JP2013149238A - Information processing device, information processing method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a mechanism for realizing single sign-on even without work such as repair of existing applications on sites not cooperating with each other.SOLUTION: A mapping table in which a user account in a cooperation source Web site is associated with a user account in a cooperation destination Web site is stored, account information in the cooperation source Web site is acquired, the acquired account information is converted into account information in the cooperation destination Web site using the mapping table, and in order to access the cooperation destination Web site using the converted account information, the account information is sent back to a user.

Description

  The present invention relates to an authentication technique for a website.

  Currently, various information and services are provided by websites. Among them, there are information and services that can only be obtained by registered users. In such a case, normally, an ID is assigned to each registered user, and information and services are obtained by logging in to the Web site using the ID. In particular, in recent years, the opportunity to log in to many sites has increased.

  As described above, when logging in to the Web site, it is necessary to input a login ID and a password assigned to each user.

  In such a case, in order to save the trouble of inputting the ID and password many times, a function (so-called single sign-on) can be used to log in to another website by logging in to one website between a plurality of sites. ) Is popular.

  Patent Document 1 describes a technique related to this single sign-on, and in particular, a technique for performing distribution to a plurality of authentication sites using a load balancer for the purpose of surely authenticating at a plurality of authentication sites. Have been described.

Japanese Patent Laying-Open No. 2005-301424

  However, when performing single sign-on between different sites, it is necessary to provide a single sign-on function on both the cooperation source website and the cooperation destination website.

  Therefore, when trying to realize single sign-on with a site having an original authentication function, work such as renovation of an existing application is required, which hinders realization.

  Accordingly, an object of the present invention is to provide a mechanism for realizing single sign-on between sites that are not linked to each other without performing work such as repairing an existing application.

  The present invention is an information processing apparatus that stores a mapping table in which a user account in a cooperation source website and a user account in a cooperation destination website are associated with each other, and an account relating to a user who has requested access to the cooperation destination website Mapping for converting a user account of the cooperation source website included in the account information into a user account of the cooperation destination website using the account information acquisition means for acquiring information from the cooperation source website and the stored mapping table Means for generating an authentication token from the account information converted by the mapping means, and to use the authentication token generated by the generating means for accessing the cooperation destination website. No Characterized in that it comprises an authentication token transmission unit that transmits to the user who processes the request.

  The present invention is also an information processing method in an information processing apparatus that stores a mapping table in which a user account in a cooperation source website and a user account in a cooperation destination website are associated with each other. An acquisition unit acquires account information about a user who has requested access to the cooperation destination website from the cooperation source website, and a mapping unit of the information processing apparatus uses the stored mapping table. A mapping step of converting a user account of the cooperation source website included in the account information into a user account of a cooperation destination website, and the generation unit of the information processing apparatus authenticating the authentication token by the account information converted by the mapping step The And a user who has requested access to the cooperation destination website so that the authentication token transmission means of the information processing apparatus uses the authentication token generated in the generation step for accessing the cooperation destination website. An authentication token transmission step of transmitting to the authentication token.

  In addition, the present invention is a program that can be executed in an information processing apparatus that stores a mapping table in which a user account in a cooperation source website and a user account in a cooperation destination website are associated with each other. Using account information acquisition means for acquiring account information about a user who has requested access to the cooperation destination website from the cooperation source website, and the stored mapping table, the user of the cooperation source website included in the account information Mapping means for converting the account into a user account of the cooperation destination website, generation means for generating an authentication token from the account information converted by the mapping means, and the authentication token generated by the generation means to the cooperation destination website For use in the access, characterized in that to function as an authentication token transmission unit that transmits to the user who requested access to the cooperation destination Web site.

  According to the present invention, it is possible to provide a mechanism that realizes single sign-on between sites that are not linked to each other, by reducing a workload such as renovation of an existing application.

It is a figure which shows an example of a structure of the information processing system of this invention. It is a figure which shows an example of the hardware constitutions of the client terminal 101 of FIG. 1, and the relay server 102 The flowchart which shows the authentication process which the client terminal 101 in the 1st Embodiment of this invention, the relay server 102, and the cooperation origin Web site 104 perform. The figure which shows an example of a cooperation information management table The figure which shows an example of a mapping table The flowchart which shows the authentication process which the client terminal 101 in the 2nd Embodiment of this invention, the relay server 102, and the cooperation origin Web site 104 perform.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram showing an example of a system configuration of an information processing system according to the present invention.

