JP6190106B2 - Authentication system, authentication apparatus, authentication method, and program - Google Patents

Description

  The present invention relates to an authentication technique using a plurality of authentication methods.

  There is a mechanism for authenticating a user or device using a plurality of authentication information. For example, there are a technique for ensuring higher security by using a plurality of authentication information, and a technique for improving convenience by performing only a first authentication after a plurality of authentication processes.

  In Patent Document 1, the first authentication information unique to each portable terminal and the second authentication information generated for each portable terminal are used, and when the authentication using the first authentication information succeeds, A system that permits communication with a terminal and performs authentication processing using second authentication information is described. Patent Document 2 describes an authentication device that includes a first authentication unit for using an application installed in a terminal device and a second authentication unit for using an external service. The authentication device described in Patent Literature 2 simplifies a user login operation using an authenticator obtained when both the first authentication and the second authentication are successful.

  Non-Patent Document 1 discloses a method of maintaining compatibility with an authentication method used in the specification of ONVIF published in the past by using two authentications of HTTP digest authentication and WS-Security.

JP 2009-123059 A JP 2009-223739 A

ONVIF Core Spec. Ver. 2.2 pp. 30-31

  Further, in the technique of Non-Patent Document 1, it is required that the Web server checks the presence / absence of both HTTP digest authentication information and WSS (WS-Security) authentication information. In the technique of Non-Patent Document 1, if WSS authentication information is included, even if HTTP digest authentication authentication information is not included, HTTP digest authentication is not performed and authentication is performed using only WSS authentication information. Process. However, in the authentication method described in Non-Patent Document 1, it is difficult to apply the technique described in Patent Document 1 or Patent Document 2 in order to enhance the convenience of authentication.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a technique for processing a Web service while improving the convenience of authentication.

To achieve the above object, a first authentication device in the authentication system to perform user authentication processing according to the present invention, if it contains the first authentication information to the request from the client device, the first authentication information A first authenticating unit that executes a user authentication process using the determination unit; a determining unit that determines whether the request includes second authentication information different from the first authentication information; If the authentication information is determined to be included , the second authentication information is included in the second authentication device having the second authentication means for executing the user authentication process using the second authentication information. Transmitting means for transmitting information .

  According to the present invention, it is possible to improve the convenience of authentication when performing authentication using a plurality of authentication methods.

1 is a configuration diagram of a Web service system according to a first embodiment. 5 is a flowchart showing authentication processing of the Web server according to the first embodiment. 5 is a flowchart showing processing of a Web service processing unit according to the first embodiment. FIG. 3 is a configuration diagram of a Web service system according to a second embodiment. 9 is a flowchart showing authentication processing of the Web server according to the second embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

<< Embodiment 1 >>
(System configuration)
FIG. 1 shows the configuration of the Web service system according to the present embodiment. The Web service system includes, for example, a Web server 11 that is a first device and a Web service processing device 12 that is a second device. Then, a user authentication system is constructed by the first authentication processing unit 1 of the Web server 11 and the second authentication processing unit 2 of the Web service processing device 12. The web server 11 accepts a web service request by the HTML message 14 from the user client 13. The Web server 11 and the Web service processing device 12 are described as different devices such as the first device and the second device. However, the entire Web service system includes a PC or the like. It may be included in one device.

  The first authentication processing unit 1 executes HTML digest authentication (first authentication processing) which is a mechanism of HTML user authentication. The first authentication processing unit 1 executes determination of presence / absence of authentication information for HTML digest authentication, which is first authentication information, and authentication processing. Then, the Web server 11 transmits the SOAP message 15 to the Web service processing device 12 by a transmission unit (not shown). Note that the SOAP message 15 includes at least a part of information (for example, a body part) constituting the HTML message 14.

  The Web service processing device 12 is a module that performs Web service processing, and includes a second authentication processing unit 2 that performs WS-Security authentication (WSS authentication) (second authentication processing), which is a Web service user authentication mechanism. The second authentication processing unit 2 includes an engine that analyzes the SOAP message 15 described in XML, and executes determination of presence / absence of authentication information of WSS authentication that is second authentication information and authentication processing. The Web service processing device 12 processes a Web service request from the user client 13 and transmits the processing result to the user client 13 through the Web server 11.

