JP2012014424A - Image forming apparatus, authentication system, method for processing image forming apparatus, and program for the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a mechanism for allowing registration of appropriate user information for logging in an image forming apparatus.SOLUTION: The image forming apparatus can communicate with a first authentication server for performing authentication using a recording medium, and a second authentication server for performing authentication using user identification information and a password, performs an authentication request of recording medium identification information of the recording medium to the first server, accepts input of the user identification information and the password when the authentication fails, performs an authentication request to the second authentication server according to the user identification information and the password which are accepted, determines whether or not the accepted user identification information is in a form which can be managed in a management area which is managed by the image forming apparatus when the authentication succeeds, changes the form of the user identification information, and transmits the recording medium identification information and the user identification information whose form is changed when it is determined that the image forming apparatus is in the form which can not be managed.

Description

  The present invention relates to user registration in an authentication server for authenticating a user.

  Currently, authentication technology for MFPs using IC cards is widely used. Such a multi-function peripheral authentication system inquires a pre-registered authentication server for card information such as a manufacturing number read from an IC card, and makes the multi-function peripheral usable when it is registered.

  Also, it can be used in existing authentication systems, such as creating a unique authentication database in the multifunction device and using the multifunction device itself as an authentication server, constructing a unique authentication server on the same network as the multifunction device, or using an existing authentication system. There is a method of using the directory server that is.

  As a maintenance method of an authentication server used for authentication, a method of manual registration, deletion, and editing is generally used. However, in recent years, in order to minimize maintenance work, there is a system that automatically registers an authentication server in the case of an unregistered card.

  For example, Patent Document 1 describes a mechanism for automatically registering card information and user information in association with an authentication server.

JP 2010-33356

  However, in a company, there is a case where a directory server has already been constructed, and there is a demand for registering user information in the authentication server when the directory server is used for authentication.

  As a mechanism in this case, the authentication server is inquired of the card information (card ID) read by the card reader. As a result, if it is determined that the card is an unregistered card, the user information entered by the user on the MFP is authenticated against the directory server (authentication domain) specified when logging in to the PC during normal operations. Inquire. If there is user information in the directory server (authentication domain) as a result of the inquiry, a mechanism for associating the card ID with the user information and registering it in the authentication server can be considered.

  When authentication is performed using a directory server as in the above mechanism, for example, Windows (registered trademark) Active Directory (registered trademark) server can perform full-width authentication. This is a mechanism that allows full-width user names to be entered.

  In this way, when a multi-byte user name is allowed to be input on the multi-function device and the user name input on the multi-function device is used as it is in the authentication server after successful authentication to the directory server (registering user information), Authentication to the directory server succeeds, but a character type that is not permitted for login to the multifunction device is used for the user name (for example, authentication to the directory server with a full-width user name is successful, but the multifunction device Registration to the authentication server succeeds, but login to the multifunction device fails.

  In addition, when the user name is registered in the directory server in half-width, and the user name acquired from the directory server and other user information (e-mail address or group information) are registered with the card ID and registered in the authentication server Will not be registered with a full-width user name, but the only information required to log in to the MFP is the user name. Therefore, unnecessary communication for searching user information occurs. Therefore, when registering a user name and a card ID in association with each other, it is desirable to use the user name entered by the user on the multifunction device. However, since full-width characters are allowed, when logging into the multifunction device It happens that it fails.

  SUMMARY An advantage of some aspects of the invention is that it provides a mechanism that enables registration of appropriate user information for enabling login to an image forming apparatus.

  In order to achieve the object of the present invention, an image which can communicate with a first authentication server for performing authentication using a recording medium and a second authentication server for performing authentication using user identification information and a password A forming device for reading the recording medium identification information of the recording medium; a second authentication requesting means for requesting the recording medium identification information to be authenticated to the first authentication server; A first authentication result receiving means for receiving an authentication result from an authentication server; and a receiving means for receiving input of user identification information and a password when the authentication result received by the first authentication result receiving means is an authentication failure. , Receiving the authentication result from the second authentication server, second authentication requesting means for making an authentication request to the second authentication server according to the user identification information and password received by the receiving means When the authentication result received by the second authentication result receiving unit and the second authentication result receiving unit is successful, the user identification information received by the receiving unit is managed by the image forming apparatus when the authentication is successful. A determination unit that determines whether the format can be managed in the management area; and a change unit that changes the format of the user identification information when the determination unit determines that the format cannot be managed in the management area. When the determination means determines that the format can be managed in the management area, the recording medium identification information and the user identification information are registered with the first authentication server so as to be stored in association with each other. And when the determination means determines that the format cannot be managed in the management area, the recording medium identification information and the user identification whose format has been changed by the change means In order to store in association with broadcast, characterized in that it comprises a registration requesting means for registration request to the first authentication server.

  According to the present invention, it is possible to register appropriate user information for enabling login to the image forming apparatus. For example, when the card information is not registered, even if the user name input when registering the card is a full-width alphanumeric character, it can be converted into a half-width alphanumeric character and registered, so the image forming apparatus manages it. It is possible to prevent an error at the time of authentication due to failure to register user information for logging in to the login context.

