JP2013077176A - User information provision device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To acquire necessary user information from a database of an authentication function providing product and a product other than the authentication function providing product without requiring modification of a function provided in a Web application even when the authentication function providing product is changed to another authentication function providing product.SOLUTION: User information acquisition method definition means defines a user information acquisition method including an attribute name used for the acquisition, a user information acquisition source and a user information acquisition parameter (the user information acquisition parameter shows an attribute name which both first user information and second user information include.). The user information providing device acquires first user partial information from a request on the basis of the user information acquisition method. The user information providing device uses an attribute name of the first user partial information as the user information acquisition parameter on the basis of the user information acquisition method, and acquires second user partial information from a storage device.

Description

  Embodiments described herein relate generally to a user information providing apparatus and a program.

  In building a Web (World Wide Web) application, it is indispensable to incorporate a user authentication mechanism. As a method for realizing this type of authentication function, in addition to a method for creating an authentication function in a Web application, an application server product that provides an authentication function or an access management server product that provides a single sign-on function is used. There is a way.

  A product that provides such an authentication function or a single sign-on function (hereinafter also referred to as “authentication function providing product”) executes a user authentication process, and if the authentication is successful, the user information of the authenticated user is transferred to the HTTP ( It has a function of passing it to a Web application by including it in a Hyper Text Transfer Protocol) header or a cookie.

  The Web application implements a necessary user information acquisition process by implementing a function for acquiring user information in accordance with a method of providing user information by the authentication function providing product and user information managed by the authentication function providing product. . If the user information required by the Web application is not managed in the authentication function providing product, the user required from the database other than the authentication function providing product using the user ID of the authenticated user acquired from the authentication function providing product as a key Execute acquisition processing to acquire information. Thereafter, the Web application performs screen display and access control by using the acquired user information.

  However, when changing an authentication function providing product to another authentication function providing product, the method of providing user information is different for each authentication function providing product and the managed user information is different. According to the authentication function providing product, it is necessary to modify the function for acquiring user information.

  For this reason, even if the authentication function providing product is changed to another authentication function providing product, a user information acquisition technique has been devised that does not require modification of the function implemented in the Web application.

JP 2010-267118 A

  However, in the user information acquisition technology as described above, when the authentication function providing product is changed to another authentication function providing product, the Web application can acquire necessary user information from the changed authentication function providing product. However, there is an inconvenience that necessary user information cannot be obtained from a database other than the authentication function providing product after the change.

  The problem to be solved by the present invention is that even if the authentication function providing product is changed to another authentication function providing product, it is not necessary to modify the function implemented in the Web application, and the necessary user information is provided with the authentication function. It is to provide a user information providing apparatus and program that can be obtained from a database other than products and authentication function providing products.

  The service providing system of the embodiment includes an authentication server device, a Web / application server device, and a storage device.

  When receiving the request from the terminal, the authentication server device executes an authentication process of the user who transmitted the request, and transmits the request in which user information of the authenticated user is stored after the authentication process is successful. . The first user information includes a plurality of attribute names and attribute values corresponding to the plurality of attribute names.

  In the Web / application server device, service providing means provides service information to the terminal in response to the transmitted request.

  The storage device is used to provide the service information to the terminal, and stores second user information. The second user information includes any attribute name included in the first user information and an attribute value corresponding to the attribute name, and an attribute name different from the attribute name and an attribute value corresponding to the different attribute name. Consists of.

  In the Web / application server apparatus, a user information providing apparatus is provided, and third part information corresponding to first user partial information and second user partial information is sent to the service providing means. A part of the first user partial information is obtained from the first user information. A part of the second user partial information is obtained from the second user information.

  In the user information providing apparatus, the user information acquisition method defining means defines a user information acquisition method including an attribute name used for the acquisition, a user information acquisition destination, and a user information acquisition parameter. The attribute name used for the acquisition is an attribute name used for the acquisition among attribute names included in at least one of the first user information and the second user information. The user information acquisition parameter is required when acquiring an attribute value corresponding to an attribute name included only in the second user information among the attribute names used for the acquisition. However, the user information acquisition parameter represents an attribute name included in both the first user information and the second user information among the attribute names used for the acquisition.

