JP2011164686A - Information processor, image processor, login authentication method, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce fail-over time when an authentication server responds to an authentication request by a client in a JAAS Kerberos authentication system. <P>SOLUTION: When an authentication request is issued by a JAAS 13 to a KDC according to priority, the authentication request is issued for each KDC based on a Kerberos configuration file 15 generated so as to reflect user's initial setting, a successfully authenticated KDC is specified and registered in a priority registration unit 6, the Kerberos configuration file 15 is corrected such that an authentication request retry unit 4 can prioritize the KDC as an authentication request issuance destination at the next authentication. Fail-over time is reduced by optimizing the priority of the KDC as an authentication request issuance destination according to the status of the KDC at the time of authentication request and performing processing for issuing the authentication request. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to JAAS Kerberos authentication that uses a plurality of authentication servers that can connect to a network for login authentication. More specifically, the present invention aims to shorten the failover time when an authentication server responds to a client authentication request. The present invention relates to an information processing apparatus, an image processing apparatus, a login authentication method, a program for executing the authentication process, and a recording medium.

In Kerberos (registered trademark, the same applies hereinafter), which is an authentication system developed for use in a public network such as the Internet, for the purpose of redundancy, one master KDC (KDC: Key Distribution Center: Key distribution center) and an authentication system consisting of multiple slave KDCs.
In addition, in the Kerberos authentication service implemented in Sun OS, which is the Kerberos authentication of Java (registered trademark) authentication and authorization service (that is, JAAS: Java (registered trademark) Authentication and Authorization Service), the slave KDC is installed after J2SE v1.4.2. Supported, multiple KDCs can be specified.
For this reason, if a failure occurs in the master KDC and there is no response within the preset timeout period, this Kerberos authentication system already has a function that can automatically redirect and execute authentication to the slave KDC. That is known.

However, the Kerberos authentication service implemented in the existing Sun OS has a function to solve by automatically changing the priority so that priority is not given until the failed KDC recovers, or which KDC There is no way to know if you responded. For this reason, the next time authentication is requested, the master KDC must be executed again, and there is a problem that it takes a failover time until a normally operating server responds.
By the way, in Patent Document 1, in a cluster system in which a plurality of servers sharing a storage device such as a disk array device are combined, when a failure occurs in a certain server, a failover function in which an alternative server takes over processing and data is shown. Has been. In this prior art, the storage device includes a status detection unit and a priority control unit, the server status is observed from the storage device side, and the processing priority is controlled according to the observation result, It describes that an operation for reducing the failover time is performed.

However, in the prior art disclosed in Patent Literature 1, the observation result of the server status increases the priority of the processing of the alternative server that takes over processing and data when a failure or the like occurs, and avoids prolonging the failover time when taking over. The failover function is implemented in hardware, and the above-described failover time problem caused by the client-side operation that makes an authentication request in the JAAS Kerberos authentication service cannot be solved.
The present invention has been made in view of the above-mentioned problems of the prior art in JAAS's Kerberos authentication system, and its purpose is to provide a plurality of authentication servers and an information processing apparatus as a client connected to these via a network. In an authentication system configured as a system element, it is to reduce a failover time when an authentication server responds to a client authentication request.