It is a figure which shows an example of a structure of the multifunctional device IC card authentication system which can apply the directory server in the embodiment which concerns on this invention, an authentication server, and a multifunctional device. FIG. 2 is a block diagram showing a hardware configuration applicable to the client PC, authentication server, and directory server shown in FIG. 1. FIG. 2 is a block diagram illustrating an example of a hardware configuration of a controller unit of the multifunction machine illustrated in FIG. 1. It is a 1st figure which shows the functional block with which each terminal is provided. It is a 2nd figure which shows the functional block with which each terminal is provided. It is a flowchart which shows the procedure of the IC card authentication process in this embodiment. It is a flowchart which shows the procedure of the user registration process in this embodiment. It is a figure which shows an example of an IC card authentication screen. FIG. 9 is a diagram illustrating an example of a screen displayed when “keyboard input” is selected on the screen illustrated in FIG. 8. It is a figure which shows an example of a user registration screen. It is a figure which shows an example of an unregistered user registration confirmation screen. It is a figure which shows an example of a user registration success screen. It is a figure which shows an example of the screen displayed when card information cannot be registered. FIG. 5 is a diagram illustrating an example of a screen displayed after logging in to the multifunction machine. It is a figure which shows an example of user information DB of the authentication server. It is a figure which shows an example of user information DB of the directory server.

  The best mode for carrying out the present invention will be described below in detail with reference to the drawings. The same constituent elements are denoted by the same reference numerals, and the description thereof is omitted.

  FIG. 1 is a diagram showing an example of a configuration of an IC card authentication system configured by a directory server, an authentication server, and a multifunction peripheral according to the present invention.

  As shown in FIG. 1, one or a plurality of multifunction peripherals 300 (image forming apparatuses), an authentication server 200 (first authentication server for performing authentication using a recording medium), a client PC 100, and a directory server 400. A second authentication server for performing authentication using user identification information and a password input by the multifunction machine is connected via a network 105 such as a LAN (local area network). Here, one or a plurality of multifunction peripherals may be configured. In that case, the multifunction device 300 is installed, for example, for each floor, the client PC is installed, for example, by an administrator, and the directory server is installed, for example, for each site.

  The authentication server 200 holds user information. The user is searched according to the user information (card number, user name, password) transmitted from the multifunction device 300, and the user information is returned to the multifunction device 300.

  The client PC 100 is a PC for setting the multifunction device 300, and can communicate with the multifunction device 300 by HTTP (Hyper Text Transfer Protocol) via a network. The client PC 100 is, for example, a PC having a Microsoft Internet Explorer (registered trademark) function.

  The directory server 400 centrally manages hardware resources such as servers, clients, and printers existing on the network, and information such as attributes and access rights of users who use them. The directory server 400 is, for example, a server equipped with an Active Directory (registered trademark) function. The user attributes are, for example, a Microsoft Windows (registered trademark) login user name and password.

  Hereinafter, the hardware configuration of the information processing apparatus applicable to the client PC 100, the authentication server 200, and the directory server 400 illustrated in FIG. 1 will be described with reference to FIG. FIG. 2 is a block diagram showing a hardware configuration applicable to the client PC 100, authentication server 200, and directory server 400 shown in FIG.

  In FIG. 2, reference numeral 201 denotes a CPU that comprehensively controls each device and controller connected to the system bus 204. In addition, the ROM 202 or the external memory 211 stores a BIOS (Basic Input / Output System), an operating system program (OS), or the like, which is a control program of the CPU 201. The ROM 202 or the external memory 211 also stores various programs described below that are necessary for realizing the functions executed by each server or each PC.

  Reference numeral 203 denotes a RAM which functions as a main memory, work area, and the like for the CPU 201. When executing the processing, the CPU 201 loads necessary programs or the like from the ROM 202 or the external memory 211 to the RAM 203 and executes the loaded programs, thereby realizing various operations.

  An input controller 205 controls input from a keyboard (KB) 209, a pointing device such as a mouse (not shown), and the like. A video controller 206 controls display on a display unit such as the display 210. In FIG. 2, the display unit 210 is described, but the display unit may be configured by a liquid crystal display or the like. The keyboard 209 and the display 210 are used by an administrator as necessary.

  A memory controller 207 controls access to an external memory 211 such as a hard disk (HDD), a flexible disk (FD), or a Compact Flash (registered trademark) memory connected to a PCMCIA card slot via an adapter. To do. The hard disk stores a boot program, various applications, font data, user files, editing files, various data, and the like.

  A communication I / F controller 208 is connected to and communicates with an external device via a network, and executes communication control processing in the network. The communication I / F controller can perform communication using TCP / IP, for example.

  Note that the CPU 201 can display the display information on the display 210 by executing outline font development processing (rasterization) on the display information area in the RAM 203, for example. Further, the CPU 201 can instruct the user with a mouse cursor (not shown) on the display 210.

