JP2008287599A - Information processor and information processing method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To legibly display an authentication information input picture in a frame region in a Web page having a plurality of frame regions. <P>SOLUTION: This information processor communicatively connected to a user terminal for transmitting the image data of a Web page having a plurality of frame regions to a user terminal is provided with an authentication information input picture transmitting part for transmitting an authentication information input picture to be displayed in one of the frame regions and a program for enlarging the area of the frame region in which the authentication information input picture is displayed to the user terminal. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an information processing apparatus and an information processing method.

  User authentication may be required when accessing a Web server. When a web page is divided into a plurality of frame areas and a user does not operate for a certain period of time and authentication is required again, a request to be displayed in a certain frame area is sent to the web server. An input screen for inputting authentication information such as a user ID and password is displayed in the frame area. When the area of the frame area is small, the entire authentication information input screen is not displayed, and the user has to scroll the screen, which is inconvenient.

In order to solve such a problem, Non-Patent Document 1 discloses a method for displaying an authentication information input screen on the entire Web page divided into frame areas.
"Method to execute by specifying a specific frame with CGI", [online], [Search April 20, 2007], Internet <URL: http://www.drk7.jp/MT/archives/000796.html >

  However, in the method described in Non-Patent Document 1, since the authentication information input screen is displayed on the entire Web page, the contents displayed in each of the plurality of frame areas are discarded before the screen is displayed. End up.

  The present invention has been made in view of such a background. An information processing system and an information processing method capable of easily displaying an authentication information input screen in a frame area in a Web page having a plurality of frame areas are provided. The purpose is to provide.

  A main invention of the present invention for solving the above problem is an information processing apparatus that is communicably connected to a user terminal and transmits screen data of a Web page having a plurality of frame regions to the user terminal. An authentication information input screen transmitting unit for transmitting to the user terminal an authentication information input screen to be displayed in one of the frame regions and a program for expanding the area of the frame region in which the authentication information input screen is displayed. I will do it.

  According to the present invention, in a Web page having a plurality of frame areas, the authentication information input screen can be easily displayed in the frame area.

  Hereinafter, an information processing system according to an embodiment of the present invention will be described. The information processing system of the present embodiment accesses a Web server 20 that provides a Web page that requires authentication from a client terminal 10. In this embodiment, it is assumed that the Web page is described in HTML (HyperText Markup Language). In this embodiment, it is assumed that a Web page provided from a Web server is divided into a plurality of areas (hereinafter referred to as frame areas). The frame area is set by a frame set tag (<FRAMESET>) and a frame tag (<FRAME>) in HTML.

== System configuration ==
FIG. 1 is a diagram illustrating an overall configuration of an information processing system according to the present embodiment. As shown in the figure, the information processing system of this embodiment includes a client terminal 10 and a Web server 20. The client terminal 10 and the web server 20 are connected via a communication network 30. The communication network 30 is, for example, the Internet or a LAN (Local Area Network).

The Web server 20 is an information processing apparatus that provides a Web page described in HTML. The Web server 20 is, for example, a personal computer or a workstation. The client terminal 10 is a computer operated by a user, such as a personal computer, a workstation, a PDA (Personal Digital Assistant), or a mobile phone. In the client terminal 10, a Web browser is operating, and communication between the client terminal 10 and the Web server 20 is performed by HTTP (HyperText Transfer Protocol) or HTTPS (Hyper Text Transfer Protocol Security). A user can browse a web page provided by the web server 20 by operating a web browser. Further, the client terminal 10 stores information related to a communication session with the Web server 20 as a cookie. For communication between the client terminal 10 and the Web server 20, it is preferable to adopt HTTPS that performs encrypted communication in consideration of safety.

== Hardware configuration ==
FIG. 2 is a diagram illustrating a hardware configuration of the Web server 20. As shown in the figure, the Web server 20 includes a CPU 201, a memory 202, a storage device 203, a communication device 204, and an input device 205. The storage device 203 is, for example, a hard disk drive or a flash memory that stores various programs and data. The CPU 201 implements various functions by reading a program stored in the storage device 203 into the memory 202 and executing it. The communication device 204 is an interface for connecting to the communication network 30 and is, for example, an adapter for connecting to Ethernet (registered trademark) or a modem for connecting to a public telephone line network. The input device 205 is, for example, a keyboard or a mouse that accepts input of information.

== Software configuration ==
FIG. 3 is a diagram illustrating a software configuration of the Web server 20. As shown in the figure, the Web server 20 includes a request reception unit 211, an authentication necessity determination unit 212, an authentication screen transmission unit 213, an authentication processing unit 214, and a business screen transmission unit 215, and a session information storage unit. 31, an authentication information storage unit 32, a business screen storage unit 33, an authentication screen storage unit 34, an enlarged program storage unit 35, and a restoration program storage unit 36. Each of the above functional units is realized by the CPU 201 included in the Web server 20 reading the program stored in the storage device 203 into the memory 202 and executing it. Each said memory | storage part is implement | achieved as a memory area which the memory 202 with which the Web server 20 is provided, and the memory | storage device 203 provide. The functional units and the storage units may be realized as dedicated hardware functions.

  The request receiving unit 211 receives a request specified by HTTP from the client terminal 10. It is assumed that the request includes user identification information (hereinafter referred to as a user ID) and a URL (Uniform Resource Locator) indicating a Web page.