The present invention is an information processing apparatus that accepts a user's login and performs authentication for the accepted login using an authentication server that can be connected to a network, and includes a user interface unit that accepts a user's login and a received user's login. On the other hand, a configuration information creation unit that creates configuration information of an authentication request to be issued to a specified authentication server, an authentication request issue unit that issues an authentication request based on the configuration information of the authentication request, and an available destination that can be specified as an issue destination A priority order registration unit for registering the priority order of a plurality of authentication servers, and a next order registered in the priority order registration unit when a response to an authentication request issued to a prioritized authentication server is not obtained. Modify configuration information that modifies the configuration information of an existing authentication request in order to change the authentication server to the issue destination The authentication request issuing unit is instructed to execute an authentication request issued based on the modified authentication request configuration information, and a response to the authentication request issued to the changed authentication server is obtained. And an authentication request retry unit for changing the priority of the authentication server of the priority order registration unit from the initial priority to the order of giving priority to the authentication server from which a response has been obtained.
The present invention is an image processing apparatus that accepts a user login, performs authentication for the accepted login using an authentication server that can be connected to a network, and performs data processing on an image to be processed in response to a processing request accompanying the login. The user interface unit that accepts user login, the configuration information creation unit that creates the configuration information of the authentication request issued to the specified authentication server for the received user login, and authentication based on the configuration information of the authentication request An authentication request issuing unit that issues a request, a priority registration unit that registers the priorities of a plurality of available authentication servers that are designated as issue destinations, and a response to the authentication request issued to the priority authentication server If it cannot be obtained, the authentication server of the next order registered in the priority registration unit is changed to the issue destination. In order to issue, a configuration information correction unit for correcting configuration information of an existing authentication request, and an instruction to execute an authentication request issued based on the corrected configuration information of the authentication request are instructed to the authentication request issuing unit. When the response to the authentication request issued to the changed authentication server is obtained, the priority of the authentication server of the priority registration unit is set to the priority of the authentication server in which the response is obtained. And an authentication request retry unit for changing from the above.
The present invention relates to a login authentication method in an information processing apparatus that accepts a user's login and performs authentication for the accepted login using an authentication server that can be connected to a network, the step of accepting the user's login, and the accepted user Configuration information creation step for creating authentication request configuration information to be issued to the designated authentication server, authentication request issuance step for issuing an authentication request based on the authentication request configuration information, and designation as an issue destination Registered in the priority registration step when a response to an authentication request issued to a priority issuer authentication server cannot be obtained, and a priority order registration step of registering the priorities of a plurality of available authentication servers Modify the configuration information of the existing authentication request to change the authentication server of the next order to the issue destination and issue it. The authentication information issuing step and an instruction to execute the authentication request issued based on the configuration information of the corrected authentication request to the authentication request issuing step, and for the authentication request issued to the changed authentication server An authentication request retry step for changing the priority order of the authentication servers registered in the priority order registration step when the response is obtained from the initial priority order to a priority order for giving priority to the authentication server for which the response is obtained. It is characterized by that.

  According to the present invention, in an authentication system comprising a plurality of authentication servers and an information processing apparatus as a client connected to these servers via a network as system elements, it can be used as an issue destination by a response result to an authentication request. By changing the priority order of a plurality of authentication servers so that an authentication request can be made, the failover time when the authentication server responds can be shortened.

It is a block diagram which shows the hardware constitutions which concern on embodiment of the image processing apparatus of this invention. It is a block diagram which shows the hardware constitutions of the computer used as an authentication server in the information processing apparatus (image processing apparatus) of this invention. It is a block diagram which shows the software configuration of the client in a general Kerberos authentication system. FIG. 4 is a block diagram illustrating an example of a Kerberos configuration file created by the authentication system of FIG. 3. It is a figure which shows the processing sequence of the client at the time of the authentication request | requirement of the authentication system of FIG. It is a block diagram which shows the software configuration of the client in the Kerberos authentication system which concerns on embodiment of this invention. FIG. 7 is a block diagram showing an example of a Kerberos configuration file created at the time of first login with the authentication system of FIG. 6. It is a figure which shows the processing sequence of the client at the time of the authentication request | requirement of the authentication system of FIG. FIG. 7 is a block diagram illustrating an example of a Kerberos configuration file created at the time of a retry in the authentication system of FIG. 6.

Embodiments of the present invention will be described with reference to the accompanying drawings.
The following embodiment shows an example of configuring a JAAS Kerberos authentication system that can specify a plurality of KDCs as authentication servers.
In addition, an example in which an image processing apparatus such as an MFP (multifunction apparatus having a combination of functions such as a copy, a printer, and a scanner) is applied to a client apparatus that uses a KDC on a network is shown. The MFP is used for image output and network distribution to an external device based on a function of generating image data by scanning a scanner, image input from a scanner or an external device via a network (including a print request). It is an apparatus that processes image data, and is one of image processing apparatuses that are often shared and have a high necessity for Kerberos authentication.
However, basically, the following method for an image processing apparatus such as an MFP as an example is used as another information processing apparatus such as a shared PC (Personal Computer) that requires Kerberos authentication for login. By applying to the above, the present invention can be similarly applied to such an information processing apparatus.

"Hardware configuration of client device"
FIG. 1 is a block diagram illustrating a hardware configuration of an image processing apparatus as a client apparatus according to the present embodiment.
In the image processing apparatus 100 shown in FIG. 1, the entire image processing apparatus 100 is controlled under the controller 110, and the controller 110 controls the operations of various devices that are necessary even when using functions such as copying, printers, and scanners. Control.
The controller 110 includes a CPU (Central Processing Unit) 111 for executing instructions of the software program, a ROM (Read Only Memory) 112 for storing the program, a page memory created by the operation of the program, A computer comprising a RAM (Random Access Memory) 113 used as a work memory necessary for the operation of the program and an NVRAM 114 which is a non-volatile memory for storing setting conditions for properly operating the image processing apparatus 100 To do.