  As shown in FIG. 1, in the information processing system according to the present embodiment, a client terminal 101, a cooperation source website 104, a cooperation destination website 105, and a relay server 102 are connected via a wide area network 103 so that they can communicate with each other. ing.

  Hereinafter, each apparatus which comprises the information processing system of this invention is demonstrated.

  Hereinafter, an example of the hardware configuration of the client terminal 101 and the relay server 102 illustrated in FIG. 1 will be described with reference to FIG.

  In FIG. 2, reference numeral 201 denotes a CPU that comprehensively controls each device and controller connected to the system bus 204. Further, the ROM 203 or the external memory 211 is necessary to realize a BIOS (Basic Input / Output System) or an operating system program (hereinafter referred to as an OS), which is a control program of the CPU 201, or a function executed by each server or each PC. Various programs are stored.

  A RAM 202 functions as a main memory, work area, and the like for the CPU 201. The CPU 201 implements various operations by loading a program necessary for execution of processing from the ROM 203 or the external memory 211 into the RAM 202 and executing the loaded program.

  An input controller 205 controls input from the input device 209 or the like. A video controller 206 controls display on a display device 210 such as a liquid crystal display. The display device is not limited to a liquid crystal display, and may be a CRT display or the like. These are used by clients as needed.

  A memory controller 207 is connected to the hard disk (HD), flexible disk (FD), or PCMCIA card slot for storing a boot program, various applications, font data, user files, editing files, various data, etc. via an adapter. The access to the external memory 211 such as a compact flash (registered trademark) memory is controlled.

  A communication I / F controller 208 connects and communicates with an external device via a network (for example, the LAN 400 shown in FIG. 1), and executes communication control processing in the network. For example, communication using TCP / IP is possible.

  Note that the CPU 201 enables display on the display device 210 by executing outline font rasterization processing on a display information area in the RAM 202, for example. Further, the CPU 201 enables a user instruction with a mouse cursor (not shown) on the display device 210.

  Various programs that operate on the hardware are recorded in the external memory 211 and are executed by the CPU 201 by being loaded into the RAM 202 as necessary.

  It should be noted that not all devices have these configurations, and it is only necessary to provide necessary devices.

  Next, an authentication process performed by the client terminal 101, the relay server 102, and the cooperation source website 104 according to the first embodiment of the present invention will be described with reference to FIG.

  Note that the process shown in the flowchart of FIG. 3 is a process in which the CPU 201 of the client terminal 101 reads and executes a predetermined control program.

In step S301, the CPU 201 of the client terminal 101 accepts an access request to the website (cooperation destination website) from the user.
For example, an access request to the cooperation destination website is accepted by accepting an operation (clicking a link or pressing a button) for transition from the cooperation source website to the cooperation destination website.
When receiving an access request to the Web site, the CPU 201 of the client terminal 101 transmits the request to the cooperation source Web site.

  In step S302, upon receiving the request transmitted from the client terminal 101 in step S301, the cooperation source website 104 first performs authentication processing for the user who transmitted the request.

  If the authentication process is successful, the encryption process is performed on the information indicating the Web site that is the access request destination (cooperation destination Web site) and the cooperation source account (account for the user who has performed the authentication process) (account information is changed). Encrypt).

  In step S303, the cooperation source website 104 returns the account information encrypted in step S302 and the URL of the relay server 102 to the browser.

  In step S304, the CPU 201 of the client terminal 101 redirects or automatically POSTs to the relay server 102 based on the URL of the relay server transmitted in step S303, and relays the encrypted account information transmitted in step S303. Send to server 102.

  In step S305, upon receiving the account information transmitted in step S304, the CPU 201 of the relay server 102 decrypts the account information.

  Note that the encryption process in step S304 and the decryption process in step S305 are performed using a known technique.

