JP2007272492A - Authentication and authorization server, authentication and authorization system, authentication and authorization method, and authentication and authorization program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To control access to systems of a plurality of enterprises by authentication of one authentication and authorization system and to consolidate user attribute information even when a user has authorities over a plurality of enterprises to access systems of the plurality of enterprises from one authentication and authorization server. <P>SOLUTION: An authentication and authorization server 1 acquires user information (user A) from an authentication repository (authentication repository A2a) assigned to an enterprise (enterprise A) designated by the user and determines the user information as a main job. The authentication and authorization server 1 acquires user information (user A') of a linked authentication repository (authentication repository B2b) from the acquired user information and determines the user information (user A') as an auxiliary job. The authentication and authorization server 1 acquires an authority over a business server of the enterprise A from an ACLDB 3 with the user information (user A) as the main job and acquires an authority over a business server of an enterprise B from the ACLDB 3 with the user information (user A') as the auxiliary job, to perform access control. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  In the present invention, for example, when a user has authority across a plurality of companies and uses the system across a plurality of companies, the access control is performed on the system of each company by the duties or authority of each company. It relates to the technology to be performed.

  In an enterprise, strict access control is required for various users to use various systems. In recent years, there are cases where a user has duties across a plurality of companies such as a company group. In this case, it is necessary to use the system not only within the company but also across a plurality of companies. However, depending on the type of business, there may be cases where it is prohibited by law or the like to perform duties across multiple companies at the same time. Therefore, in such a case, measures are taken in operation such as installing an operation terminal in a different room for each company's system. However, the convenience for the user is extremely low. Therefore, it is necessary to have a mechanism that integrates authentication and authorization for systems of a plurality of companies.

In a Web client / server type system, there is an authentication / authorization server that integrates authentication and authorization of a plurality of systems. This authentication authorization server performs authentication authorization by referring to only one authentication repository. Here, the authentication repository is a server, database, or the like having authentication information.
In addition, there are devices that provide access control from a distributed base as well as a local base by providing a device that performs access control for each base at a distributed base, and give a certain operating authority.
In Japanese Patent Laid-Open No. 2000-148737, each electronic document distributed and managed through a network is provided with communication information including participant information. Then, the distributedly managed communication information is associated with each other by a link. By using this communication information, access control can be performed not only for local users but also for users in other locations.
JP 2000-148737 A

In the access control by the conventional authentication / authorization system, when a plurality of company's systems are used, the business is performed by logging in to each authentication / authorization system. Therefore, user management is also performed in each company, and it is not related to user attribute information (user management information). Therefore, there is a problem that it is not possible to control access to the operations of a plurality of companies at the same time.
In addition, when having a job across companies, if it is possible to connect to a system of another company from a certain company's authentication authorization server, it is necessary to manage the user attribute information of the other company in the authentication repository of each company. That is, in this case, double management of user attribute information is required, and there is a problem that the security level is lowered and the operation load is increased.
An object of the present invention is to perform access control to systems of a plurality of companies, for example, by authentication of one authentication / authorization system. In addition, the present invention unifies management of user attribute information even when, for example, a job (authority) spans a plurality of companies (groups) and a system of a plurality of companies is accessed from one authentication authorization server. For the purpose.

An authentication authorization server according to the present invention includes a predetermined authentication repository from a plurality of authentication repositories that store user attribute information assigned to each user including attribute information and link information indicating an authentication repository to be linked in a storage device. Obtaining first user attribute information for acquiring user attribute information of a predetermined user from an authentication repository search unit that is searched by a processing device and a first authentication repository that is an authentication repository searched by the authentication repository search unit, and storing it in a storage device A link information acquisition unit that acquires link information from the user attribute information acquired by the first user attribute information acquisition unit and stores it in a storage device, and an authentication repository indicated by the link information acquired by the link information acquisition unit A second user that acquires user attribute information of the user from a second authentication repository and stores it in a storage device. User attribute acquired by the first user attribute information acquisition unit with respect to the access from the user terminal by the user to the server of the first group which is the group to which the attribute information acquisition unit and the first authentication repository are assigned The second user attribute information acquisition unit performs access control by the processing device based on the information, and the access from the user terminal by the user to the server of the second group that is the group to which the second authentication repository is assigned. And an authentication / authorization processing unit that performs access control by the processing device based on the user attribute information acquired.

  According to the authentication authorization server according to the present invention, access control to the server of each group is performed based on the user attribute information stored for each authentication repository. The user attribute information is linked with other authentication repositories by link information. Therefore, access control to a plurality of company systems can be performed by authentication of one authentication / authorization system.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  First, an example of the hardware configuration of the authentication authorization server 100 according to the present invention will be described with reference to FIGS.

FIG. 1 is a diagram illustrating an example of an appearance of an authentication authorization system 1000 according to the embodiment.
In FIG. 1, an authentication authorization system 1000 includes a CRT (Cathode Ray Tube) display device 901, a keyboard (K / B) 902, a mouse 903, a compact disk device (CDD) 905, a database 908, a system unit 909, a server A 917, and a server. B918 and these are connected by a cable.
Further, the authentication / authorization system 1000 is connected to the Internet 940 via a local area network (LAN) 942 and a gateway 941. The authentication / authorization system 1000 is connected to an external server 916 and the like via the Internet 940.
Here, the server A 917 is an example of an authentication authorization server 100 described later. The server B 918 and the external server 916 are examples of business servers that provide Web-based business and the like described later. Further, the database 908 is an example of an authentication repository, ACLDB (Access Control List Data Base). The CRT display device 901 is an example of the display device 986.

FIG. 2 is a diagram illustrating an example of a hardware configuration of the authentication authorization server 100 according to the embodiment.
In FIG. 2, the authentication / authorization server 100 is a computer, and includes a CPU (Central Processing Unit) 911 that executes a program. The CPU 911 includes a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a CRT display device 901, a K / B 902, a mouse 903, an FDD (Flexible Disc) 904, a CDD 905, and a magnetic disk. A disk device 920 is connected.
The RAM 914 is an example of a volatile memory. The ROM 913 and the magnetic disk device 920 are examples of a nonvolatile memory. These are examples of the storage device 984.
The communication board 915 is connected to the LAN 942 or the like.
K / B 902, mouse 903, and the like are examples of the input device 982.
The CPU 911 is an example of a processing device 980.
The communication board 915 is an example of the communication device 988.

Here, the communication board 915 is not limited to the LAN 942 but may be directly connected to the Internet 940 or a WAN (Wide Area Network) such as ISDN. When directly connected to the Internet 940 or a WAN such as ISDN, the authentication / authorization server 100 is connected to the Internet 940 or a WAN such as ISDN, and the gateway 941 is unnecessary.
The magnetic disk device 920 stores an operating system (OS) 921, a window system 922, a program group 923, and a file group 924. The program group 923 is executed by the CPU 911, the OS 921, and the window system 922.

In the program group 923, for example, a program that executes a function described as “˜unit” in the description of the embodiment described below is stored. The program is read and executed by the CPU 911.
In the file group 924, what is described as “to determination” in the description of the embodiment described below is stored as “to file”.
Also, the arrows in the flowcharts described in the following description of the embodiments mainly indicate data input / output, and the data for the data input / output is the magnetic disk device 920, FD, optical disk, CD, MD. (Mini disc), DVD (Digital Versatile Disk) and other recording media. Alternatively, it is transmitted through a signal line or other transmission medium.

  In addition, what is described as “unit” in the description of the embodiment described below may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

  In addition, a program that implements the embodiment described below may be stored using a recording device using another recording medium such as the magnetic disk device 920, FD, optical disk, CD, MD, DVD, or the like.

Embodiment 1 FIG.
Next, the first embodiment will be described. In the first embodiment, an authentication authorization system 1000 that performs access control to a plurality of company systems with only one authentication will be described.