Further, as a component of the controller 110, an operation instruction such as a print command is issued between the network I / F (interface) 115 for exchanging data with the external device 120 connected on the network and the engine 130. It has an operation panel I / F 117 for exchanging data between the engine I / F 116 and an operation panel 140 functioning as a user interface (UI).
Note that the external unit 120 connected via the network I / F 115 includes a host PC, an authentication server described later, and the like. Examples of the engine 130 connected via the engine I / F 116 include a scanner and a printer. The operation panel 140 includes a display unit and an input unit that receives an input operation such as a key, and provides an interactive UI function.

"Authentication Server Hardware Configuration"
FIG. 2 is a block diagram showing a hardware configuration of the authentication server according to the present embodiment.
The hardware of the authentication server 200 can be configured by a PC, and includes a bus 210, a CPU 212, a memory 213, a communication device 214, a display device 215, an HD (Hard Disk) drive 216, which are connected to the bus 210, respectively. It has an input device 217, a CD (Compact Disk) -ROM (Read Only Memory) drive 218, and an FD (Flexible Disk) drive 219.
The CPU 212 controls the operation of the authentication server 200. The memory 213 includes a ROM for storing a program executed by the CPU 212 at startup, necessary data, and a RAM for configuring a work area of the CPU 212.
The CPU 212 uses the RAM as a work memory to operate software (programs) stored in the ROM, the HD drive 216, and the like, and causes a computer configured by these elements to function as an operation control unit. In this embodiment, this computer functions as these processing means by driving a program for executing processing of the KDC as an authentication server.

The communication device 214 is a device for connecting the authentication server 200 to a network such as the Internet and exchanging data with the image processing device (client device) 100 (FIG. 1) and the like. Configure.
The display device 215 displays a screen for operating the authentication server 200 and an operation state.
The input device 217 includes a keyboard, a mouse, and the like, and is used for inputting various key operations and instructions to the authentication server 200.
The HD drive 216 stores a program for executing KDC processing, work data, file data, and the like. The CD-ROM drive 218 is a device for reading a recording medium such as a CD-ROM or a DVD-ROM. The FD drive 219 is a device for performing writing and reading on a flexible disk.

"Authentication system and its operation"
A JAAS Kerberos authentication system configured by an image processing apparatus 100 as a client apparatus and an authentication server 200 connected via a network, and an operation at the time of authentication in this authentication system will be described in detail.
In the following description, an embodiment is shown in which a realm environment is configured from one master KDC (master.sample.com) and two slave KDCs (slave1.sample.com, slave2.sample.com) as an authentication server. The priority order of the authentication servers to be used is set in advance, and the initial setting is the order of master.sample.com, slave1.sample.com, and slave2.sample.com.

<Prior art>
Before describing an embodiment according to the present invention, first, as an example of a Kerberos authentication system of JAAS, an example of the authentication system of the prior art configured by using a part common to the present invention is shown in FIGS. Reference is made to the description. Here, there is a characteristic part in the configuration of the client of this authentication system, and the KDC itself as the authentication server can be implemented by applying the existing technology, and thus detailed description of the authentication server is omitted. .
FIG. 3 is a block diagram showing a prior art software configuration used by a client device to perform Kerberos authentication using JAAS API (Application Program Interface).
As illustrated in FIG. 3, the client apparatus includes a Kerberos client 9 and a Java (registered trademark) Authentication and Authorization Service (JAAS) 13 as a client Java (registered trademark) VM (virtual machine) 10. Client Java (registered trademark)
The VM 10 is connected to one master KDC (master.sample.com) 20 and two slave KDCs 21 and 22 (slave1.sample.com, slave2.sample.com) via the network 30.

The Kerberos client 9 includes a UI (user interface) unit 1, a configuration file creation unit 2 that creates a Kerberos configuration file (krb5.conf) 15, and an authentication request unit 3 that requests JAAS 13 for authentication.
JAAS 13 uses LoginContext 11 and Krb5LoginModule 12 as components, and performs processing when issuing an authentication request to KDC as an authentication server, as will be described later.
The Kerberos configuration file 15 created by the configuration file creation unit 2 includes all information necessary for the Kerberos library linked to the Kerberos client 9, the authentication servers (KDC) 20 to 22, the management utility, and the KDC itself.
FIG. 4 shows an example of the Kerberos configuration file 15.
In the example shown in FIG. 4, under the description of [realms], one master KDC (master.sample.com) and two slave KDCs (slave1.sample.com, slave2.sample.) Are included in the SAMPLE.COM realm. com) are defined according to the priority set by the user.

