JP2005321970A - Computer system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To realize a single sign-on environment without changing a back-end server. <P>SOLUTION: A computer system includes a window server which becomes a window of service to a client, one or more back-end servers which provide service to the clients, and a relay server which relays access to the back-end server. While maintaining a session with the client, the relay server adds the second identification information which the window server acquired to an access request to the back-end server from the client, and requires access to the back-end server. After verifying by the second identification information, the back-end server transmits the content requested by the client to the relay server. When the content is received from the back-end server, the relay server transmits the content concerned to the client. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a computer system having a server that functions based on login from a client, and to a technique for automatically logging in to a Web application.

  In-house information systems are shifting from conventional client-server systems to three-tier systems based on Web (World Wide Web) technology. Various business operations have been converted into Web applications so far, and business efficiency has been improved. However, on the other hand, there are many information systems for each business in the company, and users are forced to perform complicated operations such as visiting these systems and logging in to each system to perform daily business. . In order to solve this problem, single sign-on technology has attracted attention. Single sign-on is a login method in which, when using a plurality of systems that require authentication, the user can use all the systems by performing a login operation only once and receiving authentication.

  The single sign-on technology includes a portal server for the client to automatically log in to multiple Web servers. The portal server performs user authentication processing when there is an access request from the client. Based on a user ID that permits the above, a technique for taking out login information of a system frequently used by the client and logging in to a Web server is known. (For example, refer to Patent Document 1).

  Also, on the website, as information to be provided from the website to the client-side terminal, a sign-up screen for inputting authentication information including a client login ID and password, and URL information indicating the location in the web server are signed. There is known a technique for preparing a bookmark registration screen in which URL information including the office information input on the up screen is set and providing it to the end of the client side to realize automatic login (for example, patent document) 2).

Further, in response to the login request connected to the client and the plurality of application servers, the login proxy system generates a login request including authentication information for the application of the user and logs in on behalf of the user. A technique is known in which the content of a response to be returned is converted so as to function in the same manner as when the client directly receives the response from the application server, and the response is returned to the client (see, for example, Patent Document 3).
JP 2003-141081 A JP 2002-41380 A JP 2002-334056 A

  According to the above-described conventional technology, basically, the back-end server needs to be modified, which tends to increase the construction period and construction cost for realizing single sign-on. The construction of IT systems requires shortening the construction period and cost effectiveness, and it may be difficult to achieve this requirement for these products.

  Further, even in single sign-on by the method of Patent Document 3 that does not require modification of the back-end server, when the load on the computer resource of the proxy server increases, or when creating a URL on the client side such as JavaScript (registered trademark), There is a problem in feasibility when URL conversion is difficult. Even if URL conversion is realized, the method of embedding the user ID and password in the request URL still has security problems.

  An object of the present invention is to realize automatic login without modifying a back-end server and to realize a single sign-on environment.

  The present invention relates to a computer system that includes a window server serving as a window of service for clients, one or more back-end servers that provide services to the clients, and a relay server that relays access to the back-end servers. The window server authenticates the client based on the first authentication information, establishes a session, and displays a screen including a link for requesting the window server to access the back-end server. Transmitting and accepting an access request from the client to the back-end server while maintaining the established session, and second authentication of the client to the back-end server based on the first authentication information acquired from the client Get information The client establishes a session with the relay server, and the relay server maintains the session with the client while the window server acquires the access request from the client to the back-end server. 2 adds authentication information and requests access to the back-end server. The back-end server authenticates with the second authentication information, and then transmits the content requested by the client to the relay server. When the relay server receives content from the back-end server, the relay server transmits the content to the client.

  According to the present invention, automatic login can be realized without modifying the back-end server. As a result, a low-cost single sign-on environment can be realized.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(First embodiment)
First, as a first embodiment, a case where a Web application of a back-end server uses basic authentication will be described.

  FIG. 1 is a system configuration diagram of a computer system according to the first embodiment of this invention.