FIG. 3 is a configuration diagram showing a schematic configuration of the authentication authorization system 1000 according to the first embodiment.
The authentication authorization system 1000 includes an authentication authorization server 1, an authentication repository A2a, an authentication repository B2b, and an ACLDB3. Here, the authentication repository A2a is an authentication repository assigned to the company A, and the authentication repository B2b is an authentication repository assigned to the company B.

The authentication repository A2a stores user information 2a-1, and the authentication repository B2b stores user information 2b-1. The user information 2a-1 and the user information 2b-1 manage user attribute information including a user ID (identifier), an organization, a title, and link information (link source and link destination). That is, the authentication repository A2a and the authentication repository B2b store the assigned user attribute information for each user. In the link information, a link source (destination) authentication repository and a user ID are stored here. The ACLDB 3 stores an access control list 3-1. The access control list 3-1 manages the authority to access the business server for each company, role (organization, post), job, and business server using the ACL name as a key.
When the client 4 accesses the business servers of the company A and the company B, the authentication authorization system 1000 performs access control using information of the authentication repository A2a, the authentication repository B2b, and ACLDB3.

Next, functions and operations of the authentication / authorization system 1000 will be described with reference to FIGS. 4, 5, and 6. FIG. 4 is a functional block diagram illustrating functions of the authentication authorization system 1000 according to the first embodiment.
In FIG. 4, the authentication / authorization system 1000 includes an authentication / authorization server 1, an authentication repository A2a, an authentication repository B2b, and ACLDB3 as described above. Further, the authentication authorization server 1 is connected to the business server A-1 and business server A-2 of the company A, and the business server B-1 and business server B-2 of the company B.
The authentication authorization server 1 includes an identification information reception unit 10, an authentication repository search unit 20, a user attribute information acquisition unit 30, a link information acquisition unit 40, an authority information acquisition unit 50, an authentication authorization processing unit 60, an authentication determination unit 90, and a processing device. 980, a storage device 984, and a communication device 988. The user attribute information acquisition unit 30 includes a first user attribute information acquisition unit 32 and a second user attribute information acquisition unit 34.

  FIG. 5 is a flowchart of the authentication process of the authentication authorization server 1 in the first embodiment. FIG. 6 is a flowchart of the authorization process of the authentication authorization server 1 in the first embodiment. These are examples of authentication authorization processing (authentication authorization method, authentication authorization program) of the authentication authorization server 1.

  First, the user accesses the authentication authorization server 1 from the client 4 (an example of a user terminal) using a Web browser or the like (S1: authentication authorization server access step). Next, the authentication determination unit 90 determines whether or not the authentication has been completed based on the presence or absence of the authenticated information (S2: authentication confirmation step). If the authentication determination unit 90 determines that the authentication has been completed (authenticated in S2), the authentication determination unit 90 proceeds to (S5). On the other hand, when the authentication determination unit 90 determines that it has not been authenticated (before authentication in S2), the authentication determination unit 90 transmits, for example, the login screen 6 shown in FIG. 3 (S3: identification screen transmission step). Here, as shown in FIG. 3, the login screen used for user authentication includes a user ID (UID), a password (PWD), a field for inputting a company code, and a SUBMIT button for transmitting input data. Then, the login screen 6 is displayed on the display device of the client 4 (S4: identification screen display step). The user inputs a user ID (an example of user identification information), a password, and a company code (an example of group identification information) for identifying a company on the login screen 6 and presses a SUBMIT button (S5: identification) Information input step). Then, the information input by the user is transmitted to the authentication authorization server 1 (S6: identification information transmission step). Here, it is assumed that the user inputs “user A” as the user ID and “A” as the company code.

  The identification information receiving unit 10 of the authentication authorization server 1 receives the user ID, password, and company code transmitted by the user via the communication device 988 (S7: identification information receiving step). And the authentication repository search part 20 searches and determines the authentication repository used for authentication from a company code (S8: authentication repository search step). Here, it is determined to be “authentication repository A2a” (an example of the first authentication repository) assigned to the company A (an example of the first group). Next, the authentication determination unit 90 transmits an authentication request to the authentication repository determined by the authentication repository search unit 20 by using the user ID and password (S9: authentication request transmission step). The authentication determination unit 90 determines whether or not to authenticate based on a response from the authentication repository by the processing device 980 (S10: authentication determination step). If the authentication determination unit 90 does not authenticate (failed in S10), the authentication determination unit 90 returns to (S3). On the other hand, when the authentication determination unit 90 authenticates (successful in S10), the authentication determination unit 90 creates authenticated information (S11: authenticated information creation step). Then, the first user attribute information acquisition unit 32 acquires user attribute information (organization, job title) of the corresponding user from the authentication repository A2a, and stores the organization and job title information as the main job in the authenticated information (S12: No. 1). 1 user attribute information acquisition step). Here, the first user attribute information acquisition unit 32 stores the company A, the general affairs, and the section manager as main duties in the storage device 984. Next, the link information acquisition unit 40 checks whether a value is set in the link information of the user attribute information acquired by the first user attribute information acquisition unit 32 (S13: link information determination step). If the link information acquisition unit 40 determines that there is no link information (NO in S13), the link information acquisition unit 40 proceeds to (S16). On the other hand, when the link information acquisition unit 40 determines that there is link information (S13), the link information acquisition unit 40 acquires link information included in the user attribute information acquired from the ACLDB 3. (S14: Link information acquisition step). Then, the second user attribute information acquisition unit 34 acquires user attribute information (organization, job title) from the link-destination and link-source authentication repositories, and stores them in the storage device 984 as sub-tasks in the above-described authenticated information ( S15: Second user attribute information acquisition step). Here, “user A ′ of authentication repository B” is stored as link destination information. Therefore, the second user attribute information acquisition unit 34 acquires user attribute information of the user A ′ of the authentication repository B (an example of the second authentication repository). That is, the 2nd user attribute information acquisition part 34 memorizes company B (an example of the 2nd group), accounting, and charge as sub duties. The processes from (S13) to (S15) are repeated until all the user attribute information of the link destination and the link source is acquired. Then, the authentication authorization server 1 completes authentication (S16: authentication completion step).

  The user who has completed authentication accesses the business server from the client 4 via the authentication authorization server 1 (S19: server access authentication step). Next, the authority information acquisition unit 50 acquires ACL (authority information) related to the access destination business server from the ACLDB 3 and stores it in the storage device 984 (S20: authority information acquisition step). Then, the authentication authorization processing unit 60 compares the main job with the ACL acquired by the authority information acquisition unit 50 by the processing device 980 (S21: first authority information comparison step (authentication authorization processing step)). When it is determined that the authentication authorization processing unit 60 matches the main job (matched in S21), the authentication authorization processing unit 60 proceeds to (S24). On the other hand, when it is determined that the authentication authorization processing unit 60 does not match the main job (mismatched in S21), the authentication authorization processing unit 60 checks the presence or absence of the sub job by the processing device 980 (S22: second authority information determination step). . When the authentication / authorization processing unit 60 determines that there is no sub-task (No in S22), the authentication / authorization processing unit 60 transmits an access impossible notification to the client via the communication device 988 and ends the processing (S26: Authentication). Failure notification step). On the other hand, when the authentication authorization processing unit 60 determines that there is a sub job (S22), the authentication authorization processing unit 60 compares the sub job with the ACL by the processing device 980 (S23: second authority information comparison step ( Authentication authorization processing step)). If the authentication authorization processing unit 60 determines that it matches the sub-task (matching in S23), the authority is set by the processing device 980 according to the ACLDB3 access control list 3-1 (S24: access authority setting step (authentication authorization processing step) )). On the other hand, when the authentication authorization processing unit 60 determines that it does not coincide with the sub-duties (non-coincidence in S23), the authentication authorization processing unit 60 returns to (S22) and checks whether there is another sub-duty. When the authority is set in (S24), the business server is accessed based on the set authority (S25: server access step).