An authentication request processing process performed by the client Java (registered trademark) VM 10 will be described with reference to a sequence diagram showing a processing procedure of FIG.
The UI unit 1 has an interface for inputting information necessary for this Kerberos authentication and an interface for inputting user information necessary for user authentication. Therefore, FIG. 5 shows a sequence performed in accordance with each input performed through these interfaces.
Information necessary for Kerberos authentication is input as a KDC setting via the UI unit 1 of the Kerberos client 9 by a user operation (FIG. 5, sequence 1).
At this time, the UI unit 1 passes information for determining the priority order of the KDC to be used from the input information necessary for Kerberos authentication to the configuration file creation unit 2 (FIG. 5, sequence 1.1).
Next, the configuration file creation unit 2 creates the Kerberos configuration file 15 according to a predetermined format based on the information for determining the priority order of the KDC used from the UI unit 1 (FIG. 5, sequence 1. 2). In the created Kerberos configuration file 15 (krb5.conf), KDCs are defined in the priority order set by the user based on the description of [realms].

In addition, a login operation is input through the UI unit 1 of the Kerberos client 9 by a user operation (FIG. 5, sequence 2).
At this time, the UI unit 1 accepts the user's login, attaches the user information indicated in the login, and requests the authentication request unit 3 to process the authentication request. Upon receiving this request, the authentication request unit 3 uses the user information passed from the UI unit 1 to interact with the LoginContext 11 of the JAAS API and makes an authentication request (FIG. 5, sequence 2.1).
Next, the Krb5LoginModule 12 issues a user authentication request to the authentication server using the Kerberos protocol in response to the authentication request received via the LoginContext 11. As a procedure of this process, the Krb5LoginModule 12 reads the Kerberos configuration file 15 (krb5.conf) created by the configuration file creation unit 2 in the sequence 1.2 (FIG. 5, sequence 2.1.1), and the Kerberos configuration file. According to the description in 15, a user authentication request is issued to the KDC using the Kerberos protocol (FIG. 5, sequence 2.1.2, 2.1.3, 2.1.4).

According to the Kerberos configuration file illustrated in FIG. 4, the Krb5LoginModule 12 redirects authentication in order from the top in the description of the KDC list, that is, (master.sample.com, slave1.sample.com, slave2.sample.com).
For example, a user authentication request is issued to the KDC of master.sample.com (Fig. 5, sequence 2.1.2), and some failure occurs in the issued KDC, and the set timeout time (value of kdc_timeout: milliseconds) If there is no response in (), it is automatically redirected to slave1.sample.com in the next rank and an authentication request is issued (FIG. 5, sequence 2.1.3).
Similarly, when a failure occurs in the KDC of slave1.sample.com and there is no response within the timeout period, an authentication request is issued to slave2.sample.com of the next rank (FIG. 5, sequence 2). .1.4).
Here, there is a response from the slave2.sample.com within the timeout period, and if the authentication is successful by this KDC, the authentication result is transmitted to the Kerberos client 9, and the login result is operated as the login result. Notify the user through the panel display.

As described above, according to the prior art, a function of automatically redirecting to a plurality of KDCs with a priority determined in advance by user input is realized.
However, as shown in the example above, the response from master.sample.com and slave1.sample.com was not obtained in JAAS13 of client Java (registered trademark) VM10, and authentication was successful at slave2.sample.com. In this case, there is no way to know this situation and there is no function to optimize the priority of the KDC according to the situation at that time, so the next time authentication is requested, it is executed again from master.sample.com. If the situation does not change, it will take a response time as before.

<Embodiment of the present invention>
Therefore, in the embodiment of the present invention, when issuing an authentication request to the KDC in accordance with the priority order, the authentication request is issued to the KDC in accordance with a predetermined initial priority order for the first time, and the authentication is successful in any KDC. If the authentication is successful, that is, the KDC that has obtained the authentication result is given priority as the issue destination when the authentication request is issued next time.
Therefore, in this embodiment, when issuing an authentication request to the KDC in accordance with the priority order, the authentication request is issued for each KDC so that the KDC that has been successfully authenticated can be specified, and the next specified KDC is requested to be authenticated. Manage the information necessary to give priority to the issuer.
As described above, the priorities of the prior art are solved by optimizing the priority order of the KDCs to which requests are issued according to the state of the KDC at the time of the authentication request and performing the process of issuing the authentication request.