  The session information storage unit 31 stores information related to a communication session between the client terminal 10 and the Web server 20 (hereinafter referred to as session information). FIG. 4 is a diagram illustrating a configuration example of session information stored in the session information storage unit 31. As shown in the figure, the session information includes a session ID that is identification information of the communication session, an expiration date of the communication session, and a user ID.

  In this embodiment, it is assumed that session information is newly generated when user authentication is performed, and the user authentication is performed while the communication session is valid.

  The authentication necessity determination unit 212 determines whether user authentication is necessary according to the request. In the present embodiment, the authentication necessity determination unit 212 stores the session information corresponding to the user ID included in the request in the session information storage unit 31, and the expiration date of the stored session information is It is determined whether the user is authenticated based on whether it is after the current time.

  The authentication information storage unit 32 stores authentication information used for user authentication. FIG. 5 is a diagram illustrating a configuration example of authentication information stored in the authentication information storage unit 32. As shown in the figure, the authentication information includes a user ID and a password.

  The business screen storage unit 33 and the authentication screen storage unit 34 store screen data (hereinafter also simply referred to as a Web page) for displaying a Web page, such as files and image data described in HTML. The authentication screen storage unit 34 stores a Web page for displaying a screen for inputting authentication information such as a user ID and a password (hereinafter referred to as an authentication screen, which corresponds to the authentication information input screen of the present embodiment). . The business screen storage unit 33 stores Web pages other than the authentication screen (hereinafter referred to as business screen).

  FIG. 6 is a diagram illustrating a screen 41 which is an example of an authentication screen. In the present embodiment, the authentication information is a user ID and a password. The screen 41 includes a user ID input field 411 and a password input field 412. When the button 413 is pressed by the user, the client terminal 10 transmits a request including the authentication information input in the input fields 411 and 412 to the Web server 20.

  FIG. 7 is a diagram illustrating a screen 42 which is an example of a business screen. The screen 42 is an example of a business screen for inputting search conditions. The screen 42 includes a search condition input field 421. When the button 422 is pressed, a request including the character string input in the input field 421 is transmitted to the Web server 20.

  In the present embodiment, it is assumed that the client terminal 10 displays Web pages in a plurality of frame areas. FIG. 8 is a diagram illustrating a screen 43 that is an example of a Web page on which a business screen is displayed in a plurality of frame areas. As shown in the figure, the screen 43 is composed of three frame areas 431 to 433. In the example of FIG. 8, the screen 42, which is an example of the above-described business screen, is displayed in the frame area 432. Has been. The content displayed in each frame area of the screen 43 is not limited to the example of FIG.

  The enlargement program storage unit 35 stores a program (hereinafter referred to as an enlargement program) for enlarging the area of a frame area (hereinafter referred to as a display destination frame area) on which an authentication screen is displayed. The enlargement program is executed by the client terminal 10. The enlargement program is described by, for example, JavaScript or Java (registered trademark), and is transmitted along with the authentication screen.

  FIG. 9 is a diagram illustrating a processing flow when the enlargement program is executed by the client terminal 10.

The client terminal 10 determines whether the display destination of the authentication screen is a frame area (S501). If the display destination is a frame area (S501: YES), the client terminal 10 associates each of a plurality of frame areas constituting the Web page displayed on the Web browser with a frame ID indicating the frame area, Size information including the width and height of the area is generated (S502). The client terminal 10 sets the generated size information list as an attribute of the frame set (S503). The client terminal 10 maximizes the width of the display destination frame area, that is, sets the width of the Web browser screen (S504), and maximizes the height of the display destination frame area, that is, sets the height of the Web browser screen. (S505). As a result, the width or height of the frame area other than the display destination frame area is set to zero.
The client terminal 10 displays an authentication screen in the display destination frame area (S506).

  As described above, the enlargement program causes the client terminal 10 to increase the width or height of the display destination frame region to enlarge the area of the display destination frame region.

  If the authentication necessity determination unit 212 determines that the user authentication is necessary, the authentication screen transmission unit 213 attaches an enlargement program to the authentication screen and transmits it to the client terminal 10. Note that the authentication screen transmission unit 213 may attach the enlargement program only when the authentication screen is displayed in the frame area, when it is possible to determine whether the display destination of the authentication screen is in the frame area. .

  The authentication processing unit 214 performs user authentication based on authentication information input on the authentication screen. The client terminal 10 transmits a request in which the user ID and password input on the authentication screen are set to the Web server 20, and the authentication processing unit 214 determines that the user ID and password are set in the request when the user ID and password are set. Authenticate.

  The restoration program storage unit 36 stores a program for reducing the area of the display destination frame region. In the present embodiment, the program stored in the restoration program storage unit 36 is a program that sets the size of each frame area constituting the Web page to the size before the above-described enlargement program is executed (hereinafter, referred to as the program). This is called a restoration program.) The restoration program is also executed on the client terminal 10. The restoration program is described in, for example, JavaScript or Java (registered trademark), and is transmitted along with a business screen transmitted after the authentication process is performed.

  FIG. 10 is a diagram showing a flow of processing when the restoration program is executed by the client terminal 10.

