JP2008210117A - Information management system and user information management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information management system and a user information management method, in which input is easy when setting or deleting user information. <P>SOLUTION: The information management system includes a user information management system 10 and a plurality of sub-systems connected to the user information management system 10 via a network 30. The user information management system 10 includes: authority information in sub-systems 20; an authority conversion information storage part 163 wherein authority information for management associated with one piece or a plurality of pieces of the authority information is stored; a user information storage part 151 wherein user information including authority information for management is stored; and an authority conversion means which converts authority information for management stored in the user information storage part 151 to authority information of sub-systems associated with the authority information for management on the basis of information stored in the authority conversion information storage part 163. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to user information management in a network distributed environment, and more particularly to an information management system and user information management method for managing user information.

  In recent years, there are many examples of building large-scale systems in which multiple systems are connected via a network, but the user environment is often different for each system, so the management of the system administrator who creates the user environment Work is increasing. In such a network distributed environment, the user environment for using the system varies from system to system. Therefore, the system administrator needs to create / delete different user environments for each system. For the system administrator to manage, the work of creating / deleting the user environment has been a burden. Since only the system administrator is authorized to create and delete user environments, general users who wish to start and end use of the system should create or delete user environments from the system administrator. There was a need to ask.

In order to solve such a problem, Patent Document 1 proposes a system that can create and delete user environments of a plurality of subsystems by one operation in the user information management system.
Japanese Patent Laid-Open No. 9-185503

  In a network distributed environment, user information management is generally executed individually in each of a plurality of systems. Even if the user information is collectively managed as shown in Patent Document 1, the user information in a plurality of systems is merely associated with the user ID, so that the user authority is granted / deleted / updated, locked / unlocked When changing the password, it is necessary to perform complicated input to each of the plurality of systems.

  The present invention has been made to solve such problems, and an object of the present invention is to provide an information management system and a user information management method that can be easily input when setting or deleting user information.

  An information management system according to the present invention includes a user information management system and a plurality of subsystems connected to the user information management system via a network, and the user information management system performs authority management in the plurality of subsystems. An information management system that executes centrally, wherein the user information management system includes an authority conversion information storage unit that stores management authority information and authority information in a plurality of subsystems associated with the management authority information The user information storage unit stores user identification information, management authority information associated with the user identification information, and information stored in the authority conversion information storage unit. The stored management authority information is stored in the subsystem authority information associated with the management authority information. And authority conversion means for converting, in which comprising means for performing a permission management processing for each sub-system based on the authority information of the sub-system which has been converted by the authority converting means.

  Here, the user information management system specifies the user identification information and the management authority, and when an authorization request is executed, the user information management unit stores the user identification information and the management authority information in the user information storage unit. Means for storing in association; means for converting the authority information for management stored in the user information storage unit into authority information of the subsystem by the authority converting means; authority information of the subsystem after the conversion; A plurality of subsystems that generate the request and authorization request information including user identification information and transmit the authorization request information to each of the plurality of subsystems. Means for executing an authorization process based on the authorization information, authorization request, and user identification information included in the request information is provided.

  Further, the user information management system further stores the identification information of the subsystem in which the user is registered in association with the identification information of the user in the user information storage unit, and generates the authorization request information In this case, it is determined based on the information stored in the user information storage unit whether the user is registered in the subsystem that performs the authorization request, and when the user is not registered, the user registration request is sent to the subsystem. It is desirable to have a means for transmitting.

  The subsystem may include means for determining whether the user identification information included in the authorization request is already registered as a user, and executing user registration when it is determined that the user is not registered. Good.

  Further, the user information management system associates the user identification information with the management authority information from the user information storage unit when the authority deletion request is executed by specifying the user identification information and the management authority. Means for deleting, means for causing the authority conversion means to convert the management authority information into authority information of the subsystem, authority information of the subsystem after conversion, authority deletion request, and authority deletion including user identification information Means for generating request information and transmitting the request information to each of the plurality of subsystems. The subsystem that has received the authority deletion request information includes authority information, authority deletion request, and user included in the authority deletion request information. A means for executing authority deletion processing based on the identification information may be provided.

  Here, the user information management system further stores, in the user information storage unit, identification information of a subsystem in which the user is registered in association with user identification information, and generates the authority deletion request information. In the subsystem that performs the authority deletion request, it is determined whether the authority of the user is blanked by the authority deletion request based on the information stored in the user information storage unit, and the authority of the user is blanked. At this time, a means for transmitting a user registration deletion request to the subsystem may be provided.

  The subsystem preferably further includes means for determining whether or not the user's authority is blanked by the authority deletion request, and executing deletion of the user registration when it is determined that the user's authority is blank.

  An information management system according to another aspect of the present invention includes a user information management system, a first subsystem connected to the user information management system via a network, and a second subsystem, and the user information An information management system that centrally executes authority management in the first subsystem and the second subsystem in the management system, wherein the user information management system includes management authority information and the first subsystem Authority conversion for storing first authority information having authority contents corresponding to management authority information and second authority information having authority contents corresponding to the management authority information in the second subsystem in association with each other An information storage unit, a user identification information, and a user authority information associated with the user identification information; Based on the information stored in the information storage unit and the authority conversion information storage unit, the management authority information stored in the user information storage unit is associated with the management authority information. Authority conversion means for converting to authority information and second authority information, means for transmitting the first authority information converted by the authority conversion means to the first subsystem, and first information converted by the authority conversion means Means for transmitting the second authority information to the second subsystem.

  Here, the user information management system specifies the user identification information and the management authority, and when an authorization request is executed, the user information management unit stores the user identification information and the management authority information in the user information storage unit. Means for associating and storing, means for converting the management authority information stored in the user information storage unit into first authority information and second authority information by the authority conversion means, and the first authority after conversion Means for generating first authorization request information including information, authorization request, and user identification information, and transmitting the first authorization request information to the first subsystem, converted second authorization information, and authorization Means for generating a second authorization request information including a request and user identification information, and transmitting the second authorization request information to a second subsystem, wherein the first subsystem includes the first authorization request; Receive information , Including means for executing an authorization process based on the first authorization information, the authorization request, and the user identification information included in the first authorization request information, wherein the second subsystem includes the second authorization information A means for receiving the authorization request information and executing the authorization process based on the second authorization information, the authorization request, and the user identification information included in the second authorization request information may be provided.

  Further, the user information management system further stores the identification information of the subsystem in which the user is registered in association with the identification information of the user in the user information storage unit, and generates the authorization request information In this case, it is determined based on the information stored in the user information storage unit whether the user is registered in the subsystem that performs the authorization request, and when the user is not registered, the user registration request is sent to the subsystem. You may make it have a means to transmit.

  Each of the first subsystem and the second subsystem determines whether the user identification information included in the authorization request is already registered as a user, and determines that the user is not registered as a user. You may make it have a means to perform registration.