An example of the JAAS Kerberos authentication system of this embodiment will be described with reference to FIGS. Here, there is a characteristic part in the configuration of the client of this authentication system, and the KDC itself as the authentication server can be implemented by applying the existing technology, and thus detailed description of the authentication server is omitted. .
FIG. 6 is a block diagram showing a software configuration used by the client apparatus (image processing apparatus 100 in FIG. 1) to perform Kerberos authentication using JAAS API (Application Program Interface).
As illustrated in FIG. 6, the client device includes a Kerberos client 9 and a Java (registered trademark) Authentication and Authorization Service (JAAS) 13 as a client Java (registered trademark) VM (virtual machine) 10. Client Java (registered trademark)
The VM 10 is connected to one master KDC (master.sample.com) 20 and two slave KDCs 21 and 22 (slave1.sample.com, slave2.sample.com) via the network 30.

The Kerberos client 9 includes a UI (user interface) unit 1, a configuration file creation unit 2 that creates a Kerberos configuration file (krb5.conf) 15, an authentication request unit 3 that requests JAAS 13 for authentication, and an authentication request unit 3. Authentication request retry unit 4 that can repeatedly make requests, configuration file modification unit 5 that modifies Kerberos configuration file 15 according to instructions from authentication request retry unit 4, and priority of connected KDC that is changed by authentication request retry The priority order registration unit 6 for registering the order is a constituent element.
The UI unit 1 has an interface for inputting the priority of KDC to be connected as information necessary for Kerberos authentication, and an interface for inputting user information necessary for user authentication. Further, the configuration file creation unit 2 creates a Kerberos configuration file 15 according to a predetermined format based on information necessary for Kerberos authentication passed from the UI unit 1. These points are the same as the Kerberos client in the prior art described above.

JAAS 13 uses LoginContext 11 and Krb5LoginModule 12 as components, and performs processing when issuing an authentication request to KDC as an authentication server, as will be described later.
The Kerberos configuration file 15 created by the configuration file creation unit 2 includes all information necessary for the Kerberos library linked to the Kerberos client 9, the authentication servers (KDC) 20 to 22, the management utility, and the KDC itself.
FIG. 7 shows an example of the Kerberos configuration file 15 created in the present embodiment.
In the example shown in FIG. 7, only one KDC is set in the SAMPLE.COM realm under the description of [realms]. In the example of FIG. 7, only the first master KDC (master.sample.com) in the priority order set by the user is defined. This is because only one KDC is set and an authentication request retry operation is performed, so that a KDC that has been successfully authenticated can be identified. This retry operation will be described in detail in the following processing procedure.

An authentication request processing process performed by the client Java (registered trademark) VM 10 will be described with reference to a sequence diagram showing a processing procedure of FIG.
First, information necessary for Kerberos authentication is input as a KDC setting via the UI unit 1 of the Kerberos client 9 by a user operation (FIG. 8, sequence 1).
At this time, the UI unit 1 passes information for determining the priority order of the KDC to be used from the input information necessary for Kerberos authentication to the configuration file creation unit 2 (FIG. 8, sequence 1.1).
Next, the configuration file creation unit 2 creates the Kerberos configuration file 15 according to a predetermined format based on the information for determining the priority order of the KDC to be used passed from the UI unit 1 (FIG. 8, sequence 1. 2). In the created Kerberos configuration file 15 (krb5.conf), KDCs are defined in the priority order set by the user based on the description of [realms] (see FIG. 4). The sequence so far is the same as the sequence of the prior art shown in FIG. 5, and the Kerberos configuration file 15 to be created is the same as that shown in FIG.

In addition, a login operation is input through the UI unit 1 of the Kerberos client 9 by a user operation (FIG. 8, sequence 2).
At this time, the Session Timeout (session timeout) between the client device and the KDC as the authentication server is confirmed, and if it is Session Timeout, the priority is initialized (FIG. 8, sequence 2.1). In this embodiment, a predetermined time is determined as the session time from the previous login time (in this embodiment, the login authentication time), and priorities are not initialized until the time has elapsed. The priority order of the KDC is changed in accordance with the processing result of the authentication request made for the process, and processing according to the changed priority order is performed. That is, by performing an authentication request retry operation (described in detail later), a time limit for performing an operation to prioritize the KDC that has been successfully authenticated as an issue destination when the next authentication request is issued is determined by the session time.

