generated: '2026-08-29' method: probed source: >- Live anonymous probes of https://api.tcs.taranawireless.com/, https://idp.tcs.taranawireless.com/, https://portal.tcs.taranawireless.com/northbound/, https://support.taranawireless.com/.well-known/openid-configuration, plus the operator portal's anonymous runtime configuration at https://portal.tcs.taranawireless.com/operator-portal/env-config.js name: Tarana Wireless — authentication profile note: >- NO OpenAPI securitySchemes could be read: the TCS northbound OpenAPI sits behind the same RBAC wall as the API itself, so derive-authentication.py had nothing to parse. Everything below was established by probing the live edges and by reading the configuration Tarana serves anonymously. Where a mechanism is implied but not stated by Tarana, it is marked inferred and the evidence is named — nothing here is asserted from the shape of the URL alone. gated: true gate: >- The northbound API reference (Swagger UI) and every Swagger/OpenAPI sibling path return HTTP 403 with the plain-text body "RBAC: access denied" to anonymous callers. Credentials are issued to an operator with a TCS tenant; there is no self-service developer signup. schemes: - id: tcs-portal-session surface: TCS operator portal (portal.tcs.taranawireless.com) type: oauth2 flow: authorization_code authorization_server: https://idp.tcs.taranawireless.com evidence: - url: https://idp.tcs.taranawireless.com/oauth2/idpresponse note: >- Named verbatim in the portal's env-config.js as the IdP response URL. The host answers unknown paths with {"error":"This URL doesn't exist on the authorization server."}, which confirms it is an OAuth 2.0 authorization server rather than a static host. status: 404 discovery_document: false discovery_note: >- /.well-known/openid-configuration, /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource and /.well-known/jwks.json all return 404 on the IdP host. The authorization server publishes no discovery metadata, so an OAuth client cannot be configured without out-of-band instructions. mfa: true mfa_evidence: >- The TCS event vocabulary defines an MFA_MANAGEMENT_OPERATIONS event type with three events, so multi-factor enrolment and management are first-class portal operations. - id: tcs-northbound-api-credential surface: TCS northbound REST API (portal.tcs.taranawireless.com/northbound) type: unknown status: gated note: >- The credential type is NOT documented on any anonymously reachable Tarana surface and is deliberately not guessed here. Two pieces of real evidence bracket it: the portal's own service map names a security-service exposing /api/tcs/v1/authorization and /api/tcs/v1/clients/key, which is the shape of a client-key issuance and authorization endpoint pair; and the TCS event vocabulary carries no separate API-token event type, which suggests keys are issued through the same operator/user management surface. Confirm against the TCS Administration Guide or the gated Swagger UI before integrating. evidence: - url: https://portal.tcs.taranawireless.com/northbound/swagger-ui.html status: 403 note: 'Body: "RBAC: access denied".' - url: https://portal.tcs.taranawireless.com/operator-portal/env-config.js status: 200 note: >- Public. Names security-service endpoints /api/tcs/v1/authorization and /api/tcs/v1/clients/key, and an apigw block whose apikey value is the literal placeholder SECRET_FROM_VAULT (no live secret is exposed). - id: tcs-api-gateway surface: TCS API gateway (api.tcs.taranawireless.com) type: apiKey in: header status: gated evidence: - url: https://api.tcs.taranawireless.com/ status: 403 note: >- AWS API Gateway. Responds with x-amzn-errortype MissingAuthenticationTokenException and the body {"data":null,"error":{"code":403,"message":"The HTTP method or resources may not be supported.","status":"Unsupported API"}}. MissingAuthenticationTokenException is the standard AWS API Gateway response to an unsigned/unkeyed request. CORS access-control-allow-origin is pinned to https://portal.tcs.taranawireless.com, so this edge is provisioned for the first-party portal, not as a public developer API. - id: support-portal-oidc surface: Salesforce Experience Cloud support portal (support.taranawireless.com) type: openIdConnect openIdConnectUrl: https://support.taranawireless.com/.well-known/openid-configuration artifact: well-known/tarana-wireless-support-openid-configuration.json status: published evidence: - url: https://support.taranawireless.com/.well-known/openid-configuration status: 200 note: >- Complete OpenID Provider Metadata: authorization, token, revocation, introspection, userinfo, registration and JWKS endpoints; RS256 id_token signing; DPoP signing algorithms advertised; client_secret_post / client_secret_basic / private_key_jwt token endpoint auth. Scopes are the Salesforce platform set, not Tarana product scopes. scope: >- This governs sign-in to the customer support and knowledge portal only. It is NOT the authorization server for the TCS northbound API — that is idp.tcs.taranawireless.com. oauth_scopes_published: false oauth_scopes_note: >- No Tarana-defined scope reference is reachable. The only scopes list found anywhere is the Salesforce platform scope set in the support portal's OIDC metadata, which describes Salesforce APIs and not Tarana's. scopes/ is deliberately not written rather than filled with a foreign vocabulary. authorization_model: style: role-based access control (RBAC), enforced at the ingress evidence: >- Anonymous requests to gated paths are refused by the Istio ingress with the literal string "RBAC: access denied", and the portal env-config exposes an HBAC block with a ROLES_WITH_GLOBAL_ACCESS list. documented_roles: - NOC Operator - NOC L1 User - OP Admin roles_source: >- Role names appear in Tarana's own operator-portal documentation surface; the machine definition is not public. hierarchy: >- Access is additionally scoped by the network hierarchy the portal filters on — operator, region, market, cell, site, sector, device — which is the same hierarchy carried on every webhook payload.