  Further, the user information management system deletes the association between the user identification information and the management authority information from the user information storage unit when the authority deletion request is executed by specifying the user identification information and the management authority. Means for converting the management authority information into first authority information and second authority information by the authority conversion means, converted first authority information, authority deletion request, and user identification Means for generating first authority deletion request information including information and transmitting the first authority deletion request information to the first subsystem; second authority information after conversion; authority deletion request; and second information including user identification information Generating the authority deletion request information and transmitting the authority deletion request information to the second subsystem, wherein the first subsystem receives the first authority deletion request information and deletes the first authority deletion. Included in request information Means for executing authority deletion processing based on the first authority information, the authority deletion request, and the user identification information; the second subsystem receives the second authority deletion request information; Means for executing authority deletion processing based on the second authority information, authority deletion request, and user identification information included in the deletion request information may be provided.

  Further, the user information management system further stores the identification information of the subsystem in which the user is registered in association with the identification information of the user in the user information storage unit, and generates the authority deletion request information In this case, in the subsystem that performs the authority deletion request, it is determined based on the information stored in the user information storage unit whether the authority of the user is blanked by the authority deletion request, and the user authority is blanked. Sometimes it is desirable to have means for sending a user registration deletion request to the subsystem.

  Further, each of the first subsystem and the second subsystem determines whether or not the authority of the user is blanked by the authority deletion request, and deletes the user registration when it is determined that the user authority is blank. You may make it further have a means to perform.

  A user information management method according to the present invention is a method for managing user information in a plurality of subsystems connected to at least one user information management system via a network. Registering the authority information and the authority information for the plurality of subsystems associated with the authority information for management in the authority conversion information storage unit, and registering the authority information for management in the user information management system, A step of storing the identification information and management authority information associated with the identification information of the user in the user information storage unit, and in the user information management system, based on the information stored in the authority conversion information storage unit, The management authority information stored in the user information storage unit is changed to the management authority information. And converting the sub-system privilege information associated with contrast, in the user information management system, in which with a step of transmitting the authority information of the converted sub-system for each of the subsystems.

  Here, in the user information management system, when an authorization request is executed by specifying user identification information and management authority, the user information storage unit associates the user identification information and management authority information with each other. In the user information management system, the management authority information stored in the user information storage unit is converted into authority information of the subsystem by the authority conversion means, and in the user information management system, A step of generating authority request information including authority information of the subsystem after conversion, an authority request, and user identification information, and transmitting the information to a plurality of subsystems, and a plurality of the authority request information received In the subsystem, authorization information, authorization request, and user identification included in the authorization request information It may include a step of performing a authorization process based on the distribution.

  Furthermore, in the user information management system, the user information storage unit further stores the identification information of the subsystem in which the user is registered in association with the user identification information, and generates the authorization request information. In this case, it is determined based on the information stored in the user information storage unit whether the user is registered in the subsystem that performs the authorization request, and when the user is not registered, the user registration request is sent to the subsystem. You may make it transmit.

  In the subsystem, it is desirable to determine whether the user identification information included in the authorization request has already been registered, and to perform user registration when it is determined that the user has not been registered.

  In the user information management system, when an authority deletion request is executed by specifying user identification information and management authority, the association between the user identification information and management authority information is deleted from the user information storage unit. In the user information management system, the step of converting the management authority information into the authority information of the subsystem, the authority information of the subsystem after the conversion in the user information management system, an authority deletion request, The step of generating authority deletion request information including user identification information and transmitting it to the subsystem, and the authority information and authority deletion included in the authority deletion request information in the subsystem that has received the authority deletion request information A step of executing authority deletion processing based on the request and user identification information may be provided.

  Further, in the user information management system, the user information storage unit further stores identification information of a subsystem in which the user is registered in association with user identification information, and generates the authority deletion request information. In this case, in the subsystem that performs the authority deletion request, it is determined based on the information stored in the user information storage unit whether the authority of the user is blanked by the authority deletion request, and the user authority is blanked. Sometimes a user registration deletion request may be sent to the subsystem.

  In the subsystem, it is desirable to determine whether the authority of the user is blanked by the authority deletion request, and to delete the user registration when it is determined that the authority of the user is blank.

  A user information management method according to another aspect of the present invention is a method for managing user information in a first subsystem and a second subsystem connected to at least one user information management system via a network. In the user information management system, authority conversion is performed on the management authority information, the first authority information in the first subsystem associated with the management authority information, and the second authority information in the second subsystem. A step of registering management authority information by storing in the information storage unit; and in the user information management system, the user identification information and the management authority information associated with the user identification information in the user information storage unit And storing in the authority conversion information storage unit in the user information management system Converting the management authority information stored in the user information storage unit into first authority information and second authority information associated with the management authority information based on the information; A step of transmitting the converted first authority information from the user information management system to the first subsystem, and the converted second authority information from the user information management system to the second subsystem. And a step of transmitting to.

  Here, in the user information management system, when an authorization request is executed by specifying user identification information and management authority, the user information storage unit associates the user identification information and management authority information with each other. Storing the management authority information stored in the user information storage unit into first authority information and second authority information by the authority conversion means in the user information management system, and the user The information management system generates first authorization information after conversion, authorization request, and first authorization request information including user identification information, and transmits the first authorization information to the first subsystem; The user information management system generates second authority information after conversion, authority request, and second authority request information including user identification information, A step of transmitting to the subsystem; the first subsystem receives the first authorization request information; and the first authorization information, the authorization request included in the first authorization request information, and A step of executing an authorization process based on the identification information of the user; and the second subsystem receives the second authorization request information, and the second authorization information included in the second authorization request information And a step of executing an authorization process based on the authorization request and the identification information of the user.

  In the user information management system, the user information storage unit further stores the identification information of the subsystem in which the user is registered in association with the user identification information, and generates the authorization request information. In this case, it is determined based on the information stored in the user information storage unit whether the user is registered in the subsystem that performs the authorization request, and when the user is not registered, the user registration request is sent to the subsystem. It is desirable to send.

  Further, in the first subsystem and the second subsystem, it is determined whether the user identification information included in the authorization request has already been registered as a user. If it is determined that the user has not been registered, user registration is performed. It is desirable to execute.

  In the user information management system, when an authority deletion request is executed by specifying user identification information and management authority, the association between the user identification information and management authority information is deleted from the user information storage unit. Converting the management authority information into first authority information and second authority information in the user information management system; and converting the first authority information in the user information management system; Generating an authority deletion request and first authority deletion request information including user identification information, and transmitting the first authority deletion request information to the first subsystem; and converting the second authority in the user information management system Generating a second authority deletion request information including information, an authority deletion request, and user identification information, and transmitting the information to the second subsystem; The first subsystem receives the first authority deletion request information and performs authority deletion processing based on the first authority information, the authority deletion request, and the user identification information included in the first authority deletion request information. A step of executing, wherein the second subsystem receives the second authority deletion request information, and includes second authority information, authority deletion request, and user identification information included in the second authority deletion request information. And a step of executing authority deletion processing based on the above.

  Further, in the user information management system, the user information storage unit further stores identification information of a subsystem in which the user is registered in association with user identification information, and generates the authority deletion request information. In this case, in the subsystem that performs the authority deletion request, it is determined based on the information stored in the user information storage unit whether the authority of the user is blanked by the authority deletion request, and the user authority is blanked. Sometimes it is desirable to send a user registration deletion request to the subsystem.