The client terminal 10 determines whether or not the display destination of the business screen is the frame area (S521). If the display destination is the frame area (S521: YES), whether the size information is set as the attribute of the frame set. It is determined whether or not (S522).
When the display destination of the business screen is the frame area (S521: YES) and the size information is stored in the attribute of the frame set (S522: YES), the client terminal 10 uses the size information list of the frame set. Obtained from the attribute (S523), for each size information, the width and height of the frame area indicated by the frame ID included in the size information are set to the width and height included in the size information (S524).
The client terminal 10 displays the business screen in the display destination frame area (S525).

  As described above, when the size of the display destination frame area before the authentication screen is displayed is stored in the client terminal 10, the restoration program restores the size of the display destination frame area to that size. is there.

  The business screen transmission unit 215 transmits the business screen to the client terminal 10 in response to the request. When the authentication processing unit 214 succeeds in authenticating the user, the business screen transmission unit 215 attaches a restoration program to the business screen and transmits it.

== Processing ==
Next, the flow of processing by the Web server 20 will be described. FIG. 11 is a diagram illustrating a flow of processing in which the Web server 20 transmits a business screen or an authentication screen to the client terminal 10 in response to a request.

  When the request reception unit 211 receives a request from the client terminal 10 (S541), the authentication necessity determination unit 212 determines whether the session ID of the communication session is set in the received request (S542). When the session ID is not set in the request (S542: NO), the authentication necessity determination unit 212 determines whether both the user ID and the password are set in the request (S543). When the password is not set in the request (S543: NO), the authentication screen transmission unit 213 attaches the enlargement program to the authentication screen and transmits it to the client terminal 10 (S544).

  On the other hand, when both the user ID and the password are set in the request (S543: YES), that is, when the user ID and password input on the authentication screen are transmitted from the client terminal 10, the authentication processing unit 214. Reads the password corresponding to the user ID from the authentication information storage unit 32 (S545), and determines whether the read password matches the password included in the request (S546). If the passwords match (S546: YES), the business screen transmission unit 215 reads the business screen specified in the request from the business screen storage unit 33, attaches a restoration program to the read business screen, and sends it to the client terminal 10. Transmit (S547). If the passwords do not match (S546: NO), the process proceeds to step S544, and the authentication screen transmission unit 213 transmits the authentication program with the enlargement program attached thereto.

  When the session ID is set in the request (S542: YES), the authentication necessity determination unit 212 reads out the session information corresponding to the session ID specified in the request from the session information storage unit 31 (S548), and reads out the session information. It is determined whether or not the expiration date included in the session information is after the current time (S549). If the expiration date is after the current time (S549: YES), the business screen transmission unit 215 transmits the business screen corresponding to the request to the client terminal 10.

  With the above processing, if the communication session with the client terminal 10 is valid, that is, if authentication is not required, the Web server 20 transmits a business screen corresponding to the request to the client terminal 10 and if authentication is necessary. Then, an enlargement program is attached to the authentication screen and transmitted to the client terminal 10, and when the user is authenticated, the restoration program is attached to the work screen according to the request and transmitted.

== Example of operation ==
12 and 13 are diagrams for explaining a state of communication performed between the client terminal 10 and the Web server 20. An example of a screen displayed on the client terminal 10 at this time is shown in FIG.

The client terminal 10 transmits a request to the Web server 20 (S601), and the Web server 20 transmits an authentication screen to the client terminal 10 (S602).
The client terminal 10 displays the authentication screen received from the Web server 20 (S603). Here, in the client terminal 10, a screen 41 in FIG. 14A is displayed on the browser screen. The client terminal 10 receives the user ID and password input from the user (S604), and transmits a request including the received user ID and password to the Web server 20 (S605).

  The web server 20 authenticates the user based on the user ID and password included in the request (S606). Specifically, the user is authenticated by comparing the password in the authentication information storage unit 32 corresponding to the user ID with the password included in the request. If the user authentication fails (S607: NO), a Web page indicating that the authentication has failed is transmitted to the client terminal 10 (S608), and the client terminal 10 indicates a Web page indicating that the authentication has failed. Is displayed (S609).

  On the other hand, when the user authentication is successful (S607: YES), the Web server 20 newly generates a session ID, and includes the generated session ID, the expiration date after a predetermined time from the current time, and the request. Session information including the user ID to be generated is registered in the session information storage unit 31 (S610). The Web server 20 attaches the session ID to the business screen corresponding to the request and transmits it to the client terminal 10 (S611).

  The client terminal 10 displays the received business screen (S612). The Web page displayed here is composed of a plurality of frame regions as shown in FIG. In the example of FIG. 14, the screen 43 is composed of three frame areas 431 to 433.

Here, it is assumed that the time exceeding the predetermined time has elapsed (S613).
In response to an instruction from the user (S614), the client terminal 10 transmits a request including the session ID and user ID to the Web server 20 (S615). For example, the client terminal 10 transmits a request to the Web server 20 in response to pressing of the button 4321 displayed in the frame area 432 of FIG.

  The Web server 20 reads session information corresponding to the session ID and user ID included in the request from the session information storage unit 31, and the communication session is determined depending on whether or not the expiration date included in the read session information is after the current time. It is determined whether or not it is valid (S616).