Here, first, it is assumed that the user A accesses the business server A-1 of the company A (S19). Then, since the current main job of user A is (company A, general affairs, section manager), it matches ACL-A1 in ACLDB3 access control list 3-1 (matched in S21), and the authority can be “read and write” (S24).
On the other hand, assume that user A accesses business server B-1 of company B (S19). Then, since the current main duties of the user A are (company A, general affairs, section manager), there is no authority information in the access control list 3-1 of the ACLDB 3 that matches the main duties (disagreement in S21). Next, it is checked whether or not the user A has a sub job (S22), but the user A has a sub job (S22). Since the sub-task of user A is (company B, accounting, charge), it matches ACL-B2 in access control list 3-1 of ACLDB3 (matches in S23), and the authority can only be “read”. (S24).

Further, when the user A accesses the business server A-2 of the company A, the same processing as when accessing the business server A-1 is followed. That is, since the main duties of the user A are (company A, general affairs, section manager), according to ACL-A3 of the access control list 3-1 of ACLDB3, the authority can only be “read”.
On the other hand, when the user A accesses the business server B-2 of the company B, there is no authority information in the access control list 3-1 of the ACLDB 3 that matches the main job of the user A, and the ACLDB 3 that matches the sub job of the user A Since there is no authority information in the access control list 3-1, the client has no authority and notifies the client that access is not possible (S26).

That is, the authentication authorization processing unit 60 does not use the authentication repository A2a assigned to the company A for access from the client 4 to the server of the company A (an example of the first group) selected at the time of login by the user. Based on the user attribute information acquired from (an example of the first authentication repository) (user attribute information acquired by the first user attribute information acquisition unit 32), access control is performed by the processing device 980. On the other hand, for the access from the client 4 to the server of the company B (an example of the second group), the user attribute information (the first) acquired from the authentication repository B2b (an example of the second authentication repository) assigned to the company B (2) User attribute information acquisition unit 34 acquires user attribute information) and performs access control by the processing device 980.
In addition, for access from the client 4 to the company A server, the authority information acquisition unit 50 uses the user attribute information acquired from the authentication repository A2a as the ACL assigned to the main function (an example of the first level). The authentication authorization processing unit 60 performs access control based on the ACL (an example of first authority information) acquired by the authority information acquiring unit 50. On the other hand, for access from the client 4 to the company B server, the authority information acquisition unit 50 uses the user attribute information acquired from the authentication repository B2b as the ACL assigned to the sub-task (an example of the second level). The authentication authorization processing unit 60 performs access control based on the ACL (an example of second authority information) acquired by the authority information acquiring unit 50.

Next, an operation when the user A inputs the company B on the login screen 6 will be described. The basic flow is the same as above.
First, the user accesses the authentication authorization server 1 from the client 4 using a Web browser or the like (S1). Before authentication, the login screen 6 is displayed on the display device of the client 4 (S4). When the user A inputs the user ID, password, and company code on the login screen and presses the SUBMIT button (S5), the information input to the authentication authorization server 1 is transmitted. Here, it is assumed that the user inputs “user A ′” as the user ID and “B” as the company code.

  The identification information receiving unit 10 receives the user ID, password, and company code transmitted by the user A (S7), and the authentication repository search unit 20 determines an authentication repository to be used for authentication from the company code (S8). Here, “authentication repository B2b” (an example of the first authentication repository) assigned to the company B (an example of the first group) is determined. The authentication determination unit 90 performs an authentication process on the determined authentication repository using the user ID and password (S9, S10). When the authentication is successful (successful in S10), the authentication determination unit 90 creates authenticated information (S11), and the first user attribute information acquisition unit 32 acquires the attribute (organization, job title) of the corresponding user information (S12). The first user attribute information acquisition unit 32 stores the organization and job title as the main job in the authenticated information. Here, the 1st user attribute information acquisition part 32 memorizes company B, accounting, and charge as main duties. The link information acquisition unit 40 checks whether or not a value is set for the acquired link information attribute (S13). If there is link information (S13), the link information acquisition unit 40 acquires the link information (S14). ). The second user attribute information acquisition unit 34 also acquires link destination and link source attribute information. The acquired job title (organization, job title) and the above-mentioned authenticated information are stored as a sub job (S15). Here, “user A of authentication repository A” is stored as link destination information. Therefore, the second user attribute information acquisition unit 34 acquires user attribute information of the user A of the authentication repository A (an example of the second authentication repository). That is, the 2nd user attribute information acquisition part 34 memorizes company A (an example of the 2nd group), general affairs, and section manager as sub duties.

When the user A who has been authenticated accesses the business server A-1 of the company A (S19), the main job of the user A is (company B, accounting, charge), so the access control of the ACLDB 3 that matches the main job There is no authority information in the list 3-1 (mismatch in S21). Next, it is checked whether or not the user A has a sub job (S22), but the user A has a sub job (S22). Since the current sub-task of the user A is (company A, general affairs, section manager), according to the ACL-A2 of the access control list 3-1 of the ACLDB 3, the authority can only be “read”.
On the other hand, when the business server B-1 of the company B is accessed, since the main duty of the user A is (company B, accounting, charge), the authority is “read / write” according to the ACL-B1 of the access control list 3-1 of the ACLDB3. It becomes possible.
Further, when the user A accesses the business server A-2 of the company A, there is no authority information in the access control list 3-1 of the ACLDB 3 that matches the main job of the user A, and the ACLDB 3 that matches the sub job of the user A Since there is no authority information in the access control list 3-1, there is no authority and the client is notified that access is impossible.
On the other hand, when accessing the business server B-2 of the company B, since the main job of the user A is (company B, accounting, charge), the authority is “read” according to the ACL-B3 of the access control list 3-1 of the ACLDB3. Only possible.

  As described above, according to the authentication authorization system 1000 according to the first embodiment, when accessing the same business server, strict access control is possible by changing the access authority according to the duties at the time of using the system. It is. In addition, by making it possible to extract user attribute information through a link, the user attribute information can be divided for each company. Therefore, it is not necessary to perform double management of user attribute information for access control. Therefore, it is possible to prevent an increase in management load and a decrease in security due to double management.

  That is, the authentication / authorization system 1000 according to the first embodiment includes an authentication repository having a link between the same users across the companies in the authentication / authorization server 1 that separately manages the authentication repository for each company, and links at the time of authentication. It is characterized in that attribute information in a plurality of companies is held as authentication information based on the information, and access control is performed using user attribute information recorded in the authentication information.

  The authentication authorization system 1000 according to the first embodiment sets a link between data (entries) of the same user in the authentication repository of each company, and the authentication authorization server 1 based on attribute information collected by the link at the time of authentication. However, strict access control is performed according to the duties at the time of use by the user.

Embodiment 2. FIG.
Next, a second embodiment will be described. In the first embodiment, the authentication and authorization method when the authentication authorization server 1 is single is shown. In the second embodiment, an authentication and authorization system 1000 that performs authentication and access control when there are a plurality of authentication and authorization servers 1 will be described.

  FIG. 7 is a configuration diagram illustrating a schematic configuration of the authentication / authorization system 1000 according to the second embodiment. Unlike the configuration of the first embodiment, there are two authentication authorization servers A1a and B1b in which the authentication authorization server 1 is in the same domain. Accordingly, there are two authentication repositories 2, that is, an authentication repository A 2 a assigned to the company A to which the authentication authorization server A 1 a is assigned and an authentication repository B 2 b assigned to the company B to which the authentication authorization server B 1 b is assigned. There are two ACLDBs 3, ACLDB-A 3 a assigned to the company A and ACLDB-B 3 b assigned to the company B. The other configuration is the same as that of the first embodiment.

