JP2017059149A - Authentication system and authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication system and authentication method that can resolve defects occurring upon authenticating a web service having access restricted thanks to an SSO using account information without greatly changing an existing system infrastructure environment.SOLUTION: An authentication system comprises: a first authentication device that conducts authentication according to OS account information on a client terminal; a second authentication device that conducts authentication according to Form authentication information input in a login form in a web browser; and an allocation server that discriminates a category of the web browser, and performs control so that when the web browser is a prescribed web browser, the authentication is conducted by the first authentication device and when the web browser is not the prescribed web browser, the authentication is conducted by the second authentication device.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an authentication system and an authentication method for performing authentication of an access-restricted web service by single sign-on.

  In recent years, an integrated authentication technique called Single Sign-On (SSO) has become widespread (for example, Patent Document 1). According to SSO, a plurality of web services (for example, groupware applications) that require individual authentication processing can be used only by user authentication by a single login operation. The web service linked by SSO is referred to as “SSO linked service”.

  In particular, in the case of Internet Explorer (registered trademark, hereinafter referred to as “IE”), which is a standard browser of Windows (registered trademark), when accessing a plurality of web services that require individual authentication processing, By participating in the active directory, integrated windows authentication can be used (for example, Patent Document 2). In integrated Windows authentication, authentication at the first access is performed by account information (user ID and password, hereinafter referred to as “OS account information”) when logging in to an operating system (hereinafter referred to as “OS”).

  FIG. 1 is a diagram illustrating an example of a conventional authentication system 60 that performs single sign-on using integrated windows authentication. As shown in FIG. 1, the authentication system 60 uses a web service provided by a plurality of web servers 20 that require authentication processing and are connected to a corporate network N1 such as a LAN (Local Area Network). Authenticate. For this authentication, the client terminal 53 existing in the corporate network N1 can participate in the active directory 40 to use integrated windows authentication. Further, by joining the external client terminal 51 to the active directory 40 via the VPN server 55 (VPN: Virtual Private Network) from the Internet N2, integrated Windows authentication can be similarly used.

  The authentication system 60 is an integrated Windows authentication environment that realizes integrated Windows authentication, and includes a reverse proxy server 61 and an SSO server 62. The reverse proxy server 61 and the SSO server 62 cooperate to perform authentication processing by integrated windows authentication. Below, the authentication process at the time of the first access to the web server 20 is demonstrated.

  When the client terminal 50 requests access to the URL of the web service provided by the web server 20, the DNS server 54 connects to the reverse proxy server 61.

  When the client terminal 53 logs in to the OS, an authentication ticket called TGT (Ticket Granting Ticket) is issued from the active directory 40. In this state, when the IE of the client terminal 53 requests access to the web service provided by the web server 20, the reverse proxy server 61 determines whether the client terminal 53 is authenticated by the SSO server 62.

  If it is confirmed that the user is not authenticated, the SSO server 62 responds with an authentication error (401 error). When receiving the 401 error, the IE of the client terminal 53 requests the SSO server 62 to collate the authentication ticket information with the OS account information registered in the active directory 40. Upon receiving this request, the SSO server 62 collates the authentication ticket information with the OS account information registered in the active directory 40. When the collation is established, the authentication cookie of the SSO server 62 is sent to the IE of the client terminal 53. Issue.

  Accordingly, since integrated windows authentication is established, the client terminal 53 can use the SSO cooperation service including the web service provided by the web server 20 by using this authentication cookie. In other words, each time the SSO cooperation service is used, access is permitted by having an authentication cookie without performing a login operation.

  On the other hand, the client terminal 52 is iPhone (registered trademark), iPad (registered trademark), or the like, and a web service provided by the web server 20 from a web browser other than IE (for example, Safari (registered trademark) which is a standard browser of iOS). When access is requested to the user, the authentication system 60 does not perform integrated windows authentication. This is because in the integrated windows authentication, the use of IE is assumed, and a web browser other than IE is not supported.

  In this case, Safari ignores the authentication error (401 error) and requests the SSO server 62 for a login screen for inputting a login ID and a login password for authentication. The act of establishing authentication with the SSO server 62 using this login screen is referred to as “Form authentication”. When the user performs form authentication and the verification of the login ID and the login password input by the SSO server 62 is established, an authentication cookie is issued to Safari of the client terminal 52.

Japanese Patent No. 4652350 JP2013-8140A

  As described above, web browsers other than IE do not perform authentication by integrated windows authentication, but perform authentication by form authentication. However, depending on the web browser to be used, an authentication error cannot be interpreted, and even form authentication may not be possible. For example, in the version after iOS 7.0, when attempting to use integrated windows authentication with Safari, a communication error occurs and Safari hangs up. As a solution for such a problem, the following three methods are generally used.