  If the communication session is valid (S617: YES), the Web server 20 reads the business screen corresponding to the request from the business screen storage unit 33 and transmits it to the client terminal 10 (S618), and the client terminal 10 receives it. The business screen is displayed in the display destination frame area (S619).

  If the communication session is not valid (S617: NO), the Web server 20 attaches an enlargement program to the authentication screen and transmits it to the client terminal 10 (S620), and the client terminal 10 displays the received authentication screen. (S621) The enlargement program attached to the authentication screen is executed (S622), and the display destination frame area is maximized. As a result, as shown in FIG. 14C, the display of the frame region 432 is maximized, the frame regions 431 and 433 only leave a border (border), and the screen in the frame region is not displayed. The client terminal 10 receives input of a user ID and password via the displayed authentication screen (S623), and transmits a request including the received user ID and password to the Web server 20 (S624).

  The Web server 20 authenticates the user based on the user ID and password included in the request (S625). If the user authentication fails (S626: NO), the Web page indicating that the authentication has failed. Is transmitted to the client terminal 10 (S627), and the client terminal 10 displays the received Web page (S628).

  On the other hand, if the user authentication is successful (S626: YES), the Web server 20 sets the expiration date corresponding to the session ID and user ID included in the request to a time after a predetermined time from the current time. Update (S629). The Web server 20 reads the business screen corresponding to the request from the business screen storage unit 33, attaches the restoration program to the read business screen, and transmits it to the client terminal 10 (S630).

  The client terminal 10 displays the business screen received from the Web server 20 in the display destination frame (S631), and executes the restoration program attached to the business screen (S632), based on the size of the display destination frame area. Restore to the size of. FIG. 14D shows the state of the Web page displayed on the client terminal 10 after executing the restoration program. The screen 43 shown in FIG. 14D is restored to the same size as the state of the screen 43 shown in FIG.

  As described above, according to the Web server 20 of the present embodiment, when the Web page is divided into a plurality of frame areas and the authentication screen is displayed in one of the frame areas, the authentication screen is displayed. The area of the display destination frame region can be enlarged. When the area of the display destination frame area is allocated to be small as the layout of the Web page, or when the display area of the display destination frame area becomes small due to the user moving the boundary (border) that divides the frame area The user may not notice that the authentication screen is displayed, but according to the Web server 20 of the present embodiment, the client terminal 10 is provided with an expansion program for expanding the area of the display destination frame area. Since the authentication screen can be transmitted, a situation in which the user does not notice the authentication screen can be avoided. Therefore, the user can easily input authentication information. Also, on the authentication screen, there are many cases where the user is required to enter a password, the cause of the need for authentication, and other information are displayed. Such information can be made easily visible to the user.

  Further, according to the Web server 20 of the present embodiment, the area of the display destination frame area is enlarged while retaining the contents displayed in the frame area other than the display destination frame area, and after the authentication is successful, the display is performed. The size of the previous frame area can be restored to the size before enlargement. Therefore, the user can continuously browse the contents displayed in the other frame area even after authentication. Therefore, the authentication screen can be displayed on the client terminal 10 without impairing the convenience for the user.

== Modification ==
Next, a configuration in which the functions of the Web server 20 described above are distributed to a plurality of information processing apparatuses will be described. FIG. 15 is a diagram showing an overall configuration of an information processing system having a configuration in which the functions of the Web server 20 are distributed to a plurality of information processing apparatuses. As shown in the figure, the information processing system includes a client terminal 10, a reverse proxy server 21, a Web server 22, and an authentication server 23. The functions of the Web server 20 described above are realized by the reverse proxy server 21, the Web server 22, and the authentication server 23. The configuration of the information processing apparatus shown in FIG. 15 is also referred to as single sign-on (SSO), and the authentication server 23 performs user authentication in a centralized manner, thereby distributing requests using a plurality of Web servers 22. Make it possible to do. In an information processing system having a configuration in which the authentication server 23 for performing user authentication is independent (hereinafter referred to as an SSO configuration), the reverse proxy server 21 receives a request from the client terminal 10 and determines whether authentication is necessary. If the authentication is necessary, the request is redirected to the authentication server. If the authentication is not necessary, the business screen specified in the request is acquired from the Web server 22 and transferred to the client terminal 10.

FIG. 16 is a diagram illustrating a software configuration in an information processing system having an SSO configuration.
The reverse proxy server 21 includes the request reception unit 211, the authentication necessity determination unit 212, the expansion program storage unit 35, and the restoration program of the Web server 20 described above, an authentication confirmation query transmission unit 221, an authentication confirmation result reception unit 222, An enlarged program transmission unit 223, a restoration program transmission unit 224, and a business screen transfer unit 225 are provided. In the information processing system having the SSO configuration, a communication session between the client terminal 10 and the reverse proxy server 21 and a communication session between the client terminal 10 and the authentication server 23 (hereinafter referred to as an SSO communication session, simply communication) The term “session” refers to a communication session between the client terminal 10 and the reverse proxy server 21). Therefore, the request transmitted from the client terminal 10 may include a session ID for identifying a communication session or a session ID for identifying an SSO communication session (hereinafter referred to as an SSO session ID).