The appropriate value for the above session time varies depending on various factors including the configuration of the authentication system.For example, a value to be applied to each authentication system is determined based on the experience value obtained for each configuration of the authentication system. It is done.
The initial priority set when initializing with Session Timeout is, for example, the statistical data is obtained based on the high success rate and processing time when the authentication system is operated as the experience value, and based on the obtained data. Priorities are assigned to the KDCs constituting the authentication system and stored in the client device.
The authentication request retry unit 4 receives an initialization command issued by the client device itself, and registers the stored initial priority in the priority registration unit 6 to apply this priority at the time of execution.

If the priority is initialized with Session Timeout, the logged-in user may input from the operation panel to specify the priority of the KDC to be used for authentication. And the difference between the initial settings (Fig. 8, Sequence 2.2).
When the priority input by the user is different from the initial priority set at the time of initialization, the configuration file correction unit 5 corrects the Kerberos configuration file 15 created in the above sequence 1.2 according to the user input. (FIG. 8, sequence 2.3). At this time, in this embodiment, as illustrated in FIG. 7, a modification that defines only the first master KDC (master.sample.com) having the priority set by the user is added to the Kerberos configuration file 15.

After the modification of the Kerberos configuration file 15, the authentication request retry unit 4 that has accepted the user login from the UI unit 1 attaches the user information indicated in the login and requests the authentication request unit 3 to process the authentication request. Upon receiving this request, the authentication request unit 3 uses the user information passed from the UI unit 1 to interact with the JAAS API LoginContext 11 to make an authentication request (FIG. 8, sequence 2.4).
Next, the Krb5LoginModule 12 issues a user authentication request to the authentication server using the Kerberos protocol in response to the authentication request received via the LoginContext 11. As a procedure of this process, the Krb5LoginModule 12 reads the Kerberos configuration file 15 (krb5.conf) modified by the configuration file creation unit 2 in FIG. 8 and sequence 2.3 (FIG. 8, sequence 2.4.1), According to the description of the Kerberos configuration file 15, a user authentication request is issued to the first priority KDC using the Kerberos protocol (FIG. 8, sequence 2.4.2).

In the sequence shown in FIG. 8, when a failure occurs in the first priority KDC issued in sequence 2.4.2 and there is no response within the set timeout period (kdc_timeout value: milliseconds). Yes, in this case, an authentication request is issued to the next-ranked KDC.
As a procedure for this, the configuration file modification unit 5 further modifies the Kerberos configuration file 15 modified in the above-described sequence 2.3 according to the priority order instructed by the user input (see FIG. 8, sequence 2.5). At this time, in this embodiment, as shown in the Kerberos configuration file in FIG. 9, only the second KDC having the priority set by the user is defined in the SAMPLE.COM realm under the description of [realms]. Correction to be made.

After the modification of the Kerberos configuration file 15, the authentication request retry unit 4 that has accepted the user login from the UI unit 1 attaches the user information indicated in the login and requests the authentication request unit 3 to process the authentication request. Upon receiving this request, the authentication requesting unit 3 interacts with the LoginContext 11 of the JAAS API using the user information passed from the UI unit 1 and makes an authentication request (FIG. 8, sequence 2.6).
Next, the Krb5LoginModule 12 issues a user authentication request to the authentication server using the Kerberos protocol in response to the authentication request received via the LoginContext 11. As a procedure of this process, the Krb5LoginModule 12 reads the Kerberos configuration file 15 (krb5.conf) modified by the configuration file creation unit 2 in FIG. 8 and sequence 2.5 (FIG. 8, sequence 2.6.1), In accordance with the description in the Kerberos configuration file 15, a user authentication request is issued to the second priority KDC using the Kerberos protocol (FIG. 8, sequence 2.6.2).