  In the user information providing apparatus, the user information storage method defining means corresponds to the attribute name used for the acquisition, the attribute name used for the acquisition, and a storage attribute name indicating the attribute name when storing the attribute value, the user A user information storage method including a user information storage parameter necessary for storing the information storage destination and the attribute value is defined. However, the user information storage parameter corresponds to the attribute name represented by the user information acquisition parameter among the storage attribute names when the user information storage destination is other than a session, and the attribute name when storing the attribute value Indicates the storage attribute name indicating.

  The user information providing device acquires the first user partial information from the transmitted request based on the user information acquisition method.

  In the user information providing device, the second user partial information is obtained from the storage device by using the attribute name of the first user partial information as the user information acquisition parameter based on the user information acquisition method. get.

  In the user information providing device, after the attribute names of the acquired first user part information and the acquired second user part information are changed to the stored attribute names based on the user information storage method The third user information composed of the first user partial information and the second user partial information is written into a storage area indicated by the user information storage destination.

  The user information providing apparatus sends the written third user information to the service providing means.

It is a schematic diagram which shows the structural example of the service provision system containing the user information provision apparatus which concerns on 1st Embodiment. It is a schematic diagram which shows the structure of the common user information storage part in the embodiment. It is a schematic diagram which shows the structure of the application user information storage part in the embodiment. It is a schematic diagram which shows the structure of the user information acquisition method definition part in the embodiment. It is a schematic diagram which shows the structure of the temporary memory part in the embodiment. It is a schematic diagram which shows the structure of the user information storage method definition part in the embodiment. It is a flowchart which shows an example of operation | movement of the user information provision apparatus in the embodiment. It is a schematic diagram which shows the structural example of the service provision system containing the user information provision apparatus which concerns on 2nd Embodiment. It is a schematic diagram which shows the structure of the user information acquisition method definition part in the embodiment. It is a schematic diagram which shows the structure of the user information storage method definition part in the embodiment. It is a schematic diagram which shows the structure of the user information acquisition / storage method selection rule definition part in the embodiment. It is a flowchart which shows an example of operation | movement of the user information provision apparatus in the embodiment.

  Each embodiment will be described below with reference to the drawings. Note that the following user information providing apparatus can be implemented with either a hardware configuration or a combination configuration of hardware resources and software. As the software of the combined configuration, a program that is installed in advance from a network or a storage medium into a computer and causes the computer to realize the function of the user information providing apparatus is used.

(First embodiment)
FIG. 1 is a schematic diagram illustrating an example of a configuration of a service providing system including a user information providing apparatus according to the first embodiment. FIGS. 2 to 6 illustrate each storage unit or definition unit in the service providing system. It is a schematic diagram which shows a structural example.

  The service providing system 1 includes a client terminal 10, an authentication server device 20, and a Web / application server device 30.

  The client terminal 10 is provided with an arbitrary web browser unit (not shown). The Web browser unit has a function of transmitting a request to the authentication server device 20 and the Web / application server device 30 by a user operation, and a function of displaying service information provided from the Web / application server device 30.

  The authentication server device 20 includes a common user information storage unit 21, an authentication unit 22, and a user information providing unit 23.

  The common user information storage unit 21 is a database that can be read / written from the authentication unit 22 and the user information providing unit 23, and stores a first user information table 21a as shown in FIG. The first user information table 21a stores, for each user, a record composed of fields including attribute values corresponding to USER_ID (user ID), PASSWORD (password), and ROLE (role) as attribute names. Note that information including a plurality of attribute names stored in the first user information table 21a and attribute values corresponding to the plurality of attribute names is also referred to as first user information.

  When receiving the request from the client terminal 10, the authentication unit 22 determines whether or not the user who transmitted the request is an authenticated user. If the request is not (that is, unauthenticated), the authentication unit 22 It has a function to execute the authentication process.