  In step S306, the CPU 201 of the relay server 102 determines whether the access request destination Web site included in the account information received in step S305 is registered in the cooperation information management table.

  If it is determined that it is registered in the cooperation information management table (FIG. 4) (step S306: YES), the process proceeds to step S307.

  If it is determined that it is not registered in the cooperation information management table (FIG. 4) (step S306: NO), the process proceeds to step S314.

  In step S307, the CPU 201 of the relay server 102 determines whether or not the cooperation source account included in the account information received in step S305 is registered in the mapping table (FIG. 5).

  If it is determined that it is registered in the mapping table (step S307: YES), the process proceeds to step S308.

  If it is determined that it is not registered in the mapping table (step S307: NO), the process proceeds to step S314.

  In step S308, the CPU 201 of the relay server 102 performs account authentication processing.

  In the authentication process in step S308, the account information received in step S305 is compared with the account information registered in the directory server (not shown), and if the same account information is registered, it is determined that the authentication is OK. . As account information used for authentication, a combination of a user ID, a password, a certificate, and the like are used.

  Note that the directory server may be the same terminal as the relay server.

  In step S309, the CPU 201 of the relay server 102 determines the result of the authentication process in step S308.

  If the authentication is OK (step S309: YES), the process proceeds to step S310.

  When it is authentication NG (step S309: NO), the process proceeds to step S314.

  In step S310, the CPU 201 of the relay server 102 executes an account mapping process.

  Specifically, the cooperation source account included in the account information received in step S305 is replaced with the cooperation destination account using the account mapping table shown in FIG.

  In step S <b> 311, the CPU 201 of the relay server 102 generates an authentication token to be transmitted to the website (cooperation destination website) that requested access.

  In step S312, the CPU 201 of the relay server 102 returns the authentication token generated in step S311 to the browser.

  In step S313, the CPU 201 of the client terminal 101 accesses the access request destination site (cooperation destination website) by redirection or automatic POST using the authentication token transmitted from the relay server 102 in step S312.

  As described above, the relay server has a single sign-on function, and by using the single sign-on function of the relay server, it is possible to minimize the modification of existing applications even between sites that are not linked to each other. It is possible to provide a mechanism for realizing single sign-on.

  In addition, since the account information exchanged between the client terminal 101 and the relay server 102 is encrypted, unauthorized access due to impersonation or the like can be prevented.

  Next, an authentication process performed by the client terminal 101, the relay server 102, and the cooperation source website 104 according to the second embodiment of the present invention will be described with reference to FIG.

  The flowchart shown in FIG. 6 is obtained by adding steps S601 to S605 to the process of the flowchart of FIG. 3 in the first embodiment. For this reason, only the added steps S601 to S605 will be described here.

  Other processing is the same as the processing shown in the flowchart of FIG. 3, and thus the description thereof is omitted here.

  If it is determined in step S309 that the authentication is OK (step S309: YES), the CPU 201 of the relay server 102 executes the process of step S601.

  In step S <b> 601, the CPU 201 of the relay server 102 returns authenticated information to the client terminal 101. Here, specifically, the authenticated information is an ID (generally called a session ID) for uniquely identifying a client and a service URL.

  The service URL is specified based on the content requested by the user in step S301.

  In step S602, the CPU 201 of the client terminal 101 redirects or automatically POSTs and accesses the service URL (in this embodiment, the single sign-on start URL) transmitted in step S601.

  In step S603, the CPU 201 of the relay server 102 determines whether the authenticated information is valid or invalid.

  That is, although the authentication is successful in step S309, it may be invalid due to a timeout or the like at the time of step S603, and thus the validity is confirmed in step S603.

  If it is determined that the authenticated information is valid (step S603: YES), the process proceeds to step S310.

  Since the processing in steps S310 to S313 is the same as the processing in the flowchart shown in FIG. 3, description thereof is omitted here.

  If the authenticated information is invalid (step S603: NO), the process proceeds to step S604.

  In step S <b> 604, the CPU 201 of the relay server 102 transmits an error page to the client terminal 101.

In step S605, the CPU 201 of the client terminal 101 receives and displays the error page transmitted in step S604.
And the process of this flowchart is complete | finished.

