Security Service Refactored

  * API Invoker is pre-authorised (has valid apiInvokerID from CAPIF Authority)

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Store signed Certificate

  3. Create Security Context

**Information of Test**:

  1. Perform [Invoker Onboarding]

     * body [service security body]

     * Use **Invoker Certificate**

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Store signed Certificate

  3. Create Security Context

**Expected Result**:

  1. Create security context:

  * API Invoker is pre-authorised (has valid apiInvokerID), but user that create Security Context with Provider role

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context using Provider certificate

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

     * body [service security body]

     * Using **AEF Certificate**

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context using Provider certificate

**Expected Result**:

  1. Create security context using Provider certificate:

  2. No context stored at DB

## Test Case 3: Create a security context for an API invoker with Provider entity role and invalid apiInvokerId

**Test ID**:: ***capif_security_api-3***

  * API Invoker is pre-authorised (has valid apiInvokerID), but user that create Security Context with Provider role

**Execution Steps**:

  1. Register Provider at CCF

  2. Create Security Context using Provider certificate

**Information of Test**:

  1. Perform [Provider Registration]

     * body [service security body]

     * Using **AEF Certificate**

**Execution Steps**:

  1. Register Provider at CCF

  2. Create Security Context using Provider certificate

**Expected Result**:

  1. Create security context using Provider certificate:

        * cause with message "User role must be invoker".

  2. No context stored at DB

## Test Case 4: Create a security context for an API invoker with Invoker entity role and invalid apiInvokerId

**Test ID**:: ***capif_security_api-4***

  * API Invoker is pre-authorised (has valid apiInvokerID), but user that create Security Context with invalid apiInvokerId

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Create Security Context using Provider certificate

**Information of Test**:

  1. Perform [Invoker Onboarding]

     * body [service security body]

     * Use **Invoker Certificate**

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Create Security Context using Provider certificate

**Expected Result**:

  1. Create security context using Provider certificate:

  * Provider is pre-authorised (has valid apfId from CAPIF Authority) and API Invoker has created a valid Security Context

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context using Provider certificate

  4. Retrieve Security Context by Provider

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

     * Send **GET** **https://{CAPIF_HOSTNAME}/trustedInvokers/{apiInvokerId}**

     * Using **AEF Certificate**

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context using Provider certificate

  4. Retrieve Security Context by Provider

**Expected Result**:

  1. Retrieve security context:

  * Provider is pre-authorised (has valid apfId from CAPIF Authority) and API Invoker has created a valid Security Context

**Execution Steps**:

  2. Register Provider at CCF

  3. Create Security Context using Provider certificate

  4. Retrieve Security Context by Provider of invalid invoker

**Information of Test**:

  1. Perform [Provider Registration]

     * Send **GET** **https://{CAPIF_HOSTNAME}/trustedInvokers/{API_INVOKER_NOT_VALID}**

     * Using **AEF Certificate**.

**Execution Steps**:

  2. Register Provider at CCF

  3. Create Security Context using Provider certificate

  4. Retrieve Security Context by Provider of invalid invoker

**Expected Result**:

  1. Retrieve security context:

  * API Exposure Function is not pre-authorised (has invalid apfId)

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Store signed Certificate

  3. Create Security Context

  4. Retrieve Security Context as Provider.

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

     * Send **GET** **https://{CAPIF_HOSTNAME}/trustedInvokers/{apiInvokerId}**

     * Using **Invoker Certificate**

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Store signed Certificate

  3. Create Security Context

  4. Retrieve Security Context as Provider.

**Expected Result**:

  1. Create security context:

  * Provider is pre-authorised (has valid apfId from CAPIF Authority) and API Invoker has created a valid Security Context

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context using Provider certificate

  4. Delete Security Context by Provider

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

     * Send **GET** **https://{CAPIF_HOSTNAME}/trustedInvokers/{apiInvokerId}**

     * Using **AEF Certificate**

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context using Provider certificate

  4. Delete Security Context by Provider

**Expected Result**:

  1. Delete security context:

  * Provider is pre-authorised (has valid apfId from CAPIF Authority) and API Invoker has created a valid Security Context