  Various programs to be described later for realizing the present invention are recorded in the external memory 211, and are executed by the CPU 201 by being loaded into the RAM 203 as necessary. Furthermore, a definition file and various information tables used when executing the program are also stored in the external memory 211, and detailed description thereof will be described later.

  Next, the hardware configuration of the controller unit that controls the multifunction peripheral 300 shown in FIG. 1 will be described with reference to FIG. FIG. 3 is a block diagram illustrating an example of a hardware configuration of the controller unit of the multifunction peripheral 300 illustrated in FIG.

  In FIG. 3, a controller unit 300 is connected to a scanner 314 that functions as an image input device and a printer 312 that functions as an image output device. In addition, image data and device information can be input / output by being connected to a LAN or a public line (WAN) (for example, PSTN or ISDN).

  In the controller unit 300, reference numeral 301 denotes a CPU, which is a processor that controls the entire system. Reference numeral 302 denotes a RAM, which is a system network memory for the CPU 301 to operate. The RAM 302 also functions as a program memory for recording a program and an image memory for temporarily recording image data.

  A ROM 303 stores a system boot program and various control programs. A hard disk drive (HDD) 304 stores various programs for controlling the system, image data, and the like.

  In 303, there is a platform for controlling the multifunction peripheral, and an authentication application for communicating with the authentication server 200 and the directory server 400 is operating on this platform. The authentication application is stored in the HDD 304. Furthermore, an area is secured on the HDD for a login context that stores user information at the time of login managed by the platform.

  An operation unit interface (operation unit I / F) 307 is an interface unit with the operation unit (UI) 308. For example, image data such as an IC card authentication screen as shown in FIG. Output and display.

  In addition, the operation unit I / F 307 transmits user information and the like input by the user of the system from the operation unit 308 to the CPU 301. Note that the operation unit 308 includes a display unit having a touch panel, and the user can give various instructions by pressing a button displayed on the display unit with a finger or the like.

  A network interface 305 is connected to a network (LAN) and inputs / outputs data. Reference numeral 306 denotes a modem, which is connected to a public line to input / output data such as FAX transmission / reception.

  Reference numeral 318 denotes an external interface that accepts an external input via USB, IEEE 1394, a printer port, RS-232C, or the like. In this embodiment, a card reader 319 for reading an IC card necessary for authentication is connected to the external interface 318. The CPU 301 can control reading of information from the IC card by the card reader 319 via the external interface 318, and can acquire information read from the IC card. The above devices are arranged on the system bus 309.

  An image bus interface 320 connects the system bus 309 and an image bus 315 that transfers image data at a high speed, and is a bus bridge that converts a data structure. The image bus 315 is configured by a PCI bus or IEEE1394. The following devices are arranged on the image bus 315.

  A raster image processor (RIP) 310 develops vector data such as a PDL code into a bitmap image. A printer interface 311 connects the printer 312 and the controller unit 300 and performs synchronous / asynchronous conversion of image data. Reference numeral 313 denotes a scanner interface, which connects the scanner 314 and the controller unit 300 to perform synchronous / asynchronous conversion of image data.

  An image processing unit 317 performs correction, processing, and editing on input image data, and performs printer correction, resolution conversion, and the like on print output image data. In addition, the image processing unit 317 performs rotation of image data and compression / decompression processing such as JBIG, MMR, and MH for binary image data for multi-valued image data.

  The scanner 314 illuminates an image on paper as a document and scans it with a CCD line sensor, thereby converting it into an electrical signal as raster image data. The original sheet is set on the tray of the original feeder, and the CPU 301 instructs the scanner 314 when the apparatus user issues a reading start instruction from the operation unit 308. As a result, the feeder feeds original sheets one by one and performs an original image reading operation.

  The printer 312 is a part that converts raster image data into an image on paper, and as its method, an electrophotographic method using a photosensitive drum or a photosensitive belt, or by ejecting ink from a micro nozzle array and directly on the paper. There is an ink jet method for printing an image. Any method may be used in the present embodiment. The activation of the printing operation is started by an instruction from the CPU 301. The printer 312 has a plurality of paper feed stages so that different paper sizes or different paper orientations can be selected, and paper cassettes corresponding to these are provided.

  The operation unit 308 has an LCD display unit, a touch panel sheet is pasted on the LCD, and a system operation screen is displayed. When the displayed key is pressed, the position information is transmitted to the CPU 301 via the operation unit I / F 307. The operation unit 308 includes, for example, a start key, a stop key, an ID key, a reset key, and the like as various operation keys.

  Here, the start key of the operation unit 308 is used when starting a document image reading operation. There is a green and red two-color LED in the center of the start key, and the color indicates whether or not the start key can be used. Further, the stop key of the operation unit 308 functions to stop the operation in operation. The ID key of the operation unit 308 is used when inputting the user ID of the user. The reset key is used when initializing settings from the operation unit.

  The card reader 319 reads information stored in an IC card (for example, Sony FeliCa (registered trademark)) under the control of the CPU 301, and reads the read information via the external I / F 318. The CPU 301 is notified.