  Further, in the subsystem, it may be determined whether the authority of the user is blanked by the authority deletion request, and the user registration is deleted when it is determined that the authority of the user is blank.

  According to the present invention, it is possible to provide an information management system and a user information management method that can be easily input when setting or deleting user information.

  First, the processing of the information management system according to the exemplary embodiment of the present invention will be described using the principle diagram of FIG. As shown in FIG. 1, the information management system includes a user information management system 10 and a plurality of subsystems 20 connected via a network.

  In this example, a process for giving “top”, which is a management authority, to a user whose user ID is “XX1” will be described. Here, the management authority does not include all authority information different for each subsystem in parallel, but is identification information assigned to a combination of authority information different for each subsystem. For example, for the user whose user ID is “XX1”, the authority “A” (for example, a file can be referenced) is given in the subsystem A, and the authority “α” (for example, a file can be updated) is given in the subsystem B. Is assigned to the subsystem C, the user ID “XX1” is simply assigned to the subsystem A, and the subsystem B is assigned the authority “A” (for example, file reference and file update is possible). “Α” of subsystem C and “a” of subsystem C are stored in association with each other, instead of “a” of subsystem A, “α” of subsystem B, and “a” of subsystem C The authority information for management called “Class A” is given.

  Thus, in the user information management system 10, the authority in each of the subsystems 20 is not associated with the user ID, but only the management authority information is associated with the user ID. At this time, the management authority information can be determined according to the position of the user. For example, administrative authority information “Extra” that grants a broad authority is granted to users at the department manager level, and administrative authority “Oto” that grants a narrower authority to users at the managerial level Is granted. The management authority information can be determined according to the department to which the user belongs. For example, for the user in the personnel department, the management authority “丙 1” that can execute the necessary process in the personnel department is given, and for the user in the sales department, the necessary process is executed in the sales department. A management authority of “丙 2” is granted. A plurality of management authorities may be given to one user.

  For example, when a user changes from a section manager's position to a section manager's position, execute the input to change the authority "B" given to the section manager's office to the management authority "B" given to the department manager's position, and store the user information The identification information of the user and the management authority “A” are stored in the unit 151 in association with each other. In this case, each subsystem 20 executes a process for deleting the authority on the subsystem corresponding to the management authority “O” for this user by the process described later, and corresponds to the management authority “E”. Execute the process to grant authority on the subsystem to be executed.

  Here, the process of granting authority will be described. First, the system administrator or the like performs input for associating the user ID “XX1” with the management authority “A” to the user information management system 10. In the user information management system 10, since the management authority “A” and authority information in each subsystem 20 associated therewith are stored in the authority conversion information storage unit, this authority conversion information storage Based on the information stored in the section, the management authority information is converted into subsystem authority information associated with the management authority information. In this example, the management authority “A” is converted to “A” for subsystem A, “α” for subsystem B, and “A” for subsystem C.

  Next, the user information management system 10 transmits an authority grant request packet to each of the subsystems A, B, and C. The authorization request packet for subsystem A includes an authorization request, user ID “XX1”, and authority “A” in subsystem A. The authorization request packet for the subsystem B includes an authorization request, “XX1” as the user ID, and “α” as the authority in the subsystem B. The authorization request packet for the subsystem C includes an authorization request, “XX1” as the user ID, and “a” as the authority in the subsystem C.

  The subsystems A, B, and C that have received these authorization request packets execute the authorization process.

  When executing the authority deletion, the user information management system 10 converts the authority information for authority deletion into the authority information of the subsystem and includes the converted authority information in the authority deletion request packet. Send to each subsystem. The authority change means that the authority is different from the authority in the state where the authority has been granted in advance, for example, when a different authority is added and granted, or when a part of the authority is deleted, Some or all of the authority may be deleted and the authority may be added.

  As described above, in the information management system according to the present invention, the authority of a plurality of subsystems can be centrally managed in the user information management system 10, and a plurality of subsystems can be obtained by granting and deleting authority in the user information management system 10. Since it is not necessary to perform each of 20 individually, it is possible to drastically reduce the labor of the system administrator. In particular, in the information management system according to the present invention, in the user information management system 10, each authority in the subsystem 10 is not registered for each user, but a combination of authorities in each subsystem 10 is used as one management authority. Since registration is performed for each user, the management is extremely easy. For example, when granting authority to a certain user, consider what authority should be granted in each subsystem one by one, and do not register it, but a combination that gives equivalent authority in each subsystem It is only necessary to define one management authority for and to grant this authority. Even in the case of deleting the authority, it is possible to specify the authority to be deleted in each subsystem 20 as a management authority, so the authority deletion process can be performed very easily. It becomes.

  Next, the configuration and processing of the information management system according to the embodiment of the present invention will be specifically described with reference to FIGS. FIG. 2 is a conceptual diagram of a user authorization / deletion method, lock / unlock, and password change in the information management system according to the present invention.

  The information management system according to the present invention includes at least one user information management system 10 and a plurality of subsystems 20. The user information management system 10 and the plurality of subsystems 20 are connected by a network 30.

  The user information management system 10 includes a user information storage unit 151, a processing procedure information storage unit 161, a program information storage unit 162, and an authority conversion information storage unit 163.

  In the user information storage unit 151, as shown in FIG. 4, user identification information 152a (153a) for identifying a user, management authority information 152b for specifying user authority, lock status information 153b, and password 153c information Are stored in association with each other. In the present invention, the management authority information 152b does not include all of the authority information different for each subsystem in parallel, but as described above, the identification assigned to the combination of authority information different for each subsystem. Information.

  In the example shown in FIG. 4, the data is stored separately for the first user information and the second user information. However, the present invention is not limited to this, and if other information is associated with the user identification information, the data is divided. There is no need to be. The user information storage unit 151 may further store user attribute information such as a user name, email address, telephone number, affiliation, and title. As a result, user attribute information can be centrally managed.

  In the processing procedure information storage unit 161, processing procedure information defining processing procedures for executing various processing such as user authorization / deletion processing, lock / unlock processing, and password change processing with the subsystem 20 Is stored.

  As shown in FIG. 2, the program information storage unit 162 includes a user authority grant request program 101, a user authority deletion request program 102, a user lock request program 103, a user lock release request program 104, a user password change request program 105, A process execution program 106, a user management program 107, and an authority conversion program 108 are stored.

  Here, the user authority grant request program 101 executes, for example, processing for requesting user authority grant according to the flowchart shown in FIG. The user authority deletion request program 102 executes, for example, processing for requesting user authority deletion in accordance with the flowchart shown in FIG. For example, the user lock request program 103 executes a process for requesting the user lock setting according to the flowchart shown in FIG. The user lock release request program 104 executes processing for requesting user lock release according to the flowchart shown in FIG. 9, for example. For example, the user password change request program 105 executes processing for requesting change of the user password in accordance with the flowchart shown in FIG. For example, the process execution program 106 executes a process according to the process execution request from the user management program 107 according to the flowchart shown in FIG.

