JP2011128994A - Apparatus and method for processing information, and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To flexibly define classification of a role being a unit for giving access authority and authority to be given to each role in each tenant in a multi-tenant type application, such as a SaaS application. <P>SOLUTION: Access authority definition information for defining information of operation authority to an information resource, tenant role definition information that defines the classification of roles of each tenant and authority to be given to a role, and user role definition information that defines assignment of the role to a user are stored. The application uses a single program to achieve user's access control to the information resource by combining and connecting these pieces of information. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to access control to information resources, and particularly to access to information resources based on the definition of roles (role) managed for each tenant and roles assigned to users in a multi-tenant type system. It is about control.

  When performing access control for information resources based on user roles, the access authority for the information resources is given to the roles, and the roles are assigned to the users. If the role assigned to the user has authority for a specific operation, the user is allowed to perform that action. Patent Document 1 discloses an access control method using a user role as described above.

JP 2000-207363 A

  In a multi-tenant system such as a SaaS application, the same application program is provided to a plurality of tenants (use companies). However, in tenant companies with different company sizes and business types, desirable classifications of roles representing user roles are different, and the authority granted to the same role may be different. For this reason, in a multi-tenant type application, the role classification that is a unit for granting access authority, the authority granted to each role (hereinafter, the role classification that is a unit for granting access authority, It is necessary to allow the application to realize access control by a single program control, in addition to enabling flexible definition for each tenant.

  However, in the user access control device described in Patent Document 1, access control to information resources by a single role definition information is possible, but access control to information resources based on a plurality of role definition information for each tenant. Cannot be realized. In particular, there is a lack of means for storing a plurality of role definition information and means for converting the authority of roles defined for each tenant into data for realizing access authority control for information resources by a single program.

  The present invention has been made in order to solve the above-described problems, and it is possible to set roles classified as units for granting access authority and the authority granted to each role for each tenant. An object of the present invention is to provide an access control apparatus, a control method therefor, an access control system, and a program for enabling user access control to be realized by a single program control.

  In order to achieve the above object, an information processing apparatus of the present invention has the following configuration. That is, an information processing apparatus that determines a function that can be used by a user based on a user's authority among functions provided by a multi-tenant type application, and a role and an authority having the role for each of the tenants For each tenant, for each tenant, user-role definition information indicating a relationship between a user and a role assigned to the user, and for each of the plurality of multi-tenant type applications, the authority and its A user who uses the terminal in accordance with storage means storing access authority definition information indicating a relationship with the function of the application that can be executed by the authorized user, and authentication information used for user authentication transmitted from the terminal used by the user Authentication means for authenticating the authentication and authentication by the authentication means First determination means for determining the authority of the user that has been made according to the user-role definition information and tenant-role definition information stored in the storage means, a reception means for receiving an application execution request from the terminal, Functions that can be used by the user in the application that has received the execution request in accordance with the access authority definition information of the application that has received the execution request from the terminal and the authority of the user determined by the first determination unit. Second deciding means for deciding.

  In order to achieve the above object, the information processing detailed report of the present invention has the following configuration. That is, for each of the plurality of tenants, tenant-role definition information indicating a relationship between a role and an authority having the role, and for each tenant, user-role definition information indicating a relationship between a user and a role assigned to the user. For each of the plurality of multi-tenant type applications, the information processing apparatus includes a storage unit that stores access authority definition information indicating a relationship between the authority and a function of the application that can be executed by a user having the authority. Of the functions provided by the multi-tenant type application, an information processing method for determining a function that can be used by the user based on the user's authority, and according to authentication information used for user authentication transmitted from a terminal used by the user, Authenticate users using the terminal An authentication step, a first determination step of determining the authority of the user authenticated in the authentication step according to the user-role definition information and the tenant-role definition information stored in the storage means, and An acceptance process that accepts an execution request, an access authority definition information of an application that has accepted an execution request from the terminal in the acceptance process, and an application that has accepted the execution request according to the authority of the user determined in the first determination process And a second determination step of determining a function that can be used by the user.