  The user information providing unit 23 has a function of providing (sending) the user information of the authenticated user to the Web / application server device 30 by including the user information of the authenticated user in an HTTP header, a cookie, or the like after successful authentication processing in the authentication unit 22. Further, the user information providing unit 23 responds to an acquisition request from the Web / application server device 30 to be described later, so that the authenticated user (that is, the user indicated by the user ID and password included in the HTTP header, the cookie, etc.) 1 has the function of providing the user information 1 to the Web / application server device 30.

  On the other hand, the Web / application server device 30 includes an application user information storage unit 40, a service providing unit 50, and a user information providing device 60.

  The application user information storage unit 40 is a database that can be read from the user information providing device 60, and stores a second user information table 40a as shown in FIG. The second user information table 40a stores a record including fields including attribute values corresponding to USER_ID (user ID), USER_NAME (user name), MAIL (mail address), and TEL (phone number) as attribute names. Remember every time. Note that information including attribute names and attribute values stored in the second user information table 40a is also referred to as second user information. The second user information is different from any attribute name (USER_ID) included in the first user information, an attribute value corresponding to the attribute name, and an attribute name (USER_NAME, MAIL, TEL) different from the attribute name. Consists of an attribute value corresponding to the attribute name.

  In the present embodiment, the application user information storage unit 40 is included in the Web / application server device 30. However, the present invention is not limited to this. For example, the application user information storage unit 40 is included in the Web / application server device 30. The configuration may be included in an external storage device connected to the.

  The service providing unit 50 has a function of providing service information to the client terminal 10 in response to a request sent from the client terminal 10. The name of “service providing unit” may be appropriately replaced with a name such as “service logic unit”, “service implementation unit”, or “service information providing unit”.

  Here, the user information providing apparatus 60 is provided in the Web / application server apparatus 30, and a part of the first user partial information obtained from the first user information and a part of the second user information. The third user information corresponding to the acquired second user partial information is sent to the service providing unit 50. Specifically, the user information providing device 60 includes a user information acquisition method definition unit 61, an access detection unit 62, a user information acquisition unit 63, a temporary storage unit 64, a user information storage method definition unit 65, and a user information storage unit 66. I have.

  The user information acquisition method definition unit 61 indicates in advance how to acquire user information from the authentication server device 20 and the application user information storage unit 40 as shown in FIG. 4 by an operator's setting operation in advance. An information acquisition method 61a is defined. Note that the term “definition” may be read as “setting”, and this is the same in other explanations in this specification. The user information acquisition method 61a includes an acquisition attribute name, a user information acquisition destination, and a user information acquisition parameter.

  “Acquired attribute name” of the user information acquisition method indicates an attribute name of the user information acquired by the user information acquisition unit 63. Supplementally, at least one of the first user information and the second user information is included. Of the attribute names included in one, the attribute name used for the acquisition is shown. “User information acquisition destination” acquires user information (for example, attribute values corresponding to USER_ID, ROLE, USER_NAME, TEL, etc. as attribute names) stored in the authentication server device 20 and the application user information storage unit 40. Define what. In the present embodiment, “HTTP_HEADER” is acquired from the HTTP header, and “RDB_USER1” is acquired from the relational database (in other words, the application user information storage unit 40). In addition, the “user information acquisition parameter” is a parameter (for example, the acquisition attribute name is required when acquiring the attribute value corresponding to the attribute name included only in the second user information among the attribute names indicated by the acquisition attribute name). Among the attribute names shown, the attribute names included in both the first user information and the second user information are defined. Here, when the attribute value corresponding to the acquired attribute name “USER_NAME” and the acquired attribute name “TEL” is acquired from the application user information storage unit 40, the attribute value corresponding to the acquired attribute name “USER_ID” is required as an acquisition key. It is shown that.

  When receiving the request from the client terminal 10, the access detection unit 62 determines whether or not the user who transmitted the request is an authenticated user, like the authentication unit 22 in the authentication server device 20. In other words, if the user is an authenticated user, the received request is redirected to the authentication server device 20, and if the user is an authenticated user, an acquisition request for acquiring the first user information of the user is authenticated. It has a function of transmitting to the server device 20. Further, when the access detection unit 62 acquires the first user information of the authenticated user from the authentication server device 20, the acquired first user information is included in the request (for example, included in an HTTP header or a cookie). It has a function of storing and passing this request to the user information acquisition unit 63.