Here, there is a response from the second KDC within the timeout time, and when the authentication is successful by this KDC, the authentication result is notified to the Kerberos client 9. The authentication result received by the Kerberos client 9 is added with information specifying the authenticated KDC and the time at this time, along with the result of the authentication success and failure. The time may be the time when the authentication result is notified. However, if the time stamp added by the KDC at the time of authentication is added, this time stamp is used.
Upon receiving this authentication result, the authentication request retry unit 4 of the Kerberos client 9 registers the KDC successfully authenticated and the time stamp in association with the notified priority registration unit 6. Since this registration changes the priority order of the KDC to be used next time, registration is performed with the normal operation KDC that has been successfully authenticated as the first priority order (FIG. 8, sequence 2.7).
Note that when changing the priority order, the authentication request issued for this login is not responded, and the KDC that fails authentication is not redirected. This is because immediately after the failure, the cause of the previous failure is removed and the possibility of success in the retry is low, so adding a KDC that failed to authenticate is a negative factor in order to shorten the failover time. It is possible.

Further, the authentication request retry unit 4 creates a session based on the authentication time when the authentication result is received, which is preferably the time stamp given by the KDC at the time of authentication (FIG. 8, sequence 2.8). .
The time of the created session is the start time of the session, and is used when confirming the Session Timeout at the next user login (see FIG. 8, sequence 2.1). In other words, if you do not set Session Timeout exceeding the session time starting from the start time of this session, the authentication request is issued using the priority changed this time. On the other hand, if Session Timeout is used, the session is cleared and The procedure to initialize the priority order and make it possible to cope with KDC recovery is also possible.
In addition, the user is notified through the display unit of the operation panel as a login result whether or not the login according to the success or failure of the authentication is possible.

<Processing accompanying priority change>
In the present embodiment, as described above, until the session time is exceeded, the authentication request issuance destination is determined using the priority order changed so that the KDC that normally operates at the time of the previous login is given priority.
However, there is no guarantee that the KDC will always operate normally for authentication requests issued by applying the changed order.
Therefore, when the issue destination KDC to which the changed order is applied does not operate normally, the priority order is returned to the initial setting. By using this method, the login process can be performed faster depending on the failure that occurs in the KDC.

  As described above, according to the JAAS Kerberos authentication system of the present embodiment, an authentication request is issued as an initial condition set in advance by the client device itself or sequentially to the KDC determined according to the priority set by the user. Depending on the status of the KDC at the time of the authentication request, the priority of the multiple KDCs that can be used is changed so that the KDC that responds to the authentication request has priority. Failover time can be shortened by optimizing priorities and issuing authentication requests according to the priorities. Furthermore, by checking the elapsed time from the time stamp of the KDC that responded to the authentication request and initializing the priority when a predetermined time has passed (session timeout), it is possible to cope with KDC recovery and optimization. It becomes possible.

  1 .... UI part 2 .... Configuration file creation part 3 .... Authentication request part 4 .... Authentication request retry part 5 .... Configuration file modification part 6 .... Priority registration part 9 ... Kerberos client 10..Client Java (registered trademark) VM, 13 .... JAAS (Java (registered trademark) Authentication and Authorization Service), 15..Kerberos configuration file, 20..Master KDC, 21, 22..Slave KDC, 30. ..Network, 100..Image processing apparatus, 110..Controller, 111..CPU, 112..ROM, 113..RAM, 115..Network I / F, 116..Engine I / F, 117 .. Operation panel I / F, 120 ..External unit, 130 ..Engine, 140 ..Operation panel.

JP-A-2005-301442

Claims (18)