  The user management program 107 is, for example, based on the user information stored in the user information storage unit 151 and the processing procedure information stored in the processing procedure information storage unit 161 according to the flowchart shown in FIG. Authorizing / deleting, locking / unlocking, and password of the user with respect to the processing execution program 106 in response to requests from the authority deleting request program 102, user lock request program 103, user lock release request program 104, and user password change request program 105 Execute the process that requests the change. The authority conversion program 108 executes processing for requesting change of user authority.

  The authority conversion program 108 executes authority conversion processing, for example, according to the flowchart shown in FIG.

  The authority conversion information storage unit 163 stores information for converting the authority of the user information management system 10 into the authority of the subsystem 20. An example of information is shown in the authority conversion information storage unit 163 shown in FIG. In the authority conversion information storage unit 163, management authority information and authority information in the subsystem 20 are stored in association with each other. In this example, “a” in the subsystem A, “α” in the subsystem B, and “a” in the subsystem C are associated with the management authority information “A”. For example, when the management authority information “A” is associated with a certain user on the user information management system 10, “A” in the subsystem A and “α” in the subsystem B are processed by a process described later. And “a” is registered in the subsystem C, respectively. For management authority information, as shown in “B” in FIG. 5, a certain subsystem may not have corresponding authority information. Further, as shown by “丙” in FIG. 5, a plurality of authority information (here “I”, “ C) may correspond.

  In such an authority conversion information storage unit 163, specifically, the authority information for management and the authority information in the subsystem can be associated with each other via a value variable corresponding to the authority content on a one-to-one basis.

  The subsystem 20 includes a processing procedure information storage unit 251 and a program information storage unit 252.

  The processing procedure information storage unit 251 stores processing procedure information that defines processing procedures for executing various processing such as user authorization / deletion processing, lock / unlock processing, and password change processing.

  The program information storage unit 252 stores programs such as the process execution program 106.

  Next, the configuration of the user information management system 10 according to the present embodiment will be described with reference to FIG. The user information management system 10 is configured by a computer system, and includes a control unit 11, an input device 12, an output device 13, an input / output control circuit 14, an information storage unit 15, and an information storage unit 16 that are configured by a CPU 111, a ROM 112, and a RAM 113. These components are connected to each other by a system bus.

  The control unit 11 executes individual arithmetic processing for realizing the operation as the user information management system 10. The CPU 111 is a central processing unit, and executes transfer and arithmetic processing based on a main program stored in the ROM 112, an application program expanded from the information storage unit 15 to the RAM 113, temporarily stored data, and the like. The RAM 113 functions as a storage unit that temporarily stores data.

  The input device 12 is a data input device such as a keyboard and a mouse. Data can be input to the information storage unit 15 and the information storage unit 16 by the input device 12. The output device 13 is a display device such as an LCD or a CRT, or a printing device (printer). The input / output control circuit 14 performs control for executing data input / output with an external system such as the subsystem 20.

  The information storage unit 15 is a storage unit (storage unit) that stores user information, and includes a memory, a hard disk, and the like. The information storage unit 15 according to this example includes a user information storage unit 151.

  As shown in FIG. 4, the user information storage unit 151 stores user identification information for identifying a user, management authority information for specifying user authority, lock status information, and password information.

  The information storage unit 16 is a storage unit (storage unit) that stores processing procedure information and program information, and includes a memory, a hard disk, and the like. The information storage unit 16 according to this example includes at least a processing procedure information storage unit 161, a program information storage unit 162, and an authority conversion information storage unit 163.

  Since the processing procedure information storage unit 161, the program information storage unit 162, and the authority conversion information storage unit 163 store the information described with reference to FIG. 1, the description thereof is omitted here.

  Next, the configuration of the subsystem 20 according to the present embodiment will be described with reference to FIG. The subsystem 20 is configured by a computer system, and includes a control unit 21, an input device 22, an output device 23, an input / output control circuit 24, and an information storage unit 25 configured by a CPU 211, a ROM 212, and a RAM 213. The elements are connected to each other by a system bus.

  The control unit 21 executes individual arithmetic processing for realizing the operation as the subsystem 20. The CPU 211 is a central processing unit, and executes transfer and arithmetic processing based on a main program stored in the ROM 212, processing procedure information expanded from the information storage unit 25 to the RAM 213, temporarily stored data, and the like. . The RAM 213 functions as a storage unit that temporarily stores data.

  The input device 22 is a data input device such as a keyboard and a mouse. Data can be input to the information storage unit 25 by the input device 22. The output device 23 is a display device such as an LCD or a CRT, or a printing device (printer). The input / output control circuit 24 performs control for executing data input / output with an external system such as the user information management system 10 or another subsystem 20.

  The information storage unit 25 is a storage unit that stores information such as a program, and includes a memory, a hard disk, and the like. The information storage unit 25 according to this example includes at least a processing procedure information storage unit 251 and a program information storage unit 252.

  Since the processing procedure information storage unit 251 stores the same information as the processing procedure information storage unit 161 described above, the description thereof is omitted.

  The program information storage unit 252 stores a process execution program 106 that executes a process as shown in FIG.

  Since the process execution program 106 executes the same process as described above, the description thereof is omitted.

  Subsequently, a user authority grant process will be described with reference to FIGS. 6, 11, 12, and 13. This user authorization processing can be executed in either the user information management system 10 or the subsystem 20, but in the following description, a case in which the user authority management processing is executed in the user information management system 10 will be described. . In addition, although various processes in the following description are executed by the control unit based on each program, the description of the control unit is omitted and described as the process of each program. The flowchart shown in FIG. 6 shows the authorization processing for one subsystem. However, when there are a plurality of subsystems that need authorization, the authorization processing shown in FIG. 6 is performed for each subsystem. Executed.

  When the system administrator inputs a user ID and management authority information on the user information management system 10, the user ID and management authority information are associated with each other and stored in the user information storage unit 151. In response to this input, the control unit 11 of the user information management system 10 recognizes that there has been a user authority grant request, and executes processing based on the user authority grant request program 101.

  As shown in FIG. 6, the user authority grant request program 101 of the user information management system 10 generates a user authority grant request packet including the input user ID and identification information of the subsystem that requests the user authorization. (S101), and transmits to the user management program 107 of the user information management system 10 (S102). At this time, the subsystem identification information includes authority information corresponding to the management authority information from the authority conversion information storage unit 163 based on the management authority information associated with the user ID in the user information storage unit 151. It can be obtained by referring to the subsystem identification information. Normally, a user authority grant request packet corresponding to each of a plurality of subsystems that need to be given user authority is generated.

  As shown in FIG. 11, the user management program 107 receives the user authority grant request packet (S602), and determines the destination subsystem 20 and the processing procedure information according to the definition of the processing procedure information storage unit 161 (see FIG. 11). S604).

  The processing procedure information stored in the processing procedure information storage unit 161 is transmitted to the processing execution program 106 of the subsystem 20 specified by the subsystem identification information included in the user authority grant request packet (S605).

  The processing execution program 106 of the subsystem 20 shown in FIG. 12 converts the received processing procedure information into a file and stores it on the disks (storage means) 251 and 252 of the subsystem 20 (S716, S717), and the result is displayed. Transmit (S707).