  The client 100, the window server 101, the relay server 104, the backend server 1 (106), and the backend server 2 (107) each have a control device (CPU), a memory, an input / output device, and a network interface. ) Is a computer device that performs arithmetic processing by executing a program stored in a memory. The client 100, the window server 101, the relay server 104, the back-end server 1 (106), and the back-end server 2 (107) are connected by a network 108, and data, control information, etc. can be communicated between these computer devices. It has become.

  The window server 101 and the relay server 104 provide the client 100 with automatic login to the back-end servers 106 and 107. However, access from the client 100 to the back-end server 1 (106) and the back-end server 2 (107) passes through the relay server 104 depending on the proxy settings. In the example of FIG. 1, there are two back-end servers 106 and the like. However, when a large number of back-end servers are provided, the client 100 can automatically log in to a large number of back-end servers.

  The window server 101 includes a user management table 102 (FIG. 3A) that stores authentication information for the window server of the client 100 and a mapping table 103 that stores authentication information such as the back-end server 106 of the client 100. (FIG. 3B) is provided. However, if the window server 101 can access the user management table 102 and the mapping table 103, the user management table 102 and the mapping table 103 may be provided outside the window server 101.

  The relay server 104 is provided with an authentication information table 105 (FIG. 3C) that stores authentication information for automatic login to the back-end server 106 and the like. However, if the relay server 104 can access the authentication information table 105, the authentication information table 105 may be provided outside the relay server 104.

  FIG. 2 is a timing chart of the first embodiment, showing a case where the back-end server 106 or the like uses basic authentication.

  When the client 100 automatically logs in to the back-end server 1 (106), it is necessary to log in to the window server 101 first (200). Specifically, the window user ID and window password entered by the user are included in the login request by the browser of the client 100 and transmitted to the window server 101. Upon receiving the login request from the client 100, the window server 101 authenticates by comparing the window user ID and window password included in the login request with the window user ID 300 and window password 301 recorded in the user management table 102. (201). Here, the authentication method of the window server may be any authentication method used in a Web application such as Form authentication or Basic authentication.

  If the user authentication (201) is successful, a session between the client 100 and the window server 101 is established by transmitting the window session ID 302 to the client 100 (202). Thereafter, the session is validated by including this window session ID 302 in the access from the client 100. In the subsequent period in which this session is valid, the client 100 can automatically log in to the back-end server 106 or the like that is subject to automatic login. The session is valid until the client 100 logs out from the window server 101 or times out.

  When this session is established (202), the window server 101 transmits an automatic login screen 400 (FIG. 4) to the client 100.

  The client 100 receives the automatic login screen 400, the user desires access to the back-end server 1 (106), and selects the login to the back-end server 1 (106) on the automatic login screen 400 (FIG. 4). Then, the client 100 requests the window server 101 to access the backend server 1 (106) (203).

  Then, the window server 101 retrieves the window user ID 300 corresponding to this session (202), and acquires the user ID 304 and password 305 of the back-end server 1 (106) corresponding to the window user ID 300 from the mapping table 103.

  Next, the window server 101 issues an SSO session ID 308 in order to maintain a session between the client 100 and the relay server 104 (205). It is conceivable that the SSO session ID 308 is issued using a random number.

  Further, the window server 101 uses the user ID 304 and the password 305 of the back-end server 1 (106), authentication information necessary for basic authentication (a colon symbol is inserted between the user ID and password, and the entire character string is Base64). (Encoded symbol string) is created and set in the authentication information table 105 of the relay server 104 in combination with the SSO session ID 308 (206).

  Next, the window server 106 transmits an HTTP redirect request (500 in FIG. 5) to the client 100 to set the SSO session ID 308 (207).

  The client 100 that has received the HTTP redirect request to the back-end server 1 (106) attempts to access the back-end server 1 (106) including the SSO session ID 308 in order to request the setting of the SSO session ID 308 (see FIG. 5), since the proxy setting via the relay server (104) is set in advance when accessing the back-end server 1 (106), the client 100 accesses the relay server 104 (208).

