JP2017126191A - Giving authority system, information processing device and control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an empowerment system that allows giving authority to be easily set with respect to lots of instruments.SOLUTION: A master IoT instrument 451 is configured to acquire a token from an authentication permission server 110 as a bender client, and acquire a token from the authentication permission server 110 as a tenant exclusive client. The master IoT instrument 451 is configured to, in a relevant instrument registration function: acquire a token acquired as the bender client of a slave IoT instrument 452 within the same network from the slave IoT instrument 452; request the authentication permission server 110 to register the slave IoT instrument as the tenant exclusive client on behalf of the slave IoT instrument 452; transmit a client ID and secret to be provided in accordance with the registration of the slave IoT instrument 452 as the tenant exclusive client; and request so as to acquire the token.SELECTED DRAWING: Figure 4

Description

  The present invention relates to an authority delegation system, an information processing apparatus, and a control method.

  In recent years, a mechanism called Internet of Things (IoT) for connecting various devices to the Internet and using the information has spread. In an office environment, various devices transmit data to a cloud service and use functions provided by the service. To securely connect a device to a cloud service and establish communication with the cloud service, it is necessary to correctly authenticate the device and allow the connection. Patent Document 1 discloses an authority delegation system that performs application registration and resource acquisition in authority delegation processing.

Japanese Patent Laying-Open No. 2015-5202

  In a cloud service, in order to link a large number of devices and service tenants, it is necessary to perform settings for each device, and a lot of work is required. Also, in order to associate each device with a tenant, it is necessary to perform operations such as inputting a cloud service account on each device, and operations on devices that do not have a rich UI are difficult and cannot be realized. There is a case.

  SUMMARY OF THE INVENTION An object of the present invention is to provide an authority delegation system that enables easy setting of authority delegation to a large number of devices.

  An authority delegation system according to an embodiment of the present invention includes an information processing device, a service providing device that provides a service via a network, and an authentication authorization server, and the information processing device serves as a client to the authentication authorization server. It is a delegation authority registration system. A first acquisition unit configured to acquire first authorization information as a first client not belonging to a tenant from the authentication authorization server; and a second client associated with the tenant from the authentication authorization server. As the first client, the second acquisition unit acquires the second authorization information, and the second information processing apparatus from the second information processing apparatus in the same network as the first information processing apparatus. The third acquisition means for acquiring the first authorization information, and the authentication to register the second information processing apparatus as a second client associated with the tenant on behalf of the second information processing apparatus Provided to the proxy means for requesting the authorization server and to the second information processing apparatus when the second information processing apparatus is registered as the second client. It transmits the authentication information comprises a request means for requesting to acquire the second authorization information. The second information processing apparatus acquires second authorization information from the authentication authorization server using the authentication information transmitted from the first information processing apparatus.

  According to the authority delegation system of the present invention, settings for delegating authority to a large number of devices can be easily performed.

It is a figure which shows the structure of an authority transfer system. It is a figure which shows the hardware constitutions of an authentication authorization server, a resource server, and an IoT apparatus. It is a figure which shows the module structure of an authentication authorization server, a resource server, and an IoT apparatus. It is a figure which shows the process which a parent IoT apparatus registers a child IoT apparatus. It is a figure which shows the process in which an authentication authorization server acquires the same access source device. It is an example of the screen which displays the list | wrist of the child IoT apparatus used as registration object. It is a figure which shows the process in which an authentication authorization server creates a tenant dedicated client.

Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings.
(First embodiment)
In the present embodiment, a server on the Internet provides a data reception service for receiving data from a device. The data reception service provides a function of receiving data transmitted from a device, storing it for each tenant, and analyzing it. Hereinafter, a function (service) provided on the Internet like the above-described service is referred to as a resource service.

  In the present embodiment, an application installed in a device for transmitting data cooperates with a resource service. Hereinafter, this application is referred to as a resource service cooperation application. In this embodiment, the OAuth mechanism is used for authority delegation. In OAuth, information called a token (authorization information) is used as information for proving the authority delegated by the user.