  First, since the version of iOS 7.0 or later has an enterprise single sign-on function, it is conceivable that the configuration profile of iOS can be changed to use authentication by integrated windows authentication. However, it is necessary to manage all client terminals that have an access right inherently, and since the iOS is automatically updated, there is a possibility that a sudden malfunction or the like may occur.

  Second, using the load balancer function that is installed when the SSO environment is introduced, the type of the web browser of the access source is determined at the time of authentication, and the authentication environment of the access destination (for integrated windows authentication) is determined based on the determination result. Or an authentication environment for form authentication). However, the function of discriminating the type of web browser is not an essential function for a load balancer, and there is a load balancer that does not have the function, so it is not a standard solution.

  Third, it is conceivable that a DNS server accessed by the IE and a DNS server accessed by a web browser other than the IE are installed, and the authentication environment of the access destination is distributed by the DNS server. However, since changing the DNS server for each client terminal or web browser is not a general operation, it is often necessary to reconstruct the system infrastructure.

  SUMMARY OF THE INVENTION An object of the present invention is to provide an authentication system and an authentication method capable of eliminating problems that occur when authentication of a web service with access restriction is performed by SSO using OS account information without significantly changing an existing system infrastructure. Is to provide.

An authentication system according to the present invention is an authentication system that performs authentication by SSO when an access request is made from a web browser of a client terminal to an access-restricted web service,
A first authentication device that performs authentication based on OS account information of the client terminal;
A second authentication device that performs authentication based on form authentication information input in a login form in the web browser;
When the type of the web browser is determined and control is performed so that authentication is performed by the first authentication device when the web browser is a predetermined web browser, while the web browser is not the predetermined web browser A distribution server that controls the second authentication apparatus to perform authentication.

An authentication method according to the present invention is an authentication method for performing authentication by SSO when an access request is made from a web browser of a client terminal to an access-restricted web service,
(A) determining the type of the web browser;
(B) when the web browser determined in the step A is a predetermined web browser, authenticating with the OS account information of the client terminal;
(C) when the web browser determined in the step A is not the predetermined web browser, the web browser performs authentication based on the form authentication information input in the login form.

  According to the present invention, since the authentication device associated with the web browser in advance performs authentication processing suitable for the web browser, when authenticating the access-restricted web service by SSO using OS account information. Problems that arise can be resolved without significantly changing the existing system infrastructure.

It is a figure which shows an example of the conventional authentication system which performs single sign-on using integrated windows authentication. It is a figure which shows an example of the authentication system which concerns on one embodiment of this invention. It is a figure which shows an example of the authentication process at the time of the first access using the authentication system of this Embodiment. It is a figure which shows another example of the authentication process at the time of the first access using the authentication system of this Embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 2 is a diagram showing an authentication system 10 according to an embodiment of the present invention. As shown in FIG. 2, the authentication system 10, the web server 20, the distribution server 30, and the active directory 40 are connected to a corporate network N1, such as a LAN.

  The authentication system 10 realizes single sign-on when the client terminal 50 uses a web service with access restriction provided by the web server 20. When authentication at the time of the first access is performed by the authentication system 10 and an authentication cookie is issued, the SSO cooperation service including the web service provided by the web server 20 can be used without performing individual authentication processing.

  The web service provided by the web server 20 includes an external client terminal from the Internet N2 via the VPN server 55 as well as the client terminal 53 that exists in the corporate network N1 and participates in the active directory 40. 51 and 52 are also accessible.

  In the client terminals 51 and 53, when the OS is Windows and the web service is used by the IE which is a standard browser of Windows, SSO using an integrated Windows authentication environment is supported. When the OS is iOS and the web service is used in Safari, which is the standard browser of iOS, the client terminal 52 does not support SSO with an integrated Windows authentication environment by default unless the configuration file of the iOS is changed. .

  The authentication system 10 includes a distribution server 30 that determines the types of the first authentication device 11, the second authentication device 12, and the web browser, and controls the authentication device destination based on the determination result.

  The first authentication device 11 is an authentication environment that realizes integrated Windows authentication, and includes a reverse proxy server 111 and an SSO server 112. When the web service provided by the web server 20 is accessed for the first time, the reverse proxy server 111 and the SSO server 112 cooperate to perform authentication processing using integrated windows authentication.