  With the configuration as described above, the multifunction peripheral 300 can transmit the image data read from the scanner 314 to the LAN, and can print out the print data received from the LAN by the printer 312.

  In addition, the multi-function apparatus 300 can send the image data read from the scanner 314 to the public line via the modem 306 or output the image data received from the public line via the printer 312.

  As described above, the MFP 300 has a platform for controlling the MFP, and an authentication application for communicating with the authentication server 200 and the directory server 400 operates on the platform. The authentication application is stored in the HDD 304. In the login context managed by the platform and storing user information at the time of login, an area is secured on the HDD. For this reason, the authentication application supports full-width characters, etc., the user name entered by the user is full-width, and the login context is half-width compatible so that login cannot be performed and the full-width user entered by the authentication application. Register the name with half-width characters.

  The overall processing flow of the MFP authentication system according to the present invention will be described below. 4 and 5 are functional block diagrams showing functions provided in each terminal. Functions in each terminal in the embodiment of the present invention will be described with reference to FIGS. Details of the operation of each function will be described later. Therefore, hereinafter, a block diagram of functions in various terminals will be described.

  A card reader control function unit 350, an authentication service communication function unit 351, and an authentication processing function unit 352 on the multifunction machine are necessary for the authentication process.

  A card reader control function unit 350 controls communication with an IC card reader connected to the multifunction peripheral. When the IC card reader can hold a readable IC card, the card information necessary for authentication is acquired from the IC card and transmitted to the authentication service communication function unit 351. Here, the card information necessary for authentication is a card serial ID, for example, a card manufacturing number.

  The authentication service communication function unit 351 acquires card information from the card reader control function unit 350 and transmits a user information acquisition request (that is, an authentication request) corresponding to the card information to the authentication server. Also, the authentication service communication function unit 351 passes the user information to the authentication processing function unit 352 after acquiring the user information.

  The authentication processing function unit 352 performs processing (login processing) for notifying the MFP main body (platform) of user information included in the user information acquired from the authentication service communication function unit 351.

  The UI display control function unit 353 has a function of controlling display / non-display of various function screens (UI) of the multifunction peripheral based on the user information acquired from the authentication processing function unit 352.

  The directory server communication function unit 354 transmits an authentication request to the authentication processing function unit 450 of the directory server 400 based on the user information and login destination information input by the user from the operation unit 308 shown in FIG. Further, it has a function of transmitting a search request for user information to the search processing function unit 451. The search processing function unit 451 searches the user information DB 2 in FIG. 15 for user information of the designated item, and sends it back to the multifunction device 300.

  The user search function unit 251 has a function of receiving an authentication request from the authentication service communication function unit 351, searching for user information from the user information DB 1 held on the authentication server, and returning it to the multifunction device.

  The user automatic registration function unit 252 has a function of registering user information including at least a half-width user name and card information in the user information DB 1.

  Here, a screen displayed on the operation unit 308 of the multifunction machine 300 will be described with reference to FIGS.

  8 and 9 are diagrams showing an example of an authentication information input screen at the time of authentication operation in the IC card authentication system of the present invention. FIG. 8 shows a screen for inputting IC card information, which is displayed on the operation unit 308 shown in FIG.

  FIG. 9 is a screen displayed when the “keyboard input” button is selected on the screen shown in FIG. 8. In FIG. 9, user name, password, and domain information of authentication destination (log-in destination) can be input. In the case of this keyboard authentication screen, the directory server 400 is authenticated.

  FIG. 10 shows an input screen when authenticating to the directory server in order to associate and register card information and a user ID (user name) in the MFP login information management table (FIG. 15) stored in the user information DB1. It is a figure which shows an example. This is displayed on the operation unit 308 of FIG.

  FIG. 11 is a diagram illustrating an example of a screen displayed on the operation unit 308 when a card is held over by a user but the card is not authenticated.

  FIG. 12 is obtained from the user name input in FIG. 10 or the directory server when authentication is successful according to the authentication request on the screen of FIG. 10 when the card is held by the user but the card is not authenticated. It is an example of a screen displayed on the operation unit 308 when card information is registered in association with a user name and registration is successful. The case where the card is held by the user but the card is not authenticated means that the card information held in the MFP login information management table (FIG. 15) stored in the user information DB 1 is not registered. Means.

  FIG. 13 shows a screen displayed on the operation unit 308 when card information cannot be registered in the MFP login information management table (FIG. 15) stored in the user information DB 1 displayed in step S221 described later. It is an example.

  FIG. 14 is an example of a screen that is displayed when the MFP 300 can be logged in, which is displayed in step S122 described later.

  FIG. 6 is a flowchart showing a procedure of IC card authentication processing in the embodiment according to the present invention. Hereinafter, FIG. 6 will be described with reference to FIG.

  First, in step S100, when a user holds an IC card over an IC card reader connected to the multifunction device 300, a driver corresponding to the IC card reader receives card information (serial ID) (recording medium of recording medium) Reading means for reading the identification information).

  In step S101, the card reader control function unit 350 of the MFP 300 acquires card information from the driver.