  In this embodiment, a user on a virtual server corresponding to each device in the authentication authorization server 110 is referred to as a vendor client (first client). Each device is registered in the authentication authorization server as a vendor client after confirming the certainty of the device, and a token corresponding to the vendor client is issued to the device. By using this token, the device can use the service provided by the resource server as a device that does not belong to a specific tenant.

  In addition, a user on a virtual server for associating each device with a specific tenant is referred to as a tenant dedicated client (second client). Through authority delegation processing by OAuth, each device is linked to a specific tenant, registered as a tenant dedicated client in the authentication authorization server, and a token corresponding to the tenant dedicated client is issued to the device. By using this token, the device can use a service provided by the resource server as a device for a specific tenant linked. In this embodiment, the operation of registering a device as a tenant dedicated client is performed by one device, so that the operation of registering other devices at the same access source can be omitted.

FIG. 1 is a diagram showing a configuration of an authority delegation system according to the present embodiment.
The WAN 100 is a wide area network. That is, in this embodiment, a World Wide Web (WWW) system is constructed. The LAN 101 and the LAN 102 are local area networks that connect each component. The authentication authorization server 110 performs processing for realizing user authentication, IoT device authentication, and OAuth.

  The resource server 120 functions as a service providing server that provides a service via a network (WAN 100, LAN 101, LAN 102). In the present embodiment, the resource server 120 provides a data reception service, but the present invention is not limited to this. In the authority delegation system according to the present embodiment, each server is installed one by one, but may be configured by a plurality of servers, for example, a server system that performs authentication authorization may be provided.

  The IoT device 140 is a device (device) such as an image forming apparatus, a projector, or a network camera. The IoT device 140 uses a service provided by the resource server 120 via a network. In the present embodiment, the IoT device 140 transmits data to the resource server 120. One or a plurality of resource service cooperation applications are installed in the IoT device 140, and data is transmitted to the resource service using the applications.

  The authentication authorization server 110, the resource server 120, and the IoT device 140 are communicably connected via networks (WAN 100, LAN 101, LAN 102), respectively. Note that the authentication authorization server 110, the resource server 120, and the IoT device 140 may be configured on individual LANs or may be configured on the same LAN. Further, the authentication authorization server 110 and the resource server 120 may be configured on the same server. Further, the authentication / authorization server 110 and the resource server can be configured to be connected via the WAN 100.

FIG. 2 is a diagram illustrating a hardware configuration of the authentication authorization server 110, the resource server 120, and the IoT device 140.
A hardware configuration of a general information processing apparatus can be applied to each server and device of this embodiment. Further, a virtual hardware configuration of an information processing apparatus provided as IaaS (Infrastructure as a Service) can be applied to each server.

  In FIG. 2, a CPU (Central Processing Unit) 231 executes a program such as an OS or an application stored in a program ROM included in the ROM 233 and controls each block connected to the system bus 234. The CPU 231 executes a program loaded from the external memory 241 such as a hard disk (HD) to the RAM 232 and controls each block. The OS is an abbreviation for an operating system that runs on a computer. Hereinafter, the operating system is referred to as an OS. Each process to be described later can be realized by executing a program by the CPU 231.

  Note that ROM is an abbreviation for Read Only Memory, and RAM is an abbreviation for Random Access Memory. The RAM 232 functions as a main memory, work area, and the like for the CPU 231. The operation unit I / F 235 controls input from the operation unit 239. A CRT controller (CRTC) 236 controls display on the CRT display 240. The authentication / authorization server 110 and the resource server 120 generally do not include the CRTC 236 or the CRT display 240, and the IoT device 140 may not include the CRTC 236 or the CRT display 240.