  The Web server 11 analyzes the SOAP message 15 (the body of the HTML message 14), and determines the presence / absence of authentication information for WSS authentication, which is the second authentication information. If there is authentication information for WSS authentication, the transmission unit transmits the SOAP message 15 to the Web service processing apparatus 12.

  FIG. 2 is a flowchart showing details of processing of the first authentication processing unit 1 in the Web server 11. When receiving the HTML message 14 from the user client 13, the Web server 11 analyzes the HTML message and determines whether or not an HTTP digest authentication authentication header is included (S21). If the HTTP digest authentication header is included (Yes in S21), the Web server 11 executes the HTTP digest authentication process (S22), and determines the result of the HTTP digest authentication (S23). If the HTTP digest authentication has failed (No in S23), the Web server 11 returns an HTTP 400 error (Bad Request) to the user client 13 to notify that the HTTP digest authentication has failed (S24). When the HTTP digest authentication is successful (Yes in S23), the Web server 11 transmits a SOAP message 15 to the Web service processing apparatus (S25).

  On the other hand, when it is determined in S21 that the authentication header for HTTP digest authentication is not included (No in S21), the Web server 11 determines whether the HTML message 14 includes WSS authentication information (S26). If it is determined that the WSS authentication information is included in the HTML message 14 (Yes in S26), the Web server 11 transmits the SOAP message 15 to the Web service processing unit (S25).

  When it is determined that the WSS authentication information is not included in the HTML message 14 (No in S26), the Web server 11 determines whether the Web service requested by the HTML message 14 is a specific service (S27). . Here, the specific service is a service that does not require user authentication, such as providing time information and function information of the Web service system. If it is determined that the Web service requested by the HTML message 14 is a specific service (Yes in S27), the Web server 11 transmits a SOAP message 15 to the Web service processing apparatus 12 (S25). On the other hand, if the service requested by the HTML message 14 is not a specific service (No in S27), the HTML message 14 requests a service that requires user authentication. However, in this case, authentication is not possible because there is no header for HTTP digest authentication and WSS authentication information. Therefore, the Web server 11 notifies the user client 13 of an HTTP 401 error (Unauthorized) (S28) and prompts the user to give authentication information.

  If there is no authentication information (first authentication information) for HTTP digest authentication, a normal Web server notifies the user client 13 of an HTTP 401 error and prompts the user to add HTTP digest authentication information. However, in this embodiment, even if the HTTP digest authentication header is not included (No in S21), if the WSS authentication information is included (Yes in S26), the SOAP message 15 is sent to the Web service processing apparatus 12. Transmit (S25). In this case, the user authentication is performed only by WSS authentication in the Web service processing apparatus described later.

  Next, authentication processing in the Web service processing apparatus 12 will be described. FIG. 3 is a flowchart showing details of processing of the second authentication processing unit 2 in the Web service processing apparatus 12.

  The Web service processing apparatus 12 analyzes the SOAP message 15 acquired from the Web server 11 and determines whether or not the requested service is a specific service (S31). If the requested service is a service that does not require user authentication (Yes in S31), WSS authentication is unnecessary, use of the Web service is permitted, and processing is executed (S35). On the other hand, if the requested service is a service that requires user authentication (No in S31), the Web service processing apparatus 12 determines whether WSS authentication information is included in the SOAP message 15 (S32). .

  When the WSS authentication information is not included in the SOAP message 15 (No in S32), the Web service processing apparatus 12 has succeeded in user authentication by HTTP digest authentication on the Web server 11. For this reason, the use of the Web service is permitted and the process is executed (S35). If the WSS authentication information is included in the SOAP message 15 (Yes in S32), the first authentication processing unit 1 knows that the user authentication has not ended because there is no HTTP digest authentication header. Therefore, in this case, the Web service processing apparatus 12 performs WSS authentication processing (S33), and determines whether the WSS authentication is successful (S34). If the WSS authentication is successful (Yes in S34), the Web service processing apparatus 12 is permitted to use the Web service and the process is executed (S35). If the WSS authentication fails (No in S34), the Web service processing apparatus 12 returns an HTTP 400 error indicating that the authentication has failed to the user client 13 (S36).