  In step S102, the authentication service communication function unit 351 of the MFP 300 makes an authentication request to the authentication server 200 together with the serial ID (second authentication request means for requesting authentication of recording medium identification information). This is to determine whether there is user information associated with the card information (serial ID) acquired from the card reader control function unit 350.

  In step S <b> 103, the user search function unit 251 of the authentication server 200 receives an authentication request from the authentication service communication function unit 351.

  In step S104, the user search function unit 251 of the authentication server 200 searches the MFP login information management table (FIG. 15) for user information associated with the received serial ID.

  In step S105, the user search function unit 251 of the authentication server 200 determines the presence / absence of user information. If the user information associated with the received serial ID exists in the MFP login information management table (FIG. 15), the process proceeds to step S106. On the other hand, if there is no user information, the process proceeds to step S113.

  Here, a case where it is determined that the user information associated with the card information (serial ID) of the IC card held by the user does not exist in the MFP login information management table (FIG. 15) of the authentication server 200 will be described. .

  In step S <b> 113, the user search function unit 251 of the authentication server 200 transmits an unregistered response of user information associated with the serial ID to the multifunction device 300.

  In step S <b> 114, the authentication service communication function unit 351 of the MFP 300 receives the user unregistered response from the authentication server 200. The unregistered response is information indicating an authentication failure (first authentication result receiving means for receiving an authentication result).

  In step S115, the authentication processing function unit 352 of the MFP 300 receives the user unregistered response from the authentication service communication function unit 351, and displays the unregistered user registration confirmation screen shown in FIG.

  If the “Yes” button is pressed on the unregistered user registration confirmation screen shown in FIG. 11, the user registration screen shown in FIG. 10 is displayed, and the process proceeds to step S200 of the registration process shown in FIG. On the other hand, when the “No” button is pressed on the unregistered user registration confirmation screen shown in FIG. 11, the IC card authentication screen shown in FIG. 8 is displayed, and the processing from step S100 is performed again.

  A case will be described in which it is determined in step S105 that the user information associated with the card information (serial ID) of the IC card held by the user exists in the MFP login information management table (FIG. 15) of the authentication server 200. .

  In step S <b> 106, the user search function unit 251 of the authentication server 200 transmits the user ID searched and acquired in step S <b> 114 and the associated user information to the multi-function device 300.

  In step S107, the authentication service communication function unit 351 of the MFP 300 uses the user name associated with the serial ID transmitted in step S102 from the user search function unit 251 of the authentication server 200 and the associated user information as login information. Receive (first authentication result receiving means for receiving the authentication result).

  In step S108, the authentication processing function unit 352 of the MFP 300 performs login processing based on the login information received in step S107. The login process is a process of checking whether the user information received from the authentication server 200 corresponds to a login context managed by the platform of the multifunction machine 300 when logging in. For example, it is checked whether the user name is single-byte or whether a prohibited character type is included.

  The reason for this check is that the directory server can manage “double-byte alphanumeric characters”, “Hiragana”, “Kanji”, etc. as user names, so that the MFP login information management table of the authentication server 200 (FIG. 15). This is for preventing the login to the MFP 300 from causing an error as much as possible by registering full-width characters when importing into ().

  If there is a full-width alphanumeric character, it is converted to a half-width alphanumeric character, and if it is “Hiragana” or “Kanji”, it is converted to a hexadecimal character string. If the conversion is successful, the authentication is OK. If there is an illegal character that cannot be converted to any of the characters or a prohibited character type, the authentication is NG.

  In step S109, the authentication processing function unit 352 of the MFP 300 determines whether the authentication is OK or authentication NG as a result of the login process. If it is determined that the authentication is OK, that is, the user is permitted to log in, the process proceeds to step S111. On the other hand, if it is determined that the user is not permitted to log in, the process proceeds to step S110.

  When it is determined that the user is not permitted to log in, in step S110, the authentication processing function unit 352 of the MFP 300 notifies the user who is determined not to be permitted to log in a login error. Is displayed. When the login error screen is erased, the process returns to step S100 again.

  When it is determined that the user is permitted to log in, in step S111, login information is stored in a login context (management area) managed by the platform of the multifunction device 300, and the authentication processing function unit 352 of the multifunction device 300 is stored. Notifies the various programs of the MFP 300 of login information of the user who is determined to be a user who is permitted to log in. As a result, the multifunction device 300 can be used, and an application installed in the multifunction device 300 can be used.

  In step S112, the UI display control function unit 353 of the MFP 300 is a user who is permitted to log in, and thus displays a screen as illustrated in FIG. 14 after the login.

  FIG. 7 is a flowchart showing a procedure of user registration processing in the present embodiment. Hereinafter, FIG. 7 will be described with reference to FIG.