  A disk controller (DKC) 237 controls data access in an external memory 241 such as a hard disk (HD) that stores various data. A network controller (NC) 238 executes communication control processing with other devices connected via the WAN 100, the LAN 101, and the LAN 102. In all the descriptions below, unless otherwise specified, the hardware main body of execution in the server or device is the CPU 231, and the software main body is an application program installed in the external memory 241.

FIG. 3 is a diagram illustrating a software configuration of the authentication authorization server 110, the resource server 120, and the IoT device 140.
The authentication authorization server 110 includes an authentication authorization module 310. The resource server 120 includes a resource server module 320. The IoT device 140 includes an authentication / authorization server cooperation client 341, a resource service cooperation application 342, and a Web browser 343. The web browser 343 is a user agent for using the WWW, but is not essential. Details of each module will be described later.

  Next, data managed by the authentication authorization server 110 will be described. The authentication authorization server 110 stores data in the external memory 241. Note that the data may be stored not in the external memory 241 of the authentication / authorization server 110 but in another server configured to be communicable via the LAN 101.

Table 1 is an example of a tenant management table for managing tenant information. A tenant is a management unit assigned to each customer who has a service usage contract. In the authentication authorization server, data management is performed in units of tenants. The tenant management table holds “tenant ID” and “tenant name”. “Tenant ID” is an ID for uniquely identifying a tenant. In the “tenant name”, for example, the name of a customer who has a service use contract is set.

  Table 2 is an example of a client management table for managing information on clients (vendor clients and tenant dedicated clients). The client management table includes “client ID”, “secret”, “device serial ID”, “tenant ID”, “parent client ID”, “IP”, and “local IP”. “Client ID” is an ID (identification information) for uniquely identifying a client. The authentication authorization server 110 can uniquely identify the connection-source IoT device 140 as a client based on the client ID.

“Secret” corresponds to a password for authenticating the client ID by the authentication authorization server 110. The “device serial ID” is identification information that uniquely identifies the IoT device 140. “Tenant ID” indicates the tenant to which the client belongs. “Parent client ID” is the client ID of the client that is the parent of the client, and will be described in detail later. “IP” is an access source IP address when the IoT device 140 accesses the authentication authorization server 110, and “local IP” is an IP address set in the IoT device 140 itself.

Table 3 is an example of a token management table for managing tokens used for authentication by OAuth. The token management table holds “token ID”, “client ID”, “scope”, “expiration date”, “refresh token ID”, and “refresh time limit”. The scope will be described with reference to Table 4.

Table 4 is an example of a scope management table for managing a scope for authentication by OAuth. The scope management table holds “scope” and “role”. The scope indicates an authority range defined in the resource service cooperation application provided in the IoT device 140.

Next, data managed by the IoT device 140 will be described. The IoT device 140 stores data in the external memory 241.
Table 5 is an example of a device user management table for the IoT device 140 to manage users. The device user management table holds “user ID”, “password”, and “authority information”. When the user accesses the IoT device 140, the IoT device 140 performs authentication using, for example, a “user ID” and a “password” input by the user. Further, the IoT device 140 performs access control based on the “authority information”.

Note that some IoT devices 140 may not manage users. Depending on the IoT device 140, access control based on authority may not be performed. In this case, “user ID” and “authority information” in the device user management table may not exist. In this embodiment, authentication using a user ID and a password is assumed. However, different authentication methods such as authentication using an IC card, biometric authentication using a fingerprint or the like, and authentication using a PIN code may be used. In this case, information necessary for these authentication methods is managed instead of the “password”. In the present invention, the authentication method in the IoT device 140 does not matter.

  Table 6 is an example of a device vendor client management table for managing vendor client information. The device vendor client management table holds “client ID”, “secret”, “token ID”, and “refresh token ID”. The “client ID” and “secret” are issued in advance by the authentication authorization server 110.

“Token ID” and “Refresh Token ID” indicate tokens issued by the authentication authorization server 110 for each client. As a method for registering such information, for example, a method in which the IoT device 140 registers online via the LANs 101 and 102 and the WAN 100 can be considered. Alternatively, a method may be used in which values are set in the authentication authorization server 110 and the IoT device 140 via the user.