Next, functions and operations of the authentication / authorization system 1000 will be described with reference to FIGS. 8, 9, and 6. FIG. 8 is a functional block diagram of functions of the authentication / authorization system 1000 according to the second embodiment. Here, it is assumed that the user first accesses the authentication authorization server A1a. Therefore, the authentication authorization server A1a is an example of a first authentication authorization server, and the authentication authorization server B1b is an example of a second authentication authorization server. The authentication repository A2a is an example of a first authentication repository, and the authentication repository B2b is an example of a second authentication repository. Further, ACLDB-A3a is an example of the first ACLDB, and ACLDB-B3b is an example of the second ACLDB.
In FIG. 8, the authentication authorization system 1000 includes an authentication authorization server A1a, an authentication authorization server B1b, an authentication repository A2a, an authentication repository B2b, ACLDB-A3a, and ACLDB-B3b. The authentication / authorization server A1a is connected to the business server A-1 and business server A-2 of the company A (an example of the first group). Furthermore, the authentication authorization server B1b is connected to the business server B-1 and business server B-2 of the company B (an example of the second group).
The authentication authorization server A1a includes an identification information receiving unit 10, an authentication repository search unit 20, a user attribute information acquisition unit 30, a link information acquisition unit 40, a first authority information acquisition unit 52, a first authentication authorization processing unit 62, and an authentication determination unit. 90, a processing device 980A, a storage device 984A, and a communication device 988A. The user attribute information acquisition unit 30 includes a first user attribute information acquisition unit 32 and a second user attribute information acquisition unit 34.
The authentication authorization server B1b includes a second authority information acquisition unit 54, a second authentication authorization processing unit 64, a processing device 980B, a storage device 984B, and a communication device 988B.

  FIG. 9 is a flowchart of authentication processing of the authentication authorization server A1a and authentication authorization server B1b in the second embodiment. The authorization process of the authentication authorization server A1a and the authentication authorization server B1b in the second embodiment is the same as the process shown in FIG. These are examples of authentication authorization processing (authentication authorization method, authentication authorization program) of the authentication authorization system.

  First, the user accesses the authentication authorization server A1a from the client 4. (S1). (S2) to (S4) are the same as in the first embodiment. However, in the case of (authenticated in S2), the process proceeds to (S5-1). In (S3), a login screen 6-1 is transmitted. In (S5-1: identification information input step), the user inputs only a user ID (an example of user identification information) and a password for identifying the user on the login screen 6-1, and presses the SUBMIT button. Then, information input by the user is transmitted to the authentication authorization server 1 (S6-1: identification information transmission step). Here, it is assumed that the user inputs “user A” as the user ID.

In (S7-1: identification information receiving step), the identification information receiving unit 10 of the authentication authorization server A1a receives the user ID and password transmitted by the user A via the communication device 988A. In (S8-1: Authentication repository search step), the authentication repository search unit 20 determines an authentication repository to be used for authentication. Since the authentication repository search unit 20 is accessed by the user from the client to the authentication authorization server A1a, the authentication repository to be used is determined as “authentication repository A2a” assigned to the company A to which the authentication authorization server A1a is assigned. . (S9) to (S16) are the same as in the first embodiment.
Here, for example, the client stores the authentication information created by the authentication authorization server A1a. When the client accesses the authentication / authorization server B1b in the same domain, the authentication information is transmitted from the client to the authentication / authorization server B1b, and the authentication / authorization server B1b is determined to be authenticated in the process of (S2). That is, the authentication information created by the authentication / authorization server 1 in the same domain is also trusted by other authentication / authorization servers 1.

  In (S19), it is assumed that the user who has been authenticated by the processing up to (S16) accesses the business server of the company A via the authentication authorization server A1a. In this case, in (S20), the first authority information acquisition unit 52 acquires ACL (authority information) related to the access destination business server from the ACLDB-A 3a assigned to the company A to which the business server to be accessed is assigned. In (S21), the first authentication authorization processing unit 62 compares the main job with the ACL acquired by the first authority information acquisition unit 52. The processing from (S22) to (S26) is the same as in the first embodiment. However, the difference is that the first authority information acquiring unit 52 performs the process performed by the authority information acquiring unit 50, and the first authentication authorization processing unit 62 performs the process performed by the authentication authorization processing unit 602.

  On the other hand, in (S19), it is assumed that the user who has been authenticated by the processing up to (S16) accesses the business server of the company B via the authentication authorization server B1b. In this case, in (S20), the second authority information acquisition unit 54 acquires ACL (authority information) related to the access destination business server from the ACLDB-B 3b. In (S21), the second authentication authorization processing unit 64 compares the main job with the ACL acquired by the second authority information acquisition unit 54. The processing from (S22) to (S26) is the same as in the first embodiment. However, it differs in that the second authority information acquisition unit 54 performs the processing performed by the authority information acquisition unit 50 and the second authentication authorization processing unit 64 performs the processing performed by the authentication authorization processing unit 60.

Here, it is assumed that the user A accesses the business server A-1 of the company A via the authentication authorization server A1a (S19). Since the current main function of the user A is (company A, general affairs, section manager), it matches the ACL-A1 of the access control list 3a-1 of the ACLDB-A 3a, and the authority becomes “read / write” (S24).
On the other hand, it is assumed that user A accesses business server B-1 of company B via authentication authorization server B1b (S19). Then, since the current main duties of the user A are (company A, general affairs, section manager), there is no authority information in the access control list 3b-1 of the ACLDB-B 3b that matches the main duties (does not match in S21). Next, it is checked whether or not the user A has a sub job (S22), but the user A has a sub job (S22). Since the sub-task of user A is (company B, accounting, charge), ACL-B2 in ACLDB-B3b access control list 3b-1 matches (matches in S23), and the authority can only be “read”. (S24).

Further, when the user A accesses the business server A-2 of the company A via the authentication / authorization server A1a, the same processing as when accessing the business server A-1 is followed. That is, since the main function of the user A is (company A, general affairs, section manager), the authority can only be “read” according to the ACL-A3 of the access control list 3a-1 of the ACLDB-A3a.
On the other hand, when the user A accesses the business server B-2 of the company B via the authentication authorization server B1b, there is no authority information in the access control list 3b-1 of the ACLDB-B3b that matches the main job of the user A. Since there is no authority information in the access control list 3b-1 of ACLDB-B 3b that matches the sub-task of user A, there is no authority and the client is notified that access is not possible (S26).

That is, the first authentication authorization processing unit 62 acquires from the authentication repository A2a assigned to the company A for the access from the client 4 to the server of the company A (an example of the first group) selected by the user. The access control is performed by the processing device 980 based on the user attribute information. On the other hand, for the access from the client 4 to the server of the company B (an example of the second group), the second authentication authorization processing unit 64 uses the user attribute information acquired from the authentication repository B2b assigned to the company B. Based on this, the processor 980 performs access control.
Also, the first authority information acquisition unit 52, for access from the client 4 to the server of the company A, from the ACLDB-A (an example of the first ACLDB) assigned to the company A, the main function (first level The ACL assigned to (example) is acquired based on the user attribute information acquired from the authentication repository A2a, and the first authentication authorization processing unit 62 acquires the ACL acquired by the first authority information acquisition unit 52 (an example of first authority information). Access control based on On the other hand, for the access from the client 4 to the company B server, the second authority information acquisition unit 54 starts from the ACLDB-B (an example of the second ACLDB) assigned to the company B to the sub job (second level). The ACL assigned to (example) is acquired based on the user attribute information acquired from the authentication repository B2b, and the second authentication authorization processing unit 624 acquires the ACL acquired by the second authority information acquisition unit 54 (an example of second authority information). Access control based on

  As described above, according to the authentication / authorization system 1000 according to the second embodiment, even when there are a plurality of authentication / authorization servers 1, as in the case of a single authentication / authorization server 1, Strict access control is possible by changing the access authority accordingly.

  In the above, single sign-on is possible when the authentication and authorization server is in the same domain. However, the present invention is not limited to this, and only authentication information created by a predetermined server may be trusted. Single sign-on when the authentication authorization server 1 is not in the same domain can be realized by using SAML (Security Assession Markup Language).

  That is, the authentication / authorization system 1000 according to the second embodiment includes the authentication / authorization server 1 in a plurality of different housings, and obtains attribute information from single sign-on and a link between users even between different servers for access control. It is characterized by performing.