  Based on the user information acquisition method 61 a defined by the user information acquisition method definition unit 61, the user information acquisition unit 63 receives the request passed from the access detection unit 62 and the first user partial information from the application user information storage unit 40. And a second user partial information acquisition function.

  Specifically, the user information acquisition unit 63 acquires the first user partial information from the request handed over from the access detection unit 62 based on the user information acquisition method 61a, and the attribute of the first user partial information By using the name as a user information acquisition parameter, the second user partial information is acquired from the application user information storage unit 40, and the acquired first user partial information and second user partial information are stored in the temporary storage unit 64. Execute the writing process.

  As shown in FIG. 5, the temporary storage unit 64 has acquired user information 64a acquired by the user information acquisition unit 63 (that is, third user information corresponding to the first user partial information and the second user partial information). ) Is temporarily stored.

  The user information storage method definition unit 65 stores the user information indicating how to store the user partial information acquired by the user information acquisition unit 63, as shown in FIG. A method 65a is defined. The user information storage method 65a includes an acquisition attribute name, a storage attribute name, a user information storage destination, and a user information storage parameter.

  The “acquisition attribute name” of the user information storage method indicates the attribute name of the user partial information acquired by the user information acquisition unit 63, in other words, the “acquisition attribute name” defined in the user information acquisition method definition unit 61. Represent. The “storage attribute name” is defined to correspond to the acquired attribute name, and indicates an attribute name when stored (written) in an arbitrary storage area by the user information storage unit 66 described later. Here, for example, when storing an attribute value corresponding to the acquired attribute name “USER_ID” in an arbitrary storage area, the attribute name is changed from the acquired attribute name “USER_ID” to the stored attribute name “U_ID” and stored. Show. The “user information storage location” defines where the user information acquired by the user information acquisition unit 63 is stored. In the present embodiment, “SESSION” indicates that data is stored in an HTTP session. Furthermore, the “user information storage parameter” defines a parameter required when storing user information. If there is no user information that requires a user information storage parameter, it may be omitted from the user information storage method as appropriate. Good. Supplementally, when the user information storage destination is other than a session, the user information storage parameter corresponds to the attribute name represented by the user information acquisition parameter among the storage attribute names, and the storage attribute indicating the attribute name when storing the attribute value Represents a name.

  Based on the user information storage method 65 a defined by the user information storage method definition unit 65, the user information storage unit 66 stores the first user partial information and the second user partial information acquired by the user information acquisition unit 63. After the storage attribute name is changed, the third user information including the first user partial information and the second user partial information is stored in an HTTP session or a memory (not shown) indicated by the user information storage destination. Has a (write) function.

  Further, the user information storage unit 66 has a function of sending the written third user information to the service providing unit 50.

  Next, the operation of the user information providing apparatus configured as described above will be described with reference to the schematic diagrams of FIGS. 2 to 6 and the flowchart of FIG. However, it is assumed that the access detection unit 62 receives a request of an authenticated user with the user ID “user01”.

  First, when receiving an authenticated user request from the client terminal 10, the access detection unit 62 transmits an acquisition request for acquiring the first user information of the user to the authentication server device 20. After acquiring the first user information (for example, user ID “user01”, role “userRole”) and storing the acquired first user information in the request, the request is sent to the user information acquisition unit 63. Deliver (step S101).

  Subsequently, the user information acquisition unit 63 acquires the user information acquisition method 61a from the user information acquisition method definition unit 61 (step S102).

  Next, the user information acquisition unit 63 selects one of acquisition attribute names (for example, USER_ID, ROLE, USER_NAME, TEL) in the acquired user information acquisition method (step S103). Here, it is assumed that the user information acquisition unit 63 selects the acquisition attribute name “USER_NAME”.

  Subsequently, the user information acquisition unit 63 determines whether or not a user information acquisition parameter is necessary to acquire the attribute value corresponding to the selected acquisition attribute name “USER_NAME” (step S104). If the result of the determination in step S104 indicates no (step S104: “unnecessary”), the process proceeds to step S106.