In order to achieve the above object, the computer program of the present invention has the following configuration. That is, for each of the plurality of tenants, tenant-role definition information indicating a relationship between a role and an authority having the role, and for each tenant, user-role definition information indicating a relationship between a user and a role assigned to the user. And for each of the plurality of multi-tenant applications, a computer having storage means storing access authority definition information indicating a relationship between the authority and a function of the application that can be executed by a user having the authority, Among the functions provided by the application, a computer program for functioning as an information processing apparatus that determines a function that can be used by the user based on the user's authority, and authentication used for user authentication transmitted from a terminal used by the user According to the information, An authentication means for authenticating a user who uses the terminal;
First determination means for determining the authority of the user authenticated by the authentication means in accordance with user-role definition information and tenant-role definition information stored in the storage means, and accepting an application execution request from the terminal According to the receiving means, the access authority definition information of the application that has received the execution request from the terminal by the receiving means, and the user's authority determined in the first determination step, the user in the application that has received the execution request It is made to function as the 2nd determination means which determines the function which can be utilized.

  According to the present invention, the application controls the user's access to the information resource while flexibly defining the role classification, which is a unit for granting the access authority to the information resource, and the authority given to each role for each tenant. It is possible to provide an information processing apparatus, an information processing method, and a computer program that are executed by a single program control. In particular, role definition information for each tenant and user role definition information that defines the roles to which users in the tenant are assigned are stored and converted to access authority data for information resources based on this information. One system has the effect of realizing flexible access authority control.

It is a figure which shows the structure of the system in embodiment of this invention. It is a figure which shows the hardware constitutions of each terminal and server in embodiment of this invention. It is a figure which shows the module structure of each terminal and server in embodiment of this invention. It is a figure which shows an example of a structure of the access restriction definition information of FIG. It is a figure which shows an example of a structure of the user role definition information of FIG. It is a figure which shows an example of a structure of the tenant role definition information of FIG. It is a figure which shows an example of the management screen used for the setting of access authority definition information. It is a figure which shows an example of the management screen used for the setting of user role definition information. It is a figure which shows an example of the management screen used for the setting of tenant role definition information. It is a figure which shows an example of the menu screen of the service application. It is a figure which shows an example of the work screen of the service application. It is a figure which shows an example of the work screen of the service application. It is a flowchart which shows an example of the process in which the access control part 302 derives the access authority of the user with respect to an information resource. It is a flowchart which shows an example of the process which sets access authority definition information. It is a flowchart which shows an example of the process which sets tenant role authority definition information. It is a flowchart which shows an example of the process which sets user role authority definition information.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram showing the configuration of a system in an embodiment of the present invention. Note that the configuration of various terminals connected to the network 103 in FIG. 1 is merely an example, and it goes without saying that there are various configuration examples depending on applications and purposes.

  Reference numeral 101 denotes an application server that provides an application service, and a multi-tenant type application runs on the 101. Reference numeral 102 denotes a service management terminal used by a business operator who manages services. Reference numerals 104-1 and 104-2 denote service use terminals used by users of the tenants who use the service. The service management terminal 102, the service use terminal 104-1 and the service use terminal 104-2 can transmit and receive data to and from the application server 101 via the network 103.

  Next, the hardware configuration of the information processing apparatus applicable to various terminals such as the application server 101, the service management terminal 102, the service use terminal 104-1, and the service use terminal 104-2 in FIG. 1 will be described with reference to FIG. To do.

  The CPU 201 comprehensively controls devices and controllers described later connected to the system bus 204. Further, the ROM 203 or the external memory 211 is necessary to realize a BIOS (Basic Input / Output System) or an operating system program (hereinafter referred to as OS) that is a control program of the CPU 201 and functions executed by each server or each PC. Various programs to be described later are stored. The RAM 202 functions as a main memory, work area, and the like for the CPU 201.

  The CPU 201 implements various operations by loading a program necessary for execution of processing into the RAM 202 and executing the program. An input controller (input C) 205 controls input from an input device 209 configured with a keyboard, a pointing device, and the like. A video controller (VC) 206 controls display on a display device such as the display device 210. The display device is composed of, for example, a CRT display or a liquid crystal display.

  A memory controller (MC) 207 is a hard disk (HD), floppy disk (registered trademark FD) or PCMCIA card slot for storing boot programs, browser software, various applications, font data, user files, editing files, various data, and the like. Controls access to an external memory 211 such as a compact flash memory connected via an adapter.

  A communication I / F controller (communication I / FC) 208 is connected to and communicates with an external device via a network, and executes communication control processing in the network. For example, Internet communication using TCP / IP is possible.