Table 7 is an example of a device tenant dedicated client management table for managing information of the tenant dedicated client. In this table, only the client type is different, and the same data as the device vendor client management table is managed.

Next, processing for the IoT device 140 to connect to the resource service will be described.
First, the authentication authorization server cooperation client 341 included in the IoT device 140 acquires authentication information regarding the vendor client issued by the authentication authorization server 110. The vendor client issues it after the authentication authorization server 110 confirms the certainty of the IoT device 140. For example, the authentication / authorization server cooperation client 341 holds a client certificate in advance, and the authentication / authorization server 110 determines whether or not to issue a vendor client by authentication using the client certificate.

  Through the processing described above, a client ID (here, “ID0001”) is created in the client management table (Table 2) managed by the authentication authorization server 110. Since the vendor client does not belong to a specific tenant, “Vender” is set in the tenant ID of the client management table corresponding to the client ID “ID0001”. The device serial ID is set to the device serial ID “S0001” of the IoT device 140 that has requested the vendor client to issue.

  Furthermore, the IP of the client management table is set with the access source IP address “150.63.177” when the IoT device 140 accesses the authentication authorization server 110. In addition, the IP address “192.168.0.1” set in the IoT device 140 itself is set in the local IP. The IoT device 140 uses the issued vendor client to acquire the token “AT0001” as the authorization information from the authentication authorization server 110, and the resource server 120 can be used as a device that does not belong to a specific tenant.

  Next, the resource service cooperation application 342 included in the IoT device 140 acquires authentication information regarding the tenant dedicated client issued by the authentication authorization server 110. The tenant dedicated client is issued when the authentication authorization server 110 determines the tenant to which the user of the IoT device 140 belongs. For example, the authentication authorization server 110 determines whether or not a user of the IoT device 140 issues a tenant dedicated client by logging in to the authentication authorization server 110 and performing OAuth's Authorization Code Grant processing.

  Through the processing described above, a client ID (here, “ID0010”) having the tenant ID “1001AA” to which the user of the IoT device 140 belongs is created in the client management table (Table 2) managed by the authentication authorization server 110. The resource service cooperation application 342 included in the IoT device 140 acquires the token “AT0010” that is the authorization information from the authentication authorization server 110 using the issued tenant dedicated client. As a result, the resource server 120 can be used as a device for the tenant “1001AA”.

  Next, processing for connecting the second and subsequent IoT devices 140 to the resource service will be described. In the following description, the first IoT device 140 holding the tenant dedicated client is referred to as a parent IoT device, and the second and subsequent IoT devices 140 are referred to as child IoT devices. The child IoT device newly connected to the network holds the vendor client in the same manner as described above.

  Here, it is assumed that “ID0003” is created as the client ID in the client management table and “S0003” is set as the device serial ID. In addition, since IP is the same LAN 101 as the first IoT device 140 (parent IoT device), “150.61.37.7” is set, and “192.168.0.3” is set as the local IP. It shall be set.

FIG. 4 is a diagram illustrating processing in which the parent IoT device 451 requests registration of a tenant dedicated client on behalf of the child IoT device 452.
With this processing, it is not necessary to acquire a tenant dedicated client in each of the child IoT devices 452, and registration is completed only by an operation in the parent IoT device 451 that has already been set as a tenant dedicated client.

  In step S <b> 401, the user who operates the parent IoT device 451 logs into the parent IoT device 451. In this embodiment, a method of inputting a user ID and a password managed in the device user management table is assumed, but a login method is not particularly limited. Also, it is not necessary to log in. In step S402, the user accesses the related device registration function of the resource service cooperation application 342 of the parent IoT device 451.