Embodiment 3 FIG.
Next, a third embodiment will be described. In the first embodiment, the authentication / authorization method is shown when the authentication / authorization server 1 is the reverse proxy method for relaying requests to each business server. In the third embodiment, authentication and access control in the case where the authentication authorization server 1 is an agent system that receives a request from an agent of each business server will be described.

  FIG. 10 is a configuration diagram illustrating a schematic configuration of an authentication authorization system 1000 according to the third embodiment. In each business server (business server 5A-1, business server 5A-2, business server 5B-1, business server 5B-2), the authentication authorization agent 7 operates. The business servers are assumed to be in the same domain. The other configuration is the same as that of the first embodiment.

Next, functions and operations of the authentication / authorization system 1000 will be described with reference to FIGS. 11, 12, and 13. FIG. 11 is a functional block diagram of functions of the authentication / authorization system 1000 according to the third embodiment.
The authentication / authorization system 1000 according to the third embodiment receives access from the client to the authentication / authorization server 1 via each business server. Others are the same as in the first embodiment.

  FIG. 12 is a flowchart of the authentication process of the authentication authorization server 1 in the third embodiment. FIG. 13 is a flowchart of the authorization process of the authentication authorization server 1 in the third embodiment. These are examples of authentication authorization processing (authentication authorization method, authentication authorization program) of the authentication authorization system 1000 and the authentication authorization server 1.

  First, in (S1-1: Authentication and authorization server access step), the user accesses the business server from the client 4 using a Web browser or the like. Next, in (S2-1: authentication confirmation step), the authentication authorization agent 7 of the business server checks whether it has been authenticated based on the presence or absence of authenticated information. When the authentication / authorization agent 7 determines that it has been authenticated (authenticated in S2), the authentication / authorization agent 7 proceeds to (S5-1). On the other hand, when the authentication authorization agent 7 determines that it has not been authenticated (before authentication in S2), the authentication authorization agent 7 transmits, for example, the login screen 6-1 shown in FIG. 9 (S3-1: identification screen transmission step) ). (S4) is the same as in the first embodiment. In (S5-1: identification information input step), the user inputs only a user ID (an example of user identification information) and a password for identifying the user on the login screen 6, and presses the SUBMIT button. In (S6-1: identification information transmission step), the information input to the business server is transmitted. Here, it is assumed that the user inputs “user A” as the user ID.

The authentication authorization agent 7 of the business server receives the user ID and password transmitted by the user and determines the company code (group identification information). Here, the company code of the company to which the business server is assigned is used (S28: group identification information search step). Then, the authentication / authorization agent 7 adds the determined company code to the authentication / authorization server 1 and transmits it (S29: identification information transfer step).
Next, the identification information receiving unit 10 of the authentication authorization server 1 receives the user ID, password, and company code transmitted by the authentication authorization agent 7 via the communication device 988 (S7-1: identification information receiving step). Here, it is assumed that the user has accessed the business server A-1. Accordingly, since the business server accessed first is the business server A-1, the company code is “A”. (S8) to (S16) are the same as in the first embodiment. For example, the client stores the authentication information created by the authentication authorization server 1. When the client accesses another business server in the same domain, it is transmitted from the client to the business server, and the authentication authorization agent 7 determines that it has been authenticated in the process of (S2). That is, the other business servers trust the authentication information created based on the information transmitted from the business servers in the same domain.

  In (S19-1: Server access authentication step), a user who has been authenticated accesses the business server. When the user accesses the business server, for example, request information such as an HTTP request is transmitted from the client to the server. Here, the business server A-1 is accessed as described above. The authentication authorization agent 7 of the business server receives the request information and transmits the request information to the authentication authorization server 1 (S30: authentication request transmission step). (S20) to (S26) are the same as in the first embodiment.

  As described above, according to the authentication / authorization system 1000 according to the third embodiment, even when the authentication / authorization server 1 is of the agent method, the duties at the time of using the system are the same as when the authentication / authorization server 1 is of the reverse proxy method. Strict access control is possible by changing the access authority according to.

  That is, the authentication / authorization system 1000 according to the third embodiment is characterized in that authentication and authorization are performed not only by direct access from a user but also by redirect access from a business server.

Embodiment 4 FIG.
Next, a fourth embodiment will be described. In the third embodiment, the authentication authorization system in the case where the authentication authorization server 1 is the agent system and the authentication authorization server 1 is single is shown. In the fourth embodiment, authentication and access control when the authentication and authorization server 1 is an agent system and there are a plurality of authentication and authorization servers 1 will be described.

  FIG. 14 is a configuration diagram illustrating a schematic configuration of an authentication authorization system 1000 according to the fourth embodiment. The authentication authorization agent A7a operates on the business server 5A-1 and the business server 5A-2 of the company A, and the authentication authorization agent B7b operates on the business server 5B-1 and the business server 5B-2 of the company B. Each business server (business server 5A-1, business server 5A-2, business server 5B-1, business server 5B-2) is the same domain. The other configuration is the same as that of the second embodiment.

The functional block diagram of the authentication / authorization system 1000 according to the fourth embodiment is the same as that of the first embodiment except that access from a client is received via each business server.
Further, the authentication process and the authorization process in the fourth embodiment are processes that combine the second embodiment and the third embodiment. That is, for the authentication process, (S2), (S3), and (S6) of the authentication process according to the second embodiment shown in FIG. 9 are replaced with (S2-1) of the authentication process according to the third embodiment shown in FIG. ), (S3-1), (S6-1). Further, after (S6-1), (S28) and (S29) are executed. The authorization process is the same as the authorization process of the third embodiment shown in FIG.

  As described above, according to the authentication and authorization system 1000 according to the fourth embodiment, even when the authentication and authorization server 1 is an agent system and there are a plurality of authentication authorization servers 1, the authentication and authorization server 1 is an agent system and an authentication authorization server. Similar to the case where 1 is single, strict access control is possible by changing the access authority according to the duties at the time of using the system.

  That is, the authentication / authorization system 1000 according to the fourth embodiment includes the authentication / authorization server 1 in a plurality of different housings, and obtains attribute information from single sign-on and a link between users even between different servers for access control. And performing authentication and authorization not only by direct access from a user but also by redirect access from a business server.

Embodiment 5 FIG.
Next, a fifth embodiment will be described. In the above-described embodiment, the authentication authorization method in the case where the user uses the business system in consideration of the current job has been shown. In the fifth embodiment, authentication and access control when a user uses a business system without being aware of the current job will be described.

  FIG. 15 is a configuration diagram illustrating a schematic configuration of an authentication / authorization system 1000 according to the fifth embodiment. The authentication authorization system 1000 according to the fifth embodiment has an access route mapping DB (Data Base) 8. The company A5a includes a portal server A, and the company B5b includes a portal server B. Portal server A and portal server B are servers through which access is made to each business server (business server A-1, business server A-2, business server B-1, business server B-2). The other configuration is the same as that of the first embodiment.

  FIG. 16 is a diagram illustrating an example of the access route mapping DB 8. The access route mapping DB 8 stores, in a storage device, route information for accessing the server for each user and group identification information for identifying a group assigned to the route information. Here, as shown in FIG. 16, the access route mapping DB 8 has an access route including a main duty company code (group identification information), an access route 1 and an access route 2.

Next, functions and operations of the authentication / authorization system 1000 will be described with reference to FIGS. 17, 18, and 19. FIG. 17 is a functional block diagram of functions of the authentication / authorization system 1000 according to the fifth embodiment.
The authentication authorization server 1 according to the fifth embodiment includes a route acquisition unit 72, a route determination unit 74, and a group identification information acquisition unit 76. The user attribute information acquisition unit 30 includes a first user attribute information acquisition unit 32, a second user attribute information acquisition unit 34, and a third user attribute information acquisition unit 38. The second user attribute information acquisition unit includes a link destination user attribute information acquisition unit 35 and a link source user attribute information acquisition unit 36. Others are the same as in the first embodiment.