  Note that the CPU 201 enables display on the display device 210 by executing outline font rasterization processing on a display information area in the RAM 202, for example. Further, the CPU 201 enables a user instruction with a mouse cursor (not shown) on the display device 210.

  A program used by the various terminals (application server 101, service management terminal 102, service using terminals 104-1 and 104-2) according to the present embodiment shown in FIG. And is executed by the CPU 201 by being loaded into the RAM 202 as necessary. Furthermore, definition files and various information tables used by the program according to the present invention are stored in the external memory 211.

  Next, internal configurations of various terminals such as the application server 101, the service management terminal 102, the service use terminal 104-1 and the service use terminal 104-2 in FIG. 1 will be described with reference to FIG.

  In FIG. 3, a service application 301 (service AP) 301 is arranged on the application server 101, and when the service application 301 takes the form of a Web application, it is accessed from the service use terminal 104 using the browser 303. Reference numeral 302 denotes an access control unit that provides the service application 301 with information on access authority that a specific user of a specific tenant is permitted. The access control unit 302 may be arranged on another hardware that can be accessed from the service application 301 via the network 103. Reference numerals 311, 312, and 313 are components of the access control unit 302. The access authority management module 311 is a main module of the access control unit 302, calls the user role provider module 312 and the tenant role definition provider module 313, and uses the access authority definition information 321 to access the access authority that can be used by the tenant user. Providing information. The user role provider module 312 is a module that uses the user definition information 322 to provide role information to which users in the tenant are assigned. The tenant role definition provider module 313 is a module that uses the tenant role definition information 323 to provide information on the role defined by the tenant and the authority granted to the role. The user role provider module 312 and the tenant role definition provider module 313 may be arranged on other hardware accessible via the network 103 from the access authority management module 311. Reference numeral 305 denotes a management application (management AP) for setting the access authority definition information 321, user definition information 322, and tenant role definition information 323 necessary for the operation of the access control unit 302. The management application 305 can be accessed via the network 103 from the browser 303 of the service using terminal 104 or the browser 304 of the service management terminal 102.

  Next, examples of various data structures of the access authority definition information 321, user role definition information 322, and tenant role definition information 323 in FIG. 3 and examples of management screens for setting the data structure will be described with reference to FIGS. 4 to 9. explain.

  FIG. 4 shows an example of the data structure of the access authority definition information 321 of FIG. The access authority definition information 321 holds an access authority list 401. For each access authority 401, a business function (business function 1 (402), business function 2 (403), business function 3 (404), business function 4 (405) is stored. )) Operation authority is defined. For example, in the setting example of FIG. 4, the access authority “AP authority-4” has a reference authority “R” for “business function 1” and a reference / edit authority “R / W” for “business function 2”. means.

  FIG. 7 is an example of a management screen for setting the access authority definition information 321. When the management screen 700 is provided in the form of a Web application, the service management terminal 102 receives data input via the management screen 700 displayed by the browser 304 of the service management terminal 102, and manages the management application via the network 103. By transmitting data to 305, the access authority management module 311 of the access control unit 302 sets the access authority definition information 321.

  FIG. 5 shows an example of the data structure of the user role definition information 322 in FIG. The user role definition information 322 defines a role assigned to the user for each tenant user. The tenant ID 501 is an ID for uniquely identifying a tenant, and the user ID 502 is an ID for uniquely identifying a user in the tenant. A role 503 indicates a role assigned to the user. For example, in the setting example of FIG. 5, the user “USER1” belonging to the tenant whose tenant ID is “TA” is assigned “Role 2”, “Role 3”, and “Role 4”. To do. The authority assigned to the role assigned to the user is defined in the tenant role definition information 323.

  FIG. 8 is an example of a management screen for setting the user role definition information 322. When the management screen 800 is provided in the form of a Web application, the service using terminal 104 receives data input via the management screen 800 displayed by the browser 303 of the service using terminal 104, and the management application via the network 103. By transmitting data to 305, the user role provider module 312 of the access control unit 302 sets the user role definition information 322.

  FIG. 6 shows an example of the data structure of the tenant role definition information 323. The tenant role definition information 323 defines, for each role 602 of the tenant specified by each tenant ID 601, an access authority 603 to be given to the role. For example, in the setting example of FIG. 6, in the tenant whose tenant ID is represented by “TA”, “role 3” means that “AP authority-1” and “AP authority-2” have authority. The access authority given to the role is defined in the access authority definition information 321 described with reference to FIG.