  The relay server 104 that has received the access request from the client 100 extracts the SSO session ID 308 from the URL (501 in FIG. 5). Further, the relay server 104 sets the extracted SSO session ID 308 in the cookie of the client 100 and transmits a request to redirect to the backend server 1 (106) (502 in FIG. 5) to the client 100 (209).

  The client 100 that has received the redirect request from the relay server 104 sets the SSO session ID 308 to Cookie and attempts to access the back-end server 1 (106) (503 in FIG. 5). 104 is accessed (210). The client 100 accesses the relay server 105 including the SSO session ID 308 according to the setting of the cookie.

  The relay server 104 that has received the access refers to the authentication information table 105, extracts the authentication information 309 of the back-end server 1 (106) corresponding to the SSO session ID 308, and uses the authentication information 309 as the access request from the client 100. It adds to the HTTP header and makes an access request to the backend server 1 (106) (212).

  The back-end server 1 (106) receiving the access request performs basic authentication by comparing the authentication information added to the HTTP header with the authentication information recorded in the back-end server 1 (106). If the authentication is successful, the content is transmitted to the relay server 104 (213).

  The relay server 104 that has received the content from the back-end server 1 (106) transfers the content to the client 100. Then, the client 100 receives the content transmitted from the back-end server 1 (106) from the relay server 104.

  With the above processing, automatic login when the back-end server 1 (106) is in Basic authentication can be realized. Thereafter, when an access request is made to the back-end server 1 (106), steps 210 to 214 are repeated.

  In the present embodiment, the window server 101 and the relay server 104 have been described as separate servers, but may be realized as the same server (the same program). In such a configuration, the SSO session (209) established between the client 100 and the relay server 104 can be replaced with the session (202) established between the client 100 and the window server 101. It is. When substituting a session, the SSO session ID 308 issued in the SSO session ID issuance (205) is substituted with the window session ID 302 of the session (202) established between the client 100 and the window server 101. Therefore, the processing steps 207 to 209 for establishing a session between the client 100 and the relay server 104 are not necessary. Instead, the window server 101 transmits an HTTP redirect request to the client 100 in order to cause the client 100 to make an access request to the back-end server 1 (106).

  As described above, automatic login can be realized.

  FIG. 3A is an example of the user management table 102. The user management table 102 stores a window password 301 and a window session ID 302 corresponding to the window user ID 300. The window user ID 300 and the window password 301 are collated with the authentication information transmitted by the client 100 when the client 100 logs into the window server 101. In the user table 102 of this embodiment, a window session ID 302 for maintaining a session between the window server 101 and the client 100 is also stored.

  FIG. 3B is an example of the mapping table 103. The mapping table 103 stores the user ID 304 and password 305 of the back-end server 1 (106) and the user ID 306 and password 307 of the back-end server 2 (107) corresponding to the window user ID 303. The user ID 304 and password 305 of the back-end server 1 (106) are authentication information that is collated with authentication information stored in advance in the back-end server 1 (106) when accessing the back-end server 1 (106). . The same applies to the back-end server 2 (107).

  Note that the mapping table 103 may be set in the client 100 by inputting authentication information such as the backend server 106 from the screen using a user interface (FIG. 6), or may be set in a batch by the administrator. Also good.

  FIG. 3C is an example of the configuration of the authentication information table 105. The authentication information table 105 stores encoded authentication information 309 corresponding to the SSO session ID 308.

  FIG. 4 is an example of an automatic login screen 400. The automatic login screen 400 includes a link 402 to the backend server 1 (106) and a link 403 to the backend server 2 (107), and the link destination to the backend server 1 (106) is 401. It is described in. When the user requests access to the backend server 1 (106), automatic login is realized by selecting the link 402.

  The link destination for automatic login is formed by adding a parameter storing the automatic login destination to the automatic login request URL of the window server 101 as indicated by 401. However, as a method of adding the automatic login destination to the URL, the automatic login destination may be included in a path other than the URL 401, or the automatic login destination may be POSTed using the POST method of HTTP. That is, according to the POST method, data (automatic login destination) to be transmitted to the main body (entity) following the request can be included.