  The session information storage unit 37 stores session information related to a communication session between the reverse proxy server 21 and the client terminal 10. FIG. 17 shows a configuration example of the session information storage unit 37. As shown in the figure, the configuration of the session information storage unit 37 is the same as that of the session information storage unit 31 provided in the Web server 20 described above, but the user identification information managed by the authentication server 23 instead of the user ID. Is stored.

  The authentication confirmation query transmission unit 221 transmits a command (hereinafter referred to as an authentication confirmation query) for inquiring whether or not the user indicated by the SSOID is authenticated in the authentication server 23 to the authentication server 23. An SSOID is set in the authentication confirmation query.

  The authentication confirmation result receiving unit 222 receives information (hereinafter referred to as an authentication confirmation result) transmitted from the authentication server 23 in response to the authentication confirmation query and indicating whether the user is authenticated.

  Similar to the Web server 20 described above, the authentication necessity determination unit 212 determines that the user is authenticated if the session information is stored in the session information storage unit 37 and the current time is before the expiration date. In other cases, it is determined based on the authentication confirmation result from the authentication server 23 whether or not the user is authenticated. If it is determined that the user is authenticated, the authentication necessity determination unit 212 updates the expiration date of the session information after a predetermined time from the current time.

  When it is determined that the user is not authenticated, the enlargement program transmission unit 223 instructs to access the client terminal 10 that specifies a URL indicating an authentication screen provided in the authentication server 23 described later. An enlargement program is attached to a Web page (hereinafter, referred to as a redirect screen) including a command to be executed (for example, in the case of HTML, it can be specified by a <META> tag) and transmitted to the client terminal 10. Thereby, the area of the display destination frame area where the authentication screen transmitted from the authentication server 23 should be displayed can be enlarged.

  When it is determined that the user is authenticated after transmitting the redirect screen, the restoration program transmission unit 224 attaches the restoration program to the redirect screen that specifies the URL indicating the business screen and transmits it to the client terminal 10. To do. Thereby, the display destination frame area enlarged by the enlargement program can be restored to the original size.

  The Web server 22 includes the request reception unit 211, the business screen transmission unit 215, and the business screen storage unit 33 of the Web server 20 described above. The request receiving unit 211 included in the Web server 22 transmits a business screen to the reverse proxy server 21 in response to a request from the reverse proxy server 21 as described later.

  The authentication server 23 includes an authentication screen transmission unit 213, an authentication processing unit 214, an authentication information storage unit 32, and an authentication screen storage unit 34 of the above-described Web server 20, and an authentication confirmation query reception unit 231, an authentication confirmation processing unit 232, An authentication confirmation result transmission unit 233 and an SSO session information storage unit 38 are provided.

  The SSO session information storage unit 38 stores session information related to a communication session between the client terminal 10 and the authentication server 23 (hereinafter referred to as SSO session information). FIG. 18 is a diagram illustrating a configuration example of the SSO session information storage unit 38. As shown in the figure, the configuration of the SSO session information storage unit 38 is the same as that of the session information storage unit 37 of the reverse proxy server 21 described above, but includes an SSO session ID instead of the session ID.

  The authentication processing unit 214 included in the authentication server 23 authenticates the user based on the user ID and the password as in the case of the Web server 20 described above. If the user authentication is successful, the authentication processing unit 214 of the reverse proxy server 21 A redirect screen specifying a predetermined URL including an address (hereinafter referred to as a verification URL. The verification URL is expressed as, for example, “http: // address of reverse proxy server 21 / authcheck.cgi”) is displayed on the client. Transmit to the terminal 10.

The authentication confirmation query receiving unit 231 receives an authentication confirmation query transmitted from the reverse proxy server 21.
The authentication confirmation processing unit 232 stores the SSO session ID set in the authentication confirmation query and SSO session information corresponding to the SSOID in the SSO session information storage unit 38, and the expiration date of the SSO session information is the current time. It is determined whether or not the user is authenticated depending on whether or not it is after.
The authentication confirmation result transmission unit 233 transmits an authentication confirmation result indicating the determination result by the authentication confirmation processing unit 232 to the reverse proxy server 21.

== Processing ==
FIG. 19 is a diagram illustrating a processing flow of the reverse proxy server 21 when a request is received from the client terminal 10.

  When the request receiving unit 211 receives a request from the client terminal 10 (S701), if the request includes a verification URL (S702: YES), an error occurs if the request does not include an SSOID (S703: NO). (Hereinafter, referred to as an error screen) indicating “” is transmitted to the client terminal 10 (S704).

  If the SSOID is included, the authentication confirmation query transmitting unit 221 transmits the authentication confirmation query in which the SSOID is set to the authentication server 23 (S705), and the authentication confirmation result receiving unit 222 responds to the authentication confirmation query. The authentication confirmation result transmitted from 23 is received (S706). When the authentication confirmation result indicates that the user is authenticated (S707: YES), the restoration program transmitting unit 224 attaches the restoration program to the redirect screen specifying the URL indicating the predetermined business screen, and the client terminal 10 (S708).

  On the other hand, when the URL included in the request received from the client terminal 10 is not the verification URL (S702: NO), the authentication necessity determination unit 212 includes the session ID in the request and the session information corresponding to the session ID. Whether the communication session is valid is determined based on whether the expiration date is after the current time (S709). If the communication session is valid (S710: YES), the business screen transfer unit 225 transmits a request including the URL included in the request received from the client terminal 10 to the Web server 22 (S711), and responds to the transmitted request. Then, the business screen returned from the Web server 22 is transferred to the client terminal 10 (S712).