  First, in step S200, the authentication service communication function unit 351 of the MFP 300 authenticates the directory server 400, which includes the user name, password, and login destination information input by the user from the user registration screen shown in FIG. Information and detailed registration necessity selection status are acquired (accepting means for receiving input of user identification information and password when the received authentication result is an authentication failure). The login destination information shown here indicates an authentication domain to which the user belongs. Further, whether or not detailed registration is necessary is obtained by acquiring detailed user information (for example, a user name and an e-mail address) from the directory server 400 at the time of registration in the authentication server 200, or registering a user input on the panel This indicates selection information for registering name information in association with the serial ID of the card. When the detailed registration is not performed (the detailed registration in FIG. 10 is not checked), the simple registration mode is set, and the user name input to the user without making a search request for acquiring detailed user information to the directory server 400. And the serial ID (card information) of the card are registered in the MFP login information management table (FIG. 15).

  In step S202, the authentication service communication function unit 351 of the MFP 300 makes an authentication request to the directory server 400 using the authentication information acquired in step S200 (authentication request to the second authentication server according to the user identification information and password). Second authentication requesting means). Here, as the authentication method, for example, Kerberos authentication or the like is used.

  In step S203, the authentication processing function unit 450 of the directory server 400 receives an authentication request including a user ID and a password, and performs authentication of the user.

  In step S204, the authentication processing function unit 450 of the directory server 400 returns the authentication processing result in step S203 to the authentication server 200 as an authentication result. Here, for example, when there is matching information, the authentication result is “OK”, and when there is no matching information, the authentication result is “NG”.

  In step S205, the directory server communication function unit 354 of the MFP 300 receives the user authentication result transmitted in step S204 (second authentication result receiving unit that receives the authentication result).

  In step S206, if the authentication service communication function unit 351 of the MFP 300 determines that the authentication is OK in the authentication domain designated by the user based on the authentication result received in step S205, the process proceeds to step S207. On the other hand, if the user is determined to be authenticated NG, the process proceeds to step S221.

  In step S221, the authentication processing function unit 352 of the MFP 300 displays the registration error notification screen shown in FIG. 13, and when the registration error screen is deleted, the user registration screen shown in FIG. 10 is displayed again. The process proceeds to the registration process in step S200.

  In step S207, the authentication service communication function unit 351 of the MFP 300 performs the detailed registration when the detailed registration is selected based on the user's detailed registration selection determined to be authentication OK based on the determination in step S206. The mode is shifted to step S210. On the other hand, when the detailed registration is not selected, the mode shifts to the simple registration mode and proceeds to step S208.

  If it is determined in step 208 that the detailed registration is not selected based on the determination in step S207, the authentication service communication function unit 351 of the MFP 300 sets the user name input in the user name input field in FIG. It is determined whether or not double-byte characters are included (when the authentication result is successful authentication, the user identification information can be managed in a management area (for example, login context) managed by the MFP when authentication is successful (for example, login context) Determining means for determining whether or not half-width). If it is determined that the input user name includes double-byte characters, the process proceeds to step S209. On the other hand, if it is determined that a full-width character is not included, the process proceeds to step S216.

  In step S209, the authentication service communication function unit 351 of the MFP 300 performs conversion processing to half-width characters when it is determined based on the determination in step S208 that the input user name includes double-byte characters. (If it is determined that the format cannot be managed in the management area, a change unit that changes the format of the user identification information). For example, when [A12345] is input, the conversion process is performed with [A12345]. If it is “Hiragana” or “Kanji”, it is configured to be converted into a hexadecimal character string. If it is “Hiragana” or “Kanji”, the process proceeds to Step S210. User information may be acquired from the directory server. In this case, when the user name of the user information acquired from the directory server is “Hiragana” or “Kanji”, the character string before @ of the mail address may be acquired as the user name. . Accordingly, it is possible to prevent full-width registration and appropriately log in to the multifunction machine 300.

  In step S210, when the authentication service communication function unit 351 of the MFP 300 determines that the detailed registration is selected based on the determination in step S207, the authentication service communication function unit 351 enters the detailed registration mode and logs in to the MFP. In order to search additional information such as e-mail address and group information, a search request including a user name is transmitted to the directory server 400.

  In step S211, the search processing function unit 451 of the directory server 400 receives the search request in step S210.

  In step S212, the search processing function unit 451 of the directory server 400 determines, based on the content of the search request acquired in step S211, the mail address or group information corresponding to the user name included in the search request from the user information in the directory server. Search for user information such as In the example of the present embodiment, description will be made assuming that an e-mail address is acquired.

  In step S213, the search processing function unit 451 of the directory server 400 transmits a search result including the user information of the mail address searched in step S212 to the multi-function device 300.

  In step S214, the directory server communication function unit 354 of the MFP 300 receives the search result response in step S213.

  In step S215, the authentication service communication function unit 351 of the MFP 300 determines whether the user information has been searched based on the search result received in step S214. If it is determined that the user information can be acquired from the search result, the search is successful. If the user information cannot be acquired, that is, if the user information in the search result is empty, the search fails. And If user information could not be acquired, the process proceeds to step S221. On the other hand, if the user information has been acquired, the process proceeds to step S216.

  In step S221, the authentication processing function unit 352 of the MFP 300 displays a screen for notifying the registration error shown in FIG. 13. When the registration error screen is erased, the user registration screen shown in FIG. 12 is displayed again. The process proceeds to the registration process in step S200.