  When the result of determination in step S104 indicates that it is necessary (step S104: “necessary”), the user information acquisition unit 63 acquires user information for acquiring an attribute value corresponding to the acquisition attribute name “USER_NAME”. It is determined whether or not the attribute value corresponding to the acquisition parameter “USER_ID” has already been acquired (step S105). If the result of the determination in step S105 indicates no (step S105: “not acquired”), the process returns to step S103, and the USER_ID defined as the user information acquisition parameter is selected as the acquisition attribute name.

  When the result of determination in step S105 indicates that it has been acquired (step S105: “acquired”), the user information acquisition unit 63 corresponds to the acquisition attribute name “USER_NAME” based on the user information acquisition method. The attribute value “user 01” to be acquired is acquired from the application user information storage unit 40 (step S106), and the acquired attribute name “USER_NAME” and the acquired attribute value “user 01” are associated and written to the temporary storage unit 64.

  Next, the user information acquisition unit 63 compares the acquired attribute name defined in the user information acquisition method 61a with the acquired attribute name stored in the temporary storage unit 64, thereby obtaining unacquired user information (user part (Information) is determined (that is, it is determined whether or not all acquisition attribute names defined in the user information acquisition method 61a are stored in the temporary storage unit 64) (step S107). If the result of the determination in step S107 indicates that it exists (step S107: “exists”), the process returns to step S103, and an acquisition attribute name of unacquired user information (user partial information) is selected. Then, the processes in steps S103 to S107 are executed again.

  When the determination result in step S107 indicates NO (step S107: “does not exist”), the user information storage unit 66 acquires the user information storage method 65a from the user information storage method definition unit 65 (step S108). .

  Subsequently, the user information storage unit 66 selects one of acquisition attribute names (for example, USER_ID, USER_NAME, ROLE, TEL) in the acquired user information storage method 65a (step S109). Here, it is assumed that the user information storage unit 66 selects the acquired attribute name “USER_ID”.

  Next, the user information storage unit 66 associates the attribute value “user01” corresponding to the acquired attribute name “USER_ID” with the storage attribute name “U_ID” based on the user information storage method 65a, and stores the user information storage location “SESSION”. (Step S110), and the acquired attribute name “USER_ID” and the corresponding attribute value “user01” are deleted from the temporary storage unit.

  Subsequently, the user information storage unit 66 compares the acquired attribute name defined in the user information storage method 65a with the acquired attribute name stored in the temporary storage unit 64, so that unstored user information exists. (That is, it is determined whether or not all of the acquired attribute names defined in the user information storage method 65a have been deleted from the temporary storage unit 64) (step S111). If the result of the determination in step S111 indicates that it exists (step S111: “exists”), the process returns to step S109, and an acquisition attribute name of unstored user information (user partial information) is selected. Then, the processes in steps S109 to S111 are executed again.

  When the result of the determination in step S111 indicates NO (step S111: “does not exist”), the user information storage unit 66 stores the user information of the authenticated user stored based on the user information storage method 65a (third (User information) is delivered to the service providing unit 50 (step S112), and the processing in the user information providing device 60 is terminated.

  In addition, when the service providing unit 50 receives the user information of the authenticated user from the user information providing apparatus 60, the service providing unit 50 provides the service information to the user.

  According to the first embodiment described above, the attribute name of the first user partial information is used as the user information acquisition parameter, and the attribute name included only in the second user information among the attribute names indicated by the acquired attribute name is used. Even if the authentication function providing product is changed to another authentication function providing product by the configuration in which the corresponding attribute value is acquired from the second user information, the necessary user information from the database other than the changed authentication function providing product Since (second user partial information) can be acquired, there is no need to change the implementation of the Web / application server device 30, and the operational burden can be reduced.

(Second Embodiment)
FIG. 8 is a schematic diagram showing a configuration example of a service providing system including a user information providing apparatus according to the second embodiment of the present invention. The same parts as those in FIG. The portions including the parts are denoted by reference numeral 'and will not be described in detail. Here, the added functional parts will be mainly described.