**Execution Steps**:

  1. Register Provider at CCF

  2. Create Security Context using Provider certificate

  3. Delete Security Context by Invoker

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

     * Send **DELETE** **https://{CAPIF_HOSTNAME}/trustedInvokers/{apiInvokerId}**

     * Use **Invoker Certificate**

**Execution Steps**:

  1. Register Provider at CCF

  2. Create Security Context using Provider certificate

  3. Delete Security Context by Invoker

**Expected Result**:

  1. Delete security context:

  * Invoker is pre-authorised.

**Execution Steps**:

  1. Register Provider at CCF

  2. Delete Security Context by invoker

**Information of Test**:

  1. Perform [Invoker Onboarding]

     * Send **DELETE** **https://{CAPIF_HOSTNAME}/trustedInvokers/{API_INVOKER_NOT_VALID}**

     * Use **Invoker Certificate**

**Execution Steps**:

  1. Register Provider at CCF

  2. Delete Security Context by invoker

**Expected Result**:

  1. Delete security context:

  * Provider is pre-authorised (has valid apfId from CAPIF Authority).

**Execution Steps**:

  1. Register Provider at CCF

  2. Delete Security Context by provider

**Information of Test**:

  1. Perform [Provider Registration]

     * Send **DELETE** **https://{CAPIF_HOSTNAME}/trustedInvokers/{API_INVOKER_NOT_VALID}**

     * Use **AEF Certificate**

**Execution Steps**:

  1. Register Provider at CCF

  2. Delete Security Context by provider

**Expected Result**:

  1. Retrieve security context:

  * API Invoker is pre-authorised (has valid apiInvokerID from CAPIF Authority) and Provider is also authorized

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context By Invoker

  4. Update Security Context By Invoker

  5. Retrieve Security Context By Provider

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

     * Send **GET** **https://{CAPIF_HOSTNAME}/trustedInvokers/{apiInvokerId}**

     * Using **AEF Certificate**.

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context By Invoker

  4. Update Security Context By Invoker

  5. Retrieve Security Context By Provider

**Expected Result**:

  1. Update security context:

  * API Invoker is pre-authorised (has valid apiInvokerID from CAPIF Authority) and Provider is also authorized.

  * Invoker has created the Security Context previously.

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context

  4. Update Security Context as Provider

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

     * body [service security body] but with notification destination modified to **http://robot.testing2**

     * Using **AEF Certificate**

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context

  4. Update Security Context as Provider

**Expected Result**:

  1. Update security context:

  * API Invoker is pre-authorised (has valid apiInvokerID from CAPIF Authority) and Provider is also authorized.

  * Invoker has created the Security Context previously.

**Execution Steps**:

  1. Register Provider at CCF

  2. Update Security Context as Provider

**Information of Test**:

  1. Perform [Provider Registration]

     * body [service security body]

     * Using **AEF Certificate**

**Execution Steps**:

  1. Register Provider at CCF

  2. Update Security Context as Provider

**Expected Result**:

  1. Update security context:

  * API Invoker is pre-authorised (has valid apiInvokerID from CAPIF Authority)

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Update Security Context

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

     * body [service security body]

     * Using **Invoker Certificate**.

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Update Security Context

**Expected Result**:

1. Retrieve security context:

  * API Invoker is pre-authorised (has valid apiInvokerID from CAPIF Authority) and Provider is also authorized

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context by Invoker

  4. Revoke Security Context by Provider

  5. Retrieve Security Context by Provider

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

     * Send **GET** **https://{CAPIF_HOSTNAME}/trustedInvokers/{apiInvokerId}**

     * Using **AEF Certificate**.