  Returning to the flowchart of FIG. 11, when the processing procedure information is successfully transmitted, the user management program 107 of the user information management system 10 determines the management authority 152b for granting the authority of the specified user ID (that is, the specified The management authority information associated with the user ID is acquired from the user information storage unit 151 (S613), and the management authority 152b is transmitted to the authority conversion program 108 of the user information management system 10.

  The processing of the authority conversion program 108 is shown in FIG. Upon receiving the management authority 152b (S802), the authority conversion program 108 converts the received management authority into authority information of each subsystem (S803). Thus, the authority conversion program 108 converts the authority information on the subsystem 20 having the same authority content as the management authority of the user information management system 10 by searching. The authority conversion program 108 transmits the authority information of the subsystem 20 obtained by the conversion to the user management program 107 (S803).

  In this authority conversion program 108, the authority is converted under the mapping condition that the authority contents are the same as an example of the authority conversion program. However, this mapping condition may be arbitrarily set. For example, instead of mapping conditions that the authority contents are the same, a mapping condition for converting the authority contents of the creation of the file of the user information management system 10 and the change of the file into the authority contents of the creation of the file of the subsystem 20 is defined. Also good.

  As shown in FIG. 11, the user management program 107 receives the authority information of the subsystem 20 from the authority conversion program 108 (S629), and the authority including the user ID, the authority information of the subsystem 20, and an authority grant request. A grant request packet is generated (S630). At this time, the authorization request packet is generated for each transmission destination subsystem 20. Subsequently, the user management program 107 transmits the generated authority grant request packet to the process execution program 106 of each subsystem 20 (S623).

  As shown in FIG. 12, when the authorization request packet is received (S702), the processing execution program 106 of the subsystem 20 is designated when the user ID is not registered in the designated subsystem (S719). A user ID is registered in the subsystem (S720). Here, in this embodiment, it is determined whether or not the user ID is registered in the subsystem 20, but may be executed in the user information management system 10. In this case, the user information storage unit 151 of the user information management system 10 further stores the identification information of the subsystem in which the user is registered in association with the identification information of the user. Is generated based on the information stored in the user information storage unit 151, and the user registration request is authorized when the user is not registered. The user management program 107 may be able to execute processing to be transmitted to the subsystem 20 by including it in the grant request packet.

  Next, the processing execution program 106 of the subsystem 20 sets the authority of the subsystem 20 on the memory (S704), and the processing defined by the processing procedure information in the processing procedure information storage unit 161 is set on the memory. By executing using the authority information, the user authorization process is executed (S705).

  The result of the authority grant process executed in the process execution program 106 of the subsystem 20 is transmitted to the user management program 107 of the user management system 10 (S707).

  The user management program 107 receives the result of the authorization process (S624), and determines whether there is an authority of another subsystem 20 that needs further processing (S625). If there is, the processing from step S608 onward is executed for the authority of the other subsystem 20, and if there is no authority, a packet reception waiting state is entered (S602).

  Subsequently, a user authority deletion process will be described with reference to FIGS. 7, 11, 12, and 13. This user authority deletion process can be executed in either the user information management system 10 or the subsystem 20, but in the following description, a case in which the user authority deletion process is executed in the user information management system 10 will be described. . In addition, although various processes in the following description are executed by the control unit based on each program, the description of the control unit is omitted and described as the process of each program. The flowchart shown in FIG. 7 shows the authority deletion processing for one subsystem. However, when there are a plurality of subsystems that require authority deletion processing, the authority deletion processing shown in FIG. 7 for each subsystem. Is executed.

  On the user information management system 10, the system administrator designates a user ID and management authority information, and the authority specified by the management authority information already set for the user identified by the user ID. When an input for deletion is performed, the user authority deletion request program 102 executes such authority deletion processing. Specifically, when the authority deletion request is executed by specifying the user identification information and the management authority, the association between the user identification information and the management authority information is deleted from the user information storage unit 151.

  The user authority deletion request program 102 creates a user authority deletion request packet including the user ID and identification information of the subsystem that requests the user authority deletion (S201), and transmits it to the user management program 107 (S202). At this time, the subsystem identification information includes authority information corresponding to the management authority information from the authority conversion information storage unit 163 based on the management authority information associated with the user ID in the user information storage unit 151. It can be obtained by referring to the subsystem identification information. Normally, a user authority deletion request packet corresponding to each of a plurality of subsystems that require user authority deletion is generated.

  As shown in FIG. 11, the user management program 107 receives the user authority deletion request packet (S602), and determines the destination subsystem 20 and the processing procedure information according to the definition of the processing procedure information storage unit 161 (see FIG. 11). S604).

  The user management program 107 sends the processing procedure information stored in the processing procedure information storage unit 161 to the processing execution program 106 of the subsystem 20 specified by the subsystem identification information included in the user authority deletion request packet. Transmit (S605).

  The processing execution program 106 of the subsystem 20 shown in FIG. 12 converts the received processing procedure information into a file and stores it on the disks (storage means) 251 and 252 of the subsystem 20 (S716, S717), and the result. Transmit (S707).

  Returning to the flowchart of FIG. 11, when the processing procedure information is successfully transmitted, the user management program 107 of the user information management system 10 deletes the authority of the specified user ID 152b (that is, the specified user ID). The management authority information associated with the user authority is acquired from the user information storage unit 151 (S615), and the management authority 152b is transmitted to the authority conversion program 108.

  As shown in FIG. 13, upon receiving the management authority 152b (S802), the authority conversion program 108 converts the received management authority into authority information of each subsystem (S803). Thus, the authority conversion program 108 converts the authority information on the subsystem 20 having the same authority content as the management authority of the user information management system 10 by searching. The authority conversion program 108 transmits the authority information of the subsystem 20 obtained by the conversion to the user management program 107 (S803).

  As shown in FIG. 11, the user management program 107 receives the authority information of the subsystem 20 from the authority conversion program 108 (S629), and the authority including the user ID, the authority information of the subsystem 20, and the authority deletion request. A deletion request packet is generated (S630). At this time, the authority deletion request packet is generated for each transmission destination subsystem 20. Subsequently, the user management program 107 transmits the generated authority deletion request packet to the processing execution program 106 of each subsystem 20 (S623).

  As shown in FIG. 12, upon receiving the authority deletion request packet (S702), the process execution program 106 of the subsystem 20 sets authority information for authority deletion on the memory (S704), and a processing procedure information storage unit The user's authority deletion process is executed by executing the process defined by the process procedure information 161 using the authority information set in the memory (S705). Subsequently, when the authority of the user ID of the designated subsystem is blank (S721), the process execution program 106 deletes the user ID of the designated subsystem (S722). Here, in this embodiment, it is determined whether or not the authority of the user ID is blank in the subsystem 20, but may be executed in the user information management system 10. In this case, the user information storage unit 151 of the user information management system 10 further stores the identification information of the subsystem in which the user is registered in association with the user identification information. It is determined based on the information stored in the user information storage unit 151 whether or not the user's authority is blanked by the deletion request. When the user's authority is blank, the user registration deletion request is included in the authority deletion request packet. The user management program 107 may execute the process of transmitting to the subsystem 20 by including it.