  When the communication session between the reverse proxy server 21 and the client terminal 10 is not valid, the enlargement program transmission unit 223 attaches the enlargement program to the redirect screen specifying the URL indicating the authentication screen of the authentication server 23, and the client It transmits to the terminal 10 (S713).

== Example of operation ==
20 to 22 are diagrams for explaining a state of communication in the information processing system having the SSO configuration.

  The client terminal 10 transmits a request to the reverse proxy server 21 (S721), and the reverse proxy server 21 transmits a redirect screen in which a URL indicating an authentication screen managed by the authentication server 23 is set to the client terminal 10 ( S722).

  The client terminal 10 transmits the request to the authentication server 23 by specifying the URL set on the redirect screen (S723). The authentication server 23 transmits an authentication screen to the client terminal 10 in response to a request from the client terminal 10 (S724).

  The client terminal 10 displays the authentication screen received from the authentication server 23 (S725), and accepts input of a user ID and password from the user (S726). The client terminal 10 transmits a request including the input user ID and password to the authentication server 23 (S727).

  The authentication server 23 authenticates the user based on the user ID and password included in the request (S728). If the authentication fails (S729: NO), the client displays a Web page indicating that the authentication has failed. The data is transmitted to the terminal 10 (S730), and the client terminal 10 displays the received web page (S731).

  On the other hand, when the user is successfully authenticated (S729: YES), the authentication server 23 newly generates an SSO session ID, the generated SSO session ID, an expiration date after a predetermined time from the current time, and the request SSO session information including the SSOID included in is generated and registered in the SSO session information storage unit 38 (S732). The authentication server 23 transmits a redirect screen designating the verification URL to the client terminal 10 (S733). The client terminal 10 transmits a request including the URL and SSOID specified on the redirect screen to the reverse proxy server 21 (S734).

  The reverse proxy server 21 transmits an authentication confirmation query in which the SSOID included in the request is set to the authentication server 23 (S735), and the authentication server 23 confirms the SSO session information in accordance with the authentication confirmation query and performs authentication confirmation. The result is transmitted to the reverse proxy server 21 (S736). When the authentication confirmation result received from the authentication server 23 indicates that the user is not authenticated (S737: NO), the reverse proxy server 21 transmits an error screen to the client terminal 10 (S738). Displays the received error screen (S739).

  On the other hand, if the authentication confirmation result indicates that the user is authenticated (S737: YES), the reverse proxy server 21 newly generates a session ID, and the generated session ID is a predetermined time after the current time. Session information including the expiration date and the SSOID included in the request is generated and registered in the session information storage unit 37 (S740), and a request specifying a predetermined business screen as a URL is transmitted to the Web server 22 (S741).

The Web server 22 reads a business screen from the business screen storage unit 33 in response to a request from the reverse proxy server 21, and transmits the read business screen to the reverse proxy server 21 (S742). The reverse proxy server 21 transfers the business screen received from the Web server 22 to the client terminal 10 (S743).
The client terminal 10 displays the business screen received from the reverse proxy server 21 (S744).

Here, it is assumed that the time exceeding the predetermined time has elapsed (S745).
The client terminal 10 receives the user's operation (S746), and transmits a request including the URL indicating the business screen, the session ID, and the SSOID to the reverse proxy server 21 (S747).

  When receiving the request from the client terminal 10, the reverse proxy server 21 reads the session information corresponding to the session ID and SSOID included in the request from the session information storage unit 37, and the expiration date included in the read session information is after the current time. Whether or not the communication session is valid is determined based on whether or not (S748).

  If the communication session is valid (S749: YES), a request in which the URL included in the received request is set is transmitted to the Web server 22 (S750), and the Web server 22 responds to the request from the reverse proxy server 21. In response, the business screen is transmitted (S751), and the reverse proxy server 21 transmits the business screen received from the Web server 22 to the client terminal 10 (S752), and the business screen is displayed on the client terminal 10 (S753). .

  On the other hand, if the communication session is not valid (S749: NO), the reverse proxy server 21 sends the redirect to the client terminal 10 with the enlargement program attached to the redirect specified as the URL of the authentication screen managed by the authentication server 23. (S754).

  When the client terminal 10 receives the redirect screen from the reverse proxy server 21, the client terminal 10 executes an attached enlargement program (S 755), and transmits a request to the authentication server 23 after the area of the display destination frame area is enlarged (S 755). S756).

  The authentication server 23 transmits an authentication screen in response to the request from the client terminal 10 (S757), and the client terminal 10 displays the authentication screen received from the authentication server 23 (S758), and the SSOID through the authentication screen. And the input of a password is received (S759). The client terminal 10 transmits a request for setting the input SSOID and password to the authentication server 23 (S760).

  The authentication server 23 performs user authentication processing based on the SSOID and password included in the request received from the client terminal 10 (S761). When the user authentication fails (S762: NO), the authentication server 23 transmits a Web page indicating that the authentication has failed to the client terminal 10 (S763), and the client terminal 10 displays the received Web page. (S764).