  FIG. 18 is a flowchart of the authentication process of the authentication authorization server 1 in the fifth embodiment. FIG. 19 is a flowchart of the authorization process of the authentication authorization server 1 in the fifth embodiment. These are examples of authentication authorization processing (authentication authorization method, authentication authorization program) of the authentication authorization system 1000 and the authentication authorization server 1.

  (S1) to (S4) are the same as in the first embodiment. However, in the case of (authenticated in S2), the process proceeds to (S5-1). In (S3), a login screen 6-1 is transmitted. In (S5-1: identification information input step), the user inputs a user ID (an example of user identification information) and a password for identifying the user on the login screen 6, and presses the SUBMIT button. Then, information input by the user is transmitted to the authentication authorization server 1 (S6-1: identification information transmission step). Here, it is assumed that the user inputs “user A” as the user ID.

  In (S7-1: identification information receiving step), the identification information receiving unit 10 of the authentication authorization server A1a receives the user ID and password transmitted by the user A via the communication device 988. Next, the authentication repository search unit 20 searches and determines the authentication repository used for authentication from the information specifying the access destination such as the URL of the access destination by the processing device 980 (S8-2: authentication repository search step). For example, here, it is assumed that the user A accesses the business server A-1. The business server A-1 is a company A server. Therefore, the authentication repository search unit 20 determines the authentication repository to be used for authentication as “authentication repository A2a” (an example of the first authentication repository) assigned to the company A (an example of the first group). (S9) to (S12) are the same as in the first embodiment. The link information acquisition unit 40 checks by the processing device 980 whether a value is set in the link information of the user attribute information acquired by the first user attribute information acquisition unit 32 (S13). If the link information acquisition unit 40 determines that there is no link information (NO in S13), the link information acquisition unit 40 proceeds to (S16). On the other hand, when the link information acquisition unit 40 determines that there is link information (S13), the link information acquisition unit 40 checks whether the link source information is set by the processing device 980 (S31: link source information determination). Step). When the link information acquisition unit 40 determines that there is no link source information (none in S31), the link information acquisition unit 40 proceeds to (S14-1). On the other hand, when the link information acquisition unit 40 determines that there is link source information (S31), the link information acquisition unit 40 sets the previous job as a sub job (S32: first job change step), and the link source user The attribute information acquisition unit 36 acquires the user attribute information of the link source and sets it as the main job (S33: second job change step). In (S14-1: link information acquisition step), the link information acquisition unit 40 acquires link destination information. In (S15-1: second user attribute information acquisition step), the link destination user attribute information acquisition unit 35 acquires the user attribute information from the link destination authentication repository indicated by the link information and stores it in the storage device 984. Then, the authentication authorization server 1 completes authentication (S16). That is, here, since there is link destination information but no link source information, the first user attribute information acquisition unit 32 stores company A, general affairs, and section manager as main duties. Further, the second user attribute information acquisition unit 34 stores the company B, accounting, and charge as sub duties.

  Then, the user A who has been authenticated accesses the business server A-1 of the company A via the authentication authorization server 1 (S19). Next, the route acquisition unit 72 acquires user route information, which is an access route to the business server accessed by the user A, and stores it in the storage device 984 (S34: route acquisition step). The route determination unit 74 compares the user route information stored in the storage device 984 and the route information stored in the access route mapping DB 8 to determine whether there is matching route information (S35: route determination). Step). When the route determination unit 74 determines that there is matching route information (S35), the group identification information acquisition unit 76 acquires the main business company code assigned to the route information from the access route mapping DB8. Store in the storage device 984. The third user attribute information acquisition unit sets the user attribute information acquired from the authentication repository (an example of the third authentication repository) assigned to the company code for the main job as the main job, and the user attribute information that has been the main job until now. Is a sub-job (S36: authority level changing step). Accordingly, the access history on the memory is cleared (S37: acquisition path deletion step). On the other hand, when the route determination unit 74 determines that there is no matching route information (none in S35), the route determination unit 74 proceeds to (S20). (S20) and subsequent steps are the same as in the first embodiment.

  Here, since the user A accesses the business server A-1 via the portal A, there is route information corresponding to the access route mapping DB shown in FIG. 16, and the company code for main duties is “A”. Therefore, in this case, since the user attribute information acquired from the authentication repository A2a assigned to the company A is the main job, there is no particular change.

That is, the authentication authorization processing unit 60, for the access from the client 4 to the server of the link source company (an example of the link source group), from the authentication repository (an example of the link source repository) assigned to the company. Based on the acquired user attribute information, access control is performed by the processing device 980.
Also, the authority information acquisition unit 50 determines the ACL assigned to the main job (an example of the first level) from the access path from the ACLDB 3 for the access from the client 4 to the server of the link source company. The authentication authorization processing unit 60 performs access control based on the ACL (an example of the third authority information) acquired by the authority information acquiring unit 50. On the other hand, for the access from the client 4 to the server of the company other than the link source company, the authority information acquisition unit 50 acquires the ACL assigned to the sub job (an example of the second level) from each authentication repository. The authentication authorization processing unit 60 performs access control based on the ACL (an example of the first authority information and the second authority information) acquired by the authority information acquiring unit 50.

In addition, the authentication authorization processing unit 60, for the access from the client 4 to the server of the company (an example of the third group) determined from the access path, the authentication repository assigned to the company (third authentication repository) Access control is performed by the processing device 980 based on the user attribute information acquired from
Also, the authority information acquisition unit 50 determines the ACL assigned to the main function (an example of the first level) from the access path for the access from the client 4 to the company server determined from the access path. The authentication authorization processing unit 60 performs access control based on the ACL (an example of the first authority information) acquired by the authority information acquiring unit 50. On the other hand, for the access from the client 4 to the server of the company other than the company determined from the access route, the authority information acquisition unit 50 authenticates the ACL assigned to the sub-task (second level example). Based on the user attribute information acquired from the repository, the authentication authorization processing unit 60 performs access control based on the ACL (an example of the second authority information) acquired by the authority information acquiring unit 50.

  As described above, according to the authentication authorization system 1000 according to the fifth embodiment, it is possible to determine the current job based on the access path of the user. Therefore, even when the user uses the system without being aware of the duties, the access authority can be changed according to the appropriate duties, and strict access control can be performed.

  Further, according to the authentication authorization system 1000 according to the fifth embodiment, it is possible to give a master-slave relationship to the link information, and to determine the duties based on the master-slave relationship.

  In the above, the user attribute information acquired from the authentication repository assigned to the company code for the main job is set as the main job. However, if the user attribute information acquired from the authentication repository assigned to the main company code is not acquired, the third user attribute information acquisition unit 38 reads from the authentication repository assigned to the main company code. User attribute information may be acquired.

  In (S33), when the user attribute information of the link source is acquired, the process proceeds to (S14-1). However, the process may return to (S31) and check whether the acquired link source user attribute information further includes link source information. That is, as long as the link source exists, the user attribute information of the link source may be acquired, and the user attribute information in the main may be used as the main job. In this case, all the link information of the acquired user attribute information may be acquired in (S14-1), and all the user attribute information of the acquired link information may be acquired in (S15-1).

  That is, the authentication authorization system 1000 according to the fifth embodiment is characterized in that the current job authority is automatically determined from the user's access history based on the user's access history.

Embodiment 6 FIG.
Next, a sixth embodiment will be described. In the fifth embodiment, a single authentication / authorization server 1 and an authentication / authorization method in the case where the user uses the business system without being aware of the current job are shown. In the sixth embodiment, authentication and access control when there are a plurality of authentication / authorization servers 1 and the user uses the business system without being aware of the current job will be described.

  FIG. 20 is a configuration diagram illustrating a schematic configuration of an authentication authorization system 1000 according to the sixth embodiment. The authentication / authorization system 1000 according to the sixth embodiment includes an access route mapping DB 8 similar to that of the fifth embodiment. The other configuration is the same as that of the second embodiment.