  In step S216, the authentication service communication function unit 351 of the MFP 300 transmits a user information registration request in association with the serial ID acquired in advance to the user automatic registration function unit 252 of the authentication server 200. . When the detailed registration is selected based on the determination in step S207, the user information transmitted at this time includes the user's e-mail address and user name acquired in step S214 together with the serial ID (card information) in the registration request. To send. If the detailed registration is not selected, the user name input in step S300 together with the serial ID (card information) input by the user in FIG. 10 or the user name converted in half-width in step S209 is used as a registration request. (If it is determined that the format can be managed in the management area, a registration request is made to the first authentication server to store the recording medium identification information and the user identification information in association with each other, and management is performed. If it is determined that the format cannot be managed in the area, a registration request means for requesting registration to the first authentication server so as to store the recording medium identification information and the user identification information whose format has been changed in association with each other.

  In step S217, the authentication service communication function unit 351 of the MFP 300 stores the serial ID and user information (user name or / and mail address) of the user who has received the registration request in the MFP login user information management table (FIG. 15). sign up.

  In step S218, the user automatic registration function unit 252 of the authentication server 200 transmits the registration result in step S217 to the multi-function device 300. The registration result is registration success or registration failure. In the present embodiment, the case of successful registration will be described.

  In step S219, the authentication service communication function unit 351 of the MFP 300 receives the registration result transmitted in step S217.

  In step S220, the UI display control function unit 353 of the MFP 300 displays the user registration success screen shown in FIG. 12 based on the registration result received in step S219. When the user registration success screen is deleted, the IC card authentication screen shown in FIG. 8 is displayed, and the process proceeds to the IC card authentication process in step S100.

  As described above, according to the present exemplary embodiment, it is possible to register appropriate user information for logging in to the multifunction peripheral (image forming apparatus). Further, by providing the detailed registration mode and the simple registration mode, additional information for logging in to the multifunction machine can be acquired when necessary, and a user-friendly mechanism can be provided.

  It should be noted that the configuration and contents of the various data described above are not limited to this, and it goes without saying that the various data and configurations are configured according to the application and purpose.

  Although one embodiment has been described above, the present invention can take an embodiment as, for example, a system, apparatus, method, program, or recording medium, and specifically includes a plurality of devices. The present invention may be applied to a system including a single device.

  Further, the program according to the present invention is a program that allows a computer to execute the processing methods of the flowcharts shown in FIGS. 6 to 7, and the storage medium according to the present invention is a program that allows the computer to execute the processing methods of FIGS. Is remembered. The program in the present invention may be a program for each processing method of each apparatus in FIGS.

  As described above, a recording medium that records a program that implements the functions of the above-described embodiments is supplied to a system or apparatus, and a computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by executing the reading.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium storing the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk, solid state drive, or the like can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) operating on the computer based on an instruction of the program is actually It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the processing and the processing is included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  Further, the present invention may be applied to a system composed of a plurality of devices or an apparatus composed of a single device. Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network using a communication program, the system or apparatus can enjoy the effects of the present invention.

  In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

100 client PC
200 Authentication Server 300 Multifunction Machine 400 Directory Server 500 Network 201 CPU
202 ROM
203 RAM
211 External memory 301 CPU
302 RAM
303 ROM
304 HDD

Claims (8)