  On the other hand, when the authentication server 23 succeeds in user authentication (S762: YES), the authentication server 23 updates the expiration date of the SSO session information corresponding to the SSOID included in the request to a time after a predetermined time from the current time. (S765). The authentication server 23 transmits a redirect screen designating the verification URL to the client terminal 10 (766).

  The client terminal 10 transmits the verification URL specified on the redirect screen received from the authentication server 23, and a request specifying the session ID and SSOID to the reverse proxy server 21 (S767).

  The reverse proxy server 21 transmits an authentication confirmation query in which the SSOID included in the request received from the client terminal 10 is set to the authentication server 23 (S768). The authentication server 23 reads SSO session information corresponding to the SSOID set in the authentication confirmation query received from the reverse proxy server 21 from the SSO session information storage unit 38, and the expiration date of the read SSO session information is after the current time. It is determined whether or not the user is authenticated depending on whether or not there is, and authentication confirmation information indicating the determination result is transmitted to the reverse proxy server 21 (S769).

  When the authentication confirmation result received from the authentication server 23 indicates that the user is not authenticated (S770: NO), the reverse proxy server 21 transmits an error screen to the client terminal 10 (S771), and the client The terminal 10 displays the received error screen (S772).

  On the other hand, if the authentication confirmation result indicates that the user is authenticated (S770: YES), the session ID included in the request and the expiration date of the session information corresponding to the SSOID are determined from the current time. The time is updated at a later time (S773), and a restoration program is attached to the redirect screen that is a predetermined business screen and transmitted to the client terminal 10 (S774).

  After the client terminal 10 executes the restoration program attached to the received redirect screen to restore the size of the display destination frame area (S775), the URL indicating the business screen specified in the redirect screen, the session A request in which the ID and the SSOID are set is transmitted to the reverse proxy server 21 (S776).

  The reverse proxy server 21 determines whether the communication session is valid based on the session ID set in the received request and the expiration date of the session information corresponding to the SSOID (S777). (S778: YES), a request in which the URL specified in the request is set is transmitted to the Web server 22 (S779). The Web server 22 transmits a business screen to the reverse proxy server 21 in response to the request received from the reverse proxy server 21 (S780), and the reverse proxy server 21 transfers the business screen received from the Web server 22 to the client terminal 10. The client terminal 10 displays the received business screen (S782).

  As described above, also in the information processing system having the SSO configuration according to the present embodiment, when the authentication screen is displayed in the display destination frame area, similarly to the above-described Web server 20, the enlargement program is displayed on the redirect screen first. Is transmitted to the client terminal 10 and the display area of the display destination frame region can be expanded. Therefore, the user can easily input authentication information. In addition, even when a caution note or the like is displayed on the authentication screen, the user can easily visually recognize the caution note or the like by expanding the area of the frame area.

  Further, after the user authentication is successful, prior to displaying the business screen, the restoration program is attached to the redirect screen and transmitted to the client terminal 10 to restore the size of the display destination frame area in the client terminal 10. I can keep it. Therefore, it is convenient because the user can proceed with the original screen layout after authentication.

  In the information processing system of the present embodiment, the request includes the session ID or SSO session ID and the user ID or SSOID. However, the request includes only the session ID or SSO session ID. Also good.

  In the information processing system according to the present embodiment, the user ID (or SSOID) and the password are used as the authentication information. However, the present invention is not limited to this. For example, an electronic certificate may be used.

  In the information processing system according to the present embodiment, the enlargement program maximizes the width and height. However, the present invention is not limited to this, and the width and height of the display destination frame area are increased. What is necessary is just to increase at least one.

  In the information processing system of this embodiment, the width and height of the display destination frame area are stored as the attributes of the frame set. However, the present invention is not limited to this, and the attributes of the Web page (document object) are used. You may make it memorize | store and you may make it memorize | store as a cookie.

  In the information processing system having the SSO configuration, the communication session between the client terminal 10 and the reverse proxy server 21 is different from the communication session between the client terminal 10 and the authentication server 23. The session ID may be shared to take over the communication session. In this case, the session ID can be stored in a cookie when the reverse proxy server 21 and the authentication server 23 belong to the same domain. A session ID may be embedded as a part. Furthermore, a program described in, for example, JavaScript or Java (registered trademark) such as a session ID attached to a business screen, an authentication screen, a redirect screen, or the like may be attached.

  Further, in the information processing system having the SSO configuration, the reverse proxy server 21 and the Web server 22 may be the same information processing apparatus.

  Although the present embodiment has been described above, the above embodiment is intended to facilitate understanding of the present invention and is not intended to limit the present invention. The present invention can be changed and improved without departing from the gist thereof, and the present invention includes equivalents thereof.