  In step S403, the related device registration function of the resource service cooperation application 342 requests the authentication authorization server 110 for a list of devices in the same network as the access source device. This request includes the token “AT0010”. Note that the process of step S403 is a process for facilitating the registration of the child IoT device and is not essential.

FIG. 5 is a diagram illustrating processing in which the authentication authorization server 110 that has received the device list request in step S403 acquires a list of the same access source devices.
In step S501, the authentication authorization server 110 verifies the token “AT0010” using the token management table (Table 3). Specifically, the authentication / authorization server 110 determines that the access is OK if the token is valid and the scope is “transport”.

  In step S502, the authentication authorization server 110 acquires the access source of the parent IoT device 451 that has called the related device registration function. In the present embodiment, the IP “150.61.1.77” is acquired as the access source. In step S503, the authentication authorization server 110 searches for the same access source device. Specifically, the client ID “ID0010” corresponding to the token “AT0010” is specified from the token management table (Table 3). Next, the device serial ID “S0001” corresponding to the client ID “ID0010” is specified from the client management table (Table 2).

  Next, from the client ID “ID0001” corresponding to the vendor client of the device serial ID “S0001”, the IP “150.61.31.77” is specified as the access source at the time of registration of the IoT device. Next, a device having the same value as the IP “150.61.1.77” is identified as the same access source device from the client management table.

  In this example, a device having a client ID “ID0002” and a device serial ID “S0002” and a device having a client ID “ID0003” and a device serial ID “S0003” are identified. Then, the local IPs “192.168.0.2” and “192.168.0.3” of the device with the device serial ID “S0002” and “S0003” are acquired.

  Furthermore, it is checked whether there is a record of the same tenant as the parent IoT device for the specified device. That is, for each of the device serial IDs “S0002” and “S0003”, it is checked whether or not there is the same client as “1001AA” that is the tenant ID indicated by the client ID “ID0010”. In this example, there are two IoT device 140 candidates whose access source is the same as the IP “150.61.1.77” as described above, but even when there are two or more candidates, all of them are listed. The

  Returning to the description of FIG. In step S404, the resource service cooperation application 342 that has received the response in step S403 searches for the child IoT device 452 in the LAN 101. In step S405, the resource service cooperation application 342 displays a list of search results to the user.

FIG. 6 is a diagram illustrating an example of the screen displayed in step S405.
On the related device registration screen 601, information 602, 603, and 604 of the child IoT device 452 are presented as related device candidates. For example, the information 602 indicates a child IoT device 452 whose device name is “LBP 10000”, whose IP address is “192.168.0.2”, and whose state is “connected”.

  The device name and the IP address are generated based on the search result in step S404. The state is generated from the information acquired by the process in step S403. Since the child IoT device 452 with the IP address “192.168.0.2” has already been registered as a tenant dedicated client, the status is displayed as “connected” and the registration button is not displayed. The child IoT device 452 having the IP address “192.168.0.3” indicated by the information 603 has been registered as a vendor client, but the tenant dedicated client has not been registered. Displayed and a registration button is displayed.

  The child IoT device 452 having the IP address “192.168.0.99” indicated by the information 604 is connected in the LAN 101 but is not found in the process of step S403, so “unknown” is displayed in the status. ing. The state where “unknown” is displayed occurs when the device is not registered, when the connection source IP address when registering as a vendor client is different, or when the local IP address is changed.

  On the related device registration screen 601, the user selects a child IoT device to be registered as a tenant dedicated client. Specifically, when the registration button of the child IoT device 452 to be registered is pressed, the process proceeds to step S406. In step S406, a device designation request is transmitted from the related device registration screen 601 to the resource service cooperation application 342, and the tenant dedicated client registration process in step S407 and subsequent steps is started.

  In step S407, the parent IoT device 451 issues a registration proxy notification to the child IoT device 452. In this notification, device authentication of the child IoT device 452 is generally performed, and authentication using a user ID, a password, and the like is performed. The child IoT device 452 that has received the registration proxy notification in step S407 responds with a token (here, “AT0003”) managed in the device vendor client management table (Table 6).

