Commit d73f401c authored by Sergio Gimenez's avatar Sergio Gimenez Committed by Dimitrios Gogos
Browse files

docs: align FM REQ-FED-01 to ADR-0038 (OAuth2 over deferred mTLS) 

REQ-FED-01 now mandates OAuth2 Client-Credentials + signed JWT (Keycloak
federation realm, fed-mgmt/fed-mgmt-notif scopes) for E/WBI authorization, per
OPG.04 v6.0 Sec. 9. mTLS with pre-exchanged/CA-issued certs is recast as a
deferred defense-in-depth layer. Spec refs corrected to OPG.04 Sec. 9 and
OPG.02 Sec. 3.3.4.5 / 4.2.3.
parent 979250ea

fm/requirements-and-design.md

+1 −1
Changes for fm/requirements-and-design.md: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -18,7 +18,7 @@ status: "ETSI SDG OOP" 


| ID | Requirement | Spec Reference |

|---|---|---|

| REQ-FED-01 | The system shall enforce mutual TLS (mTLS) for all incoming and outgoing EWBI connections, validating client certificate thumbprints against registered partner profiles in `fm_db`. | OPG.02 v10.0 §3.3.4.5; OPG.04 v6.0 |

| REQ-FED-01 | The system shall authorize all incoming and outgoing EWBI requests via OAuth2 Client-Credentials grant with signed JWT (JWS), issued and validated against the platform's centralized Keycloak (`federation` realm, `fed-mgmt`/`fed-mgmt-notif` scopes), per partner-specific client credentials registered in `fm_db`. mTLS with pre-exchanged/CA-issued client certificates is a deferred defense-in-depth layer, not yet required for a request to be authorized — see ADR-0038. | OPG.04 v6.0 §9; OPG.02 v10.0 §3.3.4.5/§4.2.3 (mTLS, deferred) |

| REQ-FED-02 | The system shall strip all internal IP addresses, Kubernetes cluster names, namespace names, pod UIDs, node names, and internal trace IDs from every response and event payload before it crosses the operator boundary via EWBI. | OPG.02 v10.0 §4.2.3 |

| REQ-FED-03 | The system shall route inbound and outbound federation requests to the correct partner OP based on end-user identifiers (MSISDN prefix, IP CIDR block) or explicit zone/resource identifiers, using PostgreSQL as the authoritative routing table source. | OPG.02 v10.0 §3.3.2.4; OPG.10 v2.0 |

| REQ-FED-04 | The system shall support bidirectional resource catalogue synchronization with partner OPs, publishing local edge zone availability and subscribing to partner zone updates, stored in `shared_resource_catalogues` in `fm_db`. | OPG.02 v10.0 §3.3.4.2; OPG.04 v6.0 |