  This embodiment is a modification of the first embodiment, and is a form in which user information to be acquired and user information to be stored are changed according to conditions. Specifically, the configuration shown in FIG. A user information acquisition / storage method selection rule definition unit 67 and a user information acquisition / storage method selection unit 68 are added.

  Further, as shown in FIG. 9, the user information acquisition method 61a includes an “acquisition method” in addition to the acquisition attribute name, the user information acquisition destination, and the user information acquisition parameter, and the user information storage method 65a includes: As shown in FIG. 10, an “storage method” is included in addition to the acquired attribute name, storage attribute name, user information storage destination, and user information storage parameter. Details of the “acquisition method” and “storage method” will be described later.

  Here, the user information acquisition / storage method selection rule definition unit 67 determines how to select a user information acquisition method and a user information storage method in advance by an operator's setting operation, as shown in FIG. A user information acquisition / storage method selection rule 67a to be shown is defined. The user information acquisition / storage method selection rule 67a includes a condition type, a condition, an acquisition method, and a storage method.

  “Condition type” of the user information acquisition / storage method selection rule defines on what condition the user information acquisition method and user information storage method are selected. “Condition” is a specific condition type. Define the value. Here, for example, “path (that is, URL path requested by the user)” is defined as the condition type, and “/ sample / App1” is defined as the condition as a specific value. “Acquisition method” corresponds to the acquisition method in the user information acquisition method 61a, and indicates that a user information acquisition method having the same acquisition method can be selected. Furthermore, “storage method” corresponds to the storage method in the user information storage method 65a, and indicates that the user information storage method having the same storage method can be selected.

  In this embodiment, the URL path is defined as the condition type of the user information acquisition / storage method selection rule. However, the present invention is not limited to this. For example, the access time and user ID system (specifically, user ID digit number or initial) may be defined as the condition type.

  The user information acquisition / storage method selection unit 68 has a function of selecting a user information acquisition method and a user information storage method based on the user information acquisition / storage method selection rule 67a. For example, when the URL path requested by the user is “/ sample / App1”, the user information acquisition / storage method selection unit 68 uses the user information acquisition method 61a defined by the user information acquisition method definition unit 61 ′. Among them, the user information acquisition method having the acquisition method “App1_GetUser” is selected, and among the user information storage methods 65a defined by the user information storage method definition unit 65, the user information storage method having the storage method “App1_SetUser” is selected. select.

  Next, the operation of the user information providing apparatus configured as described above will be described with reference to the schematic diagrams of FIGS. 9 to 11 and the flowchart of FIG. In the second embodiment, the processes of steps S101-1 to S101-4 are newly added between steps S101 and S102 of the process of the first embodiment. Other processes are the same as those in the first embodiment. Therefore, only the process between steps S101 and S102 of the first embodiment will be described.

  The user information acquisition / storage method selection unit 68 acquires the user information acquisition / storage method selection rule 67a from the user information acquisition / storage method selection rule definition unit 67 (step S101-1).

  Subsequently, the user information acquisition / storage method selection unit 68 selects one of the acquired user information acquisition / storage method selection rules (step S101-2). Here, it is assumed that the user information acquisition / storage method selection unit 68 selects a user information acquisition / storage method selection rule indicating the condition type “path” and the condition “/ sample / App1” as shown in FIG.

  Next, the user information acquisition / storage method selection unit 68 receives the condition type “path” and the condition “/ sample / App1” of the selected user information acquisition / storage method selection rule and the request received by the access detection unit 62. (That is, whether or not the request received by the access detection unit 62 includes information requesting “/ sample / App1”) is determined. (Step S101-3). If the determination result in step S101-3 indicates NO (step S101-3: “mismatch”), the process returns to step S101-2.

  When the result of determination in step S101-3 indicates that they match (step S101-3: “match”), the user information acquisition / storage method selection unit 68 selects the selected user information acquisition / storage method selection rule. Then, after selecting a user information acquisition method having the acquisition method “App1_GetUser” from the user information acquisition method definition unit 61, the selected user information acquisition method is written in the temporary storage unit 64. Similarly, the user information acquisition / storage method selection unit 68 selects a user information storage method having the storage method “App1_SetUser” from the user information storage method definition unit 65 based on the selected user information acquisition / storage method selection rule. After that, the selected user information storage method is written in the temporary storage unit 64 (step S101-4).