  FIG. 9 is an example of a management screen for setting the tenant role definition information 503. When the management screen 900 is provided in the form of a Web application, the service using terminal 104 receives data input via the management screen 900 displayed by the browser 303 of the service user terminal 104 and manages it via the network 103. By transmitting data to the application 305, the tenant role definition provider module 323 of the access control unit 302 sets the definition information tenant role definition information 323.

  Next, a process in which the access control unit 302 of the application server 101 derives the user access authority to the information resource will be described with reference to FIG. Here, a description will be given of a process in which the access control unit 302 derives a list of access rights of the user for the business function based on tenant IDs and user IDs given from the outside and predefined information. When performing this processing, the CPU 201 of the application server 101 loads a program for causing the CPU 201 to perform processing related to the access control unit 302, stored in the external memory 211, to the RAM 202, and performs control according to the control of the program. This processing is performed. In the following description, the process performed by the CPU 201 according to the access authority management module 311 is performed as the process performed by the access authority management module 311, and the process performed by the CPU 201 according to the control by the user role provider module 312 is performed as the process performed by the user role provider module 312. The processing performed by the CPU 201 in accordance with control by the tenant role definition provider module 313 will be described as processing performed by the tenant role definition provider module 313.

  In step S1301, the access authority management module 321 is called, and the CPU 201 receives a tenant ID (P1) and a user ID (P2) given as conditions from the outside according to the control. Then, user authentication is performed to identify the user information and tenant information. Here, assuming that the value of P1 is “TA” and the value of P2 is “USER2”, the following flow will be described.

  Subsequently, in step S1302, the access authority management module 311 calls the user role provider module 322. Then, the user role provider module 312 acquires the role list (L1) of the user from the user role definition information 322. At this time, the tenant ID (P1) and the user ID (P2) are passed to the user role provider module 312 as arguments. The user role provider module 312 refers to data defined in advance in the user role definition information 322, and acquires a role assigned to the tenant user. For example, when the user role definition information is set as shown in FIG. 5, the tenant ID column matches the value “TA” of the argument P1, and the user ID column matches the value “USER2” of the argument P2. The row is searched, and the value “Role 2, Role 3, Role 4” of the role column of the data row is obtained. Then, the array L1 having the acquired role as an element is returned to the access authority management module 401. At this time, the elements of the array of L1 include “roll 2”, “roll 3”, and “roll 4”.

  In step S1303, the array L2 is initialized. At this time, the element of the array L2 is empty. In step S1304, K, which is a counter variable of the array L2, is initialized to zero.

  Step S1305 is the beginning of the loop. The processing from step S1306 to S1311 is performed on L1 [i] (the initial value of i is 0) that is an element of each array L1.

In step S1306, the access authority management module 311 calls the tenant role definition provider module 313 to acquire the access authority list (L3) for the role of L1 [i] from the tenant role definition information 323. At this time, the tenant ID (P1) and the role (P3) of L1 [i] are delivered to the tenant role definition provider module 313 as arguments. The tenant role definition provider module 313 refers to the data defined in advance in the tenant role definition information 323 and acquires the access authority granted to the role. For example, when the tenant role definition information is set as shown in FIG. 6 and the value of the argument P3 is “role 2”, the tenant ID column and the argument P1 value “TA”, the role column and the argument P3 A row in which both of the values “role 2” match is searched, and an access authority column of the data row is acquired. Then, an array L3 having the elements set in the authority column of the acquired data row as elements is returned to the access authority management module 401. The value of the argument P1 is “TA”,
When the value of the argument P3 is “role 2”, the element of the array of L3 includes “AP authority-3”.

  Step S1307 is the beginning of the loop. The processing of steps S1308 to S1310 is performed on L3 [j] (the initial value of j is 0) that is an element of each array L3.

  In step S1308, it is confirmed whether the access authority indicated by the value of L3 [j] is included as an element of the array L2, and if it is not included in the element of the array L2, the process proceeds to step S1309. If the value of L3 [j] is already included in the element of the array L2, the process proceeds to step S1311.

  In step S1309, L3 [j] is substituted for L2 [k]. In step S1310, 1 is added to the value of the variable k.