An information processing apparatus that accepts a user login and performs authentication for the accepted login using an authentication server that can be connected to a network,
A user interface that accepts user logins;
A configuration information creation unit that creates configuration information of an authentication request issued to a specified authentication server in response to a login of an accepted user;
An authentication request issuing unit for issuing an authentication request based on the configuration information of the authentication request;
A priority registration unit for registering priorities of a plurality of available authentication servers designated as issue destinations;
If a response to the authentication request issued to the priority issuer authentication server cannot be obtained, the existing authentication server registered in the priority registration unit is changed to the issue destination and issued. A configuration information correction unit for correcting the configuration information of the authentication request of
When the authentication request issuing unit is instructed to execute an authentication request issued based on the modified authentication request configuration information, and a response to the authentication request issued to the changed authentication server is obtained. And an authentication request retry unit that changes the priority of the authentication server of the priority order registration unit from the initial priority to the order of priority of the authentication server for which the response has been obtained. The information processing apparatus according to claim 1,
The authentication request retry unit returns the priority to the initial priority when a response to the authentication request issued to the changed authentication server is not obtained. In the information processing apparatus according to claim 1 or 2,
The authentication request retry unit is configured not to redirect to an authentication server that is not operating normally. The information processing apparatus according to any one of claims 1 to 3,
The information processing apparatus, wherein the priority order registration unit automatically registers the initial priority order with a predetermined priority order. The information processing apparatus according to any one of claims 1 to 4,
The priority order registration unit registers a time stamp performed at the time of authentication by the authentication server from which a response to the authentication request is obtained in association with the server, and
The authentication request retry unit returns the priority to the initial priority on condition that a predetermined session time has elapsed from the time stamp. An image processing apparatus that accepts a user's login, performs authentication for the accepted login using an authentication server that can be connected to a network, and performs data processing on an image to be processed in response to a processing request accompanying login,
A user interface that accepts user logins;
A configuration information creation unit that creates configuration information of an authentication request issued to a specified authentication server in response to a login of an accepted user;
An authentication request issuing unit for issuing an authentication request based on the configuration information of the authentication request;
A priority registration unit for registering priorities of a plurality of available authentication servers designated as issue destinations;
If a response to the authentication request issued to the priority issuer authentication server cannot be obtained, the existing authentication server registered in the priority registration unit is changed to the issue destination and issued. A configuration information correction unit for correcting the configuration information of the authentication request of
When the authentication request issuing unit is instructed to execute an authentication request issued based on the modified authentication request configuration information, and a response to the authentication request issued to the changed authentication server is obtained. And an authentication request retry unit for changing the priority of the authentication server of the priority order registration unit from the initial priority to the order of priority of the authentication server from which a response has been obtained. The image processing apparatus according to claim 6, wherein
The authentication request retry unit returns the priority to the initial priority when a response to the authentication request issued to the changed authentication server is not obtained. In the image processing device according to claim 6 or 7,
The image processing apparatus, wherein the authentication request retry unit does not redirect to an authentication server that is not operating normally. The image processing apparatus according to any one of claims 6 to 8,
The image processing apparatus, wherein the priority order registration unit automatically registers the initial priority order with a predetermined priority order. The image processing apparatus according to any one of claims 6 to 9,
The priority order registration unit registers a time stamp performed at the time of authentication by the authentication server from which a response to the authentication request is obtained in association with the server, and
The authentication request retry unit returns the priority to the initial priority on condition that a predetermined session time has elapsed from the time stamp.   The information processing apparatus according to claim 1, wherein the information processing apparatus includes: the configuration information creation unit, the authentication request issue unit, the priority order registration unit, the configuration information correction unit, and the authentication request retry unit. Program to function as each part.   The image processing apparatus according to any one of claims 6 to 10, wherein the image processing apparatus includes: the configuration information creating unit, the authentication request issuing unit, the priority order registering unit, the configuration information correcting unit, and the authentication request retry unit. Program to function as each part.   A computer-readable recording medium recording the program according to claim 11 or 12. An authentication method for login in an information processing apparatus that accepts user login and performs authentication for the received login using an authentication server that can be connected to a network,
Accepting user logins,
A configuration information creation process for creating configuration information of an authentication request issued to a specified authentication server in response to a login of an accepted user;
An authentication request issuing step for issuing an authentication request based on the configuration information of the authentication request;
A priority registration step of registering priorities of a plurality of available authentication servers designated as issue destinations;
If a response to the authentication request issued to the priority issuer authentication server cannot be obtained, the existing authentication server registered in the priority order registration step is changed to the issue destination and issued. A configuration information correction process for correcting the configuration information of the authentication request of
When an instruction to execute an authentication request issued based on the configuration information of the modified authentication request is instructed to the authentication request issuing step, and a response to the authentication request issued to the changed authentication server is obtained The authentication request retrying step of changing the priority of the authentication server registered in the priority order registration step from the initial priority to the order of priority of the authentication server for which the response has been obtained. Authentication method. The login authentication method according to claim 14, wherein:
An authentication method for login, wherein the authentication request retrying step returns the priority to the initial priority when a response to the authentication request issued to the changed authentication server is not obtained. The login authentication method according to claim 14 or 15, wherein:
An authentication method for login, wherein the authentication request retry step does not redirect to an authentication server that is not operating normally. The login authentication method according to any one of claims 14 to 16, wherein:
In the priority order registration step, the initial priority order is automatically registered in a predetermined priority order. The login authentication method according to any one of claims 14 to 17,
In the priority order registration step, a time stamp performed at the time of authentication by the authentication server from which a response to the authentication request is obtained is registered in association with the server, and
The authentication request retrying step returns the priority to the initial priority on condition that a predetermined session time has elapsed from the time stamp.

Images