  The result of the authority deletion process executed in the process execution program 106 of the subsystem 20 is transmitted to the user management program 107 of the user management system 10 (S707).

  The user management program 107 receives the result of the authority deletion processing (S624), and determines whether there is authority deletion of another subsystem 20 that needs further processing (S625). If there is, the processing after step S608 is further executed for the authority deletion of the other subsystem 20, and if there is not, the packet reception waiting state is entered (S602).

  Next, the user lock process will be described with reference to FIGS. 8, 11, and 12. This user lock process can be executed in either the user information management system 10 or the subsystem 20, but in the following description, a case in which the user lock process is executed in the user information management system 10 will be described. In addition, although various processes in the following description are executed by the control unit based on each program, the description of the control unit is omitted and described as the process of each program. Note that the flowchart shown in FIG. 8 shows the user lock processing for one subsystem, but when there are a plurality of subsystems that require user lock processing, the user lock processing shown in FIG. 8 for each subsystem. Is executed.

  When the system administrator designates the user ID and system name and executes the user lock request program 103 on the user information management system 10 or the subsystem 20, the lock status 153b of the user information storage unit 151 is rewritten to “present”. It is done.

  As shown in FIG. 8, the user lock request program 103 creates a user lock request packet including the user ID and identification information of the subsystem that requests the user lock (S301), and transmits it to the user management program 107 (S302). ).

  As shown in FIG. 11, the user management program 107 receives a user lock request packet (S602). The destination subsystem 20 and the processing procedure information are determined according to the definition of the processing procedure information storage unit 161 (S604).

  The user management program 107 transmits the processing procedure information stored in the processing procedure information storage unit 161 to the requested processing execution program 106 of the subsystem 20 (S605).

  As shown in FIG. 12, the processing execution program 106 of the subsystem 20 converts the received processing procedure into a file and stores it on the disks (storage means) 251 and 252 of the subsystem 20 (S716, S717), and the result is displayed. Transmit (S707).

  Returning to the flowchart of FIG. 11, when the processing procedure information is successfully transmitted, the user management program 107 acquires the lock status 153b for locking the designated user ID from the user information storage unit 151 (S617), and the user ID The lock status is in the form of a user lock request packet (S618). Then, the user management program 107 transmits a user lock request packet to the processing execution program 106 of each subsystem 20 (S623).

  The process execution program 106 that has received the user lock request packet (S708) sets the lock status 153b for the lock on the memory (S709), and performs the process defined by the process procedure information in the process procedure information storage unit 161. The processing is executed using the value set on the memory (S710), and the result is transmitted (S707).

  The user lock release process will be described with reference to FIGS. 9, 11, and 12. This user lock release process can be executed in either the user information management system 10 or the subsystem 20, but in the following description, a case in which the user lock release process is executed in the user information management system 10 will be described. In addition, although various processes in the following description are executed by the control unit based on each program, the description of the control unit is omitted and described as the process of each program. Note that the flowchart shown in FIG. 9 shows the user unlock processing for one subsystem, but when there are multiple subsystems that require user unlock processing, the user shown in FIG. 9 for each subsystem. Unlock processing is executed.

  When the system administrator designates the user ID and the system identification information and executes the user lock release request program 104 on the user information management system 10 or the subsystem 20, the lock status 153b of the user information storage unit 151 is set to “none”. Will be rewritten.

  As shown in FIG. 9, the user lock release request program 104 creates a user lock release request packet including the user ID and identification information of the subsystem that requests the user to release the lock (S401), and sends it to the user management program 107. (S402).

  As shown in FIG. 11, the user management program 107 receives a user lock release request packet (S602). The destination subsystem 20 and the processing procedure information are determined according to the definition of the processing procedure information storage unit 161 (S604).

  The user management program 107 transmits the processing procedure information stored in the processing procedure information storage unit 161 to the requested processing execution program 106 of the subsystem 20 (S605).

  As shown in FIG. 12, the processing execution program 106 of the subsystem 20 converts the received processing procedure into a file and stores it on the disks (storage means) 251 and 252 of the subsystem 20 (S716, S717), and the result is displayed. Transmit (S707).

  Returning to the flowchart of FIG. 11, when the processing procedure information is successfully transmitted, the user management program 107 acquires the lock status 153b for unlocking the designated user ID from the user information storage unit 151 (S619). The ID and lock status are converted into a user unlock request packet (S620). Then, the user management program 107 transmits a user lock release request packet to the processing execution program 106 of each subsystem 20 (S623).

  The process execution program 106 that has received the user unlock request packet (S708) sets the lock status 153b for unlocking in the memory (S709), and is defined by the process procedure information in the process procedure information storage unit 161. The process is executed using the value set in the memory (S710), and the result is transmitted (S707).

  The user password changing process will be described with reference to FIGS. 10, 11, and 12. This user password change process can be executed in either the user information management system 10 or the subsystem 20, but in the following description, a case in which the user password change process is executed in the user information management system 10 will be described. In addition, although various processes in the following description are executed by the control unit based on each program, the description of the control unit is omitted and described as the process of each program. In addition, although the flowchart shown in FIG. 10 shows the user password change process for one subsystem, when there are a plurality of subsystems that require the user password change process, the user shown in FIG. 10 for each subsystem. Password change processing is executed.

  When the system administrator or the user designates the user ID, the subsystem identification information, and the new password and executes the user password change request program 105 on the user information management system 10 or the subsystem 20, the user information storage unit 151 The password 153c is rewritten with a new password.

  As shown in FIG. 10, the user password change request program 105 creates a user password change request packet including the user ID and the identification information of the subsystem that requests the user password change (S501), and sends it to the user management program 107. (S502).

  As shown in FIG. 11, the user management program 107 receives a user password change request packet (S602). The destination subsystem 20 and the processing procedure information are determined according to the definition of the processing procedure information storage unit 161 (S604).

  The user management program 107 transmits the processing procedure information stored in the processing procedure information storage unit 161 to the requested processing execution program 106 of the subsystem 20 (S605).

  As shown in FIG. 12, the processing execution program 106 of the subsystem 20 converts the received processing procedure into a file and stores it on the disks (storage means) 251 and 252 of the subsystem 20 (S716, S717), and the result is displayed. Transmit (S707).

  Returning to the flowchart of FIG. 11, when the processing procedure information is successfully transmitted, the user management program 107 acquires the password 153c for changing the password of the designated user ID from the user information storage unit 151 (S621), and the user ID And the password in the form of a user password change request packet (S622). Then, the user management program 107 transmits a user password change request packet to the processing execution program 106 of each subsystem 20 (S623).

Receiving the user password change request packet (S712), the process execution program 106 sets the password 153c for password change on the memory (S713), and the process defined by the process procedure information in the process procedure information storage unit 161 Is executed using the value set in the memory (S714), and the result is transmitted (S707).
Each of the user authority grant request packet, user authority deletion request packet, user lock request packet, user lock release request packet, and user password change request packet created in each of the above examples includes a user password. Also good. For example, the password included in the user authority grant request packet is registered as the password at the time of user ID registration (S720).