  FIG. 6 is an example of a user interface when the client 100 is set with the mapping table 103. When a screen for allowing the user to input authentication information of the back-end server 1 (106) and the back-end server 2 (107) is displayed and the user instructs completion of input after the authentication information is input (click “OK”), the mapping table In 103, authentication information corresponding to the window user ID 303 is registered.

  FIG. 7 is a system configuration diagram of an embodiment when automatic login and direct login are used in combination.

  If you want to use the backend server 1 (106) by logging in directly in parallel with the basic authentication automatic login described above, create a subdomain for automatic login and pass through the relay server 104 only during automatic login. You may want to change your browser proxy settings.

  Specifically, the back-end system 1 (106) is provided with a subdomain ssodomain for automatic login different from that for normal login. The backend system 1 (106) is also provided with a subdomain anydomain for normal login. The proxy of the client 100 is set to access ssogateway.ssodomain (relay server 104) when accessing ssodomain (702).

  At the time of automatic login, an access request is made to the ssodomain to pass through the relay server 104 (701), and at the time of direct login, an access request to the anydomain is made to pass through the relay server 104 (700). 106).

  By using both direct login and automatic login in combination, unnecessary access requests can be prevented from passing through the relay server 104, and the load on the relay server 104 can be reduced.

  In the above-described embodiment, the relay server 104 is provided separately from the back-end server 1 (106) and the back-end server 2 (107), and basic authentication is performed by adding a basic authentication header to the access request. However, it is also possible to implement the relay server 104 by using the extended function of the Web server that constitutes each back-end server 106 and the like.

  Specifically, before the program of the back end server 1 (106) receives an access request from the client 100, it is acquired in the Web server, a basic authentication header is added to the acquired access request, and the back end server By transmitting to the program 1 (106), automatic login is realized. Microsoft's IIS (Internet Information Server / Internet Information Service) can be realized by using the ISAPI interface and the Apache API of the Apache Software Foundation's Apache Web server.

  As described above, according to the first embodiment, automatic login can be realized when the back-end server 106 or the like uses basic authentication.

  That is, in basic authentication, when a client makes an access request to a back-end server, the back-end server requests authentication information of a user ID and a password from the client. The client adds a basic authentication header obtained by encoding the user ID and password input by the user with Base64, and makes an access request to the back-end server. The back-end server that has received the access request performs authentication by checking the transmitted basic authentication header against the user ID and password stored in the back-end server.

  In such basic authentication, the client needs to add a basic authentication header to the HTTP header for every access request to the back-end server. Normally, however, the browser stores the acquired user ID and password in the browser at the time of the first access request from the client, and automatically requests a basic authentication header for each access request to the backend server. This is realized by adding to the HTTP header. Note that it is impossible for a general browser such as Microsoft Internet Explorer or Netscape Communications Netscape Navigator to set a basic authentication user ID and password in the browser from the outside.

  Therefore, in the first embodiment, an HTTP request at the time of an access request from the client 100 to the back-end server 1 (106) is not transmitted directly, but is routed through the relay server 104, and the relay server 104 sets the basic authentication header to HTTP. By adding it to the header, Basic authentication single sign-on is realized.

(Second Embodiment)
Next, as a second embodiment of the present invention, a case where the Web application of the backend server uses Form authentication will be described.

  FIG. 8 is a system configuration diagram of a computer system according to the second embodiment of this invention.

  In the second embodiment, unlike the above-described first embodiment, the relay server 104 and the authentication information table 105 are not provided. Other configurations are the same as those in the first embodiment. In addition, the same structure as 1st Embodiment attaches | subjects the same code | symbol, and the description is abbreviate | omitted.

  FIG. 9 is a timing chart of the second embodiment and shows a case where the back-end server 106 or the like uses Form authentication.

  The first step when the client 100 automatically logs in to the backend server 1 (106) is the same as 200 to 204 in the first embodiment described above.