  Step S1311 is a loop end corresponding to step S1307. When the processes in steps S1308 to S1310 are finished for all elements included in the array L3, the loop is finished. The business authority given to one of the roles assigned to the user at the time when this loop is completed is added to the array L2. For example, when L1 [0], which is the first element of L1, is “role 2”, the element of L3 includes “AP authority-3”.

  Step S1312 is a loop end corresponding to step S1305. When the processes in steps S1306 to S1311 are finished for all elements included in the array L1, the loop is finished. The business authority assigned to all the roles assigned to the user at the end of this loop is added to the array L2. For example, when the value of the argument P1 is “TA” and the value of the argument P2 is “USER2”, the elements of the array L2 at the time of ending this loop are “AP authority-3” and “AP authority-1”. , “AP authority-2”. In step S1313, the array L2 is returned to the caller.

  Next, processing for setting the access authority definition information 321 will be described with reference to FIG. The access authority definition information setting process illustrated in FIG. 14 is performed by the service management terminal 102 and the application server 101. Note that the processing performed by the CPU 201 of the application server 101 will be described as a module that causes the CPU 201 to perform the processing.

  First, the CPU 201 of the service management terminal 102 transmits an access authority definition information change request to the application server 101 (step S1401). When the change request is received (step S1402), in step S1403, the management application 305 calls the access control unit 302 to acquire data of the access authority definition information 321 currently registered. This data acquisition request is transmitted to the access authority management module 311 inside the access control unit 302.

  Thereafter, in step S1404, the access authority management module 311 reads data from the access authority definition information 321 and returns the read data (hereinafter referred to as D1a) to the caller. In step S1405, the management application 305 that has received D1a from the access control apparatus 302 generates an HTML document of the access authority definition information management screen 700 reflecting D1a, and this HTML document is the response of the browser 304 of the service management terminal 102. (Step S1406). This HTML document is transmitted to the network 103 and received by the browser 304. When the service management terminal 102 acquires the HTML data of the management screen 700, the management screen 700 of the access authority definition information in which D1a is set is displayed on the display device 210 by the function of the browser 304 (step S1408).

  Thereafter, a data change input is accepted via the management screen 700 (step S1409). After that, when the pressing of the transmission button 704 on the management screen 700 is accepted, input data (hereinafter referred to as D1b) is transmitted to the network 103 by the function of the browser 304 (step S1410), and the management application 305 receives it (step S1411). ). In step S1412, the management application 305 that has received D1b passes D1b to the access control unit 302 in order to make this data permanent. This permanent request is transmitted to the access authority management module 311 inside the access control unit 302.

  Then, the access authority management module 311 replaces the data of the access authority definition information 321 with the contents of the received D1b (step S1412: data update). The management application 305 acquires the processing result from the access control unit 302, and transmits the acquired processing result to the browser 304 of the service management terminal 102 (step S1413). Then, the browser 304 of the service management terminal 102 displays the received processing result (step S1414). The above is the description of the access authority definition information setting process.

  Next, processing for setting the tenant role definition information 323 will be described with reference to FIG. The tenant role definition information setting process illustrated in FIG. 15 is performed by the service using terminal 104 and the application server 101. In the description of this processing, the processing subject is described as a module that causes the CPU 201 to perform the processing.

  First, the CPU 201 of the service using terminal 104 transmits a tenant role definition information change request to the application server 101 (step S1501). At that time, the browser 303 is used to access the management application 305. The access request includes information for identifying the access source tenant such as the tenant ID. As a method of including the tenant ID in the access request, for example, a method of including the HTTP Cookie, a query string in the URL, or HTTP POST data can be considered. In the management application 305, needless to say, sufficient countermeasures should be taken in preparation for an attack in which the assertion of the access source tenant is spoofed.

  When the management application 305 of the application server 101 receives the change request (step S1502), the access control unit 302 is called to acquire the data of the tenant role definition information 323 currently registered in step S1503. This data acquisition request is transmitted to the tenant role definition provider module 313 inside the access control unit 302.

  In step S1503, the management application 305 calls the access control unit 302 in order to acquire tenant role definition data of the corresponding tenant. When calling, the management application 305 takes out the tenant ID included in the access request and passes it to the access control apparatus 302 as an argument. This data acquisition request is transmitted together with the argument to the tenant role definition provider module 313 through the access authority management module 311 inside the access control unit 302. In step S1504, the tenant role definition provider module 313 reads all records corresponding to the tenant ID passed as an argument from the tenant role definition information 323, and returns this data (hereinafter D2a) to the caller. In step S1505, the management application 305 that has received D2a from the access control unit 302 creates an HTML document of the tenant role definition information management screen 900 reflecting D2a, and returns this HTML document as a response of the browser 303 (step S1506). ). This HTML document is transmitted to the network 103 and received by the browser 303 (step S1507). The tenant role definition information management screen 900 in which D2a is set is displayed by the function of the browser 303 (step S1508).