  In the above description, an HTTP 400 error is notified in S36, but the Web service processing apparatus 12 may notify an error (ter: Unauthorized) by a SOAP message in addition to the HTTP 400 error. This error notification also indicates that WSS authentication has failed, but it is up to the user client 13 to interpret even the SOAP message error.

  According to this embodiment, the Web server 11 analyzes the presence / absence of WSS authentication information to send a SOAP message to the Web service processing device 12 based on the result of the HTTP digest authentication, or to the user client 13 as appropriate. Returns an error. As described above, by analyzing the WSS authentication information in the Web server 11, it is possible to provide a technique for avoiding HTTP digest authentication and processing a Web service when there is no HTTP digest authentication information. As a result, the convenience of authentication can be improved.

<< Embodiment 2 >>
Subsequently, the second embodiment will be described with reference to FIGS. 4 and 5. FIG. 4 shows the configuration of the system in this embodiment. The difference from the first embodiment is that the second authentication process performed by the Web service processing apparatus 12 is executed by the Web server 11 and the user authentication process is not performed by the Web service processing apparatus 12. Another difference is that a user client having a specific user authority is considered.

  FIG. 5 is a flowchart showing processing of HTTP digest authentication and WSS authentication in the Web server 11. When receiving the processing device 1214 from the user client 13, the Web server 11 analyzes the HTML message and determines whether or not an HTTP digest authentication authentication header is included (S501). When the HTTP authentication method of the Web server 11 is basic authentication or when authentication is not performed, it is determined that the HTTP digest authentication header is not included.

  If the authentication header for HTTP digest authentication is included (Yes in S501), the Web server 11 performs HTTP digest authentication processing (S502), and determines the result of HTTP digest authentication (S503). If the HTTP digest authentication fails (No in S503), the Web server 11 returns an HTTP 400 error (Bad Request) and notifies the user client 13 that the HTTP digest authentication has failed (S504). On the other hand, when the HTTP digest authentication is successful (Yes in S503), the Web server 11 determines whether the WSS authentication information is included in the HTML message (S505).

  When the WSS authentication information is not included in the HTML message (No in S505), the user authentication can be performed by the HTTP digest authentication. Therefore, the Web server 11 sends the SOAP message 15 to the Web service processing apparatus without performing the WSS authentication. Transmit (S509). When the WSS authentication information is included in the HTML message (Yes in S505), the Web server 11 performs the WSS authentication process (S507), and determines whether the WSS authentication is successful (S508). If the WSS authentication is successful (Yes in S508), the Web server 11 transmits the SOAP message 15 to the Web service processing apparatus 12 (S509). On the other hand, if the WSS authentication fails (Yes in S508), the Web server 11 succeeds in the HTTP digest authentication but fails in the WSS authentication, and thus returns an HTTP 400 error to the user client 13. (S510).

  If it is determined in S501 that the HTTP digest authentication header is not included in the HTML message (No in S501), the Web server 11 subsequently determines whether WSS authentication information is included in the HTML message (S506). When the WSS authentication information is included in the HTML message (Yes in S506), the Web server 11 performs the WSS authentication process (S507). The subsequent processes are the same as those performed when it is determined in S505 that WSS authentication information is included in the HTML message (Yes in S505).

  If it is determined in S506 that WSS authentication information is not included in the HTML message (No in S506), the HTML message is a request for a Web service that does not include authentication information. However, for a request to a specific service that does not require user authentication, it is possible to accept Web service processing. For this reason, the Web server 11 determines whether the request for the Web service based on the HTML message is a request for a specific service (S511). If the request is for a specific service (Yes in S511), the Web server 11 transmits a SOAP message 15 to the Web service processing apparatus 12. If the service requires user authentication (No in S511), an HTTP 401 error is returned to the user client 13 to prompt the user to add authentication information.