  In step S <b> 408, the resource service cooperation application 342 included in the parent IoT device 451 requests to register as a tenant dedicated client in the authentication authorization server 110 as a proxy of the child IoT device 452. The request includes the token “AT0010” managed in the device tenant dedicated client management table (Table 7) of the parent IoT device 451 and the token “AT0003” of the child IoT device 452 acquired in step S407.

FIG. 7 is a diagram illustrating tenant dedicated client creation processing performed by the authentication authorization server 110 that has received the request in step S408.
In step S701, the authentication authorization server 110 verifies the token “AT0010” of the parent IoT device 451 included in the request using the token management table (Table 3). Specifically, if the token is valid and the scope is “transport”, the authentication / authorization server 110 determines that the access is OK.

  In step S702, the authentication / authorization server 110 uses the token management table (Table 3) to verify the token “AT0003” of the child IoT device 452 included in the request. If the token is valid and the scope of the token issued at the time of vendor client registration is “device”, it is determined that access is OK. If access is OK in the verification of each token, the process proceeds to step S703.

  In step S703, the authentication authorization server 110 registers the child IoT device 452 as a tenant dedicated client. At this time, the tenant dedicated client for the child IoT device 452 is set with the same setting as the tenant dedicated client “ID0010” corresponding to the token “AT0010”. In this example, the following settings are made in the client management table (Table 2) with the creation of the tenant dedicated client.

  New values are set in the client ID and secret. The device serial ID is set to “S0003” corresponding to the token “AT0003” of the child IoT device 452, and the tenant ID “1001AA” corresponding to the token “AT0010” of the parent IoT device 451 is set to the tenant ID. Is set. Furthermore, “ID0010” is set as the parent client ID. When the tenant dedicated client creation process is completed, the authentication authorization server 110 responds to the parent IoT device 451 with the client ID and secret of the created tenant dedicated client.

  Returning to the description of FIG. In step S409, the resource service cooperation application 342 of the parent IoT device 451 that has received the response of step S408 requests the child IoT device 452 to register a tenant dedicated client. The child IoT device 452 that has received the request stores the received tenant dedicated client ID and secret (authentication information) in the device tenant dedicated client management table (Table 7).

  With the above processing, the processing for registering the child IoT device 452 as a tenant dedicated client is completed. In step S410, the child IoT device 452 registered as the tenant dedicated client acquires a token from the authentication authorization server 110 using the tenant dedicated client (that is, using the authentication information received from the parent IoT device 451). To do. As a result, the resource server 120 can be used as a device for the tenant “1001AA”.

(Other embodiments)
The present invention supplies a program that realizes one or more functions of the above-described embodiments to a system or apparatus via a network or a storage medium, and one or more processors in a computer of the system or apparatus read and execute the program This process can be realized. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

  As mentioned above, although preferable embodiment of this invention was described, this invention is not limited to these embodiment, A various deformation | transformation and change are possible within the range of the summary.

110 Authentication Authorization Server 120 Resource Server 140 IoT Device 341 Authentication Authorization Server Cooperation Client 342 Resource Service Cooperation Application

Claims (8)