  Thereafter, a data change input is accepted via the management screen 900 (step S1509). After that, when the pressing of the transmission button 905 on the management screen 900 is accepted, the input data (hereinafter D2b) is transmitted to the network 103 by the function of the browser 303 (step S1510), and the management application 305 receives it (step S1511). . In step S1511, the management application 305 that has received D2b passes D2b and the tenant ID to the access control unit 302 as arguments in order to make this data permanent. This persistence request is transmitted to the tenant role definition provider module 313 through the access authority management module 311 inside the access unit 302 together with the argument. Note that the tenant ID delivered as part of the argument is sent from the browser 303 in the same way as in the access request described above, or is managed at the time of the access request using the session state management function of the application server 101. 305 may store the tenant ID and take it out for use. In step S1512, the tenant role definition provider module 313 replaces the record corresponding to the tenant ID of the argument in the tenant role definition information 323 with the contents of the received D2b (step S1512: data update).

  Then, the management application 305 acquires the processing result from the access control unit 302, and transmits the acquired processing result to the browser 304 of the service using terminal 104 (step S1513). Then, the browser 303 of the service using terminal 104 displays the received processing result (step S1514). The above is the description of the tenant role definition setting process.

  Next, processing for setting the user role definition information 322 will be described with reference to FIG. The user role definition information setting process illustrated in FIG. 16 is performed by the service using terminal 104 and the application server 101. In the description of this processing, the processing subject is described as a module that causes the CPU 201 to perform the processing.

  First, the CPU 201 of the service using terminal 104 transmits a user role definition information change request to the application server 101 (step S1601). At that time, the browser 303 is used to access the management application 305. The access request includes information for identifying the access source tenant such as the tenant ID. As a method of including the tenant ID in the access request, for example, a method of including the HTTP Cookie, a query string in the URL, or HTTP POST data can be considered. In the management application 305, needless to say, sufficient countermeasures should be taken in preparation for an attack in which the assertion of the access source tenant is spoofed.

  When the management application 305 of the application server 101 receives the change request (step S1602), the access control unit 302 is called to acquire data of the user role definition information 322 currently registered in step S1603. This data acquisition request is transmitted to the user role provider module 312 inside the access control unit 302.

  In step S1603, the management application 305 calls the access control unit 302 to acquire user role definition data of the corresponding user. When calling, the management application 305 extracts the tenant ID and user ID included in the access request and passes them to the access control unit 302 as arguments. The data acquisition request is transmitted to the user role provider module 312 via the access authority management module 311 inside the access control unit 302 together with the argument. In step S1604, the user role provider module 312 reads all the records corresponding to the tenant ID passed as an argument from the user role definition information 322, and returns this data (hereinafter D3a) to the caller.

  In step S1605, the management application 305 that has received D3a from the access control unit 302 creates an HTML document of the user role definition information management screen 800 reflecting D3a, and returns this HTML document as a response of the browser 303 (step S1606). . This HTML document is transmitted to the network 103 and received by the browser 303 (step S1607). With the function of the browser 303, the user role definition information management screen 800 in which D3a is set is displayed (step S1608).

  After that, data change input is accepted via the management screen 800 (step S1609). After that, when the pressing of the transmission button 803 on the management screen 800 is accepted, input data (hereinafter D3b) is transmitted to the network 103 by the function of the browser 303 (step S1610), and the management application 305 receives this (step S1611). . The management application 305 that has received D3b passes D3b, the tenant ID, and the user ID to the access control apparatus 302 as arguments in order to make this data permanent. This persistence request is transmitted to the user role provider module 312 via the access authority management module 311 inside the access control apparatus 302 together with the argument. Note that the tenant ID and user ID delivered as part of the argument are sent from the browser 303 in the same way as in the access request described above, or when the access request is issued using the session state management function of the application server. The management application 305 may store the tenant ID and extract and use it. In step S1612, the user role provider module 312 replaces the record corresponding to the argument tenant ID and user ID in the user role definition information 322 with the contents of the received D3b (step S1612: data update).