  Next, a function for determining that user authentication is not possible regardless of the result of the WSS authentication process when the user is not authorized to receive a service or when the user is a specific user will be described. In the case of a service that changes important settings of a Web service system such as a network setting, there is a request for providing a service only to a specific user or an authorized user. Therefore, before the processing of S509, it may be determined whether the user client 13 has the authority to execute the Web service. If the user is not authorized, the HTTP service 400 is notified of the HTTP 400 error without allowing the use of the Web service and executing the process.

  In the present embodiment, as shown in FIG. 4, the Web service processing apparatus does not include the second authentication processing unit 2. As for user authentication, the Web server 11 performs both HTTP digest authentication and WSS authentication, and the SOAP message 15 sent from the Web server 11 processes requests to all Web services without performing user authentication.

  According to the present embodiment, the Web server determines whether WSS authentication is possible in addition to the presence / absence of WSS authentication information, so that the SOAP message is sent to the Web service processing apparatus based on the result of the HTTP digest authentication, or the user Return an appropriate error to the client. By doing in this way, when there is no HTTP digest authentication information, the HTTP digest authentication can be avoided and a technique for processing a Web service can be provided. As a result, the convenience of authentication can be improved.

<< Other Embodiments >>
The present invention can also be realized by executing the following processing. That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU, or the like) of the system or apparatus reads the program. It is a process to be executed.

Claims (13)

A first authentication apparatus definitive authentication system that performs user authentication process,
If the first authentication information included in the request from the client device, a first authentication means for performing a user authentication process using the first authentication information,
Determining means for determining whether the request includes second authentication information different from the first authentication information;
If it is determined to contain a second authentication information to the request by the determination means, to a second authentication apparatus having a second authentication means for executing a user authentication process using the second authentication information Transmitting means for transmitting information including the second authentication information ;
An authentication apparatus comprising: The determination means determines whether the first authentication information is included in the request,
It said transmitting means is a case where the second authentication information with the previous SL first authentication information to the request is determined to not include any by the determination unit, the request for user authentication process If the subject of the request, that sends error information to the client device,
The authentication apparatus according to claim 1. The transmission unit, when the user authentication process fails in the first authentication means in a case where the first authentication information is included in the request, and transmits the error information to the client device,
The authentication apparatus according to claim 1. The determination means determines whether the second authentication information is included in the request when the request does not include the first authentication information;
The authentication device according to any one of claims 1 to 3, wherein When the determination unit determines that the second authentication information is not included in the request, and the request is not a request to be subjected to user authentication processing, the transmission unit Do not transmit information including the second authentication information to a second authentication device having means;
The authentication apparatus according to any one of claims 1 to 4, wherein: The first authentication information is authentication information for HTTP digest authentication.
The authentication apparatus according to any one of claims 1 to 5, wherein: The second authentication information is authentication information for WS-Security authentication.
The authentication device according to any one of claims 1 to 6, wherein The first authentication device according to any one of claims 1 to 7,
The second authentication device;
An authentication system comprising: Does not contain the first authentication information to the request, and, in a case that contains the second authentication information to the request, the user authentication process using the second authentication information in the second authentication means Authentication determination means for determining that the user authentication processing in the authentication system is successful when the authentication is successful,
The authentication system according to claim 8 , further comprising: The second authentication device is a device for processing a Web service;
Wherein the first authentication device second authentication device, when the request is the user authentication process is a request unwanted Web services, without the user authentication process and permits the use of the Web service,
The authentication system according to claim 8 or 9 , characterized in that. The request is a request for using a web service,
User related to said client device further includes a user determination means for determining whether authorized to use the Web service,
When the user does not have authority to use the web service, the use of the web service is not permitted regardless of the result of user authentication processing .
The authentication system according to any one of claims 8 to 10 , wherein: An authentication method in the first authentication device apparatus in the authentication system to perform user authentication,
If the first authentication information included in the request from the client device, a first authentication step of executing the user authentication process using the first authentication information,
A determination step of determining whether the request includes second authentication information different from the first authentication information;
If the is determined to contain a second authentication information to the request by the determination step, to a second authentication apparatus having a second authentication means for executing a user authentication process using the second authentication information A transmission step of transmitting information including the second authentication information ;
An authentication method characterized by comprising: The program for functioning a computer as each means with which the authentication apparatus of any one of Claim 1 to 7 is provided.

Images