It is a principle figure which shows the outline | summary of the process of the grant of the user's authority in the information management system concerning this invention. It is a conceptual diagram of a user authority grant / deletion method, lock / unlock, and password change in the information management system according to the present invention. 2 is a functional block diagram of a user information management system and a functional block diagram of a subsystem according to the present invention. FIG. It is a figure for demonstrating the user information storage part which manages the information of each user. It is a figure for demonstrating the authority conversion information storage part which manages the information for converting the authority of a user information management system into the authority of a subsystem. It is a flowchart which shows the process of a user authority grant request | requirement program. It is a flowchart which shows the process of a user authority deletion request | requirement program. It is a flowchart which shows the process of a user lock request | requirement program. It is a flowchart which shows the process of a user lock cancellation | release request | requirement program. It is a flowchart which shows the process of a user password change request program. It is a flowchart which shows the process of a user management program. It is a flowchart which shows the process of a process execution program. It is a flowchart which shows the process of an authority conversion program.

Explanation of symbols

10. User information management system 101 ... User authority grant request program 102 ... User authority deletion request program 103 ... User lock request program 104 ... User lock release request program 105 ... User password change Request program 151 ... User information storage unit 161 ... Processing procedure information storage unit 20 ... Subsystem 251 ... Processing procedure information storage unit 30 ... Network

Claims (28)