  Then, the management application 305 acquires the processing result from the access control unit 302, and transmits the acquired processing result to the browser 304 of the service using terminal 104 (step S1613). Then, the browser 303 of the service using terminal 104 displays the received processing result (step S1614). The above is the description of the user role definition setting process.

  Next, referring to FIG. 10 to FIG. 12, when an application execution request is received from the service use terminal 104, the access control unit 302 shown in FIG. An example of a screen provided by the service application 301 displayed on the service use terminal 104 used by the user after execution will be described. FIG. 10 is an example of the menu screen of the service application 301. Using this screen, the service user inputs an instruction for starting the business function to be used to the CPU 201. For example, it is possible to perform an input by giving an operation instruction to controls such as the business function 1 button (1002) to the business function 4 (1004) button shown in the figure. Using the information acquired from the access control device 302, the service application 301 can switch the availability of the buttons on the menu screen 1000. That is, “USER1”, a user belonging to the tenant “TA”, assumes that role 1 is assigned, and the authority given to “role 1” in the tenant “TA” is “AP authority− When “1”, “AP authority-2”, “AP authority-3”, and “AP authority-4”, this user is permitted to access “business function 1” and “business function 2”. Menu buttons corresponding to “business function 1” and business authority “2” can be validated, and menu buttons of business functions without authority can be invalidated.

FIG. 11 and FIG. 12 are examples of business screens activated from the menu screen 1000. For example, for a user whose access right to “business function 1” is a reference / editing authority (R / W), the service application 301 activates a button related to data change as in the screen example 1100, For a user who has the reference right (R) for the access right to the function 1 ″, a function corresponding to the access right of the user can be provided by deactivating a button related to data change as in the screen of 1200. . Note that the access authority information provided by the access control device 302 is applicable not only to screen control but also to various aspects of access control.

  As described above, according to the present embodiment, access authority definition information that defines operation authority information for information resources, tenant role definition information that defines the role classification for each tenant and the authority granted to the role, By storing user role definition information that defines the assignment of roles to users and combining these information in combination, the application can implement user access control for information resources using a single program.

As described above, the embodiment has been described in detail. However, the present invention can take an actual aspect as, for example, a system, apparatus, method, program, or storage medium, and specifically includes a plurality of devices. The present invention may be applied to a system that is configured, or may be applied to an apparatus that includes a single device.

  Note that the present invention includes a software program that implements the functions of the above-described embodiments directly or remotely from a system or apparatus. The present invention also includes a case where the system or the computer of the apparatus is achieved by reading and executing the supplied program code.

  Accordingly, since the functions of the present invention are implemented by computer, the program code installed in the computer also implements the present invention. In other words, the present invention includes a computer program itself for realizing the functional processing of the present invention.

  In that case, as long as it has the function of a program, it may be in the form of object code, a program executed by an interpreter, script data supplied to the OS, and the like.

  Examples of the recording medium for supplying the program include a flexible disk, hard disk, optical disk, magneto-optical disk, MO, CD-ROM, CD-R, and CD-RW. There are also magnetic tape, nonvolatile memory card, ROM, DVD (DVD-ROM, DVD-R) and the like.

  As another program supply method, a browser on a client computer is used to connect to an Internet home page. The computer program itself of the present invention or a compressed file including an automatic installation function can be downloaded from the homepage by downloading it to a recording medium such as a hard disk.

  It can also be realized by dividing the program code constituting the program of the present invention into a plurality of files and downloading each file from a different homepage. That is, a WWW server that allows a plurality of users to download a program file for realizing the functional processing of the present invention on a computer is also included in the present invention.

  In addition, the program of the present invention is encrypted, stored in a storage medium such as a CD-ROM, distributed to users, and key information for decryption is downloaded from a homepage via the Internet to users who have cleared predetermined conditions. Let It is also possible to execute the encrypted program by using the downloaded key information and install the program on a computer.

  Further, the functions of the above-described embodiments are realized by the computer executing the read program. In addition, based on the instructions of the program, an OS or the like running on the computer performs part or all of the actual processing, and the functions of the above-described embodiments can also be realized by the processing.

  Further, the program read from the recording medium is written in a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer. Thereafter, the CPU of the function expansion board or function expansion unit performs part or all of the actual processing based on the instructions of the program, and the functions of the above-described embodiments are realized by the processing.