  When the window server 101 acquires the user ID 304 and password 305 of the back-end server 1 (106) (204), the window server 101 logs in to the back-end server 1 (106) (900). This login is the same as the normal Form authentication login. When the back-end server 1 (106) requests the POST method, the window server 101 uses the user ID 304 and the back-end server 1 (106). The password 305 is POSTed (transmitted including data (user ID 304 and password 305) to be transmitted to the main body (entity) following the request). When the backend server 1 (106) requests the GET method, the user ID 304 and password 305 of the backend server 1 (106) are GETd (the user ID 304 and password 305 are included in the URL as a query). Send).

  When performing pre-processing such as obtaining a session ID by accessing a specific page in advance when performing Form authentication, the window server 101 may perform pre-processing. The authentication method may be an authentication method using arbitrary information other than the user ID 304 and the password 305.

  Receiving the login request, the back-end server 1 (106) acquires the user ID 304 and the password 305 from the login request. The back-end server 1 (106) performs back-end user authentication by comparing the acquired user ID 304 and password 305 with a user ID and password stored in advance (901). When the authentication is successful, the back-end server 1 (106) issues a back-end session ID, and transmits a screen and a back-end session ID after login to the window server 101 (902).

  Upon receiving the response, the window server 101 acquires the back-end session ID from the response, and performs a handover process to the client 100.

  The takeover process differs depending on the session tracking method of the back-end server 1 (106). The session tracking method is a method for maintaining a session in HTTP without the concept of a session, and includes a cookie method and a URL rewriting method. The cookie method is a method for maintaining a session by setting a back-end session ID in the cookie of the client 100 and including the cookie in the access to the back-end server 1 (106). The URL rewriting method is a method of maintaining a session by embedding a back-end session ID and accessing the URL in the response content of the back-end server 1 (106). Hereinafter, the automatic login method will be described in order for each session tracking method.

  First, the case where the session tracking method of the back-end server 1 (106) is the Cookie method will be described.

  The back-end server 1 (106) that issued the back-end session ID sets Cookie in the HTTP response header and transmits the session ID to the window server 101 (902), as indicated by 1000 in FIG.

  Upon receiving the response, the window server 101 acquires the backend session ID from the HTTP response header (903). Next, the window server 101 transmits a session ID takeover redirect response (1001 in FIG. 10) to the client 100 (904). In response to the session ID takeover redirect response, the client 100 sets the backend session ID to a cookie using the domain designation (sets a cookie with sessionid = xvz for a server in the ssodomain subdomain). Further, the client 100 accesses the back-end server 1 (106). When the client 100 accesses the specified domain (ssodomain subdomain) by specifying the domain of the cookie, the access is performed by including the set cookie (sessionid = xvz) in the access request.

  By using the domain designation and placing the window server 101 and the back-end server 1 (106) in the same subdomain, the client 100 that has received the redirect request for setting the back-end session ID from the window server 101 can The same back-end session ID can be set for the server 1 (106) and the session can be maintained.

  For this reason, in the case of the cookie method, the window server 101 and the back-end server 1 (106) are arranged in the same subdomain. In this embodiment, both servers are arranged in ssodomain. The window server 101 transmits a redirect request that causes the client 100 to set a cookie with sessionid = xyz to the server whose subdomain is ssodomain (1001 in FIG. 10).

  Upon receiving the redirect request from the window server 106, the client 100 includes the back-end session ID of the back-end server 1 (106) (1002 in FIG. 10) and sends it to the back-end server 1 (106) according to the setting of the cookie. Request access (905). The back-end server 1 (106) that has received the access extracts the back-end session ID from the access request of the client 100, and performs processing corresponding to the back-end session ID.

  Thereafter, the client 100 directly accesses the back-end server 1 (106) including the cookie.

  Through the above processing, automatic login when the back-end server 1 (106) is Form authentication can be realized.

  Next, a case where the session tracking method of the back-end server 1 (106) is the URL rewriting method will be described.

  The difference from the Cookie method is after 902 in FIG. In the case of the URL rewriting method, the back-end server 1 (106) transmits response content (1100 in FIG. 11) including the back-end session ID to the window server 101 (902).

  The window server 101 that has received the response content acquires the back-end session ID from the response content (903).

