JP2022156552A - Authentication system and authentication method - Google Patents

Abstract

To provide an authentication system and an authentication method which can perform authentication processing for access to SSO-linked services from an arbitrary account while maintaining a login state from a login account to the authentication system.SOLUTION: The authentication system comprises: a user information registration unit in which authentication information for utilization of a web service to which access is restricted is registered for each of accounts; an SSO authentication unit which performs authentication processing for the web service; and an account setting unit which, if the web service is a specific web service which can be utilized by a non-login account other than a login account used for login, sets an account for login to the specific web service on the basis of an input operation of a client terminal. For the specific web service, the SSO authentication unit performs authentication processing by using authentication information associated with the account set by the account setting unit.SELECTED DRAWING: Figure 3

Description

The present invention relates to an authentication system and an authentication method for performing access-restricted web service authentication by single sign-on.

Conventionally, an integrated authentication technology called Single Sign-On (SSO) has been widely used (see Patent Documents 1 to 3, for example). In the SSO environment, a plurality of web services that require individual authentication processing (for example, web applications provided on the cloud) can be used only by performing user authentication through a single login operation. Hereinafter, the authentication system used in the SSO environment will be referred to as "authentication system", and the web service linked by SSO will be referred to as "SSO linked service".

Normally, in an authentication system, when a client terminal requests access to an SSO cooperation service, an authentication server performs a login operation by the client terminal on behalf of the client terminal. Specifically, authentication information (for example, ID and password) for using the SSO linkage service is registered for each account, and the authentication server registers the login account used for login (for example, own personal ID) Authentication processing for the SSO collaboration service is executed using the authentication information associated with the .

JP 2012-014536 A JP 2012-234435 A JP 2016-085638 A

As described above, when a user logs in to the authentication system, authentication processing for the SSO collaboration service is automatically executed using authentication information linked to the login account. Therefore, complicated operations are required to use the SSO cooperation service with a non-login account (for example, a shared ID that can be used by multiple people) other than a login account. For example, it is necessary to log out of the login account once from the SSO environment, and then log in again with the account used for the SSO cooperation service. In this case, other SSO linkage services used by the login account are also terminated, which may reduce work efficiency.

SUMMARY OF THE INVENTION An object of the present invention is to provide an authentication system and an authentication method that can perform authentication processing for an SSO cooperation service using an arbitrary account while maintaining a login state to the authentication system using a login account.

An authentication system according to the present invention includes:
a user information registration unit in which authentication information for using restricted access web services is registered for each account;
an SSO authentication unit that executes authentication processing for the web service when a client terminal requests access to the web service;
When the web service is a specific web service that can be used with a non-login account other than the login account used for login, the account for logging in to the specific web service is set based on the input operation of the client terminal an account setting unit for setting the
The SSO authentication unit
executing the authentication process for the specific web service using the authentication information associated with the account set by the account setting unit;
For web services other than the specific web service, the authentication processing is executed using the authentication information associated with the login account.

An authentication method according to the present invention includes:
An authentication method performed when there is an access request from a client terminal to an access-restricted web service,
a first step of determining whether the web service is a specific web service that can be used by a non-login account other than the login account used for login;
a second step of setting an account for logging into the specific web service based on an input operation of the client terminal when the web service is determined to be the specific web service in the first step; ,
a third step of executing authentication processing for the specific web service using the authentication information associated with the account set in the second step;
a fourth step of executing the authentication process using the authentication information associated with the login account when it is determined in the first step that the web service is not the specific web service;
Prepare.

According to the present invention, it is possible to perform authentication processing for an SSO cooperation service using an arbitrary account while maintaining a login state to an authentication system using a login account.

FIG. 1 is a diagram showing a usage form of an authentication system according to an embodiment. FIG. 2 is a diagram showing an example of user information registered in the repository server. FIG. 3 is a flow chart showing an example of authentication processing by the authentication system. FIG. 4 is a flowchart showing an example of authentication processing by the authentication system. FIG. 5 is a diagram showing an example of a login screen of the authentication system. FIG. 6 is a diagram showing an example of an account setting screen.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
In this embodiment, a case will be described in which authentication processing is performed using SAML authentication (SAML: Security Assertion Markup Language), which is one of SSO techniques. SAML is an XML-based standard (communication protocol) for user authentication between different Internet domains. With SAML, not only the user information required for authentication, but also user attribute information (for example, the department to which the user belongs) can be given, and when using web services, it is possible to realize access permissions that consider user attributes. can.