  The second authentication device 12 is an authentication environment that realizes form authentication, and includes a reverse proxy server 121 and an SSO server 122. When the web service provided by the web server 20 is accessed for the first time, the reverse proxy server 121 and the SSO server 122 cooperate to perform an authentication process using form authentication.

  In the active directory 40, regular user OS account information of the corporate network N1 is registered.

  When the client terminal 51, 52 connected to the Internet N2 makes an access request to the service provided by the web server 20 via the VPN server 55, the distribution server 30 is connected to the web browser of the client terminal 51, 52. Determine the type and determine the access destination. Specifically, the distribution server 30 determines the type of the web browser that is the access source, and controls the first authentication device 11 to perform authentication when the web browser is an IE, while the web browser Control is performed so that authentication is performed by the second authentication device 12 when is not IE.

  For example, “Apache HTTP Server” (hereinafter referred to as “Apache”) is applied to the distribution server 30. Based on the setting of Apache, the type of the web browser of the access source is determined based on the User-Agent HTTP header included in the access request, and is transferred to the first authentication device 11 or the second authentication device 12.

  When there is an access request to the URL of the web service provided by the web server 20 from the client terminals 51 and 52, the DNS server 54 is connected to the distribution server 30.

  Below, the authentication process at the time of the first access to the web service which the web server 20 provides is demonstrated.

  FIG. 3 is a diagram illustrating an example of authentication processing at the time of first access using the authentication system 10 of the present embodiment. FIG. 3 shows a processing flow when an access request is made from the client terminal 51 whose web browser is IE.

  In step S <b> 101, the IE of the client terminal 51 makes an access request to the web service provided by the web server 20. The URL of the web service is, for example, “http://test-web.com”. The DNS server 54 determines the IP address associated with “http://test-web.com”, and transmits the access request to the distribution server 30.

  In step S102, the distribution server 30 determines the type of the web browser that has made the access request. Here, the web browser that made the access request is IE.

  In steps S103 and S104, the distribution server 30 makes a response to the web browser so as to access the first authentication device 11 which is an SSO environment corresponding to the IE. The URL of the first authentication device 11 that is the reply content is, for example, “http://test-web-win.com” based on the setting file managed by the distribution server 30.

  In step S <b> 105, the first authentication device 11 performs authentication by integrated windows authentication. Specifically, the SSO server 112 compares the authentication ticket information of the client terminal 51 with the OS account information registered in the active directory 40. When the verification is established, the SSO server 112 authenticates the IE of the client terminal 51 with an authentication cookie. Issue.

  In step S <b> 106, the first authentication device 11 permits the web server 20 to use the web service by the client terminal 51. At this time, the URL of the access destination is converted to “http://test-web.com” which is the original access destination. This is because if the URL of the access destination is the URL “http://test-web-win.com” of the first authentication device 11, malfunction may occur in the web service. By converting the URL of the access destination, the web service can be operated normally.

  In step S <b> 107, the web server 20 provides the access requested web service to the client terminal 51. The client terminal 51 can use the SSO cooperation service including the web service provided by the web server 20 without performing individual authentication processing by using the authentication cookie issued by the first authentication device 11. .

  FIG. 4 is a flowchart showing an example of authentication processing at the time of first access using the authentication system of the present embodiment. FIG. 4 shows a processing flow when an access request is made from the client terminal 52 whose web browser is Safari.

  In step S <b> 201, the Safari of the client terminal 52 makes an access request to the web service provided by the web server 20. The URL of the web service is, for example, “http://test-web.com”. The DNS server 54 determines the IP address associated with “http://test-web.com”, and transmits the access request to the distribution server 30.

  In step S202, the distribution server 30 determines the type of the web browser that has made the access request. Here, the web browser that made the access request is Safari.

  In steps S <b> 203 and S <b> 204, the distribution server 30 replies to the web browser so as to access the second authentication device 12 that is an SSO environment corresponding to Safari. The URL of the second authentication device 12 as the response content is, for example, “http://test-web-form.com” based on the setting file managed by the distribution server 30.

  In step S205, the second authentication device 12 performs authentication by form authentication. Specifically, the SSO server 122 displays a login form screen for form authentication on Safari of the client terminal 52. As the user inputs and transmits the form authentication information (login ID and login password), the second authentication device 12 collates the input login ID and login password information with the OS account information. If established, an authentication cookie is issued to the IE of the client terminal 52.

  In step S <b> 206, the second authentication device 12 permits the web server 20 to use the web service by the client terminal 52. At this time, the URL of the access destination is converted to “http://test-web.com” which is the original access destination. This is because if the URL of the access destination is the URL “http://test-web-form.com” of the second authentication device 12, malfunction may occur in the web service. By converting the URL of the access destination, the web service can be operated normally.

