Requirement: R-814377
The VNF MUST have the capability of allowing the Operator to create, manage, and automatically provision user accounts using an Operator approved identity lifecycle management tool using a standard protocol, e.g., NETCONF API.
...
NEW - Requirement: R-xxxxxx VNFRQTS-817
The VNF MUST, if not integrated with the operator's IAM system, provide a mechanism for assigning roles and/or permissions to an identity.
NEW - Requirement: R-xxxxxx VNFRQTS-818
The VNF MUST support at least the following roles: system administrator, application administrator, network function O&M.
DISCUSS CHANGE - Requirement: R-86835 VNFRQTS-819
The VNF MUST set the default settings for user access to deny authorization, except for a super user type of account. When a VNF is added to the network, nothing should be able to use it until the super user configures the VNF to allow other users (human and application) have access.
...
CHANGE - Requirement: R-931076 VNFRQTS-820
The VNF MUST support account names that contain at least A-Z, a-z, 0-9 character sets and be at least 6 characters in length.
...