FIG. 1 is a diagram showing an authentication system 1 according to one embodiment of the invention.
As shown in FIG. 1, the authentication system 1 is connected to a web server 2 and client terminals 3 via a network N so as to be able to communicate with each other. The authentication system 1 has an authentication server 11 and a repository server 12 .

The authentication server 11, the repository server 12, the web server 2, and the client terminal 3 are composed of, for example, a general-purpose computer, and include a CPU (Central Processing Unit) as an arithmetic/control device and a ROM (Read Only Memory) as a main storage device. and RAM (Random Access Memory), HDD (Hard Disk Drive) and SSD (Solid State Drive) as auxiliary storage devices, a mouse and keyboard as input devices, a display as an output device, and the like.

The web server 2 provides the client terminal 3 with SSO cooperation service on the cloud. When the web server 2 receives an access request from the client terminal 3, it requests the authentication system 1 to authenticate the user. Then, the web server 2 permits the authenticated user to use the web service to be accessed.

The authentication system 1 implements single sign-on authentication when the client terminal 3 uses an access-restricted SSO cooperation service provided by the web server 2 (for example, a web application provided on the cloud). When the authentication system 1 performs authentication at the time of the first access and issues an authentication cookie, the SSO cooperation service (including the web service provided by the web server 2) can be used without individual authentication processing.

In the authentication system 1, user authentication processing is performed by the cooperation of the authentication server 11 and the repository server 12. FIG.

For example, the authentication server 11 requests account information (eg, user ID and password) from the client terminal 3 when the client terminal 3 requests access to the SSO cooperation service. Then, the authentication server 11 performs user authentication based on the account information presented by the user. When the authentication succeeds, the authentication information associated with the user's account can be used to execute the SSO authentication process for the SSO cooperation service.

In other words, the authentication server 11 functions as an SSO authentication unit that executes authentication processing for the SSO collaboration service when there is an access request from the client terminal 3 to the SSO collaboration service. Furthermore, the authentication server 11 provides a specific SSO linkage service (hereinafter referred to as " specific service”), it functions as an account setting unit that sets an account for logging in to the specific service based on the input operation of the client terminal 3.
In the present embodiment, the authentication server 11 functioning as the SSO authentication unit incorporates the function of the account setting unit, but a server functioning as the account setting unit may be provided separately from the authentication server 11. .

The repository server 12 centrally manages user information of users who use the authentication system 1, resource information of each web server 2, and the like. The repository server 12 functions as a user information registration unit in which authentication information for using SSO cooperation services with access restrictions is registered for each account. An example of user information registered in the repository server 12 is shown in FIG.

As shown in FIG. 2, user information is registered for each account. Accounts include a personal account assigned to an individual user (“m170aaa” in FIG. 2) and a shared account shared by a plurality of users (“shared ID 1” in FIG. 2).

The user information includes account information Info1 and authentication information Info2. The account information Info1 is information required for user authentication, such as a user ID and password. The authentication information Info2 is information for performing authentication processing for the SSO cooperation service. In FIG. 2, a user ID "user_ID" and a password "user_password" are registered as account information Info1. Also, the user's surname "s_name", first name "g_name", and e-mail address "mail" are registered as authentication information Info2.
Note that the user information shown in FIG. 2 is an example, and other information (for example, the department to which the user belongs) may be registered.

Furthermore, in this embodiment, other account information Info3 that can be used by the account is registered as user information. In FIG. 2, three shared accounts of "shared ID 1", "shared ID 2", and "shared ID 3" are registered for an account whose user ID is "m170aaa". That is, the user whose user ID is "m170aaa" is authorized to use "shared ID 1", "shared ID 2", and "shared ID 3".

In addition, in the repository server 12, as the resource information of the SSO linkage service provided by the web server 2, a specific log-in account (shared ID) that can be used by a non-login account (shared ID) other than the login account used for login by the SSO linkage service is stored. Information indicating whether or not the service is an SSO linked service is registered.

In response to a request from the authentication server 11 , the repository server 12 retrieves user information required for authentication and resource information of the SSO cooperation service, and notifies the authentication server 11 of them.

Authentication processing using the authentication system 1 will be described below. 3 and 4 are flowcharts showing authentication processing by the authentication system 1. FIG.

In step S<b>101 , the user (client terminal 3 ) makes an access request to the SSO cooperation service provided by the web server 2 .

In step S<b>102 , the web server 2 makes a SAML authentication request to the client terminal 3 in response to the access request from the client terminal 3 . The SAML authentication request is redirected to the client terminal 3 authentication server 11 . If the user has not logged into the authentication system 1, the authentication system 1 presents a login screen (see FIG. 5) to the client terminal 3 in step S103. If the user has logged in to the authentication system 1, the processes of steps S103 to S106 are omitted.