The functional block diagram of the authentication and authorization system 1000 according to the sixth embodiment is the same as that of the first embodiment except that the authentication and authorization server communicates with the access route mapping DB 8.
The authentication process and the authorization process in the sixth embodiment are a combination of the second and fifth embodiments. That is, for the authentication process, (S8-2) of the authentication process according to the fifth embodiment shown in FIG. 18 is replaced with (S8-1) of the authentication process according to the second embodiment shown in FIG. The authorization process is the same as the authorization process of the fifth embodiment shown in FIG.

  As described above, according to the authentication / authorization system 1000 according to the sixth embodiment, even when there are a plurality of authentication / authorization servers 1, as in the case of a single server, the current job is determined based on the access history of the user. It is possible. Therefore, even when the user uses the system without being aware of the duties, it is possible to perform strict access control according to the appropriate duties.

  That is, the authentication / authorization system 1000 according to the fourth embodiment includes the authentication / authorization server 1 in a plurality of different housings, and obtains attribute information from single sign-on and a link between users even between different servers for access control. In addition, the current job authority is automatically determined from the user's access history based on the user's access history.

The figure which showed an example of the external appearance of the authentication authorization system 1000 concerning embodiment. The figure which shows an example of the hardware constitutions of the authentication authorization server 100 in embodiment. 1 is a configuration diagram showing a schematic configuration of an authentication authorization system 1000 according to a first embodiment. FIG. 3 is a functional block diagram showing functions of the authentication authorization system 1000 according to the first embodiment. 5 is a flowchart of authentication processing of the authentication authorization server 1 in the first embodiment. 6 is a flowchart of an authorization process of the authentication authorization server 1 in the first embodiment. FIG. 3 is a configuration diagram showing a schematic configuration of an authentication authorization system 1000 according to a second embodiment. FIG. 4 is a functional block diagram showing functions of an authentication authorization system 1000 according to the second embodiment. The flowchart of the authentication process of authentication authorization server A1a in Embodiment 2, and authentication authorization server B1b. FIG. 6 is a configuration diagram showing a schematic configuration of an authentication authorization system 1000 according to a third embodiment. FIG. 9 is a functional block diagram showing functions of an authentication authorization system 1000 according to the third embodiment. 10 is a flowchart of authentication processing of the authentication authorization server 1 according to the third embodiment. 10 is a flowchart of an authorization process of the authentication authorization server 1 in the third embodiment. FIG. 6 is a configuration diagram showing a schematic configuration of an authentication authorization system 1000 according to a fourth embodiment. FIG. 6 is a configuration diagram showing a schematic configuration of an authentication authorization system 1000 according to a fifth embodiment. The figure shown about an example of access route mapping DB8. FIG. 10 is a functional block diagram showing functions of an authentication authorization system 1000 according to the fifth embodiment. 18 is a flowchart of authentication processing of the authentication authorization server 1 in the fifth embodiment. 10 is a flowchart of authorization processing of the authentication authorization server 1 according to the fifth embodiment. FIG. 10 is a configuration diagram showing a schematic configuration of an authentication authorization system 1000 according to a sixth embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 Authentication authorization server, 2a Authentication repository A, 2b Authentication repository B, 3 ACLDB, 4 Client, 6 Login screen, 10 Identification information receiving part, 20 Authentication repository search part, 30 User attribute information acquisition part, 32 1st user attribute information Acquisition unit, 34 Second user attribute information acquisition unit, 35 Link destination user attribute information acquisition unit, 36 Link source user attribute information acquisition unit, 38 Third user attribute information acquisition unit, 40 Link information acquisition unit, 50 Authority information acquisition unit , 52 First authority information acquisition unit, 54 Second authority information acquisition unit, 60 Authentication authorization processing unit, 62 First authentication authorization processing unit, 64 Second authentication authorization processing unit, 72 Path acquisition unit, 74 Path determination unit, 76 Group identification information acquisition unit, 90 authentication determination unit, 901 CRT display device, 902 K / B, 903 mouse, 904 FDD, 905 CDD, 908 database, 909 system unit, 911 CPU, 912 bus, 913 ROM, 914 RAM, 915 communication board, 916 external server, 917 server A, 918 server B, 920 magnetic disk unit, 921 OS, 922 window System, 923 program group, 924 file group, 931 telephone, 932 FAX machine, 940 Internet, 941 gateway, 942 LAN, 980 processing device, 982 input device, 984 storage device, 986 display device, 988 communication device.

Claims (12)