An authority delegation system that includes an information processing device, a service providing device that provides a service via a network, and an authentication authorization server, and registers the information processing device as a client in the authentication authorization server,
The first information processing apparatus
First acquisition means for acquiring first authorization information as a first client not belonging to a tenant from the authentication authorization server;
Second acquisition means for acquiring second authorization information as a second client associated with the tenant from the authentication authorization server;
Third acquisition means for acquiring first authorization information acquired by the second information processing apparatus as a first client from a second information processing apparatus in the same network as the first information processing apparatus;
Proxy means for requesting the authentication authorization server to register the second information processing apparatus as a second client associated with the tenant on behalf of the second information processing apparatus;
Authentication information provided in response to the second information processing apparatus being registered as the second client is transmitted to the second information processing apparatus, and second authorization information is acquired. And a requesting means for requesting
The second information processing apparatus
A second authorization information is obtained from the authentication authorization server using the authentication information transmitted from the first information processing apparatus. The proxy means transmits second authorization information corresponding to the first information processing apparatus and first authorization information corresponding to the second information processing apparatus, and the second information processing apparatus. Requesting the authentication authorization server to register as the second client,
The authentication authorization server registers the second information processing apparatus as a second client associated with the tenant by specifying the tenant from the second authorization information corresponding to the first information processing apparatus. The authority delegation system according to claim 1, further comprising registration means. The registration unit of the authentication authorization server, when requested to register the information processing apparatus as a first client, at least identification information for uniquely identifying the information processing apparatus, and information on the network of the information processing apparatus The authority delegation system according to claim 1 or 2, wherein the authority delegation system is managed. The authority delegation system according to claim 2 or 3, wherein the registration unit of the authentication authorization server manages the first client and the second client corresponding to the information processing apparatus in association with each other. . The first information processing apparatus includes:
List request means for requesting the authentication authorization server to request a list of information processing apparatuses in the same network as the first information processing apparatus;
The authority delegation system according to any one of claims 1 to 4, further comprising selection means for selecting a second information processing apparatus to be registered as a second client from the requested list. A control method for an authority delegation system that includes an information processing device, a service providing device that provides a service via a network, and an authentication authorization server, and registers the information processing device as a client in the authentication authorization server,
A first information processing apparatus acquiring first authorization information as a first client not belonging to a tenant from the authentication authorization server;
The first information processing apparatus acquires second authorization information as a second client associated with a tenant from the authentication authorization server;
The first information processing apparatus obtains the first authorization information acquired as the first client by the second information processing apparatus from the second information processing apparatus in the same network as the first information processing apparatus. A process of acquiring;
The first information processing apparatus requesting the authentication authorization server to register the second information processing apparatus as a second client associated with the tenant on behalf of the second information processing apparatus; ,
Providing the authentication information to the first information processing apparatus in response to the authentication authorization server registering the second information processing apparatus as the second client;
A step of requesting the second information processing apparatus to acquire the second authorization information while transmitting the provided authentication information to the second information processing apparatus;
The second information processing apparatus has a step of acquiring second authorization information from the authentication authorization server using the authentication information transmitted from the first information processing apparatus. Delegation system. An information processing apparatus that uses a service provided by a service providing apparatus via a network,
A first acquisition unit that acquires first authorization information as a first client that does not belong to the tenant from the authentication authorization server;
Second acquisition means for acquiring second authorization information as a second client associated with the tenant from the authentication authorization server;
Third acquisition means for acquiring first authorization information acquired by the second information processing apparatus as a first client from a second information processing apparatus in the same network as the information processing apparatus;
Proxy means for requesting the authentication authorization server to register the second information processing apparatus as a second client associated with the tenant on behalf of the second information processing apparatus;
Authentication information provided in response to the second information processing apparatus being registered as the second client is transmitted to the second information processing apparatus, and second authorization information is acquired. An information processing apparatus comprising: requesting means for requesting as described above. An authentication authorization server that performs authentication and authorization for the information processing apparatus to use the service provided by the service providing apparatus via the network,
First issuing means for issuing first authorization information in response to a request from the first information processing apparatus as a first client not belonging to a tenant;
Second issuing means for issuing second authorization information in response to a request from the first information processing apparatus as a second client associated with a tenant;
In response to a request from the first information processing apparatus to register the second information processing apparatus as a second client associated with the tenant on behalf of the second information processing apparatus, the second information processing apparatus Providing means for providing authentication information of the information processing apparatus to the first information processing apparatus,
The second issuing means issues second authorization information to the second information processing apparatus in response to a request from the second information processing apparatus as a second client using the authentication information. An authentication authorization server characterized by that.

Images