In step S104, the user logs into the authentication system 1 by entering account information (user name and password in FIG. 5) on the login screen. A user logs into the authentication system 1 using, for example, a personal account.
In step S<b>105 , the input account information is notified from the client terminal 3 to the authentication server 11 .

In step S106, the authentication server 11 performs authentication processing for the authentication system 1 based on the notified account information. Specifically, the authentication server 11 compares the account information notified from the client terminal 3 with the account information registered in the repository server 12 in advance, and determines whether the user has legitimate authority. . If the account has valid authorization, the account is authenticated and login to the authentication system 1 is established.

Next, in step S107, the authentication server 11 allows the SSO linkage service to be accessed to be used by a non-login account (for example, shared ID1 to shared ID3) other than the login account (for example, personal ID) used for login. specific SSO linked service (hereinafter referred to as "specific service"). Specifically, the authentication server 11 determines whether or not the service is a specific service based on the resource information of the SSO collaboration service registered in the repository server 12 .

In the conventional authentication system, when a client terminal requests access to the SSO linkage service, the authentication server automatically performs the login operation from the client terminal. It is not possible to use the SSO linkage service with any account other than the login account while maintaining the login state.
In contrast, in the present embodiment, a specific SSO collaboration service can be used with any account other than the login account.

Specifically, when the SSO-linked service to be accessed is a specific service ("YES" in step S107), the processing from step S111 is performed. In step S111, the authentication server 11 inquires about account information to be displayed on the account selection screen. Then, in step S112, the authentication server 11 presents an account selection screen to the client terminal 3 based on the inquiry result to the repository server 12 (see FIG. 6).

FIG. 6 shows an account selection screen presented when the login to the authentication system 1 is performed using the account with the user ID "m170aaa" shown in FIG. As shown in FIG. 2, three shared accounts of "shared ID 1", "shared ID 2", and "shared ID 3" are registered for the account with the user ID "m170aaa". , “shared ID 1”, “shared ID 2”, and “shared ID 3” can also use the SSO cooperation service. Therefore, these accounts are presented in a selectable manner along with the logged-in account (Personal ID). In FIG. 6, available accounts are presented in a pull-down list.

Next, in step S113, the user (client terminal 3) selects an account to be used from the pull-down list on the account selection screen. In step S114, the client terminal 3 notifies the authentication server 11 of the selected account.

In step S115, the authentication server 11 acquires from the repository server 12 the authentication information linked to the account selected and notified on the account selection screen, and performs authentication processing for the SSO collaboration service to be accessed.

In step S116, the authentication server 11 notifies the client terminal 3 of the authentication result. The authentication result is redirected to the web server 2. In step S<b>117 , the web server 2 provides the requested SSO cooperation service to the client terminal 3 . The service provision screen displays the user ID (for example, "shared ID 1") of the account selected on the account selection screen.

At this time, the login state to the authentication system 1 by the account of the user ID "m170aaa" is maintained. Therefore, even if another SSO cooperation service is used before accessing the specific service, the specific service can be used with another account while the SSO cooperation service is activated.

On the other hand, if the SSO-linked service to be accessed is not the specific service ("NO" in step S107), normal SSO authentication processing is performed in steps S121 and subsequent steps. Specifically, in step S121, the authentication server 11 acquires the authentication information linked to the login account from the repository server 12, and performs authentication processing for the SSO collaboration service to be accessed.
In step S122, the authentication server 11 notifies the client terminal 3 of the authentication result. The authentication result is redirected to the web server 2. In step S<b>123 , the web server 2 provides the requested SSO cooperation service to the client terminal 3 .

As described above, the authentication system 1 according to the embodiment includes the repository server 12 and the authentication server 11. FIG. The repository server 12 functions as a user information registration unit in which authentication information for using an access-restricted SSO cooperation service (web service) is registered for each account. The authentication server 11 functions as an SSO authentication unit that executes authentication processing for the SSO cooperation service when there is an access request from the client terminal 3 to the SSO cooperation service, and the login used for the login by the SSO cooperation service. Functions as an account setting unit that sets an account for logging in to a specific SSO linked service based on an input operation of the client terminal 3 when the specific SSO linked service can be used with a non-login account other than an account. .
The SSO authentication unit performs authentication processing using the authentication information linked to the account set by the account setting unit for the specific SSO cooperation service, and for the SSO cooperation service other than the specific SSO cooperation service. In response, authentication processing (normal SSO authentication processing) is executed using the authentication information associated with the login account.