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context by Invoker

  4. Revoke Security Context by Provider

  5. Retrieve Security Context by Provider

**Expected Result**:

  1. Revoke Authorization:

  * API Invoker is pre-authorised (has valid apiInvokerID from CAPIF Authority) and Provider is also authorized

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context

  4. Revoke Security Context by invoker

  5. Retrieve Security Context

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

     * Send **GET** **https://{CAPIF_HOSTNAME}/trustedInvokers/{apiInvokerId}**

     * Using Provider Certificate

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context

  4. Revoke Security Context by invoker

  5. Retrieve Security Context

**Expected Result**:

  1. Revoke Security Context by invoker:

  * API Invoker is pre-authorised (has valid apiInvokerID from CAPIF Authority) and Provider is also authorized

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context

  4. Revoke Security Context by Provider

  5. Retrieve Security Context

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

     * This request will ask with parameter to retrieve authenticationInfo and authorizationInfo

     * Using **AEF Certificate**.

**Execution Steps**:

  1. Register and onboard Invoker at CCF

  2. Register Provider at CCF

  3. Create Security Context

  4. Revoke Security Context by Provider

  5. Retrieve Security Context

**Expected Result**:

  1. Revoke Security Context by invoker:

  * API Invoker is pre-authorised (has valid apiInvokerId)

  * Service API of Provider is published

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

       * Create Scope properly for request: ***3gpp#{aef_id}:{api_name}***

     * Using **Invoker Certificate**.

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token

**Expected Result**:

  1. Response to Request of Access Token:

  * API Invoker is pre-authorised (has valid apiInvokerID from CAPIF Authority) and Provider is also authorized

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Provider

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

       * ***grant_type=client_credentials***

     * Using **AEF Certificate**

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Provider

**Expected Result**:

  1. Response to Request of Access Token:

        * error unauthorized_client

        * error_description=Role not authorized for this API route

## Test Case 21: Retrieve access token by Provider with invalid apiInvokerId

**Test ID**:: ***capif_security_api-21***

  * API Invoker is pre-authorised and Provider is also authorized

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Provider

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

       * ***grant_type=client_credentials***

     * Using **AEF Certificate**

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Provider

**Expected Result**:

  1. Response to Request of Access Token:

  * API Invoker is pre-authorised (has valid apiInvokerId)

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

       * ***grant_type=client_credentials***

     * Using **Invoker Certificate**

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Expected Result**:

  1. Response to Request of Access Token:

**NOTE: ProblemDetails29571 is the definition present for this request at swagger of ProblemDetails, and this is different from definition of ProblemDetails across other CAPIF Services**

## Test Case 23: Retrieve access token with invalid client_id

**Test ID**:: ***capif_security_api-23***

  * API Invoker is pre-authorised and Provider is also authorized

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

       * **client_id is not-valid** 

     * Using **Invoker Certificate**

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Expected Result**:

  1. Response to Request of Access Token:

  * API Invoker is pre-authorised and Provider is also authorized

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

       * ***grant_type=not_valid***

     * Using **Invoker Certificate**

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Expected Result**:

  1. Response to Request of Access Token:

  * API Invoker is pre-authorised and Provider is also authorized

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

       * ***scope=not-valid-scope***

     * Using **Invoker Certificate**

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Expected Result**:

  1. Response to Request of Access Token:

  * API Invoker is pre-authorised and Provider is also authorized

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

       * ***scope=3gpp#1234:**service_1***

     * Using **Invoker Certificate**

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Expected Result**:

  1. Response to Request of Access Token:

  * API Invoker is pre-authorised and Provider is also authorized

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Information of Test**:

  1. Perform [Provider Registration] and [Invoker Onboarding]

       * ***scope=3gpp#{aef_id}:not-valid***

     * Using **Invoker Certificate**

**Execution Steps**:

  1. Register Provider at CCF, store certificates and Publish Service API **service_1** at CCF

  2. Register and onboard Invoker at CCF

  3. Discover Service APIs by Invoker.

  4. Create Security Context According to Service APIs discovered.

  5. Request Access Token by Invoker

**Expected Result**:

  1. Response to Request of Access Token:

  [Return To All Test Plans]: ../README.md

  [service security body]: ./service_security.json  "Service Security Request"

  [security notification body]: ./security_notification.json  "Security Notification Request"

  [access token req body]: ./access_token_req.json  "Access Token Request"