It is a figure showing the whole information processing system composition of this embodiment. 2 is a diagram illustrating a hardware configuration of a Web server 20. FIG. 2 is a diagram illustrating a software configuration of a Web server 20. FIG. It is a figure which shows the structural example of session information. It is a figure which shows the structural example of authentication information. It is a figure which shows the screen 41 which is an example of an authentication screen. It is a figure which shows the screen 42 which is an example of a work screen. It is a figure which shows the screen 43 which is an example of the web page by which the work screen was displayed on the some flame | frame area | region. It is a figure which shows the flow of a process when an expansion program is performed. It is a figure which shows the flow of a process in case a restoration program is performed. It is a figure which shows the flow of the process which transmits a business screen or an authentication screen according to a request. It is a figure explaining the mode of communication performed between the client terminal and the Web server. It is a figure explaining the mode of communication performed between the client terminal and the Web server. An example of a screen displayed on the client terminal 10 is shown in FIG. It is a figure which shows the whole structure of the information processing system of SSO structure. It is a figure which shows the software structure in the information processing system of SSO structure. The structural example of the session information storage part 37 is shown. 3 is a diagram illustrating a configuration example of an SSO session information storage unit 38. FIG. It is a figure which shows the flow of a process of the reverse proxy server 21 at the time of receiving a request from the client terminal 10. It is a figure explaining the mode of communication in the information processing system of SSO structure. It is a figure explaining the mode of communication in the information processing system of SSO structure. It is a figure explaining the mode of communication in the information processing system of SSO structure.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Client terminal 20 Web server 21 Reverse proxy server 22 Web server 23 Authentication server 30 Communication network 201 CPU
202 Memory 203 Storage Device 204 Communication Device 205 Input Device 211 Request Reception Unit 212 Authentication Necessity Determination Unit 213 Authentication Screen Transmission Unit 214 Authentication Processing Unit 215 Business Screen Transmission Unit 31 Session Information Storage Unit 32 Authentication Information Storage Unit 33 Business Screen Storage Unit 34 Authentication Screen Storage Unit 35 Extended Program Storage Unit 36 Restore Program Storage Unit 37 Session Information Storage Unit 38 SSO Session Information Storage Unit

Claims (10)

An information processing apparatus that is communicably connected to a user terminal and transmits screen data of a Web page having a plurality of frame areas to the user terminal,
An authentication information input screen transmitting unit for transmitting to the user terminal an authentication information input screen to be displayed in one of the frame regions and a program for expanding the area of the frame region in which the authentication information input screen is displayed. thing,
An information processing apparatus characterized by the above. The information processing apparatus according to claim 1,
An authentication information receiving unit for receiving authentication information input via the authentication information input screen from the user terminal;
An authentication processing unit for authenticating a user based on the authentication information;
When the authentication is successful, a reduced program transmission unit that transmits a program for reducing the area of the frame area on which the authentication information input screen is displayed to the user terminal;
An information processing apparatus comprising: An information processing apparatus according to claim 2,
The program for enlarging the area of the frame region stores the width and height of each frame region in the user terminal, and at least one of the width and height of the frame region on which the authentication information input screen is displayed Is a program that increases
The program for reducing the area of the frame region is a program for setting the width and height of each frame region to the width and height stored in the user terminal,
An information processing apparatus characterized by the above. The information processing apparatus according to claim 1,
The authentication information input screen transmission unit includes the authentication information input screen and a program for expanding the area of the frame area when a communication session between the information processing apparatus and the user terminal times out. Sending to the device,
An information processing apparatus characterized by the above. An information processing apparatus that is communicably connected to each of a user terminal displaying a Web page having a plurality of frame areas and an authentication server that authenticates the user, and that receives a request from the user terminal. And
One area of the frame region in which a redirect request for requesting the authentication server to transmit a second request in response to the first request and an authentication information input screen transmitted from the authentication server are displayed. A redirection request transmission unit that transmits a program for expanding the program to the user terminal,
An information processing apparatus characterized by the above. The information processing apparatus according to claim 5,
A communicable connection with a Web server that stores an information display screen to be displayed in the frame area;
If the first request includes information for identifying a user, an authentication inquiry request for inquiring whether the user is authenticated is transmitted to the authentication server, and based on a response from the authentication server, An authentication necessity determination unit that determines whether or not the user is authenticated;
When the user is authenticated, an acquisition request for the information display screen specified in the first request is transmitted to the Web server, and is transmitted from the Web server in response to the acquisition request. An information display screen acquisition unit for receiving the information display screen;
An information display screen transmission unit that transmits to the user terminal ancillary with a program for reducing the area of the frame area on which the authentication information input screen is displayed on the information display screen;
An information processing apparatus comprising: The information processing apparatus according to claim 6,
The program for enlarging the area of the frame region stores the width and height of each frame region in the user terminal, and at least one of the width and height of the frame region on which the authentication information input screen is displayed Is a program that increases
The program for reducing the area of the frame region is a program for setting the width and height of each frame region to the width and height stored in the user terminal,
An information processing apparatus characterized by the above. The information processing apparatus according to claim 5,
The authentication information input screen transmission unit includes the authentication information input screen and a program for expanding the area of the frame area when a communication session between the information processing apparatus and the user terminal times out. Sending to your device,
An information processing apparatus characterized by the above. An information processing apparatus that is communicably connected to a user terminal and transmits screen data of a Web page having a plurality of frame areas to the user terminal.
Transmitting an authentication information input screen to be displayed in one of the frame regions and a program for expanding the area of the frame region in which the authentication information input screen is displayed to the user terminal;
An information processing method characterized by the above. An information processing method according to claim 9,
The information processing apparatus is
Receiving authentication information input via the authentication information input screen from the user terminal;
Perform user authentication based on the received authentication information,
If the authentication is successful, sending a program for reducing the area of the frame area on which the authentication information input screen is displayed to the user terminal;
An information processing apparatus characterized by the above.

Images