JP2002073928A - Method of linking security for workflow system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve such a problem in a workflow system which completes one work through the interlinking of a plurality of operations that a log-in ID and a password for an application associated with operations are hard to be safely acquired when an operator allotted to each operation makes a dynamic determination during execution. SOLUTION: An adapter 1 (112) is provided between each operation and the application 1 (123) allotted to each operation 1 (102), and a dynamically determined operator ID (109) is delivered as an argument of the adapter 1 (112) whereby the adapter 1 (112) acquires a log-in ID and a password for the application 1 (123) from a security server (118).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a method for mapping a worker assigned to a work in a workflow and a user who logs in to an application executing the work in a workflow system.

[0002]

2. Description of the Related Art A method of defining a business flow as a business process in the form of a transition of a plurality of works and activating an application associated with the work in accordance with the definition information according to the flow control is already known. A method of substituting a single login for a login to a plurality of authentication mechanisms is known as a unitary login mechanism. Japanese Patent Application Laid-Open No. 11-345211 discloses a method of sharing the management of access rights stored in different databases between different systems to facilitate management of access rights between different systems. Is being discussed.

[0003]

In the workflow system according to the present invention, a worker name assigned to a task in advance and a login ID to an external application system executed in association with the task are stored. It is possible with the prior art to make a fixed association. However, when the worker performing the work is dynamically determined during the transition of the workflow, for example, depending on the system load status or the output value of the preceding business step on the workflow, the latter worker may be unable to perform the task. If they are different, the operator and the login ID cannot be associated in advance.

[0004]

Means for Solving the Problems To solve the above problems, a worker name dynamically assigned by the workflow control system is passed as an activation parameter of an adapter that mediates between the workflow control system and an application for executing work. Means are provided, and in the adapter, the worker name is converted into the login ID and password for the application, so that the login ID and password for the application are obtained corresponding to the dynamically determined worker name.

[0005]

Next, an embodiment of the present invention will be described.
This will be described with reference to the drawings.

FIG. 1 shows an application log-in I.
D is an embodiment in the case where a password is managed using a security server. Workflow control system 101
Controls the transition of work according to a predefined business flow definition. In the case of the example of FIG. 1, the work 1 (102) is completed by executing the application 1 (123) via the adapter 1 (112), and similarly, the work 2 (103)
Execution is completed by executing the application 2 (124) via the application 2 (113). An operator is assigned to each task in performing the task. In addition, the assigned worker differs depending on various conditions at the time of executing the business flow. The correspondence between the conditions at the time of execution and the assigned worker is stored in advance in the work distribution rule DB 104 as a table 105. At the time of execution, the workflow control system 101 refers to the work distribution DB when, for example, activating the work 1 (102) (106), and obtains a worker name corresponding to the work 1 (102) at that time. Then adapter 1
The worker name is stored in the argument 109 of (112) and the adapter 1 (11
2) Start (108). Next, the adapter 1 (112) makes an inquiry to the security server 118 to obtain the login ID and password (114) of the application 1 (123) corresponding to the worker name. In the login ID list DB 119 of the security server 118, a correspondence table 120 between the operator name, the login ID, and the password needs to be registered in advance. The adapter 1 (112) logs in (121) to the application 1 (123) based on the login information obtained from the security server 118. Similarly, work 2
(103) At the time of startup, the workflow control system 101 inquires the work distribution rule DB 104 (107) to obtain a worker name, sets the worker name in the startup parameter 111 of the adapter 2 (113), and sets the adapter 2 (113). to start. The adapter 2 (113) inquires of the security server 118 (117) and the login I corresponding to the application 2 (124).
D, the password (115) is obtained, and the application 2 (124) is started based on the password (122). In this way, even when the worker is determined at the time of execution, the worker name can be associated with the login ID and password for the application.

FIG. 2 shows the workflow control system of FIG.
3 is an example of a processing flow relating to each operation in 101. At the start of work, based on the work start conditions,
After acquiring the worker from the distribution rule DB (201), the worker name is set in a parameter at the time of starting the adapter (202), and the adapter is called (203). Depending on the nature of the application, there is a case where the adapter waits for a response or a case where it does not wait.Therefore, the judgment is made next (204).
05).

FIG. 3 is an example of a processing flow of the adapter 1 (112) and the adapter 2 (113) of FIG. The adapter started by the workflow control system generates input parameters to the application in preparation for starting the application to be connected (301). Also, by using the worker name in the adapter start parameter passed from the workflow control system as an input parameter to the security server, the security server is called to obtain the login user ID and password for the application (30
2). The user logs in to the application using this user ID and password (303), and calls the application (304). Determines whether the application returns a response (305) .If there is a response, logs out from the application after the response arrives from the application (306), prepares for termination of the adapter itself (307), and returns to the workflow The response from the application is returned to the control system, and the completion of the adapter process is notified to transition the internal state of the workflow (308). If the application does not return a response, the application logs out of the application (309) and notifies the workflow control system of the completion of the adapter processing to transition the internal state of the workflow (310). In this way, by obtaining the worker name from the workflow control system, it is possible to convert the login ID and password to the corresponding application and call the application.

