Entitlement Server — OmniSEP
The Entitlement Server (OmniSEP) decides which services a subscriber and their device are allowed to use. When a handset asks whether it may turn on VoWiFi, VoLTE or Wi‑Fi Calling — or runs ODSA device provisioning to add or activate a device — it checks in with the entitlement server, which authorises the request over the entitlement (TS.43) interface, resolves subscriber data over Diameter, and applies the subscriber's XCAP service profiles. OmniWeb surfaces its live entitlements, activity, sessions, tokens, Diameter peers and XCAP profiles on one element page; volume and trend charts live on the Grafana dashboards reached from the same page.
OmniSEP is a per‑instance element page reached from the sidebar when one runs in the site's inventory. All traffic goes through the OmniWeb backend proxy to the entitlement server's API, so it stays behind the single authenticated gateway. The documentation link in the page header (the in‑context help button) opens this page. It is organised into tabs.
Overview
The landing tab is a single‑screen health read for the entitlement server: its system status, the count of active sessions and tokens, subscribers carrying custom entitlements, and the health of its Diameter peers. It is the fastest way to confirm the server is up and authorising devices.
Entitlements
The subscribers that carry custom entitlements — overrides to the default service set, per subscriber. Open a subscriber to see which services are enabled for them. An operator can delete all entitlements for a subscriber to return them to the network default — useful for clearing a bad override during a fault.
Activity
The recent activity records — a feed of the entitlement requests the server has handled, each showing the subscriber or device, the service requested and the outcome. Open a record for its detail. This is the audit trail for confirming whether a handset actually asked for VoWiFi/VoLTE and what answer it was given.
Sessions
The active EAP‑AKA sessions the server is holding for device authentication, each with its subscriber identity and state. An individual session can be expired from here to force a device to re‑authenticate — the quickest way to clear a session that has stuck.
Tokens
The active authentication tokens the server has issued to devices after they authenticated. Each token can be revoked individually, which withdraws a device's authorisation and requires it to authenticate afresh — the entitlement equivalent of forcing a re‑login.
Diameter
The Diameter peers the entitlement server connects to for subscriber data, with each peer's connection state. When entitlement decisions start failing for reasons that look like missing subscriber data, this tab is where you confirm the Diameter path is up.
XCAP Profiles
The XCAP profiles — the per‑subscriber service settings (such as supplementary‑service configuration) the entitlement server applies. Open a profile to read it. A profile can be deleted to clear a subscriber's stored settings and fall back to the default.
Logs
The Logs tab tails the entitlement server's live log output for troubleshooting a single server without leaving OmniWeb.
Monitoring dashboards
Request rates, per‑service counters and other time‑series for the entitlement server are presented as Grafana dashboards, reached from the element page — OmniWeb does not duplicate those charts natively.
Related
- The HSS holds the subscriber data the entitlement server's Diameter requests resolve against.
- The CSCF and TAS deliver the VoLTE/VoWiFi services the entitlement server authorises.
- The ePDG and TWAG carry the Wi‑Fi Calling access the entitlement server enables.
- The DRA relays the entitlement server's Diameter signalling to its peers.