  In step S <b> 207, the web server 20 provides the access requested web service to the client terminal 52. The client terminal 52 can use the SSO cooperation service including the web service provided by the web server 20 without performing individual authentication processing by using the authentication cookie issued by the second authentication device 12. .

  The authentication system 10 according to the embodiment is an authentication system that performs authentication by SSO when there is an access request from a web browser of the client terminal 50 for a web service with access restriction. The first authentication device 11 that performs authentication based on the account information, the second authentication device 12 that performs authentication based on the form authentication information input in the login form in the web browser, and the type of the web browser are determined. When the IE (predetermined web browser) is used, control is performed so that authentication is performed by the first authentication device 11, while when the web browser is not IE, control is performed so that authentication is performed by the second authentication device 12. And a distribution server 30 that performs distribution.

  The authentication method according to the present embodiment is an authentication method in which authentication is performed by SSO when an access request is made from a web browser of the client terminal 50 to an access-restricted web service. a step of discriminating the type of the web browser, a step of (B) authenticating with OS account information of the client terminal 50 when the web browser discriminated in step A is IE (predetermined web browser), and (C And when the web browser determined in step A is not IE, the web browser performs authentication using the form authentication information entered in the login form.

  According to the authentication system 10 and the authentication method according to the embodiment, the first authentication device 11 or the second authentication device 12 associated in advance with a web browser performs an authentication process suitable for the web browser. Therefore, the trouble that occurs when the web service with restricted access is authenticated by SSO using OS account information (such as hang-up of a web browser that is not supported in the SSO environment) can be obtained simply by providing the distribution server 30. The existing system infrastructure can be resolved without drastically changing. In other words, it is possible to construct an SSO environment that does not depend on a web browser and does not require the user to be aware of whether or not integrated windows authentication is possible using the web browser.

  In addition, the network administrator does not need to change the configuration file of all the client terminals that are inherently authorized to access, and even if the iOS is automatically updated, no malfunction occurs.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the above embodiment, and can be changed without departing from the gist thereof.

  For example, since the present invention is not limited to the type of web browser, it is possible to cope with Safari, FireFox, GoogleChrome, and the like, which are web browsers other than IE, simply by editing the setting file managed by the distribution server 30.

  Further, when it is necessary to distribute the authentication method for each version in the same web browser, it is possible to cope with it by simply editing the setting file managed by the distribution server 30.

  Even when a new web browser is used in the future, it can be dealt with only by editing the setting file managed by the distribution server 30.

  Furthermore, by applying the present invention, it is conceivable that the authentication method is distributed according to the IP address of the client terminal 50 or the language information of the web browser. In this case, too, only the setting file managed by the distribution server 30 is edited. It can respond.

  Alternatively, a plurality of reverse proxy servers 111 and 121 may be prepared, and a load balancer may be provided at each preceding stage. Thereby, the processing request from the client terminal 50 can be distributed, and the load per unit can be reduced.

  The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

DESCRIPTION OF SYMBOLS 10 Authentication system 11 1st authentication apparatus 12 2nd authentication apparatus 111, 121 Reverse proxy server 112, 122 SSO server 20 web server 30 Distribution server 40 Active directory 50, 51-53 Client terminal 54 DNS server 55 VPN server

Claims (4)

An authentication system that performs authentication by SSO when an access request is made from a web browser of a client terminal to an access-restricted web service,
A first authentication device that performs authentication based on OS account information of the client terminal;
A second authentication device that performs authentication based on form authentication information input in a login form in the web browser;
When the type of the web browser is determined and control is performed so that authentication is performed by the first authentication device when the web browser is a predetermined web browser, while the web browser is not the predetermined web browser An authentication system comprising: a distribution server that performs control so that authentication is performed by the second authentication device. The predetermined web browser is a standard browser of Windows (registered trademark),
The authentication system according to claim 1, wherein the first authentication device performs authentication by integrated windows authentication.   The authentication system according to claim 1, wherein the web browser accesses the web service from the Internet via a VPN server. An authentication method for performing authentication by SSO when there is an access request from a web browser of a client terminal to an access-restricted web service,
(A) determining the type of the web browser;
(B) when the web browser determined in the step A is a predetermined web browser, authenticating with the OS account information of the client terminal;
(C) when the web browser determined in the step A is not the predetermined web browser, the web browser performs authentication using form authentication information input in a login form. Method.

Images