  Next, the window server 101 transmits a session ID takeover redirect to the client 100 (904). In the session ID takeover redirect, the acquired backend session ID is embedded in the URL that allows the client 100 to access the backend server 1 (106) (1101 in FIG. 11).

  The client 100 that has received the redirect request accesses the back-end server 1 (106) by the URL (1102 in FIG. 11) including the back-end session ID (905).

  Upon receiving the access request, the back-end server 1 (106) extracts the back-end session ID from the access request of the client 100, and performs processing corresponding to the back-end session ID.

  Through the above processing, automatic login when the back-end server 1 (106) is Form authentication can be realized.

  In the case of the URL rewriting method, it is not necessary to place the window server 101 and the back-end server 1 (106) in the same subdomain as in the cookie method.

(Third embodiment)
Next, another embodiment when the Web application of the backend server uses Form authentication will be described as a third embodiment of the present invention.

  The system configuration of the third embodiment is the same as that of the second embodiment (FIG. 8) described above.

  FIG. 12 is a timing chart of the third embodiment, showing a case where the back-end server 106 and the like use Form authentication. In the present embodiment, the session tracking method of the back-end server can be applied to either the cookie method or the URL rewriting method.

  The first step when the client 100 automatically logs in to the backend server 1 (106) is the same as 200 to 204 in the first embodiment described above.

  When the window server 101 acquires the user ID 304 and password 305 of the back-end server 1 (106) (204), the acquired user ID 304 and password 305 of the back-end server 1 (106) are embedded in the login form and embedded login. The form is sent to the client 100 (1200). The login form includes a location where the client 100 embeds a URL for requesting login to the back-end server 1 (106), a user ID 304 of the back-end server 106 to access, a password 305, and the like. Further, the input type in which the user ID 304 and the like of the back-end server 106 and the like and the password 305 and the like are described has a hidden attribute, and the form is submitted when the response HTML is read (1300 in FIG. 13). By setting the input type to the hidden attribute, the user ID 304 and password 305 of the backend server 1 (106) are not displayed on the screen of the client 100 when reading HTML. Since the form is submitted when the response HTML is read by using the handler script of the onload event, the client 100 logs in including the user ID 304 and the password 305 of the back-end server 1 (106) at the same time when the response HTML is read. The form for use (1301 in FIG. 13) is transmitted to the back-end server 1 (106) (1201).

  Then, the back-end server 1 (106) collates the authentication information transmitted from the client 100 with the authentication information stored in the back-end server, and when the authentication is successful, the client 100 transfers to the back-end server 1 (106). You can log in.

  Through the above processing, automatic login when the back-end server 1 (106) is Form authentication can be realized.

(Fourth embodiment)
Next, automatic login with a summary function will be described as a fourth embodiment of the present invention.

  14 is an example of an automatic login screen (summary screen) for automatic login with a summary function. The summary function is a function that allows the user to directly select and access content that the user wants to access, such as the back-end server 106, from the summary information by using the automatic login screen as a display including summary information (summary information). The summary screen 1400 displays a link of summary information of “PC rental request” (1401) and “travel expense settlement request” (1402) of the backend server 1 (106) and a summary information link of the backend server 2 (107) (illustrated). (Omitted).

  The link destinations to the detailed information of “PC rental request” (1401) and “travel expense settlement request” (1402) of the back-end server 1 (106) are described as 1403 and 1404, respectively.

  In this embodiment, when the session between the client 100 and the window server 101 is established (202), the automatic login screen transmitted by the window server 101 is displayed on a fixed page (for example, the top page) to the back-end server 106 or the like. Instead of the automatic login screen 400 constituted by links, a summary screen 1400 including summary information such as the back-end server 106 is displayed.

  When the client 100 acquires the summary screen 1400, it becomes possible to directly request access to necessary content without accessing a fixed page such as the back-end server 106, and wasteful access to the back-end server 106, etc. Can be reduced.

  The automatic login of this embodiment is realized by applying the automatic login of the first to second embodiments described above. Note that the above-described third embodiment cannot be applied.