  The above-described embodiments are merely examples of implementation in carrying out the present invention, and the technical scope of the present invention should not be construed as being limited thereto. That is, the present invention can be implemented in various forms without departing from the technical idea or the main features thereof.

DESCRIPTION OF SYMBOLS 101 Application server 102 Service management terminal 103 Network 104-1 and 104-2 Service utilization terminal 201 CPU
202 RAM
203 ROM
204 System Bus 205 Input Controller 206 Video Controller 207 Memory Controller 208 Communication I / F (Interface) Controller 209 Input Device 210 Display Device 211 External Memory

Claims (6)

Among the functions provided by the multi-tenant application, an information processing apparatus that determines a function that can be used by the user based on a user's authority,
For each of the tenants, tenant-role definition information indicating a relationship between a role and an authority having the role, user-role definition information indicating a relationship between a user and a role assigned to the user for each tenant, and For each of the plurality of multi-tenant type applications, a storage unit that stores access authority definition information indicating a relationship between the authority and a function of the application that can be executed by a user having the authority;
Authentication means for authenticating a user using the terminal according to authentication information used for user authentication transmitted from a terminal used by the user;
First determination means for determining the authority of the user authenticated by the authentication means according to the user-role definition information and tenant-role definition information stored in the storage means;
Receiving means for receiving an application execution request from the terminal;
Functions that can be used by the user in the application that has received the execution request in accordance with the access authority definition information of the application that has received the execution request from the terminal by the reception unit and the authority of the user determined by the first determination unit Second determining means for determining
An information processing apparatus comprising: The first determination unit acquires all the roles that the user authenticated by the authentication unit has in the tenant to which the user belongs from the user-role definition information, and the user authority that the acquired role has in the tenant The information processing apparatus according to claim 1, wherein all information is acquired from the tenant-role definition information, and the authority of all the acquired users is determined as the authority of the user. Further comprising an acquisition means for acquiring input information input via the tenant-role definition information, the user-role definition information, and the access authority definition information input screen;
The information according to claim 1, wherein the storage unit stores the tenant-role definition information, the user-role definition information, and the access authority definition information according to the input information acquired by the acquisition unit. Processing equipment. Control means for controlling whether or not to use the control included in the screen provided by the application that has received the execution request by the accepting means according to the function of the application that can be used by the user determined by the second determining means. The information processing apparatus according to claim 1, further comprising: For each of the tenants, tenant-role definition information indicating a relationship between a role and an authority having the role, user-role definition information indicating a relationship between a user and a role assigned to the user for each tenant, and For each of the plurality of multi-tenant type applications, a multi-tenant is performed by an information processing apparatus including a storage unit that stores access authority definition information indicating a relationship between the authority and a function of the application that can be executed by a user having the authority. An information processing method for determining a function that can be used by a user based on a user's authority among functions provided by a type application,
An authentication step for authenticating a user using the terminal according to authentication information used for user authentication transmitted from a terminal used by the user;
A first determination step of determining the authority of the user authenticated in the authentication step according to the user-role definition information and tenant-role definition information stored in the storage unit;
A reception step of receiving an application execution request from the terminal;
Functions that can be used by the user in the application that has received the execution request according to the access authority definition information of the application that has received the execution request from the terminal in the reception step and the authority of the user determined in the first determination step A second determination step to determine;
An information processing method comprising: For each of the tenants, tenant-role definition information indicating a relationship between a role and an authority having the role, user-role definition information indicating a relationship between a user and a role assigned to the user for each tenant, and For each of the plurality of multi-tenant type applications, a multi-tenant type application includes a computer having storage means that stores access authority definition information indicating a relationship between the authority and a function of the application that can be executed by a user having the authority. Among the functions to be provided, a computer program for causing a function as an information processing apparatus that determines a function that can be used by the user based on the authority of the user,
Authentication means for authenticating a user using the terminal according to authentication information used for user authentication transmitted from a terminal used by the user;
First determination means for determining the authority of the user authenticated by the authentication means according to the user-role definition information and tenant-role definition information stored in the storage means;
Receiving means for receiving an application execution request from the terminal;
Functions that can be used by the user in the application that has received the execution request according to the access authority definition information of the application that has received the execution request from the terminal by the receiving means and the authority of the user determined in the first determination step. A computer program that functions as second determining means for determining.

Images