Further, the authentication method according to the present embodiment is an authentication method that is performed when there is an access request from the client terminal 3 to an access-restricted SSO collaboration service (web service). A first step (step S107 in FIG. 3) of determining whether or not the specific SSO linked service can be used with a non-login account other than the login account used for login, and in the first step, the SSO linked service is determined to be a specific SSO linked service, a second step (steps S111 to S113) of setting an account for logging in to the specific SSO linked service based on the input operation of the client terminal 3; In the third step (steps S114 and S115) of performing authentication processing for a specific SSO linked service using the authentication information linked to the account set in the second step, and in the first step, the SSO linked service is specified. and a fourth step (step S121) of executing authentication processing using the authentication information associated with the login account when it is determined that the service is not the SSO cooperation service.

According to the authentication system 1 and the authentication method according to the embodiment, it is possible to execute the authentication process for the SSO cooperation service using any account while maintaining the login state of the authentication system 1 using the login account. When using the SSO cooperation service with a login account, there is no need to re-login to the authentication system 1 with the account, and there is no need to end the SSO cooperation service being used with the login account. Therefore, work efficiency is remarkably improved without impairing the convenience of the SSO environment.

In the authentication system 1, the authentication server 11, as an account setting unit, displays an account selection screen (account setting screen, see FIG. 6) for setting an account for logging in to a specific SSO linked service (web service) to the client terminal. 3, and performs authentication processing as the SSO authenticator using the authentication information associated with the account set on the account setting screen.
This allows the user to arbitrarily set an account for using a specific SSO linkage service.

Also, in the authentication system 1, the repository server 12 (user information registration unit) registers available non-login accounts for each account, and the authentication server 11 functions as an account setting unit to function as an account selection screen (account setting screen ), a list of available non-login accounts is presented, and as the SSO authentication unit, authentication processing is performed using the authentication information linked to the account selected on the account setting screen.
Thereby, the user can easily grasp the accounts that can be used in the specific SSO cooperation service, and can set the desired account by a simple selection operation. It is also useful in terms of security because it prevents the setting of an account without legitimate authority.

Although the invention made by the inventor of the present invention has been specifically described above based on the embodiments, the present invention is not limited to the above embodiments, and can be changed without departing from the scope of the invention.

For example, in the embodiment, on the account selection screen, the logged-in user is presented with available accounts and selects the account to be used from among them, but the user can enter the account information on the account setting screen. You may do so.

Further, the authentication method and the flow of authentication processing described in the embodiment are examples, and an authentication method other than SAML authentication may be applied. Also, a multi-factor authentication method abandonment using not only user IDs and passwords but also biometric authentication and one-time passwords as account information may be applied.

It should be considered that the embodiments disclosed this time are illustrative in all respects and not restrictive. The scope of the present invention is indicated by the scope of the claims rather than the above description, and is intended to include all modifications within the meaning and range of equivalents of the scope of the claims.

1 authentication system 2 web server 3 client terminal 11 authentication server (SSO authentication part, account setting part)
12 Repository server (user information registration part)

Claims (4)

a user information registration unit in which authentication information for using restricted access web services is registered for each account;
an SSO authentication unit that executes authentication processing for the web service when a client terminal requests access to the web service;
When the web service is a specific web service that can be used with a non-login account other than the login account used for login, the account for logging in to the specific web service is set based on the input operation of the client terminal an account setting unit for setting the
The SSO authentication unit
executing the authentication process for the specific web service using the authentication information associated with the account set by the account setting unit;
executing the authentication process using the authentication information associated with the login account for a web service other than the specific web service;
Authentication system. The account setting unit presents to the client terminal an account setting screen for setting an account for logging in to the specific web service,
The SSO authentication unit executes the authentication process using the authentication information associated with the account set on the account setting screen,
The authentication system according to claim 1. The user information registration unit registers the available non-login accounts for each account,
The account setting unit presents a list of the available non-login accounts on the account setting screen,
The SSO authentication unit executes the authentication process using the authentication information associated with the account selected on the account setting screen,
The authentication system according to claim 2. An authentication method performed when there is an access request from a client terminal to an access-restricted web service,
a first step of determining whether the web service is a specific web service that can be used by a non-login account other than the login account used for login;
a second step of setting an account for logging into the specific web service based on an input operation of the client terminal when the web service is determined to be the specific web service in the first step; ,
a third step of executing authentication processing for the specific web service using the authentication information associated with the account set in the second step;
a fourth step of executing the authentication process using the authentication information associated with the login account when it is determined in the first step that the web service is not the specific web service;
An authentication method comprising:

Images