  In the first and second embodiments, the window server transmits an automatic login screen 400 formed from a link to a fixed page such as the back-end server 106 as response content at the time of session establishment 202. In the present embodiment, after the client 100 logs into the window server 101 and receives user authentication (201), the window server 101 accesses the back-end server 106 and the like to create a summary screen 1400. (The method for creating the summary screen will be described later.) Then, the window server 101 transmits the created summary screen 1400 to the client 100 as response content when the session is established 202.

  Upon receiving the response, the client 100 displays a summary screen 1400. When the user selects the link 1401 of “PC rental information” of the back-end server 1 (106) in the summary screen 1400, automatic login is performed and the “PC” is directly selected. It is possible to access detailed information on “rental information”. This automatic login is an automatic login using the first or second embodiment applied to the present embodiment.

  FIG. 15 is a flowchart of the creation process of the summary screen (1400 in FIG. 14).

  After the user authentication 201, the window server 101 acquires the user ID 304 and the like of the back-end server 106 corresponding to the window user ID 303 of the client 100 and the password 306 and the like from the mapping table 103 (1500).

  Next, the window server 101 logs in to the back-end server 106 and the like using the acquired user ID 304 and the password 306 and the like (1501). For login, the basic authentication header is POSTed when the first embodiment is applied, and the login form is POSTed or GETted when the second embodiment is applied.

  The window server 101 that has logged in acquires content including information to be summary information such as the back-end server 106 (1502). This content acquisition is not necessary when the response content at the time of login (1501) is sufficient.

  Next, the window server 101 uses an HTML parser or character string processing to acquire the headline and URL of information that becomes summary information for the client 100 from the acquired content (1503).

  Further, the window server 101 passes all the acquired URLs through the window server 101, so that the URL of the detailed information is encoded in the URL of the window server 101 and added to the query (1402, 1403). (1504). The converted URL may be any conversion method as long as it is conversion for passing through the window server 101.

  The window server 101 that has converted the URL creates a summary screen 1400 using the headline acquired in 1503 and the URL converted in 1504, and transmits it to the client 100 (1505).

  The client 100 that has received the summary screen 1400 displays the summary screen 1400. When the user selects the summary information link 1401 or the like on the summary screen 1400 and an automatic login request is made to the window server 101, the window server 101 decodes the URL of the detailed information in the encoded query. To do.

  The subsequent steps are the same as those after 204 in the first or second embodiment applied as the present embodiment.

  However, when the first embodiment is applied, the URL excluding the URL query and parameters 500 to 503 in FIG. 5 is replaced with the URL of the detailed information. Even when the second embodiment is applied, the URL of detailed information is replaced with the part excluding the URL query and parameters of 1000 to 1002 in FIG. 10 and 1101 to 1102 in FIG.

With the above processing, automatic login with a summary function can be realized.

  According to the present invention, since a single sign-on is realized, a complicated login operation and password management by a user are unnecessary. Furthermore, since single sign-on can be realized without modifying the back-end server, a low-cost single sign-on environment can be realized. These effects can be applied to in-house IT systems.

It is a system configuration figure of the computer system of a 1st embodiment of the present invention. It is a timing chart of the 1st embodiment of the present invention. It is an example of the block diagram of the user management table of 1st Embodiment of this invention, a mapping table, and an authentication information table. It is explanatory drawing of an example of the screen for automatic login of 1st Embodiment of this invention, and URL for automatic login. It is explanatory drawing of an example of the message communicated in the 1st Embodiment of this invention. It is an example of the setting screen of the user ID and password of the back end server of the 1st Embodiment of this invention. FIG. 2 is a system configuration diagram when automatic login and direct login are used together in the first embodiment of the present invention. It is a system configuration | structure figure of the computer system of the 2nd and 3rd embodiment of this invention. It is a timing chart of the 2nd embodiment of the present invention. It is explanatory drawing of an example of the message communicated in the 2nd Embodiment of this invention. It is explanatory drawing of an example of the message communicated in the 2nd Embodiment of this invention. It is a timing chart of the 3rd embodiment of the present invention. It is explanatory drawing of an example of the message communicated in the 3rd Embodiment of this invention. It is explanatory drawing of an example of the screen for automatic login of 4th Embodiment of this invention, and URL for automatic login. It is a summary screen creation process flowchart of the 4th Embodiment of this invention.