An image forming apparatus capable of communicating with a first authentication server for performing authentication using a recording medium and a second authentication server for performing authentication using user identification information and a password,
Reading means for reading the recording medium identification information of the recording medium;
A second authentication request means for requesting the first authentication server to authenticate the recording medium identification information;
First authentication result receiving means for receiving an authentication result from the first authentication server;
Accepting means for accepting input of user identification information and a password when the authentication result received by the first authentication result receiving means is an authentication failure;
Second authentication requesting means for making an authentication request to the second authentication server according to the user identification information and password received by the receiving means;
Second authentication result receiving means for receiving an authentication result from the second authentication server;
Whether or not the user identification information received by the receiving unit is in a format that can be managed in the management area managed by the image forming apparatus when the authentication is successful when the authentication result received by the second authentication result receiving unit is successful. Determining means for determining
When the determination unit determines that the format cannot be managed in the management area, a change unit that changes the format of the user identification information;
If the determination means determines that the format can be managed in the management area, a registration request is sent to the first authentication server to store the recording medium identification information and the user identification information in association with each other. If the determination means determines that the format cannot be managed in the management area, the recording medium identification information and the user identification information whose format has been changed by the changing means should be stored in association with each other. An image forming apparatus comprising: a registration request unit that requests registration to the first authentication server. A simple registration mode for registering the user identification information received by the receiving means and the recording medium identification information;
Details of registering user information corresponding to the user identification information acquired from the second authentication server and the recording medium identification information when the authentication result received by the second authentication result receiving means is successful. With registration mode,
The registration request unit is acquired from the second authentication server in the detailed registration mode without determining whether the image forming apparatus can be managed in the management area managed when the authentication is successful by the determination unit. The registration request is made to the first authentication server to store the user identification information, the user information corresponding to the user identification information, and the recording medium identification information in association with each other. Image forming apparatus.   The image forming apparatus according to claim 2, wherein the changing unit changes the user identification information from a full-width format to a half-width format.   A storage for storing the user identification information included in the authentication result to be managed in the management area managed by the image forming apparatus when the authentication is successful when the authentication result received by the first authentication result receiving unit is successful. The image forming apparatus according to claim 1, further comprising a unit.   The image forming apparatus according to claim 4, further comprising a log-in unit configured to log in to the image forming apparatus by storing the user identification information in the management area. An authentication system including an image forming apparatus capable of communicating with a second authentication server for performing authentication using user identification information and a password, and a first authentication server for performing authentication using a recording medium,
The image forming apparatus includes:
Reading means for reading the recording medium identification information of the recording medium;
A second authentication request means for requesting the first authentication server to authenticate the recording medium identification information;
First authentication result receiving means for receiving an authentication result from the first authentication server;
Accepting means for accepting input of user identification information and a password when the authentication result received by the first authentication result receiving means is an authentication failure;
Second authentication requesting means for making an authentication request to the second authentication server according to the user identification information and password received by the receiving means;
Second authentication result receiving means for receiving an authentication result from the second authentication server;
Whether the user identification information received by the receiving unit is in a format that can be managed in the management area managed by the image forming apparatus when the authentication is successful when the authentication result received by the second authentication result receiving unit is successful. Determining means for determining
When the determination unit determines that the format cannot be managed in the management area, a change unit that changes the format of the user identification information;
If the determination means determines that the format can be managed in the management area, a registration request is sent to the first authentication server to store the recording medium identification information and the user identification information in association with each other. If the determination means determines that the format cannot be managed in the management area, the recording medium identification information and the user identification information whose format has been changed by the changing means should be stored in association with each other. Registration request means for requesting registration to the first authentication server,
The first authentication server is
An authentication request receiving means for receiving an authentication request for the recording medium identification information from the image forming apparatus;
Authentication means for authenticating the recording medium identification information;
An authentication result transmitting means for transmitting an authentication result including authentication success or authentication failure according to the authentication by the authentication means;
A registration request receiving means for receiving a registration request for the recording medium identification information and the user identification information;
An authentication system comprising storage means for storing the recording medium identification information and the user identification information in association with each other. A processing method of an image forming apparatus capable of communicating with a first authentication server for performing authentication using a recording medium and a second authentication server for performing authentication using user identification information and a password,
The image forming apparatus includes:
A reading step of reading the recording medium identification information of the recording medium;
A second authentication requesting step for making an authentication request for the recording medium identification information to the first authentication server;
A first authentication result receiving step of receiving an authentication result from the first authentication server;
An accepting step of accepting input of user identification information and a password when the authentication result received in the first authentication result receiving step is an authentication failure;
A second authentication requesting step for making an authentication request to the second authentication server according to the user identification information and password received in the receiving step;
A second authentication result receiving step of receiving an authentication result from the second authentication server;
Whether the user identification information received in the receiving step is in a format that can be managed in the management area managed by the image forming apparatus when the authentication is successful when the authentication result received in the second authentication result receiving step is successful. A determination step for determining
If the determination step determines that the format cannot be managed in the management area, a change step for changing the format of the user identification information;
If the determination step determines that the format can be managed in the management area, a registration request is sent to the first authentication server to store the recording medium identification information and the user identification information in association with each other. If the determination step determines that the format cannot be managed in the management area, the recording medium identification information and the user identification information whose format has been changed in the change step should be stored in association with each other. And a registration requesting step for requesting registration from the first authentication server. A program executable by an image forming apparatus capable of communicating with a first authentication server for performing authentication using a recording medium and a second authentication server for performing authentication using user identification information and a password. ,
The image forming apparatus;
Reading means for reading the recording medium identification information of the recording medium;
A second authentication request means for requesting the first authentication server to authenticate the recording medium identification information;
First authentication result receiving means for receiving an authentication result from the first authentication server;
Accepting means for accepting input of user identification information and a password when the authentication result received by the first authentication result receiving means is an authentication failure;
Second authentication requesting means for making an authentication request to the second authentication server according to the user identification information and password received by the receiving means;
Second authentication result receiving means for receiving an authentication result from the second authentication server;
Whether the user identification information received by the receiving unit is in a format that can be managed in the management area managed by the image forming apparatus when the authentication is successful when the authentication result received by the second authentication result receiving unit is successful. Determining means for determining
When the determination unit determines that the format cannot be managed in the management area, a change unit that changes the format of the user identification information;
If the determination means determines that the format can be managed in the management area, a registration request is sent to the first authentication server to store the recording medium identification information and the user identification information in association with each other. If the determination means determines that the format cannot be managed in the management area, the recording medium identification information and the user identification information whose format has been changed by the changing means should be stored in association with each other. A program for causing the first authentication server to function as registration request means for requesting registration.

Images