An information management system comprising a user information management system and a plurality of subsystems connected to the user information management system via a network, wherein the user information management system centrally executes authority management in the plurality of subsystems There,
The user information management system includes:
An authority conversion information storage unit that stores authority information for management, and authority information in a plurality of subsystems associated with the authority information for management;
A user information storage unit that stores user identification information and management authority information associated with the user identification information;
Based on the information stored in the authority conversion information storage unit, the management authority information stored in the user information storage unit is converted into the authority information of the subsystem associated with the management authority information. Authority conversion means;
An information management system comprising means for executing authority management processing of each subsystem based on the authority information of the subsystem converted by the authority conversion means. The user information management system includes:
Means for storing the user identification information and management authority information in association with each other in the user information storage unit when an authorization request is executed by specifying user identification information and management authority;
Means for converting the authority information for management stored in the user information storage unit into authority information of the subsystem by the authority converting means;
The system further comprises means for generating authority request information including authority information of the converted subsystem, authority request, and user identification information, and transmitting the information to each of the plurality of subsystems.
The plurality of subsystems that have received the authorization request information are:
2. The information management system according to claim 1, further comprising means for executing an authorization process based on the authorization information, the authorization request, and the user identification information included in the authorization request information. The user information management system includes:
The user information storage unit further stores identification information of a subsystem in which the user is registered in association with identification information of the user,
When generating the authorization request information, it is determined based on information stored in the user information storage unit whether the user is registered in the subsystem that performs the authorization request, and when the user is not registered, 3. The information management system according to claim 2, further comprising means for transmitting a user registration request to the subsystem.   The subsystem includes means for determining whether the user identification information included in the authorization request is already registered as a user, and executing user registration when it is determined that the user is not registered. Item 3. The information management system according to Item 2. The user information management system includes:
Means for deleting the association between the user identification information and the management authority information from the user information storage unit when the authority deletion request is executed by specifying the user identification information and the management authority;
Means for causing the authority conversion means to convert the management authority information into subsystem authority information;
A sub-system authority information after the conversion, an authority deletion request, and authority deletion request information including user identification information is generated and further transmitted to each of the plurality of subsystems;
The subsystem that has received the authority deletion request information
The information management system according to claim 1, further comprising means for executing authority deletion processing based on authority information, authority deletion request, and user identification information included in the authority deletion request information. The user information management system includes:
The user information storage unit further stores identification information of a subsystem in which the user is registered in association with identification information of the user,
When generating the authority deletion request information, the subsystem that performs the authority deletion request determines whether the authority of the user is blanked by the authority deletion request based on information stored in the user information storage unit. 6. The information management system according to claim 5, further comprising means for transmitting a user registration deletion request to the subsystem when the user authority is blank.   The subsystem further includes means for determining whether or not the authority of the user is blanked by an authority deletion request, and executing deletion of user registration when it is determined that the authority of the user is blank. Item 6. The information management system according to Item 5. A user information management system, a first subsystem connected to the user information management system via a network, and a second subsystem, the first subsystem and the second subsystem in the user information management system An information management system that centrally executes authority management in the system,
The user information management system includes:
Management authority information, first authority information having authority contents corresponding to the management authority information in the first subsystem, and authority contents corresponding to the management authority information in the second subsystem. An authority conversion information storage unit that stores the authority information of two in association with each other;
A user information storage unit that stores user identification information and management authority information associated with the user identification information;
Based on the information stored in the authority conversion information storage unit, the management authority information stored in the user information storage unit is associated with the first authority information and the second authority information associated with the management authority information. Authority conversion means for converting the authority information into
Means for transmitting the first authority information converted by the authority conversion means to the first subsystem;
An information management system comprising: means for transmitting the second authority information converted by the authority conversion means to a second subsystem. The user information management system includes:
Means for storing the user identification information and management authority information in association with each other in the user information storage unit when an authorization request is executed by specifying user identification information and management authority;
Means for converting the authority information for management stored in the user information storage unit into first authority information and second authority information by the authority converting means;
Means for generating first authority information after conversion, authority request, and first authority request information including user identification information, and transmitting the first authority information to the first subsystem;
Means for generating second authorization information including the converted second authorization information, authorization request, and user identification information, and transmitting the second authorization request information to the second subsystem;
The first subsystem is:
Means for receiving the first authorization request information and executing authorization processing based on the first authorization information, the authorization request, and the user identification information included in the first authorization request information;
The second subsystem is:
Means for receiving the second authorization request information and executing authorization processing based on the second authorization information, the authorization request, and the user identification information included in the second authorization request information; The information management system according to claim 8. The user information management system includes:
The user information storage unit further stores identification information of a subsystem in which the user is registered in association with identification information of the user,
When generating the authorization request information, it is determined based on information stored in the user information storage unit whether the user is registered in the subsystem that performs the authorization request, and when the user is not registered, The information management system according to claim 9, further comprising means for transmitting a user registration request to the subsystem.   Each of the first subsystem and the second subsystem determines whether the user identification information included in the authorization request has already been registered as a user, and performs user registration when determining that the user has not been registered. 10. The information management system according to claim 9, further comprising means for executing the information management system. The user information management system includes:
Means for deleting the association between the user identification information and the management authority information from the user information storage unit when the authority deletion request is executed by specifying the user identification information and the management authority;
Means for causing the authority conversion means to convert the management authority information into first authority information and second authority information;
Means for generating first authority information after conversion, authority deletion request, and first authority deletion request information including user identification information, and transmitting the first authority information to the first subsystem;
Means for generating the second authority information after conversion, the authority deletion request, and the second authority deletion request information including the user identification information and transmitting the second authority deletion request information to the second subsystem;
The first subsystem is:
Means for receiving the first authority deletion request information and executing authority deletion processing based on the first authority information, the authority deletion request and the user identification information included in the first authority deletion request information;
The second subsystem is:
Means for receiving the second authority deletion request information and executing authority deletion processing based on the second authority information, the authority deletion request, and the user identification information included in the second authority deletion request information; The information management system according to claim 8. The user information management system includes:
The user information storage unit further stores identification information of a subsystem in which the user is registered in association with identification information of the user,
When generating the authority deletion request information, the subsystem that performs the authority deletion request determines whether the authority of the user is blanked by the authority deletion request based on information stored in the user information storage unit. 13. The information management system according to claim 12, further comprising means for transmitting a user registration deletion request to the subsystem when the user authority is blank.   Each of the first subsystem and the second subsystem determines whether the user's authority is blanked by the authority deletion request, and deletes the user registration when it is determined that the user's authority is blank. 13. The information management system according to claim 12, further comprising: A method for managing user information in a plurality of subsystems connected to at least one user information management system via a network,
In the user information management system, registering the management authority information by storing the management authority information and the authority information in the plurality of subsystems associated with the management authority information in the authority conversion information storage unit;
In the user information management system, storing user identification information and management authority information associated with the user identification information in a user information storage unit;
In the user information management system, based on the information stored in the authority conversion information storage unit, the management authority information stored in the user information storage unit is associated with the management authority information. Converting to system authority information;
In the user information management system, a user information management method comprising a step of transmitting authority information of the converted subsystem to each subsystem. In the user information management system, when an authorization request is executed by specifying user identification information and management authority, the user identification information and management authority information are stored in association with each other in the user information storage unit. Steps,
In the user information management system, the management authority information stored in the user information storage unit is converted into authority information of the subsystem by the authority conversion means;
In the user information management system, generating the authorization information of the converted subsystem, the authorization request, and authorization request information including the user identification information, and transmitting to the plurality of subsystems;
The plurality of subsystems that have received the authorization request information include a step of executing an authorization process based on the authorization information, the authorization request, and the user identification information included in the authorization request information. The user information management method according to claim 15. In the user information management system, the user information storage unit further stores identification information of a subsystem in which the user is registered in association with identification information of the user,
When generating the authorization request information, it is determined based on information stored in the user information storage unit whether the user is registered in the subsystem that performs the authorization request, and when the user is not registered, 17. The user information management method according to claim 16, wherein a user registration request is transmitted to the subsystem.   17. The subsystem according to claim 16, wherein it is determined whether the user identification information included in the authorization request has already been registered as a user, and user registration is executed when it is determined that the user has not been registered. User information management method. In the user information management system, when an authority deletion request is executed by specifying user identification information and management authority, a step of deleting the association between the user identification information and management authority information from the user information storage unit When,
In the user information management system, converting the management authority information into subsystem authority information;
In the user information management system, generating the authority deletion request information including the authority information of the converted subsystem, the authority deletion request, and the user identification information, and transmitting to the subsystem;
The subsystem that has received the authority deletion request information includes a step of executing authority deletion processing based on authority information, authority deletion request, and user identification information included in the authority deletion request information. 15. A method for managing user information according to 15. In the user information management system, the user information storage unit further stores identification information of a subsystem in which the user is registered in association with identification information of the user,
When generating the authority deletion request information, the subsystem that performs the authority deletion request determines whether the authority of the user is blanked by the authority deletion request based on information stored in the user information storage unit. 20. The user information management method according to claim 19, wherein when the user authority is blank, a user registration deletion request is transmitted to the subsystem.   20. In the subsystem, it is determined whether or not the authority of the user is blanked by an authority deletion request, and the user registration is deleted when it is determined that the authority of the user is blank. User information management method. A method for managing user information in a first subsystem and a second subsystem connected to at least one user information management system via a network, comprising:
In the user information management system, authority conversion information is stored in the authority information for management, the first authority information in the first subsystem associated with the authority information for management, and the second authority information in the second subsystem. Registering the authority information for management by storing the
In the user information management system, storing user identification information and management authority information associated with the user identification information in a user information storage unit;
In the user information management system, the management authority information stored in the user information storage unit is associated with the management authority information based on the information stored in the authority conversion information storage unit. Converting the authority information into the first authority information and the second authority information;
Transmitting the converted first authority information from the user information management system to the first subsystem;
Transmitting the converted second authority information to the second subsystem from the user information management system. In the user information management system, when an authorization request is executed by specifying user identification information and management authority, the user identification information and management authority information are stored in association with each other in the user information storage unit. Steps,
In the user information management system, the management authority information stored in the user information storage unit is converted into first authority information and second authority information by the authority conversion unit;
The user information management system generates first authorization information including the converted first authorization information, authorization request, and user identification information, and transmits the first authorization request information to the first subsystem. When,
The user information management system generates second authority information after conversion, authority request, and second authority request information including user identification information, and transmits the second authority information to the second subsystem. When,
The first subsystem receives the first authorization request information, and performs authorization processing based on the first authorization information, the authorization request, and the user identification information included in the first authorization request information. Steps to perform;
The second subsystem receives the second authorization request information and performs authorization processing based on the second authorization information, the authorization request, and the user identification information included in the second authorization request information. 23. The user information management method according to claim 22, further comprising a step of executing. In the user information management system, the user information storage unit further stores identification information of a subsystem in which the user is registered in association with identification information of the user,
When generating the authorization request information, it is determined based on information stored in the user information storage unit whether the user is registered in the subsystem that performs the authorization request, and when the user is not registered, 24. The user information management method according to claim 23, wherein a user registration request is transmitted to the subsystem.   In the first subsystem and the second subsystem, it is determined whether the user identification information included in the authorization request has already been registered as a user. If it is determined that the user has not been registered, user registration is executed. 24. The user information management method according to claim 23. In the user information management system, when an authority deletion request is executed by specifying user identification information and management authority, a step of deleting the association between the user identification information and management authority information from the user information storage unit When,
In the user information management system, converting the management authority information into first authority information and second authority information;
In the user information management system, generating the first authority deletion request information including the converted first authority information, the authority deletion request, and the user identification information, and transmitting the first authority deletion request information to the first subsystem When,
In the user information management system, generating the second authority deletion request information including the converted second authority information, the authority deletion request, and the user identification information, and transmitting the second authority deletion request information to the second subsystem When,
The first subsystem receives the first authority deletion request information and performs authority deletion processing based on the first authority information, the authority deletion request, and the user identification information included in the first authority deletion request information. A step of performing
The second subsystem receives the second authority deletion request information and performs authority deletion processing based on the second authority information, the authority deletion request, and the user identification information included in the second authority deletion request information. 23. The user information management method according to claim 22, further comprising the step of: In the user information management system, the user information storage unit further stores identification information of a subsystem in which the user is registered in association with identification information of the user,
When generating the authority deletion request information, the subsystem that performs the authority deletion request determines whether the authority of the user is blanked by the authority deletion request based on information stored in the user information storage unit. 27. The user information management method according to claim 26, wherein when the user authority is blank, a user registration deletion request is transmitted to the subsystem.   27. In the subsystem, it is determined whether or not the authority of the user is blanked by an authority deletion request, and the user registration is deleted when it is determined that the authority of the user is blank. User information management method.

Images