An authentication repository search unit that searches a predetermined authentication repository by a processing device from a plurality of authentication repositories that store user attribute information assigned to each user including attribute information and link information indicating an authentication repository to be linked in a storage device When,
A first user attribute information acquisition unit that acquires user attribute information of a predetermined user from a first authentication repository that is an authentication repository searched by the authentication repository search unit;
A link information acquisition unit that acquires link information from the user attribute information acquired by the first user attribute information acquisition unit and stores the link information in a storage device;
A second user attribute information acquisition unit that acquires user attribute information of the user from a second authentication repository that is an authentication repository indicated by the link information acquired by the link information acquisition unit, and stores the user attribute information in a storage device;
In response to access from the user terminal by the user to the server of the first group, which is the group to which the first authentication repository is assigned, by the processing device based on the user attribute information acquired by the first user attribute information acquisition unit User attribute information acquired by the second user attribute information acquisition unit for access from the user terminal by the user to the server of the second group, which is a group to which the second authentication repository is assigned, by performing access control An authentication authorization server comprising an authentication authorization processing unit that performs access control by a processing device based on the above. The authentication authorization server further includes:
The authority level stored by ACLDB (Access Control List Data Base) that stores access authority information for each authority level is included in the user attribute information acquired by the first user attribute information acquisition unit from the first level access authority information. The access authority information is acquired as the first authority information based on the attribute information, and the authority level stored by the ACLDB is included in the user attribute information acquired by the second user attribute information acquisition unit from the second level access authority information. An authority information acquisition unit that acquires the access authority information as the second authority information based on the attribute information and stores it in the storage device;
The authentication authorization processing unit performs access control based on the first authority information acquired by the authority information acquisition unit for the access from the user terminal by the user to the server of the first group. 2. The authentication authorization server according to claim 1, wherein access control is performed based on the second authority information acquired by the authority information acquisition unit for access from a user terminal to the server of the group by the user. The authentication repository search unit includes a predetermined authentication repository from a plurality of authentication repositories storing user attribute information assigned to each user including attribute information and link information indicating a link destination authentication repository and a link source authentication repository. Search for
The second user attribute information acquisition unit includes a link destination user information acquisition unit that acquires user attribute information of the user from a link destination authentication repository indicated by the link information acquired by the link information acquisition unit, and a link indicated by the link information A link source user information acquisition unit that acquires user attribute information of the user from the source authentication repository,
The authentication authorization server further includes:
The authority level stored by ACLDB (Access Control List Data Base) that stores access authority information for each authority level is included in the user attribute information acquired by the first user attribute information acquisition unit from the access authority information of the second level. The access authority information is acquired as the first authority information based on the attribute information, and the authority level stored by the ACLDB is included in the user attribute information acquired by the link destination user attribute information acquisition unit from the access authority information of the second level. The access authority information is acquired as the second authority information based on the attribute information, and the authority level stored by the ACLDB is included in the user attribute information acquired by the link source user attribute information acquisition unit from the first level access authority information. Access authority information based on the attribute information 3 It has an authority information acquisition part to acquire as authority information,
The authentication authorization processing unit performs access control based on the first authority information acquired by the authority information acquisition unit for the access from the user terminal by the user to the server of the first group, and the link destination For the access from the user terminal by the user to the link destination group server to which the authentication repository is assigned, access control is performed based on the second authority information acquired by the authority information acquisition unit, and the link source authentication repository The access control is performed based on the third authority information acquired by the authority information acquisition unit for access from the user terminal by the user to the server of the link source group to which is assigned. The listed authentication authorization server. The authentication authorization server further includes:
An identification information receiving unit for receiving user identification information for identifying a user and group identification information for identifying a group via a communication device;
The authentication repository search unit searches the authentication repository assigned to the group identified by the group identification information received by the identification information receiving unit as the predetermined authentication repository,
The first user attribute information acquisition unit acquires user attribute information from the first authentication repository searched by the authentication repository search unit, with a user identified by the user identification information received by the identification information receiving unit as a predetermined user. The authentication authorization server according to claim 1, wherein: 5. The authentication authorization server according to claim 4, wherein the identification information receiving unit receives user identification information and group identification information from a server of the group accessed by a user from a user terminal. The authentication authorization server further includes:
When the user accesses the server from the user terminal, the device includes an identification information receiving unit that receives user identification information for identifying the user via the communication device,
The authentication repository search unit searches the authentication repository assigned to the group to which the server accessed by the user terminal belongs as the predetermined authentication repository,
The first user attribute information acquisition unit acquires user attribute information from the first authentication repository searched by the authentication repository search unit, with a user identified by the user identification information received by the identification information receiving unit as a predetermined user. The authentication authorization server according to claim 1, wherein: The authentication authorization server further includes:
A route acquisition unit that acquires user route information indicating a route accessed from the user terminal to the server and stores it in a storage device;
For each user, an access route mapping DB (Data Base) that stores route information for access to the server and group identification information for identifying a group assigned to the route information is searched and acquired by the route acquisition unit. A route determination unit for determining whether or not the user route information exists as route information assigned to the user by the processing device;
A group identification information acquisition unit that acquires group identification information assigned to the route information and stores the group identification information in a storage device when the route determination unit determines that there is a route accessed by the user to the server;
The authentication repository search unit searches for a third authentication repository assigned to a third group that is a group identified by the group identification information acquired by the group identification information acquisition unit,
The authentication authorization server further includes:
A third user attribute information acquisition unit that acquires user attribute information of the user from a third authentication repository searched by the authentication repository search unit and stores the user attribute information in a storage device;
The authority level stored by ACLDB (Access Control List Data Base) that stores access authority information for each authority level is included in the user attribute information acquired by the third user attribute information acquisition unit from the access authority information of the first level. An authority information acquisition unit that acquires the access authority information as the first authority information based on the attribute information and stores it in the storage device;
The authentication authorization processing unit performs access control based on the first authority information acquired by the authority information acquiring unit with respect to access from the user terminal by the user to the server of the third group. The authentication authorization server according to claim 6. The authority information acquisition unit is accessed based on attribute information included in user attribute information acquired from other authentication repositories excluding the third authentication repository from access authority information whose authority level stored by ACLDB is the second level. Obtain authority information as second authority information,
The authentication authorization processing unit performs access control based on the second authority information acquired by the authority information acquiring unit for access from a user terminal by the user to a server of a group other than the third group. The authentication authorization server according to claim 7. In an authentication and authorization system that controls access to servers assigned to each group of multiple groups,
A first authentication repository assigned to a first group that is one of the plurality of groups;
A first authentication authorization server for controlling access to the server assigned to the first group;
A second authentication repository identified by the first authentication authorization server;
A second authentication authorization server for controlling access to a server assigned to the second group to which the second authentication repository is assigned,
The first authentication repository is
A user attribute information storage unit that stores user attribute information assigned to each user including attribute information and link information indicating an authentication repository to be linked in a storage device;
The first authentication authorization server is
An identification information receiving unit for receiving user identification information for identifying a user via a communication device;
A first user attribute information acquisition unit that acquires user attribute information of a user identified by the user identification information received by the identification information reception unit from the first authentication repository;
A link information acquisition unit that acquires link information from the user attribute information acquired by the first user attribute information acquisition unit and stores the link information in a storage device;
The authentication repository indicated by the link information acquired by the link information acquisition unit is identified as the second authentication repository, and user attribute information of the user indicated by the link information is acquired from the second authentication repository and stored in a storage device. 2 user attribute information acquisition unit;
A first authentication authorization processing unit for performing access control by a processing device based on user attribute information acquired by the first user attribute information acquiring unit with respect to an access from a user terminal to the first group server by the user; With
The second authentication authorization server is
A second authentication authorization processing unit for performing access control by a processing device based on the user attribute information acquired by the second user attribute information acquiring unit with respect to an access from the user terminal by the user to the second group of servers; An authentication / authorization system comprising: The authentication authorization system further includes:
A first ACLDB (Access Control List Data Base) assigned to the first group and storing access authority information for each authority level;
A second ACLDB assigned to the second group and storing access authority information for each authority level;
The first authentication authorization server further includes:
The access authority information is acquired as the first authority information based on the attribute information included in the user attribute information acquired by the first user attribute information acquisition unit from the access authority information whose authority level is stored in the first ACLDB. A first authority information acquisition unit;
The second authentication authorization server further includes:
The access authority information is acquired as the second authority information based on the attribute information included in the user attribute information acquired by the second user attribute information acquisition unit from the access authority information whose authority level stored by the second ACLDB is the second level. A second authority information acquisition unit for storing in the storage device,
The first authentication authorization processing unit performs access control based on the first authority information acquired by the authority information acquisition unit for access from the user terminal by the user to the server of the first group,
The second authentication authorization processing unit performs access control based on the second authority information acquired by the authority information acquiring unit with respect to access from the user terminal by the user to the server of the second group. The authentication authorization system according to claim 9, wherein: In the authentication authorization method of the authentication authorization server,
An authentication repository search unit searches a predetermined authentication repository by a processing device from a plurality of authentication repositories that store user attribute information assigned to each user including attribute information and link information indicating an authentication repository to be linked in a storage device. An authentication repository search step to
A first user attribute information acquisition step in which user attribute information of a predetermined user is acquired from a first authentication repository that is an authentication repository searched in the authentication repository search step, and the first user attribute information acquisition unit stores the storage in a storage device;
A link information acquisition step in which link information is acquired from the user attribute information acquired in the first user attribute information acquisition step and the link information acquisition unit stores it in a storage device;
Acquisition of second user attribute information acquired by the second user attribute information acquisition unit from the second authentication repository, which is the authentication repository indicated by the link information acquired in the link information acquisition step, and stored in the storage device Steps,
Authentication authorization processing based on the user attribute information acquired in the first user attribute information acquisition step with respect to the access from the user terminal by the user to the server of the first group that is the group to which the first authentication repository is allocated The second user attribute information acquisition step with respect to the access from the user terminal by the user to the server of the second group, which is a group to which the second authentication repository is assigned. An authentication authorization method, comprising: an authentication authorization processing step in which an authentication authorization processing unit performs access control by a processing device based on acquired user attribute information. In the authentication authorization program of the authentication authorization server,
Authentication repository search processing for searching a predetermined authentication repository by a processing device from a plurality of authentication repositories storing user attribute information assigned to each user including attribute information and link information indicating an authentication repository to be linked in a storage device When,
A first user attribute information acquisition process for acquiring user attribute information of a predetermined user from a first authentication repository that is an authentication repository searched in the authentication repository search process;
A link information acquisition process for acquiring link information from the user attribute information acquired in the first user attribute information acquisition process and storing the link information in a storage device;
A second user attribute information acquisition process for acquiring user attribute information of the user from a second authentication repository that is an authentication repository indicated by the link information acquired in the link information acquisition process, and storing the user attribute information in a storage device;
For the access from the user terminal by the user to the server of the first group, which is the group to which the first authentication repository is assigned, by the processing device based on the user attribute information acquired in the first user attribute information acquisition process User attribute information acquired by the second user attribute information acquisition process for access from the user terminal by the user to the server of the second group, which is a group to which the second authentication repository is assigned, by performing access control An authentication authorization program for causing a computer to execute authentication authorization processing processing for performing access control by a processing device based on the above.

Images