Consent Management

[FabrizioMoggio]

Which API in the Edge Cloud Family needs to be compliant with the CAMARA User Consent management?(https://github.com/camaraproject/IdentityAndConsentManagement/blob/main/documentation/CAMARA-API-access-and-user-consent.md#user-authenticationauthorization--consent-management)

[FabrizioMoggio]

According to a discussion held in GSMA OPAG (TI Sandbox), the Traffic Influence API must adopt the User Consent management flow.
o Even if the TI API doesn’t provide any new sensitive data to the API Consumer, the Service Provider could anyway detect the location of the User because of his device attached to a specific EAS in a certain geographical location.
o For this reason, in some Country, User Consent management is required for the TI API
o User Consent management, via three-legged authentication is anyway decoupled from the API implementation, so it can be defined in the TI API but actually implemented only by Operators in countries where the local regulation requires it.
o Decision: three-legged authentication will be implemented in the TI API

[Kevsy]

All APIs need to incorporate the Identity and Consent guidelines - but the exact consent flow will be implemented by the API provider according to the sensitivity of the information shared in the API requests/responses.

So Simple Edge Discovery 0.9.4 includes the openIDconnect security scheme, and documentation, which means it is possible to check if consent is required to return the closest edge.

[FabrizioMoggio]

@Kevsy thank you very much for the pointer to the specific section of the documentation. I will implement it in the TI API.

[FabrizioMoggio]

3Legs implemented in the TI API : #167