Explanation of symbols

100 Client 101 Window server 102 User management table 103 Mapping table 104 Relay server 105 Authentication information table 106 Backend server 1
107 Backend server 2
108 network

Claims (11)

In a computer system including a window server serving as a window for services to clients, one or more back-end servers that provide services to the clients, and a relay server that relays access to the back-end servers,
The window server is
Authenticating the client based on the first authentication information and establishing a session;
A screen including a link for requesting the window server to access the back-end server is transmitted to the client;
Accepting an access request from the client to the backend server while maintaining the established session;
Acquiring second authentication information of the client for the backend server based on the first authentication information acquired from the client;
Establish a session with the relay server for the client,
The relay server requests the access to the backend server by adding the second authentication information acquired by the window server to the access request from the client to the backend server while maintaining a session with the client. And
The back-end server transmits the content requested by the client to the relay server after authenticating with the second authentication information,
When the relay server receives content from the back-end server, the relay server transmits the content to the client. The window server is
Obtaining second authentication information of the client for the backend server based on the first authentication information;
Login to the backend server using the acquired second authentication information to acquire content,
Extracting information headings and links as summary information from the acquired content,
Convert the extracted link to go through the window server,
Create a summary screen using the acquired headline and converted link,
The computer system according to claim 1, wherein the created summary screen is returned when the client logs in to the window server. The window server performs authentication by Form authentication, Basic authentication, DIGEST authentication, SSL client authentication or integrated Windows authentication,
The computer system according to claim 1, wherein the back-end server performs authentication by basic authentication.   The computer system according to claim 3, wherein the relay server is realized by a plug-in function of a Web server configuring the back-end server.   The computer system according to claim 3, wherein the relay server is the same server as the window server.   6. The computer system according to claim 5, wherein a session established between the client and the window server is used as a session between the client and the relay server. In a computer system including a window server serving as a window of service for a client and one or more back-end servers that provide services to the client
The window server is
Authenticating the client based on the first authentication information and establishing a session;
A screen including a link for requesting the window server to access the back-end server is transmitted to the client;
Accepting an access request from the client to the backend server while maintaining the established session;
Acquiring second authentication information of the client for the backend server based on the first authentication information acquired from the client;
Requesting the backend server for authentication based on the acquired second authentication information;
A computer system that transmits session maintenance information issued by the back-end server to the client and takes over the session maintenance information to the client. The window server is
Obtaining second authentication information of the client for the backend server based on the first authentication information;
Login to the backend server using the acquired second authentication information to acquire content,
Extracting information headings and links as summary information from the acquired content,
Convert the extracted link to go through the window server,
Create a summary screen using the acquired headline and converted link,
The computer system according to claim 7, wherein the created summary screen is returned when the client logs in to the window server. The window server performs authentication by Form authentication, Basic authentication, DIGEST authentication, SSL client authentication or integrated Windows authentication,
The backend server authenticates by Form authentication,
9. The computer system according to claim 8, wherein a method for transferring session maintenance information between the back-end server and the client is performed by Cookie or URL rewriting. In a computer system including a window server serving as a window of service for a client and one or more back-end servers that provide services to the client
The window server is
Authenticating the client based on the first authentication information;
A session is established and a screen including a link of an access request to the backend server for the window server is transmitted to the client;
Accepting an access request from the client to the backend server while maintaining the established session;
Acquiring second authentication information of the client for the backend server based on the first authentication information acquired from the client;
Sending an authentication request instruction to the back-end server based on the acquired second authentication information to the client;
A computer system for causing the client to authenticate to the back-end server. The window server performs authentication by Form authentication, Basic authentication, DIGEST authentication, SSL client authentication or integrated Windows authentication,
The computer system according to claim 10, wherein the back-end server performs authentication by Form authentication.

Images