  According to the second embodiment described above, the configuration including the user information acquisition / storage method selection rule definition unit 67 and the user information acquisition / storage method selection unit 68 provides a user information acquisition method and user information storage that meet conditions. A user information acquisition method and a user information storage method used for acquiring / storing user information from among the stored user information acquisition method and the stored user information storage method In order to acquire and execute user information acquisition / storage processing, user information to be acquired / stored can be changed according to the conditions included in the request.

  According to at least one embodiment described above, in addition to acquiring the first user partial information from the first user information stored in the request, the attribute name of the first user partial information is set as the user information acquisition parameter. The authentication function providing product is different from the authentication function providing product by acquiring the second user partial information from the second user information stored in the application user information storage unit 40 in the Web / application server device 30. Even if it is changed, the necessary user information can be acquired from the database other than the authentication function providing product and the authentication function providing product, without requiring the modification of the function implemented in the Web application.

  Note that the methods described in the above embodiments are, as programs that can be executed by a computer, magnetic disks (floppy (registered trademark) disks, hard disks, etc.), optical disks (CD-ROMs, DVDs, etc.), magneto-optical disks. (MO), stored in a storage medium such as a semiconductor memory, and distributed.

  In addition, as long as the storage medium can store a program and can be read by a computer, the storage format may be any form.

  In addition, an OS (operating system) running on a computer based on an instruction of a program installed in the computer from a storage medium, MW (middleware) such as database management software, network software, and the like realize the above-described embodiment. A part of each process may be executed.

  Furthermore, the storage medium in each embodiment is not limited to a medium independent of a computer, but also includes a storage medium in which a program transmitted via a LAN, the Internet, or the like is downloaded and stored or temporarily stored.

  Further, the number of storage media is not limited to one, and the case where the processing in each of the above embodiments is executed from a plurality of media is also included in the storage media in the present invention, and the media configuration may be any configuration.

  The computer in each embodiment executes each process in each of the above embodiments based on a program stored in a storage medium, and a single device such as a personal computer or a plurality of devices are connected to a network. Any configuration of the system or the like may be used.

  In addition, the computer in each embodiment is not limited to a personal computer, and includes an arithmetic processing device, a microcomputer, and the like included in an information processing device, and is a generic term for devices and devices that can realize the functions of the present invention by a program. Yes.

  In addition, although some embodiment of this invention was described, these embodiment is shown as an example and is not intending limiting the range of invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

  DESCRIPTION OF SYMBOLS 1,1 '... Service provision system, 10 ... Client terminal, 20 ... Authentication server apparatus, 21 ... Common user information storage part, 21a ... 1st user information table, 22 ... Authentication part, 23 ... User information provision part, 30 , 30 '... Web / application server device, 40 ... application user information storage unit, 40a ... second user information table, 50 ... service providing unit, 60, 60' ... user information providing device, 61 ... user information acquisition method definition 61a ... user information acquisition method, 62 ... access detection unit, 63 ... user information acquisition unit, 64 ... temporary storage unit, 64a ... acquired user information, 65 ... user information storage method definition unit, 65a ... user information storage method , 66 ... User information storage unit, 67 ... User information acquisition / storage method selection rule definition unit, 67a ... User information acquisition / case Method selection rule, 68 ... user information acquisition / storage method selection unit.