  As described above, services other than single sign-on provided by the relay server 102 are added to the processing in the first embodiment by adding processing for returning authenticated information to the client terminal 101 (step S601). Even a service that requires authentication can be used by single sign-on.

  Specifically, in this embodiment, steps S310 to S312 are processing for realizing the single sign-on function provided by the relay server, but this processing is replaced with another service provided by the relay server. Is possible.

  When the processing in steps S310 to S312 in the present embodiment is replaced with another service provided by the relay server 102, in step S313, the process is transitioned to the cooperation source website or the relay server page.

  In addition, a service that uses the relay server 102 continuously, not a service that is completed by a single request such as the single sign-on service, can be used with single sign-on.

  It should be noted that the configuration and contents of the various data described above are not limited to this, and it goes without saying that the various data and configurations are configured according to the application and purpose.

  In addition, the program in the present invention is a program that allows a computer to execute the processing method of FIG. The program in the present invention may be a program for each processing method of each apparatus in FIG.

  As described above, a recording medium that records a program that implements the functions of the above-described embodiments is supplied to a system or apparatus, and a computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by reading and executing.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium recording the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk or the like can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) operating on the computer based on an instruction of the program is actually It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the processing and the processing is included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  The present invention may be applied to a system constituted by a plurality of devices or an apparatus constituted by a single device. Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network using a communication program, the system or apparatus can enjoy the effects of the present invention. In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

101 Client terminal 102 Relay server 103 Wide area network 104 Cooperation source website 105 Cooperation destination website

Claims (5)

An information processing apparatus that stores a mapping table in which a user account in a cooperation source website and a user account in a cooperation destination website are associated with each other,
Account information acquisition means for acquiring account information about a user who has requested access to the cooperation destination website from the cooperation source website;
Mapping means for converting a user account of a cooperation source website included in the account information into a user account of a cooperation destination website using the stored mapping table;
Generating means for generating an authentication token from the account information converted by the mapping means;
An authentication token transmitting means for transmitting the authentication token generated by the generating means to a user who has requested access to the cooperation destination website in order to use it for accessing the cooperation destination website;
An information processing apparatus comprising: An authentication process executing means for executing the authentication process;
Authentication result transmitting means for transmitting the result of the authentication processing by the authentication processing executing means to the user who requested access;
With
When the authentication process by the authentication process executing means is successful, the mapping means uses the stored mapping table to convert the user account of the cooperation source website included in the account information to the user account of the cooperation destination website. The information processing apparatus according to claim 1, wherein the information processing apparatus is converted into an   3. The information processing apparatus according to claim 2, wherein the information transmitted by the authentication result transmitting unit includes information indicating a service that can be used when the authentication process by the authentication process executing unit is successful. An information processing method in an information processing apparatus for storing a mapping table in which a user account in a cooperation source website and a user account in a cooperation destination website are associated with each other,
An account information acquisition unit in which the account information acquisition unit of the information processing apparatus acquires account information about a user who has requested access to the cooperation destination website from the cooperation source website;
A mapping step in which a mapping unit of the information processing apparatus converts a user account of a cooperation source website included in the account information into a user account of a cooperation destination website using the stored mapping table;
A generating step in which the generating unit of the information processing apparatus generates an authentication token from the account information converted by the mapping step;
Authentication sent from the authentication token transmission means of the information processing apparatus to the user who has requested access to the cooperation destination website in order to use the authentication token generated in the generation step for accessing the cooperation destination website Token sending process;
An information processing method comprising: A program that can be executed in an information processing apparatus that stores a mapping table in which a user account in a cooperation source website and a user account in a cooperation destination website are associated with each other,
The information processing apparatus;
Account information acquisition means for acquiring account information about a user who has requested access to the cooperation destination website from the cooperation source website;
Mapping means for converting a user account of a cooperation source website included in the account information into a user account of a cooperation destination website using the stored mapping table;
Generating means for generating an authentication token from the account information converted by the mapping means;
In order to use the authentication token generated by the generating unit for accessing the cooperation destination website, the authentication token is made to function as an authentication token transmission means for transmitting to a user who has requested access to the cooperation destination website. program.

Images