Embodiments of the application provide a method for authorizing a service of a user, and an apparatus. In the method, a first controller obtains an identifier of a user, an identifier of a first gateway, and service information, and sends a first request to a second controller, where the first request includes the service information; the first controller receives a first response sent by the second controller, where the first response includes an identifier of a transport network; the first controller sends a second request to a third controller, where the second request includes the identifier of the user, the identifier of the first gateway, and the identifier of the transport network, the second request instructs the third controller to configure a path to transmit data, and the data is to be sent by the user to a VNF corresponding to the service information.