Claims (3)

When receiving the request from the terminal, the authentication process of the user who transmitted the request is executed, and after the authentication process is successful, the attribute values corresponding to each of the plurality of attribute names and the plurality of attribute names of the authenticated user An authentication server device that transmits the request in which the first user information including:
A Web / application server device comprising service providing means for providing service information to the terminal in response to the transmitted request;
One of the attribute names included in the first user information, the attribute value corresponding to the attribute name, and an attribute name different from the attribute name and the different attribute name used for providing the service information to the terminal And a storage device that stores second user information that includes attribute values corresponding to, provided in the Web / application server device, wherein a part is acquired from the first user information. A user information providing device that sends first user partial information and third user information corresponding to second user partial information partially obtained from the second user information to the service providing means. There,
Of the attribute names included in at least one of the first user information and the second user information, the attribute name used for the acquisition, the user information acquisition destination, and the second of the attribute names used for the acquisition The user information acquisition parameter required when acquiring the attribute value corresponding to the attribute name included only in the user information (however, the user information acquisition parameter is the first user information among the attribute names used for the acquisition) And a user information acquisition method defining means for defining a user information acquisition method including an attribute name included in both of the user information and the second user information.
Corresponding to the attribute name used for the acquisition, the attribute name used for the acquisition, a storage attribute name indicating the attribute name when storing the attribute value, a user information storage destination, and a user required for storing the attribute value Information storage parameter (however, when the user information storage destination is other than a session, the user information storage parameter stores the attribute value corresponding to the attribute name represented by the user information acquisition parameter among the storage attribute names) A user information storage method defining means for defining a user information storage method including a storage attribute name indicating an attribute name at the time)
Means for acquiring the first user partial information from the transmitted request based on the user information acquisition method;
Means for acquiring the second user partial information from the storage device by using an attribute name of the first user partial information as the user information acquisition parameter based on the user information acquisition method;
Based on the user information storage method, after the attribute name of the acquired first user part information and the acquired second user part information is changed to the storage attribute name, the first user part information And means for writing the third user information consisting of the second user partial information into a storage area indicated by the user information storage destination;
Means for sending out the written third user information to the service providing means. The user information providing apparatus according to claim 1,
User information acquisition / storage method selection rule defining means defining a user information acquisition / storage method selection rule indicating how to select the user information acquisition method and the user information storage method;
Means for selecting the user information acquisition method from the user information acquisition method definition means based on the user information acquisition / storage method selection rule and selecting the user information storage method from the user information storage method definition means; A user information providing device further comprising: When receiving the request from the terminal, the authentication process of the user who transmitted the request is executed, and after the authentication process is successful, the attribute values corresponding to each of the plurality of attribute names and the plurality of attribute names of the authenticated user An authentication server device that transmits the request in which the first user information is stored;
A Web / application server device comprising service providing means for providing service information to the terminal in response to the transmitted request;
One of the attribute names included in the first user information, the attribute value corresponding to the attribute name, and an attribute name different from the attribute name and the different attribute name used for providing the service information to the terminal And a storage device that stores second user information that includes attribute values corresponding to, provided in the Web / application server device, wherein a part is acquired from the first user information. First user partial information and third user information corresponding to second user partial information obtained in part from the second user information, to the service providing means. A program,
The user information providing device;
Of the attribute names included in at least one of the first user information and the second user information, the attribute name used for the acquisition, the user information acquisition destination, and the second of the attribute names used for the acquisition The user information acquisition parameter required when acquiring the attribute value corresponding to the attribute name included only in the user information (however, the user information acquisition parameter is the first user information among the attribute names used for the acquisition) And a user information acquisition method defining means for defining a user information acquisition method including an attribute name included in both of the user information and the second user information.
Corresponding to the attribute name used for the acquisition, the attribute name used for the acquisition, a storage attribute name indicating the attribute name when storing the attribute value, a user information storage destination, and a user required for storing the attribute value Information storage parameter (however, when the user information storage destination is other than a session, the user information storage parameter stores the attribute value corresponding to the attribute name represented by the user information acquisition parameter among the storage attribute names) A user information storage method defining means for defining a user information storage method including a storage attribute name indicating an attribute name at the time)
Means for acquiring the first user partial information from the transmitted request based on the user information acquisition method;
Means for acquiring the second user part information from the storage device by using an attribute name of the first user part information as the user information acquisition parameter based on the user information acquisition method;
Based on the user information storage method, after the attribute name of the acquired first user part information and the acquired second user part information is changed to the storage attribute name, the first user part information And means for writing the third user information comprising the second user partial information into a storage area indicated by the user information storage destination,
Means for sending the written third user information to the service providing means;
Program to function as.

Images