FIG. 4 shows an example of cooperation between the work distribution rule DB (406) managed by the workflow control system and the login ID correspondence definition tool (411) managed by the security service. I have. For work assignment rules, see the work assignment rule definition tool (4
01). The work distribution rule definition tool (401) has a definition input screen (405), input means (403), and storage means (402). As a result, the user can determine to whom the worker is assigned for a certain work, based on various conditions at the time of executing the workflow system. As a result, a correspondence table (407) between the condition and the worker name corresponding to the condition is generated in the work distribution rule DB (406). On the other hand, the login ID list DB (416) of the security service also has a login ID correspondence definition tool (411). The login ID correspondence definition tool (411) includes an input screen (414), input means (413), and storage means (412). Login ID list D by login ID correspondence definition tool (411)
In B (416), a login ID correspondence table (417) in which a login ID and a password for the target application corresponding to the worker name and the adapter name are stored is generated. Here, a new cooperation tool (408) is prepared. Cooperation tool (40
In (8), a copy (410) of the correspondence table (407) of the work distribution rule DB (406) is internally stored. Cooperation tool (408)
The worker definition information extraction / display means (409) reads the correspondence table (407) in the work distribution rule DB (406), compares it with the retained copy (410), and compares the newly defined worker (410) with the newly defined worker. Recognize and copy information and changed worker information (410)
After updating the information, the operator definition information is displayed in the form of the login ID correspondence definition tool (411) in a form that clearly expresses the difference information.
Displayed in (414) (415). As a result, the user of the login ID correspondence definition tool (411) can easily register and change the required operator name in the login ID list DB (416).

FIG. 5 shows an example of a processing flow of the operator definition information extracting / displaying means (409) of the cooperation tool (408) of FIG. The distribution definition is read from the work distribution rule DB (406) (501), and is compared with the definition information previously read and held in the cooperation tool (408) to recognize the difference (502).
After overwriting the currently loaded distribution definition information with the previously read information (503), the distribution definition information is displayed on the login ID correspondence definition tool screen (504). At this time, the difference from the previous time is distinguished by color, for example, to make it easier to visually recognize.

As described above, in the present invention, since the adapter performs processing necessary for connecting the security server to the workflow, it is possible to cooperate with the security server without modifying the workflow system.

Further, even when a necessary application is changed in each work in the business definition of the workflow, the adapter may be changed corresponding to the change of the application.

For example, in FIG. 1, when the application 1 (123) used in the work 1 is changed,
By making a change to the adapter 1 (112), it is possible to deal with a change in the application 1. That is, without changing the adapter 2 (113), the security server (118), and the workflow system (101), the application 1
(123) can be changed.

As described above, by applying the present invention, when a security server is connected to a workflow system, it does not affect the workflow system itself or other components of the system, so that it is necessary for system construction or modification. The number of man-hours is smaller than before. In addition, it is possible to flexibly respond to changes in the elements constituting the system.

In the present invention, an adapter is used to connect the security server and the workflow.
It is also possible to connect other components to the workflow system.

[0016]

According to the present invention, even when a worker assigned to each work in a workflow system is dynamically determined, a login ID and a password for a connection application corresponding to the assigned worker are determined. This makes it possible to obtain security, and security by access control on a worker basis can be ensured.

Further, by linking the work distribution DB information in the workflow control system with the security server, the efficiency of inputting a login ID correspondence table based on the work distribution DB information can be improved.

[Brief description of the drawings]

FIG. 1 is a schematic diagram showing cooperation between a workflow control system, a security server, and a connection application.

FIG. 2 is a diagram showing an example of an adapter calling process flow of the workflow control system.

FIG. 3 is a diagram showing an example of an adapter processing flow.

FIG. 4 is a schematic diagram showing cooperation between a work distribution DB and a security server.

FIG. 5 is a diagram showing an example of a processing flow of a new or change definition information extracting / displaying means in a coordination tool between a work distribution DB and a security server.

[Explanation of symbols]

101: Workflow control system, 102, 103 ...
Work in the workflow control system, 112, 11
3: Adapter for connecting the workflow control system to the external connection application, 123, 124: External connection application, 104: Workflow work distribution rule DB, 118: Security server, 119: External connection application login ID list DB, 408: Workflow control system Tool for linking with the security server.

Continued on the front page (72) Inventor Katsuhiko Kondo 1099 Ozenji Temple, Aso-ku, Kawasaki City, Kanagawa Prefecture F-term in Hitachi, Ltd. System Development Laboratory 5B049 AA05 BB00 CC00 DD05 GG04 GG07 5B085 AE02 BG07

Claims (3)

[Claims] An operation on a business flow is completed by processing of different application systems, and a plurality of operations sequentially transition to one operation to constitute a single operation. Assuming a workflow system in which there is an application to be realized, and the application and work are linked via an adapter that performs application-specific startup / termination processing, input / output data format, protocol conversion, etc. Each application requires a login using a user ID and a password to start the application. In such a workflow system, the workers assigned to the work are not statically determined when the workflow system is constructed. , When executing workflow control When dynamically determined by conditions, the dynamically determined worker name is passed to the adapter as a parameter at the time of calling the adapter associated with the work. Login ID to the application where the work is actually executed
And a workflow security cooperation system characterized by obtaining a password. 2. The workflow security system according to claim 1, wherein a login ID for an operator and an application is provided.
If the mapping with the password is realized using the unitary login function of the security server, when the worker to be assigned to the work is newly defined in the workflow system, the created new worker definition information is
A system which facilitates mapping definition of an operator and a login ID on a security server by contacting and displaying a login ID correspondence definition tool of a security server. 3. The workflow security system according to claim 1, wherein a login ID for an operator and an application is provided.
When the mapping with the password is realized using the unitary login function of the security server, when a change is made to the worker assigned to the work in the definition information of the workflow system, the change information corresponds to the login ID of the security server. A system characterized in that it is easy to change the mapping definition between an operator and a login ID on a security server by contacting and displaying a definition tool.